CN110321438A - Real-time fraud detection method, device and electronic equipment based on complex network - Google Patents
Real-time fraud detection method, device and electronic equipment based on complex network Download PDFInfo
- Publication number
- CN110321438A CN110321438A CN201910517253.9A CN201910517253A CN110321438A CN 110321438 A CN110321438 A CN 110321438A CN 201910517253 A CN201910517253 A CN 201910517253A CN 110321438 A CN110321438 A CN 110321438A
- Authority
- CN
- China
- Prior art keywords
- user
- entity
- data library
- network
- large scale
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/30—Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
- G06F16/36—Creation of semantic tools, e.g. ontology or thesauri
- G06F16/367—Ontology
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/903—Querying
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Databases & Information Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- Computational Linguistics (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Life Sciences & Earth Sciences (AREA)
- Animal Behavior & Ethology (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Real-time fraud detection method provided by the embodiments of the present application based on complex network, device, electronic equipment, by creating Large Scale Graphs deposit data library based on user data, based on Large Scale Graphs deposit data library and default Rating Model, using the inquiry mechanism of multi-hop, association has the information of fraud feature, carry out user's fraud detection, effective solution is when overabundance of data, model calculation is slow, the low problem of detection efficiency, realize real-time anti-fraud detection, Real-time defence, improve fraud detection efficiency, single entity mobility models map network and building multiple entity knowledge mapping network are constructed based on Large Scale Graphs deposit data library, based on single entity mobility models map network and multiple entity knowledge mapping network, using figure propagation algorithm, according to information progress corporations' excavation with fraud feature, realize rapid expansion swindling gang identification range, depth Swindling gang is excavated, fraud detection efficiency is improved.
Description
Technical field
This application involves technical field of information processing, more particularly to based on complex network real-time fraud detection method,
Device and electronic equipment.
Background technique
With the fast development of network technology, network swindle is gradually risen, and there are the swindlenesses of security risk for black production, black intermediary etc.
Molecule is deceived from single individual behavior, develops into a tightknit Dark Industry Link item, swindling gang passes through illegal hand
Internet information safety is upset in Duan Jinhang arbitrage.In order to improve the safety of the network information, need in time to locate swindling gang
Reason.
Traditional processing mode is mainly to construct the knowledge mapping of a dimension to verify the information being associated, by
When fraud, is passively defendd based on current dimension personal feature and remediation, this processing method are easily rolled into a ball by swindle
Partner's discovery, and fraud detection system is bypassed by updating the modes such as dimension values, lack risk assessment in advance, it can not be in fraud hair
Risk is predicted in advance before death, and can not depth excavate swindling gang, can not real-time detection, Real-time defence, detection effect
Rate is low.In addition, model calculation is slow when overabundance of data, cause detection efficiency low.In short, traditional processing mode data and
Identification dynamics is limited, cannot quickly identify the stronger potential swindling gang of camouflage, cannot effectively carry out risk monitoring and control processing.
Summary of the invention
The embodiment of the present application is designed to provide a kind of real-time fraud detection device, method and electricity based on complex network
Sub- equipment, to realize quickly identification fraud clique, real-time detection, Real-time defence.Specific technical solution is as follows:
In a first aspect, the embodiment of the present application provides a kind of real-time fraud detection method based on complex network, comprising:
Obtain the user information of user to be detected, wherein the user information of the user to be detected include user subject and
Non-user entity, the attributive character of user subject described in the non-user entity on behalf；
Based on the user information of the user to be detected, complex network model is constructed, wherein the complex network model packet
Include Large Scale Graphs deposit data library；
The inquiry mechanism of multi-hop is used based on Large Scale Graphs deposit data library, being associated with has the user of fraud feature real
Body obtains the fraud scoring of the user to be detected in conjunction with default Rating Model；
According to the fraud scoring of the user to be detected, determine whether the user to be detected is fraudulent user.
Optionally, user data and preset Large Scale Graphs deposit data library based on the user to be detected, described in building
Relationship between user subject and the non-user entity will deposit related entity as key-value pair preservation and real-time update arrives
Large Scale Graphs deposit data library, wherein if updating Large Scale Graphs deposit data library for the first time, the preset Large Scale Graphs
Deposit data library is the Large Scale Graphs deposit data library pre-established, otherwise, the preset Large Scale Graphs deposit data library be in real time more
Large Scale Graphs deposit data library after new.
Optionally, the step of pre-establishing the Large Scale Graphs deposit data library include:
Obtain the user information of sample of users, wherein the user information of the sample of users includes user subject and non-use
Family entity, the user subject include without the user subject for cheating feature, the undetected user with fraud feature
Entity and user subject with fraud feature, the attributive character of user subject described in the non-user entity on behalf；
User data based on the sample of users constructs the relationship between the user subject and the non-user entity,
Related entity will be deposited to save as key-value pair, the Large Scale Graphs deposit data library pre-established.
Optionally, the complex network model further include: single entity mobility models map network and multiple entity knowledge mapping network；
The method also includes:
Based on single entity mobility models map network and the multiple entity knowledge mapping network, feature is cheated based on having
User subject, association fraud feature, and figure propagation algorithm is used, determine single entity mobility models map network and the multiple entity
Whether the user to be detected in knowledge mapping network is fraudulent user, the list entity mobility models map network and described more
Entity mobility models map network is established based on Large Scale Graphs storing data library.
Optionally, described to be based on the user information, construct complex network model, further includes:
Based on Large Scale Graphs storing data library, using the user subject as node, the non-user entity is side, structure
Build single entity mobility models map network；
Based on Large Scale Graphs storing data library, using the user subject and the non-user entity as node, preset
Dimension is side, constructs multiple entity knowledge mapping network.
Optionally, the default dimension includes: time dimension, equipment dimension, network environment dimension, addressing dimension.
Second aspect, the embodiment of the present application provide a kind of real-time fraud detection method based on complex network, comprising:
Obtain the user information of user to be detected, wherein the user information of the user to be detected include user subject and
Non-user entity, the attributive character of user subject described in the non-user entity on behalf；
Based on the user information of the user to be detected, complex network model is constructed, wherein the complex network model packet
Large Scale Graphs deposit data library, single entity mobility models map network and multiple entity knowledge mapping network are included, wherein the list entity mobility models
Map network and the multiple entity knowledge mapping network are established based on Large Scale Graphs deposit data library；
Based on single entity mobility models map network and the multiple entity knowledge mapping network, feature is cheated based on having
User subject, association fraud feature, and figure propagation algorithm is used, determine single entity mobility models map network and the multiple entity
Whether the user to be detected in knowledge mapping network is fraudulent user.
Optionally, described to be based on the user information, construct complex network model, comprising:
User data and preset Large Scale Graphs deposit data library based on the user to be detected, construct the user subject
Relationship between the non-user entity, will deposit that related entity is saved as key-value pair and real-time update is to Large Scale Graphs
Deposit data library, wherein if updating Large Scale Graphs deposit data library for the first time, the preset Large Scale Graphs deposit data library is pre-
The Large Scale Graphs deposit data library first established, otherwise, the preset Large Scale Graphs deposit data library are extensive after real-time update
Figure deposit data library；
Based on Large Scale Graphs storing data library, using the user subject as node, the non-user entity is side, structure
Build single entity mobility models map network；
Based on Large Scale Graphs storing data library, using the user subject and the non-user entity as node, preset
Dimension is side, constructs multiple entity knowledge mapping network.
Optionally, the default dimension includes: time dimension, equipment dimension, network environment dimension, addressing dimension.
The third aspect, the embodiment of the present application provide a kind of real-time fraud detection device based on complex network, comprising:
First acquisition module, for obtaining the user information of user to be detected, wherein the user of the user to be detected believes
Breath includes user subject and non-user entity, the attributive character of user subject described in the non-user entity on behalf；
First complex network constructs module, for the user information based on the user to be detected, constructs complex network mould
Type, wherein the complex network model includes Large Scale Graphs deposit data library；
First analysis module, for using the inquiry mechanism of multi-hop based on Large Scale Graphs deposit data library, association has
The user subject of fraud feature obtains the fraud scoring of the user to be detected in conjunction with default Rating Model；
Whether first judgment module determines the user to be detected for the fraud scoring according to the user to be detected
For fraudulent user.
Optionally, the first complex network building module includes: the first Large Scale Graphs deposit data library submodule, is used for base
User data and preset Large Scale Graphs deposit data library in the user to be detected, construct the user subject and the non-use
Relationship between the entity of family, will deposit that related entity is saved as key-value pair and real-time update is to the Large Scale Graphs deposit data
Library, wherein if updating Large Scale Graphs deposit data library for the first time, the preset Large Scale Graphs deposit data library is to pre-establish
Large Scale Graphs deposit data library, otherwise, the preset Large Scale Graphs deposit data library be real-time update after Large Scale Graphs deposit number
According to library.
Optionally, described device further includes that Large Scale Graphs deposit data library pre-establishes module, the Large Scale Graphs deposit data
Library pre-establishes module and is used for:
Obtain the user information of sample of users, wherein the user information of the sample of users includes user subject and non-use
Family entity, the user subject include without the user subject for cheating feature, the undetected user with fraud feature
Entity and user subject with fraud feature, the attributive character of user subject described in the non-user entity on behalf,
User data based on the sample of users constructs the relationship between the user subject and the non-user entity,
Related entity will be deposited to save as key-value pair, the Large Scale Graphs deposit data library pre-established.
Optionally, the complex network model further include: single entity mobility models map network and multiple entity knowledge mapping network；
Described device further include:
User's fraud detection module, for based on single entity mobility models map network and the multiple entity knowledge mapping net
Network based on the user subject with fraud feature, association fraud feature, and uses figure propagation algorithm, determines that single entity is known
Whether the user to be detected known in map network and the multiple entity knowledge mapping network is fraudulent user, described single real
Body knowledge mapping network and the multiple entity knowledge mapping network are established based on Large Scale Graphs storing data library.
Optionally, first complex network constructs module further include:
First single entity mobility models map network submodular, for being based on Large Scale Graphs storing data library, with the use
Family entity is node, and the non-user entity is side, constructs single entity mobility models map network；
First multiple entity knowledge mapping network submodular, for being based on Large Scale Graphs storing data library, with the use
Family entity and the non-user entity are node, and presetting dimension is side, construct multiple entity knowledge mapping network.
Optionally, the default dimension includes: time dimension, equipment dimension, network environment dimension, addressing dimension.
Fourth aspect, the embodiment of the present application provide a kind of real-time fraud detection device based on complex network, comprising:
Second acquisition module, for obtaining the user information of user to be detected, wherein the user of the user to be detected believes
Breath includes user subject and non-user entity, the attributive character of user subject described in the non-user entity on behalf；
Second complex network constructs module, for the user information based on the user to be detected, constructs complex network mould
Type, the complex network model include Large Scale Graphs deposit data library, single entity mobility models map network and multiple entity knowledge mapping net
Network, wherein the list entity mobility models map network and the multiple entity knowledge mapping network are based on the Large Scale Graphs deposit data
What library was established；
Second analysis module is based on based on single entity mobility models map network and the multiple entity knowledge mapping network
User subject with fraud feature, association fraud feature, and figure propagation algorithm is used, determine single entity mobility models map net
Whether the user in network and the multiple entity knowledge mapping network is fraudulent user.
Optionally, the second complex network building module includes:
Second Large Scale Graphs deposit data library submodule, for user data based on the user to be detected and preset big
Scale figure deposit data library, constructs the relationship between the user subject and the non-user entity, will deposit related entity and make
It is saved for key-value pair and real-time update is to Large Scale Graphs deposit data library；
Second single entity mobility models map network submodular, for being based on Large Scale Graphs storing data library, with the use
Family entity is node, and the non-user entity is side, constructs single entity mobility models map network；
Second multiple entity knowledge mapping network submodular, for being based on Large Scale Graphs storing data library, with the use
Family entity and the non-user entity are node, and presetting dimension is side, construct multiple entity knowledge mapping network.
Optionally, the default dimension includes: time dimension, equipment dimension, network environment dimension, addressing dimension.
5th aspect, the embodiment of the present application provides a kind of electronic equipment, comprising: processor, communication interface, memory and
Communication bus, wherein
The processor, communication interface, memory complete mutual communication by communication bus；
Memory, for storing computer program；
Processor when for executing the program stored on memory, realizes that above-mentioned first aspect or second aspect are any
The real-time fraud detection method based on complex network.
6th aspect, the embodiment of the present application provide a kind of computer readable storage medium, the computer-readable storage
Instruction is stored in medium, when run on a computer, so that computer executes above-mentioned first aspect or second aspect is appointed
Real-time fraud detection method described in one based on complex network.
7th aspect, the embodiment of the present application provides a kind of computer program product comprising instruction, when it is in computer
When upper operation, so that computer executes above-mentioned first aspect or any real-time fraud based on complex network of second aspect
Detection method.
Real-time fraud detection method, device, electronic equipment, computer provided by the embodiments of the present application based on complex network
Readable storage medium storing program for executing and computer program product comprising instruction, by constructing user subject based on user data and non-user is real
Relationship between body will deposit related entity as key-value pair and save simultaneously real-time update, and create Large Scale Graphs deposit data library, base
In Large Scale Graphs deposit data library and default Rating Model, using the inquiry mechanism of multi-hop, association has the Information Number of fraud feature
According to carrying out user fraud detection, identify swindling gang, for effective solution when overabundance of data, model calculation is slow, detection effect
The low problem of rate, realizes real-time anti-fraud detection, and Real-time defence improves fraud detection efficiency, deposits number based on Large Scale Graphs
Single entity mobility models map network and building multiple entity knowledge mapping network are constructed according to library, based on single entity mobility models map network and more
Entity mobility models map network carries out corporations' excavation, is associated with the information with fraud feature, and use figure propagation algorithm, realizes fast
Speed expands swindling gang identification range, and depth excavates swindling gang, improves fraud detection efficiency.Certainly, implement the application's
Any product or method do not necessarily require achieving all the advantages described above at the same time.
Detailed description of the invention
In order to illustrate the technical solutions in the embodiments of the present application or in the prior art more clearly, to embodiment or will show below
There is attached drawing needed in technical description to be briefly described, it should be apparent that, the accompanying drawings in the following description is only this
Some embodiments of application for those of ordinary skill in the art without creative efforts, can be with
It obtains other drawings based on these drawings.
Fig. 1 a is the first schematic diagram of the real-time fraud detection method based on complex network of the embodiment of the present application；
Fig. 1 b is second of schematic diagram of the real-time fraud detection method based on complex network of the embodiment of the present application；
Fig. 1 c is the third schematic diagram of the real-time fraud detection method based on complex network of the embodiment of the present application；
Fig. 2 a is the 4th kind of schematic diagram of the real-time fraud detection method based on complex network of the embodiment of the present application；
Fig. 2 b is the 5th kind of schematic diagram of the real-time fraud detection method based on complex network of the embodiment of the present application；
Fig. 2 c is the 6th kind of schematic diagram of the real-time fraud detection method based on complex network of the embodiment of the present application；
Fig. 3 a is the first schematic diagram of the real-time fraud detection device based on complex network of the embodiment of the present application；
Fig. 3 b is second of schematic diagram of the real-time fraud detection device based on complex network of the embodiment of the present application；
Fig. 4 a is the third schematic diagram of the real-time fraud detection device based on complex network of the embodiment of the present application；
Fig. 4 b is the 4th kind of schematic diagram of the real-time fraud detection device based on complex network of the embodiment of the present application；
Fig. 5 is a kind of schematic diagram of the electronic equipment of the embodiment of the present application.
Specific embodiment
Below in conjunction with the attached drawing in the embodiment of the present application, technical solutions in the embodiments of the present application carries out clear, complete
Site preparation description, it is clear that described embodiments are only a part of embodiments of the present application, instead of all the embodiments.It is based on
Embodiment in the application, it is obtained by those of ordinary skill in the art without making creative efforts every other
Embodiment shall fall in the protection scope of this application.
The embodiment of the present application disclose it is a kind of by the real-time fraud detection method of complex network, device, electronic equipment, based on
Calculation machine readable storage medium storing program for executing and computer program product comprising instruction, are illustrated individually below.
The embodiment of the present application provides the real-time fraud detection method based on complex network, is this Shen referring to Fig. 1 a, Fig. 1 a
Please embodiment the real-time fraud detection method based on complex network the first schematic diagram, include the following steps:
Step 110, the user information of user to be detected is obtained, wherein the user information of above-mentioned user to be detected includes using
Family entity and non-user entity, the attributive character of the above-mentioned above-mentioned user subject of non-user entity on behalf.
The real-time fraud detection method based on complex network of the embodiment of the present application can realize by electronic equipment, specifically
, which can be server.
Electronic equipment obtains the user information of user to be detected, and user subject may include the body of the User ID of user, user
Part card number etc., for example, user subject is the User ID of user.Non-user entity may include equipment, network environment, address.Equipment
Equipment can be characterized only for device id, equipment MAC (Media Access Control, media access control) address etc.
One mark.Network environment can be IP (Internet Protocol Address, Internet protocol) address, Wi-Fi used
The SSID (Service Set Identifier, network service set) of (Wireless Fidelity, wireless network) etc.,
Location can be administrative region title, latitude and longitude coordinates etc..
The attributive character of the above-mentioned above-mentioned user subject of non-user entity on behalf, such as equipment represent that user is used to be set
Standby, network environment represents the network of user's access, address represents region locating for user.
Step 120, the user information based on above-mentioned user to be detected constructs complex network model, wherein above-mentioned complex web
Network model includes Large Scale Graphs deposit data library.
Based on the relationship between above-mentioned user subject and above-mentioned non-user entity, related entity will be deposited as key-value pair
The characteristics of saving and real-time update is to above-mentioned Large Scale Graphs deposit data library, can use Large Scale Graphs deposit data library cache has
When overabundance of data, model calculation is slow for the solution of effect, the low problem of detection efficiency.
It is the reality based on complex network of the embodiment of the present application referring to Fig. 1 b, Fig. 1 b in a kind of possible embodiment
When fraud detection method second of schematic diagram complex network model, packet are constructed based on the user information of above-mentioned user to be detected
It includes:
Step 121, user data and preset Large Scale Graphs deposit data library based on above-mentioned user to be detected construct above-mentioned
Relationship between user subject and above-mentioned non-user entity will deposit related entity as key-value pair preservation and real-time update arrives
Above-mentioned Large Scale Graphs deposit data library, wherein if updating Large Scale Graphs deposit data library for the first time, the preset Large Scale Graphs
Deposit data library is the Large Scale Graphs deposit data library pre-established, otherwise, the preset Large Scale Graphs deposit data library be in real time more
Large Scale Graphs deposit data library after new.
The relationship between user subject and non-user entity is constructed based on user's real time data, such as: user is currently used
The network that uses of equipment, user or equipment, user that equipment logs in, the user subject that relationship will be present and non-user entity are made
It is saved in Large Scale Graphs deposit data library for key-value pair, and real-time update.
The relationship between user subject and non-user entity is constructed based on user's real time data, and is saved simultaneously as key-value pair
Real-time update can work as overabundance of data using Large Scale Graphs deposit data library in this way to Large Scale Graphs deposit data library with effective solution
When, model calculation is slow, the low problem of detection efficiency.
Step 130, the inquiry mechanism of multi-hop is used based on above-mentioned Large Scale Graphs deposit data library, being associated with has fraud feature
User subject obtains the fraud scoring of above-mentioned user to be detected in conjunction with default Rating Model.
The inquiry mechanism of multi-hop is used based on above-mentioned Large Scale Graphs deposit data library, can be jumped using double bounce, three jumps or n
Inquiry mechanism, for example, by using the inquiry mechanism of double bounce.By association user list, it is associated with the list with fraud feature, in conjunction with
Default Rating Model, obtains the fraud scoring of above-mentioned user to be detected.Such as when with fraud feature, exporting is 1, without taking advantage of
When cheating feature, exporting is 0.
Step 140, according to the fraud scoring of above-mentioned user to be detected, determine whether above-mentioned user to be detected is that fraud is used
Family.
Such as output for 1 when, determine that above-mentioned user to be detected is fraudulent user, export when being 0, determine above-mentioned use to be detected
Family is not fraudulent user.
Based on Large Scale Graphs deposit data library and default Rating Model, using the inquiry mechanism of real-time multi-hop, association, which has, is taken advantage of
The information data of feature is cheated, user fraud detection is carried out, identifies swindling gang, effective solution is when overabundance of data, model
Operation is slow, the low problem of detection efficiency, realizes real-time anti-fraud detection, and Real-time defence improves fraud detection efficiency.
Referring to Fig. 1 c, Fig. 1 c is that the third of the real-time fraud detection method based on complex network of the embodiment of the present application shows
It is intended to.
Large Scale Graphs deposit data library is established based on user subject and non-user entity, is based on above-mentioned Large Scale Graphs deposit data library
Using the inquiry mechanism of multi-hop, being associated with, there is the user subject of fraud feature to obtain above-mentioned to be detected in conjunction with default Rating Model
The fraud scoring of user determines whether above-mentioned user to be detected is fraudulent user according to the fraud scoring of above-mentioned user to be detected.
Above-mentioned user subject is User ID, and above-mentioned non-user entity is equipment, cell-phone number, IP/WiFi, shipping address and hand
Machine number.The inquiry mechanism of double bounce is used based on above-mentioned Large Scale Graphs deposit data library, association fraud feature is obtained in conjunction with Rating Model
To the fraud scoring of User ID, determine whether user is fraudulent user according to the fraud scoring of user.
In a kind of possible embodiment, user data based on above-mentioned user to be detected and pre-establish extensive
Figure deposit data library, the step of pre-establishing above-mentioned Large Scale Graphs deposit data library include:
Obtain the user information of sample of users, wherein the user information of above-mentioned sample of users includes user subject and non-use
Family entity, above-mentioned user subject include without the user subject for cheating feature, the undetected user with fraud feature
Entity and with fraud feature user subject, the attributive character of the above-mentioned above-mentioned user subject of non-user entity on behalf.
The user information of sample of users is the user data of preset period of time, such as 1 year user data in the past.Based on default
Relationship between the user data building user subject and non-user entity of period, such as: the used equipment of user, Yong Huhuo
The used network of equipment, user that equipment logged in, the user subject that relationship will be present and non-user entity are as key-value pair
It is saved in Large Scale Graphs deposit data library, and real-time update.Large Scale Graphs deposit data library is established based on user's history data, it can be with
Expand swindling gang identification range, depth excavates swindling gang, improves fraud detection efficiency.
User data based on above-mentioned sample of users constructs the relationship between above-mentioned user subject and above-mentioned non-user entity,
Related entity will be deposited to save as key-value pair, the Large Scale Graphs deposit data library pre-established.
The relationship between user subject and non-user entity is constructed based on user's history data, and is saved simultaneously as key-value pair
Real-time update can expand swindling gang identification range using Large Scale Graphs deposit data library in this way to Large Scale Graphs deposit data library,
Depth excavates swindling gang, improves fraud detection efficiency, can also be with effective solution when overabundance of data, and model calculation is slow
Slowly, the low problem of detection efficiency.
In a kind of possible embodiment, above-mentioned complex network model further include: single entity mobility models map network and more
Entity mobility models map network；The above method further include:
Based on above-mentioned single entity mobility models map network and above-mentioned multiple entity knowledge mapping network, feature is cheated based on having
User subject, association fraud feature, and figure propagation algorithm is used, determine above-mentioned single entity mobility models map network and above-mentioned multiple entity
Whether the above-mentioned user to be detected in knowledge mapping network is fraudulent user, above-mentioned list entity mobility models map network and above-mentioned more
Entity mobility models map network is established based on above-mentioned Large Scale Graphs storing data library.
Above-mentioned single entity mobility models map network and above-mentioned multiple entity knowledge are established based on above-mentioned Large Scale Graphs storing data library
Map network, the characteristics of can use above-mentioned Large Scale Graphs deposit data library cache effective solution when overabundance of data, mould
Type operation is slow, the low problem of detection efficiency.Based on above-mentioned single entity mobility models map network and above-mentioned multiple entity knowledge mapping net
Network carries out corporations' excavation, is associated with the information with fraud feature, and use figure propagation algorithm, rapid expansion swindle may be implemented
Clique's identification range, depth excavate swindling gang, improve fraud detection efficiency.
It is above-mentioned to be based on above-mentioned user information in a kind of possible embodiment, construct complex network model, further includes:
Based on above-mentioned Large Scale Graphs storing data library, using above-mentioned user subject as node, above-mentioned non-user entity is side, structure
Build single entity mobility models map network.
Single entity mobility models map network only constructs the knowledge mapping network using user subject as node, i.e., is with user subject
Node, the non-user entity, that is, used equipment of user, network environment, cell-phone number, address, bank's card number etc. is side, and other
User subject is connected, so that building one is merely using user subject as the knowledge mapping of node.
Based on above-mentioned Large Scale Graphs storing data library, using above-mentioned user subject and above-mentioned non-user entity as node, preset
Dimension is side, constructs multiple entity knowledge mapping network.
Multiple entity knowledge mapping network not only constructs the knowledge mapping network using user subject as node, further includes with non-use
Family entity is the knowledge mapping network of node, i.e., user subject and non-user entity are node, such as: made with User ID, user
Used equipment, network environment, cell-phone number, address, bank's card number etc. are node, are closed with presetting the ownership of for example each entity of dimension
System, time are side, construct multiple entity knowledge mapping network.
In a kind of possible embodiment, above-mentioned default dimension includes: time dimension, equipment dimension, network environment dimension
Degree, addressing dimension.
Such as with User ID, the used equipment of user, network environment, cell-phone number, address, bank's card number etc. for node,
Using the time as side, multiple entity knowledge mapping network is constructed.It may be implemented to expand swindling gang identification range, depth excavates swindle group
Group, improve fraud detection efficiency.
The embodiment of the present application also provides the real-time fraud detection methods based on complex network, and a, Fig. 2 a are this referring to fig. 2
The 4th kind of schematic diagram for applying for the real-time fraud detection method based on complex network of embodiment, includes the following steps:
Step 210, the user information of user to be detected is obtained, wherein the user information of above-mentioned user to be detected includes using
Family entity and non-user entity, the attributive character of the above-mentioned above-mentioned user subject of non-user entity on behalf.
The real-time fraud detection method based on complex network of the embodiment of the present application can realize by electronic equipment, specifically
, which can be server.
Electronic equipment obtains the user information of user to be detected, and user subject may include the body of the User ID of user, user
Part card number etc., for example, user subject is the user name of user.Non-user entity may include equipment, network environment, address.Equipment
The unique identification of equipment can be characterized for device id, device mac address etc..Network environment can be IP address, Wi- used
The SSID of Fi, address can be administrative region title, latitude and longitude coordinates etc..
The attributive character of the above-mentioned above-mentioned user subject of non-user entity on behalf, such as equipment represent that user is used to be set
Standby, network environment represents the network of user's access, address represents region locating for user.
Step 220, the user information based on above-mentioned user to be detected constructs complex network model, wherein above-mentioned complex web
Network model includes Large Scale Graphs deposit data library, single entity mobility models map network and multiple entity knowledge mapping network, wherein above-mentioned list
Entity mobility models map network and above-mentioned multiple entity knowledge mapping network are established based on above-mentioned Large Scale Graphs deposit data library.
The relationship between user subject and non-user entity is constructed based on user's history data, and is saved in as key-value pair
Above-mentioned single entity mobility models map network and above-mentioned mostly real is established based on above-mentioned Large Scale Graphs deposit data library in Large Scale Graphs deposit data library
Body knowledge mapping network, in this way can be with effective solution when overabundance of data, and model calculation is slow, the low problem of detection efficiency.
Step 230, it based on above-mentioned single entity mobility models map network and above-mentioned multiple entity knowledge mapping network, is taken advantage of based on having
The user subject of feature, association fraud feature are cheated, and uses figure propagation algorithm, determines above-mentioned single entity mobility models map network and upper
Whether the above-mentioned user to be detected stated in multiple entity knowledge mapping network is fraudulent user.
According to the user data of preset period of time, suspicious clique is analyzed, according to the entity with fraud feature, association fraud is special
Sign analyzes the user in above-mentioned single entity mobility models map network and above-mentioned multiple entity knowledge mapping network, and using figure
Propagation algorithm determines that the user to be detected in above-mentioned single entity mobility models map network and above-mentioned multiple entity knowledge mapping network is
No is fraudulent user.If the use to be detected in above-mentioned list entity mobility models map network and above-mentioned multiple entity knowledge mapping network
Family has fraud feature, it is determined that user is fraud clique.
In a kind of possible embodiment, b, Fig. 2 b are the reality based on complex network of the embodiment of the present application referring to fig. 2
When fraud detection method the 5th kind of schematic diagram, it is above-mentioned be based on above-mentioned user information, construct complex network model, comprising:
Step 221, user data and preset Large Scale Graphs deposit data library based on above-mentioned user to be detected construct above-mentioned
Relationship between user subject and above-mentioned non-user entity will deposit related entity as key-value pair preservation and real-time update arrives
Above-mentioned Large Scale Graphs deposit data library, wherein if updating above-mentioned Large Scale Graphs deposit data library for the first time, above-mentioned preset Large Scale Graphs
Deposit data library is the Large Scale Graphs deposit data library pre-established, otherwise, above-mentioned preset Large Scale Graphs deposit data library be in real time more
Large Scale Graphs deposit data library after new.
The relationship between user subject and non-user entity is constructed based on user's real time data, such as: user is currently used
The network that uses of equipment, user or equipment, user that equipment logs in, the user subject that relationship will be present and non-user entity are made
It is saved in Large Scale Graphs deposit data library for key-value pair, and real-time update.
The relationship between user subject and non-user entity is constructed based on user's real time data, and is saved simultaneously as key-value pair
Real-time update can work as overabundance of data using Large Scale Graphs deposit data library in this way to Large Scale Graphs deposit data library with effective solution
When, model calculation is slow, the low problem of detection efficiency.
Step 222, it is based on above-mentioned Large Scale Graphs storing data library, using above-mentioned user subject as node, above-mentioned non-user is real
Body is side, constructs single entity mobility models map network.
Single entity mobility models map network only constructs the knowledge mapping network using user subject as node, i.e., is with user subject
Node, the non-user entity, that is, used equipment of user, network environment, cell-phone number, address, bank's card number etc. is side, and other
User subject is connected, so that building one is merely using user subject as the knowledge mapping of node.
Step 223, it is based on above-mentioned Large Scale Graphs storing data library, is section with above-mentioned user subject and above-mentioned non-user entity
Point, presetting dimension is side, constructs multiple entity knowledge mapping network.
C referring to fig. 2, Fig. 2 c are that the 6th kind of the real-time fraud detection method based on complex network of the embodiment of the present application shows
It is intended to, it further includes with non-user that multiple entity knowledge mapping network, which not only constructs the knowledge mapping network using user subject as node,
Entity is the knowledge mapping network of node, i.e., user subject and non-user entity are node, such as: it is used with User ID, user
Equipment, network environment, cell-phone number, address, bank's card number for crossing etc. be node, with preset for example each entity of dimension attaching relation,
Time is side, constructs multiple entity knowledge mapping network.
In a kind of possible embodiment, above-mentioned default dimension includes: time dimension, equipment dimension, network environment dimension
Degree, addressing dimension.
Such as with User ID, the used equipment of user, network environment, cell-phone number, address, bank's card number etc. for node,
Using the time as side, multiple entity knowledge mapping network is constructed.It may be implemented to expand swindling gang identification range, depth excavates swindle group
Group, improve fraud detection efficiency.
The embodiment of the present application also provides the real-time fraud detection devices based on complex network, are this referring to Fig. 3 a, Fig. 3 a
Apply for the first schematic diagram of the real-time fraud detection device based on complex network of embodiment, it is above-mentioned to be believed based on above-mentioned user
Breath constructs complex network model, comprising:
First acquisition module 310, for obtaining the user information of user to be detected, wherein the use of above-mentioned user to be detected
Family information includes user subject and non-user entity, the attributive character of the above-mentioned above-mentioned user subject of non-user entity on behalf.
First complex network constructs module 320, for the user information based on above-mentioned user to be detected, constructs complex network
Model, wherein above-mentioned complex network model includes Large Scale Graphs deposit data library.
First analysis module 330, for using the inquiry mechanism of multi-hop, association tool based on above-mentioned Large Scale Graphs deposit data library
There is the user subject of fraud feature to obtain the fraud scoring of above-mentioned user to be detected in conjunction with default Rating Model.
Judgment module 340, for the fraud scoring according to above-mentioned user to be detected, determine above-mentioned user to be detected whether be
Fraudulent user.
It is the reality based on complex network of the embodiment of the present application referring to Fig. 3 b, Fig. 3 b in a kind of possible embodiment
When fraud detection device second of schematic diagram, above-mentioned first complex network building module 320 includes:
First Large Scale Graphs deposit data library submodule 321 for the user data based on above-mentioned user to be detected and is preset
Large Scale Graphs deposit data library, construct the relationship between above-mentioned user subject and above-mentioned non-user entity, related reality will be deposited
Body as key-value pair save and real-time update arrive above-mentioned Large Scale Graphs deposit data library, wherein if for the first time update Large Scale Graphs deposit number
According to library, then preset Large Scale Graphs deposit data library is the Large Scale Graphs deposit data library pre-established, otherwise, preset Large Scale Graphs
Deposit data library is the Large Scale Graphs deposit data library after real-time update.
In a kind of possible embodiment, above-mentioned apparatus further includes that Large Scale Graphs deposit data library pre-establishes module, on
It states Large Scale Graphs deposit data library and pre-establishes module and be used for:
Obtain the user information of sample of users, wherein the user information of above-mentioned sample of users includes user subject and non-use
Family entity, above-mentioned user subject include without the user subject for cheating feature, the undetected user with fraud feature
Entity and with fraud feature user subject, the attributive character of the above-mentioned above-mentioned user subject of non-user entity on behalf,
User data based on above-mentioned sample of users constructs the relationship between above-mentioned user subject and above-mentioned non-user entity,
Related entity will be deposited to save as key-value pair, the Large Scale Graphs deposit data library pre-established.
In a kind of possible embodiment, above-mentioned complex network model further include: single entity mobility models map network and more
Entity mobility models map network；Above-mentioned apparatus further include:
User's fraud detection module, for based on above-mentioned single entity mobility models map network and above-mentioned multiple entity knowledge mapping net
Network based on the user subject with fraud feature, association fraud feature, and uses figure propagation algorithm, determines that above-mentioned single entity is known
Whether the above-mentioned user to be detected known in map network and above-mentioned multiple entity knowledge mapping network is fraudulent user.
In a kind of possible embodiment, above-mentioned complex network constructs module further include:
First single entity mobility models map network submodular, for being based on above-mentioned Large Scale Graphs storing data library, with above-mentioned use
Family entity is node, and above-mentioned non-user entity is side, constructs single entity mobility models map network；
First multiple entity knowledge mapping network submodular, for being based on above-mentioned Large Scale Graphs storing data library, with above-mentioned use
Family entity and above-mentioned non-user entity are node, and presetting dimension is side, construct multiple entity knowledge mapping network.
In a kind of possible embodiment, above-mentioned default dimension includes: time dimension, equipment dimension, network environment dimension
Degree, addressing dimension.
The embodiment of the present application also provides the real-time fraud detection devices based on complex network, and a, Fig. 4 a are this referring to fig. 4
Apply for the third schematic diagram of the real-time fraud detection device based on complex network of embodiment, comprising:
Second acquisition module 410, for obtaining the user information of user to be detected, wherein the use of above-mentioned user to be detected
Family information includes user subject and non-user entity, the attributive character of the above-mentioned above-mentioned user subject of non-user entity on behalf；
Second complex network constructs module 420, for the user information based on above-mentioned user to be detected, constructs complex network
Model, above-mentioned complex network model include Large Scale Graphs deposit data library, single entity mobility models map network and multiple entity knowledge mapping
Network, wherein above-mentioned list entity mobility models map network and above-mentioned multiple entity knowledge mapping network are to deposit number based on above-mentioned Large Scale Graphs
It is established according to library；
Second analysis module 430, based on above-mentioned single entity mobility models map network and above-mentioned multiple entity knowledge mapping network, base
In the user subject with fraud feature, association fraud feature, and figure propagation algorithm is used, determines above-mentioned single entity mobility models map
Whether the above-mentioned user to be detected in network and above-mentioned multiple entity knowledge mapping network is fraudulent user.
In a kind of possible embodiment, b, Fig. 4 b are the reality based on complex network of the embodiment of the present application referring to fig. 4
When fraud detection device the 4th kind of schematic diagram, above-mentioned second complex network building module includes:
Second Large Scale Graphs deposit data library submodule 421 for the user data based on above-mentioned user to be detected and is preset
Large Scale Graphs deposit data library, construct the relationship between above-mentioned user subject and above-mentioned non-user entity, related reality will be deposited
Body is saved as key-value pair and real-time update is to Large Scale Graphs deposit data library；
Second single entity mobility models map network submodular 422, for being based on above-mentioned Large Scale Graphs storing data library, with above-mentioned
User subject is node, and above-mentioned non-user entity is side, constructs single entity mobility models map network；
Second multiple entity knowledge mapping network submodular 423, for being based on above-mentioned Large Scale Graphs storing data library, with above-mentioned
User subject and above-mentioned non-user entity are node, and presetting dimension is side, construct multiple entity knowledge mapping network.
In a kind of possible embodiment, above-mentioned default dimension includes: time dimension, equipment dimension, network environment dimension
Degree, addressing dimension.
The embodiment of the present application also provides a kind of electronic equipment, are the electronic equipment of the embodiment of the present application referring to Fig. 5, Fig. 5
A kind of schematic diagram, comprising: processor 510, communication interface 520, memory 530 and communication bus 540, wherein processor
510, communication interface 520, memory 530 completes mutual communication by communication bus 540,
Above-mentioned memory 530, for storing computer program；
Above-mentioned processor 510 realizes following steps when for executing the computer program of the above-mentioned storage of memory 530:
Obtain the user information of user to be detected, wherein the user information of above-mentioned user to be detected include user subject and
Non-user entity, the attributive character of the above-mentioned above-mentioned user subject of non-user entity on behalf；
Based on the user information of above-mentioned user to be detected, complex network model is constructed, wherein above-mentioned complex network model packet
Include Large Scale Graphs deposit data library；
The inquiry mechanism of multi-hop is used based on above-mentioned Large Scale Graphs deposit data library, being associated with has the user of fraud feature real
Body obtains the fraud scoring of above-mentioned user to be detected in conjunction with default Rating Model；
According to the fraud scoring of above-mentioned user to be detected, determine whether above-mentioned user to be detected is fraudulent user.
Optionally, processor 510 when for executing the program stored on memory 530, can also be realized any of the above-described
Real-time fraud detection method based on complex network.
The communication bus that above-mentioned electronic equipment is mentioned can be Peripheral Component Interconnect standard (Peripheral Component
Interconnect, PCI) bus or expanding the industrial standard structure (Extended Industry Standard
Architecture, EISA) bus etc..The communication bus can be divided into address bus, data/address bus, control bus etc..For just
It is only indicated with a thick line in expression, figure, it is not intended that an only bus or a type of bus.
Communication interface is for the communication between above-mentioned electronic equipment and other equipment.
Memory may include random access memory (Random Access Memory, RAM), also may include non-easy
The property lost memory (Non-Volatile Memory, NVM), for example, at least a magnetic disk storage.Optionally, memory may be used also
To be storage device that at least one is located remotely from aforementioned processor.
Above-mentioned processor can be general processor, including central processing unit (Central Processing Unit,
CPU), network processing unit (Network Processor, NP) etc.；It can also be digital signal processor (Digital Signal
Processing, DSP), it is specific integrated circuit (Application Specific Integrated Circuit, ASIC), existing
It is field programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic device, discrete
Door or transistor logic, discrete hardware components.
In the embodiment of the present application, a kind of computer readable storage medium is additionally provided, the computer readable storage medium
In be stored with instruction, when run on a computer so that computer execute it is any based on complex network in above-described embodiment
Real-time fraud detection method.
In the embodiment of the present application, additionally provide a kind of computer program product comprising instruction, when its on computers
When operation, so that computer executes any real-time fraud detection method based on complex network in above-described embodiment.
In the above-described embodiments, can come wholly or partly by software, hardware, firmware or any combination thereof real
It is existing.When implemented in software, it can entirely or partly realize in the form of a computer program product.The computer program
Product includes one or more computer instructions.When loading on computers and executing the computer program instructions, all or
It partly generates according to process or function described in the embodiment of the present invention.The computer can be general purpose computer, dedicated meter
Calculation machine, computer network or other programmable devices.The computer instruction can store in computer readable storage medium
In, or from a computer readable storage medium to the transmission of another computer readable storage medium, for example, the computer
Instruction can pass through wired (such as coaxial cable, optical fiber, number from a web-site, computer, server or data center
User's line (DSL)) or wireless (such as infrared, wireless, microwave etc.) mode to another web-site, computer, server or
Data center is transmitted.The computer readable storage medium can be any usable medium that computer can access or
It is comprising data storage devices such as one or more usable mediums integrated server, data centers.The usable medium can be with
It is magnetic medium, (for example, floppy disk, hard disk, tape), optical medium (for example, DVD) or semiconductor medium (such as solid state hard disk
Solid State Disk (SSD)) etc..
It should be noted that, in this document, as long as the technical characteristic non-contradiction in each optinal plan can combine and carry out shape
At scheme, these schemes are in range disclosed in the present application.Relational terms such as first and second and the like are used merely to
It distinguishes one entity or operation from another entity or operation, without necessarily requiring or implying these entities or behaviour
There are any actual relationship or orders between work.Moreover, the terms "include", "comprise" or its any other variant
It is intended to non-exclusive inclusion, so that including that the process, method, article or equipment of a series of elements not only includes
Those elements, but also including other elements that are not explicitly listed, or further include for this process, method, article or
The intrinsic element of person's equipment.In the absence of more restrictions, the element limited by sentence "including a ...", not
There is also other identical elements in the process, method, article or apparatus that includes the element for exclusion.
Each embodiment in this specification is all made of relevant mode and describes, same and similar portion between each embodiment
Dividing may refer to each other, and each embodiment focuses on the differences from other embodiments.Especially for device,
For the embodiment of electronic equipment and storage medium, since it is substantially similar to the method embodiment, so be described relatively simple,
The relevent part can refer to the partial explaination of embodiments of method.
The foregoing is merely the preferred embodiments of the application, are not intended to limit the protection scope of the application.It is all
Any modification, equivalent replacement, improvement and so within spirit herein and principle are all contained in the protection scope of the application
It is interior.
Claims (19)
1. a kind of real-time fraud detection method based on complex network characterized by comprising
Obtain the user information of user to be detected, wherein the user information of the user to be detected includes user subject and non-use
Family entity, the attributive character of user subject described in the non-user entity on behalf；
Based on the user information of the user to be detected, complex network model is constructed, wherein the complex network model includes big
Scale figure deposit data library；
The inquiry mechanism of multi-hop is used based on Large Scale Graphs deposit data library, is associated with the user subject with fraud feature, knot
Default Rating Model is closed, the fraud scoring of the user to be detected is obtained；
According to the fraud scoring of the user to be detected, determine whether the user to be detected is fraudulent user.
2. the method according to claim 1, wherein the user information based on the user to be detected, structure
Build complex network model, comprising:
User data and preset Large Scale Graphs deposit data library based on the user to be detected, construct the user subject and institute
The relationship between non-user entity is stated, will deposit that related entity is saved as key-value pair and real-time update is to the Large Scale Graphs
Deposit data library, wherein if updating Large Scale Graphs deposit data library for the first time, the preset Large Scale Graphs deposit data library is pre-
The Large Scale Graphs deposit data library first established, otherwise, the preset Large Scale Graphs deposit data library are extensive after real-time update
Figure deposit data library.
3. according to the method described in claim 2, it is characterized in that, the step of pre-establishing Large Scale Graphs deposit data library includes:
Obtain the user information of sample of users, wherein the user information of the sample of users includes that user subject and non-user are real
Body, the user subject include user subject, the undetected user subject with fraud feature without fraud feature
With the user subject with fraud feature, the attributive character of user subject described in the non-user entity on behalf；
User data based on the sample of users constructs the relationship between the user subject and the non-user entity, will deposit
Related entity is saved as key-value pair, the Large Scale Graphs deposit data library pre-established.
4. according to the method described in claim 2, it is characterized in that, the complex network model further include: single entity mobility models figure
Compose network and multiple entity knowledge mapping network；The method also includes:
Based on single entity mobility models map network and the multiple entity knowledge mapping network, based on the user with fraud feature
Entity, association fraud feature, and figure propagation algorithm is used, determine single entity mobility models map network and the multiple entity knowledge
Whether the user to be detected in map network is fraudulent user, the list entity mobility models map network and the multiple entity
Knowledge mapping network is established based on Large Scale Graphs storing data library.
5. constructing complex network mould the method according to claim 1, wherein described be based on the user information
Type, further includes:
Based on Large Scale Graphs storing data library, using the user subject as node, the non-user entity is side, and building is single
Entity mobility models map network；
Based on Large Scale Graphs storing data library, using the user subject and the non-user entity as node, dimension is preset
For side, multiple entity knowledge mapping network is constructed.
6. according to the method described in claim 5, it is characterized in that, the default dimension include: time dimension, equipment dimension,
Network environment dimension, addressing dimension.
7. a kind of real-time fraud detection method based on complex network characterized by comprising
Obtain the user information of user to be detected, wherein the user information of the user to be detected includes user subject and non-use
Family entity, the attributive character of user subject described in the non-user entity on behalf；
Based on the user information of the user to be detected, complex network model is constructed, wherein the complex network model includes big
Scale figure deposit data library, single entity mobility models map network and multiple entity knowledge mapping network, wherein the list entity mobility models map
Network and the multiple entity knowledge mapping network are established based on Large Scale Graphs deposit data library；
Based on single entity mobility models map network and the multiple entity knowledge mapping network, based on the user with fraud feature
Entity, association fraud feature, and figure propagation algorithm is used, determine single entity mobility models map network and the multiple entity knowledge
Whether the user to be detected in map network is fraudulent user.
8. constructing complex network mould the method according to the description of claim 7 is characterized in that described be based on the user information
Type, comprising:
User data and preset Large Scale Graphs deposit data library based on the user to be detected, construct the user subject and institute
The relationship between non-user entity is stated, will deposit that related entity is saved as key-value pair and real-time update is to the Large Scale Graphs
Deposit data library, wherein if updating Large Scale Graphs deposit data library for the first time, the preset Large Scale Graphs deposit data library is pre-
The Large Scale Graphs deposit data library first established, otherwise, the preset Large Scale Graphs deposit data library are extensive after real-time update
Figure deposit data library；
Based on Large Scale Graphs storing data library, using the user subject as node, the non-user entity is side, and building is single
Entity mobility models map network；
Based on Large Scale Graphs storing data library, using the user subject and the non-user entity as node, dimension is preset
For side, multiple entity knowledge mapping network is constructed.
9. according to the method described in claim 8, it is characterized in that, the default dimension include: time dimension, equipment dimension,
Network environment dimension, addressing dimension.
10. a kind of real-time fraud detection device based on complex network characterized by comprising
First acquisition module, for obtaining the user information of user to be detected, wherein the user information packet of the user to be detected
Include user subject and non-user entity, the attributive character of user subject described in the non-user entity on behalf；
First complex network constructs module, for the user information based on the user to be detected, constructs complex network model,
In, the complex network model includes Large Scale Graphs deposit data library；
First analysis module, for using the inquiry mechanism of multi-hop based on Large Scale Graphs deposit data library, association has fraud
The user subject of feature obtains the fraud scoring of the user to be detected in conjunction with default Rating Model；
Judgment module determines whether the user to be detected is that fraud is used for the fraud scoring according to the user to be detected
Family.
11. device according to claim 10, which is characterized in that first complex network constructs module and includes:
First Large Scale Graphs deposit data library submodule, for user data based on the user to be detected and preset extensive
Figure deposit data library constructs the relationship between the user subject and the non-user entity, will deposit related entity as key
Value is to saving and real-time update is to Large Scale Graphs deposit data library, wherein if updating Large Scale Graphs deposit data library for the first time,
Then the preset Large Scale Graphs deposit data library is the Large Scale Graphs deposit data library pre-established, otherwise, the preset big rule
Mould figure deposit data library is the Large Scale Graphs deposit data library after real-time update.
12. device according to claim 11, which is characterized in that described device further includes that Large Scale Graphs deposit data library is preparatory
Module is established, Large Scale Graphs deposit data library pre-establishes module and is used for:
Obtain the user information of sample of users, wherein the user information of the sample of users includes that user subject and non-user are real
Body, the user subject include user subject, the undetected user subject with fraud feature without fraud feature
With the user subject with fraud feature, the attributive character of user subject described in the non-user entity on behalf,
User data based on the sample of users constructs the relationship between the user subject and the non-user entity, will deposit
Related entity is saved as key-value pair, the Large Scale Graphs deposit data library pre-established.
13. device according to claim 11, which is characterized in that the complex network model further include: single entity mobility models
Map network and multiple entity knowledge mapping network；Described device further include:
User's fraud detection module, for being based on single entity mobility models map network and the multiple entity knowledge mapping network,
Based on the user subject with fraud feature, association fraud feature, and figure propagation algorithm is used, determines single entity mobility models figure
Whether the user to be detected composed in network and the multiple entity knowledge mapping network is fraudulent user, and the list entity is known
Know map network and the multiple entity knowledge mapping network is established based on Large Scale Graphs storing data library.
14. device according to claim 10, which is characterized in that first complex network constructs module further include:
First single entity mobility models map network submodular, it is real with the user for being based on Large Scale Graphs storing data library
Body is node, and the non-user entity is side, constructs single entity mobility models map network；
First multiple entity knowledge mapping network submodular, it is real with the user for being based on Large Scale Graphs storing data library
Body and the non-user entity are node, and presetting dimension is side, construct multiple entity knowledge mapping network.
15. device according to claim 14, which is characterized in that the default dimension includes: time dimension, equipment dimension
Degree, network environment dimension, addressing dimension.
16. a kind of real-time fraud detection device based on complex network characterized by comprising
Second acquisition module, for obtaining the user information of user to be detected, wherein the user information packet of the user to be detected
Include user subject and non-user entity, the attributive character of user subject described in the non-user entity on behalf；
Second complex network constructs module, for the user information based on the user to be detected, constructs complex network model, institute
Stating complex network model includes Large Scale Graphs deposit data library, single entity mobility models map network and multiple entity knowledge mapping network,
Described in list entity mobility models map network and the multiple entity knowledge mapping network be to be built based on Large Scale Graphs deposit data library
Vertical；
Second analysis module, based on single entity mobility models map network and the multiple entity knowledge mapping network, based on having
Cheat the user subject of feature, association fraud feature, and use figure propagation algorithm, determine single entity mobility models map network and
Whether the user to be detected in the multiple entity knowledge mapping network is fraudulent user.
17. device according to claim 16, which is characterized in that second complex network constructs module and includes:
Second Large Scale Graphs deposit data library submodule, for user data based on the user to be detected and preset extensive
Figure deposit data library constructs the relationship between the user subject and the non-user entity, will deposit related entity as key
Value is to saving and real-time update is to Large Scale Graphs deposit data library, wherein if updating Large Scale Graphs deposit data library for the first time,
Then the preset Large Scale Graphs deposit data library is the Large Scale Graphs deposit data library pre-established, otherwise, the preset big rule
Mould figure deposit data library is the Large Scale Graphs deposit data library after real-time update；
Second single entity mobility models map network submodular, it is real with the user for being based on Large Scale Graphs storing data library
Body is node, and the non-user entity is side, constructs single entity mobility models map network；
Second multiple entity knowledge mapping network submodular, it is real with the user for being based on Large Scale Graphs storing data library
Body and the non-user entity are node, and presetting dimension is side, construct multiple entity knowledge mapping network.
18. device according to claim 17, which is characterized in that the default dimension includes: time dimension, equipment dimension
Degree, network environment dimension, addressing dimension.
19. a kind of electronic equipment characterized by comprising processor, communication interface, memory and communication bus, wherein
The processor, communication interface, memory complete mutual communication by communication bus；
Memory, for storing computer program；
Processor when for executing the program stored on memory, is realized of any of claims 1-9 based on multiple
The real-time fraud detection method of miscellaneous network.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910517253.9A CN110321438A (en) | 2019-06-14 | 2019-06-14 | Real-time fraud detection method, device and electronic equipment based on complex network |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910517253.9A CN110321438A (en) | 2019-06-14 | 2019-06-14 | Real-time fraud detection method, device and electronic equipment based on complex network |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN110321438A true CN110321438A (en) | 2019-10-11 |
Family
ID=68119650
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910517253.9A Pending CN110321438A (en) | 2019-06-14 | 2019-06-14 | Real-time fraud detection method, device and electronic equipment based on complex network |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110321438A (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111125263A (en) * | 2019-11-25 | 2020-05-08 | 深圳壹账通智能科技有限公司 | Reservation request management method, reservation function entity and readable storage medium |
| CN111369264A (en) * | 2020-02-13 | 2020-07-03 | 平安科技（深圳）有限公司 | Entity association method, device, equipment and computer readable storage medium |
| CN111915426A (en) * | 2020-08-04 | 2020-11-10 | 中投国信(北京)科技发展有限公司 | Method and system for distinguishing credit users based on graph calculation and community division algorithm |
| CN112330373A (en) * | 2020-11-30 | 2021-02-05 | 中国银联股份有限公司 | User behavior analysis method and device and computer readable storage medium |
| CN113727351A (en) * | 2020-05-12 | 2021-11-30 | 中国移动通信集团广东有限公司 | Communication fraud identification method and device and electronic equipment |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107730262A (en) * | 2017-10-23 | 2018-02-23 | 阿里巴巴集团控股有限公司 | One kind fraud recognition methods and device |
| CN109166030A (en) * | 2018-08-01 | 2019-01-08 | 深圳微言科技有限责任公司 | A kind of anti-fraud solution and system |
| CN109491995A (en) * | 2018-12-25 | 2019-03-19 | 苏宁易购集团股份有限公司 | Knowledge based map inquires the method and system of financial abnormal data |
| CN109598509A (en) * | 2018-10-17 | 2019-04-09 | 阿里巴巴集团控股有限公司 | The recognition methods of risk clique and device |
| CN109816397A (en) * | 2018-12-03 | 2019-05-28 | 北京奇艺世纪科技有限公司 | A kind of fraud method of discrimination, device and storage medium |
-
2019
- 2019-06-14 CN CN201910517253.9A patent/CN110321438A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107730262A (en) * | 2017-10-23 | 2018-02-23 | 阿里巴巴集团控股有限公司 | One kind fraud recognition methods and device |
| CN109166030A (en) * | 2018-08-01 | 2019-01-08 | 深圳微言科技有限责任公司 | A kind of anti-fraud solution and system |
| CN109598509A (en) * | 2018-10-17 | 2019-04-09 | 阿里巴巴集团控股有限公司 | The recognition methods of risk clique and device |
| CN109816397A (en) * | 2018-12-03 | 2019-05-28 | 北京奇艺世纪科技有限公司 | A kind of fraud method of discrimination, device and storage medium |
| CN109491995A (en) * | 2018-12-25 | 2019-03-19 | 苏宁易购集团股份有限公司 | Knowledge based map inquires the method and system of financial abnormal data |
Non-Patent Citations (2)
| Title |
|---|
| 奥渊博: ""基于用户信息图谱的互联网金融虚假用户信息检测系统的设计与实现"", 《中国优秀硕士学位论文全文数据库 信息科技辑》 * |
| 张翔: ""基于大规模知识库的实体描述生成和应用"", 《万方》 * |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111125263A (en) * | 2019-11-25 | 2020-05-08 | 深圳壹账通智能科技有限公司 | Reservation request management method, reservation function entity and readable storage medium |
| CN111369264A (en) * | 2020-02-13 | 2020-07-03 | 平安科技（深圳）有限公司 | Entity association method, device, equipment and computer readable storage medium |
| CN113727351A (en) * | 2020-05-12 | 2021-11-30 | 中国移动通信集团广东有限公司 | Communication fraud identification method and device and electronic equipment |
| CN113727351B (en) * | 2020-05-12 | 2024-03-19 | 中国移动通信集团广东有限公司 | Communication fraud identification method and device and electronic equipment |
| CN111915426A (en) * | 2020-08-04 | 2020-11-10 | 中投国信(北京)科技发展有限公司 | Method and system for distinguishing credit users based on graph calculation and community division algorithm |
| CN112330373A (en) * | 2020-11-30 | 2021-02-05 | 中国银联股份有限公司 | User behavior analysis method and device and computer readable storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110321438A (en) | Real-time fraud detection method, device and electronic equipment based on complex network | |
| CN109598509B (en) | Identification method and device for risk group partner | |
| CN104303153B (en) | For the detection of abnormal subgraph, abnormal/change detection and the path scanning of network situation awareness | |
| Nejat et al. | Agent‐based modeling of behavioral housing recovery following disasters | |
| CN106992994A (en) | A kind of automatically-monitored method and system of cloud service | |
| CN105991521A (en) | Network risk assessment method and network risk assessment device | |
| CN110110529B (en) | Software network key node mining method based on complex network | |
| CN108881110A (en) | A kind of safety situation evaluation and defence policies joint decision method and system | |
| CN112132676B (en) | Method and device for determining contribution degree of joint training target model and terminal equipment | |
| CN110267268A (en) | The recognition methods of pseudo-base station, apparatus and system | |
| Wang et al. | The truthful evolution and incentive for large-scale mobile crowd sensing networks | |
| CN108306891A (en) | The method, apparatus and system of machine learning are executed using data to be exchanged | |
| Rosés et al. | Simulating offender mobility: Modeling activity nodes from large-scale human activity data | |
| Hao et al. | A review on multicriteria decision support system and industrial internet of things for source code transformation | |
| Stepanova et al. | Applying large-scale adaptive graphs to modeling internet of things security | |
| Sajith et al. | Network intrusion detection system using ANFIS classifier | |
| Lin | Financial performance management system and wireless sharing network optimization of listed enterprises under BPNN | |
| Tang et al. | Identification of highly susceptible individuals in complex networks | |
| Xu et al. | An algorithm for detecting group in mobile social network | |
| Li et al. | Web and social media dynamics, and evolutionary and adaptive branding: theories and a hybrid intelligent model | |
| Boujlaleb et al. | User-centric approach of detecting temporary community | |
| CN107251519A (en) | The system and method for analyzing to detect the attack to mobile wireless network based on network controllability | |
| Jiang | Towards the design of robust trust and reputation systems | |
| Bendahman et al. | Unveiling Influence in Networks: A Novel Centrality Metric and Comparative Analysis through Graph-Based Models | |
| Da et al. | Evaluating cyber loss in star-ring and star-bus hybrid networks based on the bond percolation model |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20191011 |
|
| RJ01 | Rejection of invention patent application after publication |