CN111489168A

CN111489168A - Target object risk identification method and device and processing equipment

Info

Publication number: CN111489168A
Application number: CN202010306216.6A
Authority: CN
Inventors: 刘丹丹; 王膂; 曾威龙; 钱隽夫
Original assignee: Alipay Hangzhou Information Technology Co Ltd
Current assignee: Alipay Hangzhou Information Technology Co Ltd
Priority date: 2020-04-17
Filing date: 2020-04-17
Publication date: 2020-08-04

Abstract

The specification provides a risk identification method and device of a target object and processing equipment. In one embodiment of the method, relatively fixed data in training data of the model can be acquired according to a certain updating frequency, and then the relatively fixed data is input into the model together with real-time characteristic data to perform local updating of the model, so that the real-time updating of the model can be realized. By using the risk identification model in the embodiment of the specification, the training efficiency and the updating speed of the model can be improved, and the prediction efficiency and the prediction effect of the model can be improved.

Description

Target object risk identification method and device and processing equipment

Technical Field

The embodiment of the specification belongs to the field of computer data processing, and particularly relates to a risk identification method and device for a target object and processing equipment.

Background

With the rapid development of computer networks, network financial enterprises such as big data finance, third party payment, block chain finance and the like also rapidly develop. Due to interest temptation, more and more lawbreakers use enterprise accounts to carry out cash register, fraud and other criminal behaviors, and fraud risks are continuously appeared. Therefore, some existing machine learning algorithms are often adopted in the prior art to identify risks and warn the risk of network fraud.

The machine learning algorithm adopted by the existing scheme is mainly used for acquiring some characteristic data of an enterprise, then performing off-line model training, putting the trained model into on-line use, and outputting a prediction result in terminal equipment.

Disclosure of Invention

The purpose of the present specification is to provide a risk identification method, apparatus and processing device for a target object, which can update a model in time to obtain training data and the model itself, and improve timeliness of model prediction and accuracy of an output prediction result.

The method, the device and the processing equipment for identifying the risk of the target object provided by the embodiment of the specification are realized by the following steps:

a method of risk identification of a target object, comprising:

taking entities in a pre-constructed knowledge graph of a target object as nodes and relation data between the entities as edges, and classifying the knowledge graph by using a selected graph neural network algorithm to obtain graph vector data of the nodes;

acquiring latest risk characteristic data of a target object;

training by taking the risk characteristic data and the graph vector data as input data of a selected risk identification model to obtain an updated risk identification model; wherein the map vector data is updated according to a preset frequency;

and identifying nodes with risks in the target object based on the updated risk identification model.

A risk identification apparatus of a target object, comprising:

the fixed characteristic module is used for classifying the knowledge graph by using entities in a pre-constructed knowledge graph of a target object as nodes and relation data between the entities as edges and utilizing a selected graph neural network algorithm to acquire graph vector data of the nodes;

the change characteristic module is used for acquiring the latest risk characteristic data of the target object;

the updating module is used for training the risk characteristic data and the graph vector data as input data of the selected risk identification model to obtain an updated risk identification model; wherein the map vector data is updated according to a preset frequency;

and the risk identification module is used for identifying nodes with risks in the target object based on the updated risk identification model.

A processing device slice processing device comprising: at least one processor and a memory for storing processor-executable instructions, the instructions when executed by the processor implement the method of any of the embodiments of the present description.

According to the risk identification method, the risk identification device and the risk identification processing equipment for the target object, relatively fixed data in training data of a model can be obtained according to a certain updating frequency, and then the training data is input into the model together with real-time characteristic data to perform local updating of the model, so that real-time updating of the model can be achieved. By using the risk identification model in the embodiment of the specification, the real-time performance of the data characteristics of the target object and the real-time performance of model updating are realized, the training efficiency and the model updating speed are improved, and the model prediction efficiency and the model prediction effect are improved.

Drawings

In order to more clearly illustrate the embodiments of the present specification or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced below, it is obvious that the drawings in the following description are only some embodiments described in the present specification, and for those skilled in the art, other drawings can be obtained according to the drawings without any creative effort.

FIG. 1 is a schematic flow chart of a method for risk identification of a target object provided herein;

FIG. 2 is a schematic flow chart diagram of another method for risk identification of a target object provided herein;

FIG. 3 is a block diagram of a hardware structure of a processing device to which a risk identification method for a target object according to an embodiment of the present invention is applied;

fig. 4 is a schematic block diagram of a risk identification device for a target object provided in the present specification.

Detailed Description

In order to make those skilled in the art better understand the technical solutions in the present specification, the technical solutions in the embodiments of the present specification will be clearly and completely described below with reference to the drawings in the embodiments of the present specification, and it is obvious that the described embodiments are only a part of the embodiments of the present specification, and not all of the embodiments. All other embodiments obtained by a person skilled in the art based on the embodiments in the present specification without any inventive step should fall within the scope of protection of the present specification.

At present, some terminal devices adopt a real-time enterprise risk identification algorithm, and the real-time performance of the algorithm is mainly reflected in the real-time performance of characteristic data of a used target object. For example, real-time feature data is obtained through a streaming computing platform such as kafka, flink and the like, and is input into a trained model to obtain a prediction result. However, although some existing models use real-time feature data, the training efficiency of the generally adopted offline model based on deep learning is often low, and the training time of the offline model is usually long, so that it is difficult to meet the timeliness of the online real-time model. In addition, the training effect of the model is also attenuated continuously, and generally, the longer the distance between the training time and the service time of the model is, the poorer the effect of the model prediction is. If the model cannot be updated in real time, the timeliness of the output prediction result is often poor, the risk is not identified sufficiently, and the risk omission may be caused. There is therefore a need for a more efficient, effective real-time model to identify risks to a target object more timely.

It should be noted that the real-time/real-time described in this specification may refer to the data/model obtained or used being the latest data/model. It will be understood by those skilled in the art that the data/model obtained or used may still be considered as being real-time data/model or still have real-time property after predetermined preprocessing or persistent storage.

Based on the existing problems, the embodiment of the present specification provides a risk identification method for a target object, which may obtain an embed (embedded layer) of an enterprise by using a Graph embed (Graph Embedding) method such as a Graph neural network and the like based on an enterprise risk knowledge Graph constructed in advance, where the embedded layer embed may be used in the network to convert input into vectors, which may be referred to as Graph vector data).

The following describes embodiments of the present disclosure in a specific implementation scenario of money laundering risk identification in an enterprise. Specifically, fig. 1 is a schematic flow chart of a risk identification method for a target object provided in this specification. Although the present specification provides the method steps or apparatus and system architecture shown in the following examples or figures, more or less steps or modules may be included in the method or apparatus based on conventional or non-inventive efforts. In the case of steps or structures which do not logically have the necessary cause and effect relationship, the execution sequence of the steps or the module structure of the apparatus is not limited to the execution sequence or structure shown in the embodiment or the drawings in this specification. When the described apparatus, server, system or end product of the method or system structure is applied in an actual device, server, system or end product, the method or module structure shown in the embodiment or the figures may be executed sequentially or executed in parallel (for example, in an environment of parallel processors or multi-thread processing, or even in an implementation environment including distributed processing and server clustering).

Of course, the following description of the embodiments does not limit other extensible solutions based on the present description.

Specifically, an embodiment of the method provided in this specification is shown in fig. 1, and may include:

s10: and taking the entities in the pre-constructed knowledge graph of the target object as nodes and the relation data between the entities as edges, and classifying the knowledge graph by using the selected graph neural network algorithm to obtain the graph vector data of the nodes.

A knowledge graph of the target object may be pre-constructed, which may include entities of the constructed target object and resulting relationship data between the entities.

The target object may be an enterprise in this embodiment scenario. Of course, in other embodiment application scenarios, the target object may have a corresponding risk-identified target object, for example, the target object may also be a third-party payment platform, a community, and the like. The knowledge graph can be a pre-constructed enterprise risk knowledge graph. In the field of computer science, a graph in graph data used by GNNs generally refers to a data structure including nodes (vertices) and edges (edges). A graph may be described in terms of the set of nodes and edges it contains. Edges may be directed or undirected, typically depending on whether there is a directional dependency between nodes. In the application scenario of this embodiment, multiple entities of the target object may be constructed, the constructed entities serve as nodes for risk identification, and the relationship between the entities serves as an edge of the graph. Specifically, in an embodiment provided in this specification, the target object may be an enterprise, and the entity of the constructed target object may include: enterprises, natural people, cases, domain names; the relation data between the entities adopts a triple data structure of a head node, a relation and a tail node.

In this embodiment, a total of 4 entity types of enterprises, natural persons, cases, and domain names are constructed. Where a case may refer to a social event or criminal case and the domain name may refer to the ICP (web content provider) of the website. The information content of the graph may generally include the entity and some characteristics of the entity (e.g., the business ID may identify the entity, and the business registered city is a characteristic of the entity), and other embodiments may construct other types of entities. Various relationships can be determined between the entities to generate relationship data. Such as a natural person of a business (legal person), a business (parent company), a business (co-registered address) enterprise, a natural person (paying treasures), and so on. Taking an example of a business-to-natural relationship, if a legal relationship, it may mean that a natural person U1 is or is not a legal person of a business P1, and other relationships are similar. In the knowledge graph in this embodiment, data (s, p, o) may be displayed in a triple manner, and a corporate relationship is taken as an example to respectively represent a finger node (enterprise), a relationship (corporate relationship), and a tail node (natural person).

The specific updating frequency can be set according to the scene requirements, for example, the requirement of the real-time updating of the model can be met, for example, a risk identification model can be trained at the daily frequency, the map vector data can be fixed in one day, and the change of the whole data can be rapidly captured by an L R model (a logistic Regression model in machine learning).

In the application scenario of money laundering prevention in this embodiment, the risk of illegal operations by enterprises and natural people is usually high. Therefore, in another embodiment provided by the present specification, the relationship data of two entities, namely, an enterprise and a natural person, can be focused more, and the characteristics of the nodes with higher risks are highlighted, so that the model can identify the risks more accurately. Specifically, in another embodiment of the method provided in this specification, the relationship data between the entities may include:

s101: whether the natural person is a legal person of the enterprise, whether the enterprise is a parent company of another enterprise, whether the enterprise is the same registered place, and whether the natural person and the natural person are friends in a specified social platform.

For example, in an application scenario, in a relationship that a natural person is a legal person of a certain enterprise, the risk that the legal person performs illegal activities by utilizing the advantages of his own duties in the enterprise is higher than that of a common employee, or the enterprises in the same registered place perform illegal competitions due to the advantages of geographic locations. By processing the several business entities and the relationships among the entities into data processed by a computer, the characteristics of the nodes with higher risks can be more highlighted in the processing, so that the model risk identification is more accurate.

Furthermore, the entities in the knowledge graph can be used as nodes, the relation data can be used as edges, the selected graph neural network algorithm is used for carrying out classification processing on the knowledge graph, and graph vector data of the nodes is obtained.

In this embodiment, the entity of the target object may be used as a Node of the graph, and relationship data between the entities may be used as an edge of the graph to construct a generated knowledge graph, and then the nodes may be classified by using Structure2Vec, GeniePath, and the like, of course, in other embodiments, besides the Structure2Vec and GeniePath methods described above, other graph Embedding algorithms may be used for classification processing, such as deep walk, L ine.

In the neural network algorithm, Embedding is a way to convert discrete variables into a continuous vector representation. Embedding may represent an object by a low-dimensional vector, which may be a word, a commodity, a movie, etc. The property of the Embedding vector is that objects corresponding to vectors with similar distances have similar meanings, for example, the distance between the Embedding (revenge league) and the Embedding (ironmen) is very close, but the distance between the Embedding (revenge league) and the Embedding (dinking) is far away. In this embodiment, based on the knowledge graph, one of the purposes of performing classification processing by using a graph neural network algorithm is to obtain Embedding (graph vector data) of nodes in a training process as an input of a subsequent model. The method for obtaining the enterprise embeddings by using the graph neural network algorithm has low training efficiency, and the embeddings generally do not change very frequently, so that the partial Features can be used as Freezing Features of the risk identification model in the embodiment.

In addition, Embedding may also have a mathematical relationship. In this embodiment, the graph vector data of the target object obtained by using the GNN is used as the input of the subsequent model, the nodes of the target object and the relationship between the nodes are encoded into the low-dimensional dense vector and then fed to the subsequent risk identification model, and the data processing efficiency of the risk identification model can be greatly improved.

S12: and acquiring the latest risk characteristic data of the target object.

The processing steps of the graph neural network described above may obtain the fixed feature portion of the risk identification model. The data input to the risk identification model in this embodiment may include at least two kinds of data, one of which may be the fixed Features (FreezingFeatures) described above and the other of which may be the Changing Features (Changing Features). The change characteristics can be understood to include implementation characteristics of the target object, and the specific data form can be embodied as the latest risk characteristic data of the target object. The risk characteristic data can be obtained by calculation in some way by a server, can be obtained from other servers or platforms, and can also comprise real-time characteristic data input by a user.

In some embodiments, streaming computing may be employed to obtain the latest risk profile data for the target object. For example, the feature data obtained by the stream processing platform such as storm, spark learning, flink, etc. is used as the real-time feature in the present embodiment, i.e., the change feature (the latest risk feature data).

In another embodiment of the method provided in this specification, the latest risk characteristic data includes an amount of the enterprise transaction, and the number of the enterprise untrusted log-in devices. In some embodiments of the present disclosure, a feature with a high relevance to illegal activities related to an enterprise may be selected for risk monitoring and identification. In the embodiment, the transaction amount of the enterprise and the number of the non-credible login devices of the enterprise are used as real-time characteristics, the change information about the real-time characteristics can be captured in time, the latest data information of the characteristics related to risks is obtained for risk identification, and the accuracy of risk identification can be effectively improved.

S14: training by taking the risk characteristic data and the graph vector data as input data of a selected risk identification model to obtain an updated risk identification model; wherein the map vector data is updated according to a preset frequency.

The risk identification model may include two inputs, one being the fixed features generated as described above, i.e., the map vector data, and the other being the real-time features, i.e., the up-to-date risk feature data as described above. Of course, other data characteristic information may also be included. The data information can be subjected to preprocessing, such as aggregation or fusion, and then used as the input of a risk identification model, model training can be carried out, and meanwhile, real-time risk identification and prediction can be carried out.

The map vector is updated according to a preset frequency, and can be set according to the scene requirement as described above. For example, the requirement of real-time model update can be met, for example, the risk identification model can be trained with the frequency of days, and the same set of map vector data is fixedly used in one day. New map vector data is acquired the next day. Of course, the map vector data obtained in different periods may be the same as or different from the previous one. One of the purposes of updating the fixed features according to the preset frequency is to ensure the timely updating of the model, and meanwhile, the local fixed specific data information is updated, so that the updating efficiency of the model is improved.

S16: and identifying nodes with risks in the target object based on the updated risk identification model.

The obtained fixed features and the changed features can be aggregated and input into the selected risk identification model. The risk identification model carries out training and risk identification by using the fixed characteristic data and the variable characteristic data, on one hand, the risk identification by using real-time characteristics (variable characteristic data) of the model can be guaranteed, on the other hand, the implementation and the updating of the model can be guaranteed by local updating of the fixed characteristics obtained based on the graph neural network, the training efficiency and the updating speed of the model are improved, and the accuracy of the model prediction result is improved.

In some embodiments of the present description, a risk identification model with a relatively simple model may be selected for risk identification. The risk identification model is updated on line in real time, and meanwhile real-time characteristic data are obtained for real-time prediction, so that the training speed can be increased by selecting a simple classification model in the embodiment, and the updating speed of the model is increased. Specifically, in another implementation of the method provided in the present specification:

s160: the selected risk identification model comprises a simple classification model, and the simple classification model meets the conditions that the number of training parameters is less than a first threshold value, and the training time is less than a second threshold value.

The defined simple classification model generally refers to a classification model with relatively few parameters and high training speed. The specific selection may set a condition for model selection, for example, the training parameter is less than a first threshold, the training time is less than a second threshold, and the like. The selection of the specific first threshold and the specific second threshold can be set according to the design requirements of the model.

In another embodiment of the method provided herein, the selected risk identification model is a logistic regression model.

The L R (L g statistical Regression, L R) model belongs to an online learning algorithm, can update the weight of each feature by using new data, and can be trained without reusing historical data.

Of course, other risk identification models, such as decision trees, may be selected in other embodiments of the present description.

The method for identifying risks of one or more target objects, which is provided by the embodiment of the description, can obtain vector data of the target objects by using a neural network method based on an enterprise risk knowledge graph constructed in advance, wherein the vector data can be used as fixed features in a risk identification model, and real-time features returned by a streaming computing platform can be used as variable features and combined with the fixed features to be input into a simple classification model, such as L R.

In the present specification, each embodiment of the method is described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. Reference is made to the description of the method embodiments.

The method embodiments provided in the embodiments of the present specification may be executed in a computer terminal, a server cluster, a mobile terminal, a block chain system, a distributed network, or a similar computing device. The apparatus may include a system (including a distributed system), software (applications), modules, components, servers, clients, etc. that employ embodiments of the present description in conjunction with any necessary hardware for implementation. Taking a processing device running on a server as an example, fig. 3 is a hardware structure block diagram of a risk identification method for a target object to which an embodiment of the present invention is applied. As shown in fig. 3, the server 10 may include one or more (only one shown) processors 100 (the processors 100 may include, but are not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 200 for storing data, and a transmission module 300 for communication functions. It will be understood by those skilled in the art that the structure shown in fig. 3 is merely an illustration and is not intended to limit the structure of the electronic device. For example, the server 10 may also include more or fewer components than shown in FIG. 3, and may also include other processing hardware, such as a database or multiple levels of cache, a display, or have a different configuration than shown in FIG. 3, for example.

The memory 200 may be used to store software programs and modules of application software, and the processor 100 executes various functional applications and data processing by operating the software programs and modules stored in the memory 200. Memory 200 may include high speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, memory 200 may further include memory located remotely from processor 100, which may be connected to a computer terminal through a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The transmission module 300 is used for receiving or transmitting data via a network. Examples of such networks may include a blockchain private network of the server 10 or a network provided by the world wide web or a communications provider. In one example, the transmission module 300 includes a Network adapter (NIC) that can be connected to other Network devices through a base station so as to communicate with the internet. In one example, the transmission module 300 may be a Radio Frequency (RF) module, which is used for communicating with the internet in a wireless manner.

Based on the above description of the embodiments of the target object risk identification method, one or more embodiments of the present specification further provide a target object risk identification device. The apparatus may include systems (including distributed systems), software (applications), modules, components, servers, clients, etc. that use the methods described in the embodiments of the present specification in conjunction with any necessary apparatus to implement the hardware. Based on the same innovative conception, embodiments of the present specification provide an apparatus as described in the following embodiments. Since the implementation scheme of the apparatus for solving the problem is similar to that of the method, the specific implementation of the apparatus in the embodiment of the present specification may refer to the implementation of the foregoing method, and repeated details are not repeated. As used hereinafter, the term "unit" or "module" may be a combination of software and/or hardware that implements a predetermined function. Although the means described in the embodiments below are preferably implemented in software, an implementation in hardware, or a combination of software and hardware is also possible and contemplated.

Specifically, fig. 4 is a schematic block diagram of an embodiment of a risk identification apparatus for a target object provided in this specification, and as shown in fig. 4, the apparatus may include:

the fixed feature module 40 may be configured to classify the knowledge graph by using an entity in a pre-constructed knowledge graph of the target object as a node and using relationship data between the entities as a side, and using a selected graph neural network algorithm to obtain graph vector data of the node;

a change characteristic module 42, which may be used to obtain the latest risk characteristic data of the target object;

the updating module 44 may be configured to train the risk feature data and the graph vector data as input data of a selected risk identification model to obtain an updated risk identification model; wherein the map vector data is updated according to a preset frequency;

a risk identification module 46 may be configured to identify nodes in the target object that are at risk based on the updated risk identification model.

Based on the foregoing description of the method embodiments, in another embodiment of the apparatus provided in the present specification, the change characteristic module 42 may use streaming calculation to obtain the latest risk characteristic data of the target object.

Based on the foregoing description of the method embodiments, this specification provides another embodiment of the apparatus, where the selected risk identification model includes a simple classification model, and the simple classification model satisfies that the number of training parameters is less than a first threshold, and the training time is less than a second threshold.

Based on the foregoing description of the method embodiments, the present specification provides that in another embodiment of the apparatus, the selected risk identification model is a logistic regression model.

Based on the foregoing description of the method embodiments, this specification provides another embodiment of the apparatus, where the target object is an enterprise, and the entity of the constructed target object includes: enterprises, natural people, cases, domain names; the relation data between the entities adopts a triple data structure of a head node, a relation and a tail node.

Based on the foregoing description of the method embodiments, the present specification provides in another embodiment of the apparatus, the relationship data between the entities comprising: whether the natural person is a legal person of the enterprise, whether the enterprise is a parent company of another enterprise, whether the enterprise is the same registered place, and whether the natural person and the natural person are friends in a specified social platform.

Based on the foregoing description of the method embodiment, in another embodiment of the apparatus provided in the present specification, the latest risk characteristic data obtained by the change characteristic module 42 may include the amount of the enterprise transaction, the number of the enterprise untrusted log-in devices.

It should be noted that the above-mentioned device may also include other implementation manners according to the description of the method embodiment, and specific implementation manners may refer to the description of the related method or system embodiment, which is not described in detail herein.

In the present specification, each embodiment of the apparatus is described in a progressive manner, and the same and similar parts among the embodiments are mutually referred to or described with reference to the corresponding method embodiment, and each embodiment focuses on the differences from the other embodiments. Reference is made to the description of the method embodiments. The specific details may be obtained according to the descriptions of the foregoing method embodiments, and all of the details should fall within the scope of the implementation protected by the present application, and further description of implementation schemes of the embodiments one by one is not repeated herein.

The risk identification method or device for the target object provided in the embodiment of the present specification may be implemented in a computer by a processor executing corresponding program instructions, for example, implemented in a PC using a C + + language of a Windows operating system, implemented based on an L inux system, or implemented in an intelligent terminal using Android and iOS system programming languages, for example, or implemented in a server cluster, cloud processing/cloud computing, and implemented in processing logic based on a quantum computer.

The present specification also provides a processing device which may be a server or a cluster of servers, or a node in a system, software (application), or a server comprising quantum computer processing devices or the like, in combination with necessary implementation hardware, using one or more of the method or apparatus or system embodiments of the present specification. The processing apparatus includes: at least one processor and a memory for storing processor-executable instructions, which when executed by the processor perform the steps of implementing any one of the method embodiments of the present description.

The method, the apparatus, or the node according to the foregoing embodiments provided in this specification may implement service logic through a computer program and record the service logic on a storage medium, where the storage medium may be read and executed by a computer, so as to implement the effect of the solution described in the embodiments of this specification.

The storage medium of the memory may include a physical device for storing information, and generally, the information is digitized and then stored in a medium using an electric, magnetic, or optical method. The storage medium may include: devices that store information using electrical energy, such as various types of memory, e.g., RAM, ROM, etc.; devices that store information using magnetic energy, such as hard disks, floppy disks, tapes, core memories, bubble memories, and usb disks; devices that store information optically, such as CDs or DVDs. Of course, there are other ways of storing media that can be read, such as quantum memory, graphene memory, and so forth.

The foregoing description has been directed to specific embodiments of this disclosure. The embodiments described based on the above embodiments are extensible and still fall within the scope of implementations provided in the present specification. In some cases, the actions or steps recited in the claims may be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing may also be possible or may be advantageous.

As described above, the description of the device or node embodiment according to the related method embodiment may also include other embodiments, and the specific implementation may refer to the description of the corresponding method embodiment, which is not described in detail herein.

The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the hardware + program class embodiment, since it is substantially similar to the method embodiment, the description is simple, and the relevant points can be referred to the partial description of the method embodiment.

Certain industry standards or implementations that are slightly modified based on implementations described using custom approaches or examples may also achieve the same, equivalent, or similar, or alternative, expected implementation results of the above-described examples.

According to the risk identification method, the risk identification device and the risk identification processing equipment for the target object, relatively fixed data in training data of a model can be obtained according to a certain updating frequency, and then the training data is input into the model together with real-time characteristic data to perform local updating of the model, so that real-time updating of the model can be achieved. By using the risk identification model obtained by the embodiment of the specification, the real-time performance of the data characteristics of the target object and the real-time performance of model updating are realized, an online prediction model which is relatively simple to train can be selected, the training efficiency and the updating speed of the model are improved, and the prediction efficiency and the prediction effect of the model are improved.

In the 90 th generation of 20 th century, it is obvious that improvements in Hardware (for example, improvements in Circuit structures such as diodes, transistors and switches) or software (for improvement in method flow) can be distinguished for a technical improvement, however, as technology develops, many of the improvements in method flow today can be regarded as direct improvements in Hardware Circuit structures, designers almost all obtain corresponding Hardware Circuit structures by Programming the improved method flow into Hardware circuits, and therefore, it cannot be said that an improvement in method flow cannot be realized by Hardware entity modules, for example, Programmable logic devices (Programmable logic devices L organic devices, P L D) (for example, Field Programmable Gate Arrays (FPGAs) are integrated circuits whose logic functions are determined by user Programming of devices), and a digital system is "integrated" on a P L D "by self Programming of designers without requiring many kinds of integrated circuits manufactured and manufactured by special chip manufacturers to design and manufacture, and only a Hardware software is written in Hardware programs such as Hardware programs, software programs, such as Hardware programs, software, Hardware programs, software programs, Hardware programs, software, Hardware programs, software, Hardware programs, software, Hardware, software, Hardware, software, Hardware, software, Hardware, software, Hardware, software, Hardware, software, Hardware, software, Hardware, software, Hardware, software, Hardware, software, Hardware, software, Hardware, software, Hardware, software, Hardware, software, Hardware, software.

A controller may be implemented in any suitable manner, e.g., in the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code (e.g., software or firmware) executable by the (micro) processor, logic gates, switches, Application Specific Integrated Circuits (ASICs), programmable logic controllers (PLC's) and embedded microcontrollers, examples of which include, but are not limited to, microcontrollers 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicone L abs C8051F320, which may also be implemented as part of the control logic of a memory.

The systems, devices, modules or units illustrated in the above embodiments may be implemented by a computer chip or an entity, or by a product with certain functions. One typical implementation device is a server system. Of course, this application does not exclude that with future developments in computer technology, the computer implementing the functionality of the above described embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device or a combination of any of these devices.

Although one or more embodiments of the present description provide method operational steps as described in the embodiments or flowcharts, more or fewer operational steps may be included based on conventional or non-inventive approaches. The order of steps recited in the embodiments is merely one manner of performing the steps in a multitude of orders and does not represent the only order of execution. When an actual apparatus or end product executes, it may execute sequentially or in parallel (e.g., parallel processors or multi-threaded environments, or even distributed data processing environments) according to the method shown in the embodiment or the figures. The terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, the presence of additional identical or equivalent elements in a process, method, article, or apparatus that comprises the recited elements is not excluded. For example, if the terms first, second, etc. are used to denote names, they do not denote any particular order.

For convenience of description, the above devices are described as being divided into various modules by functions, and are described separately. Of course, when implementing one or more of the present description, the functions of each module may be implemented in one or more software and/or hardware, or a module implementing the same function may be implemented by a combination of multiple sub-modules or sub-units, etc. The above-described embodiments of the apparatus are merely illustrative, and for example, the division of the units is only one logical division, and other divisions may be realized in practice, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

The memory may include forms of volatile memory in a computer readable medium, Random Access Memory (RAM) and/or non-volatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.

Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), Digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, a computer readable medium does not include a transitory computer readable medium such as a modulated data signal and a carrier wave.

As will be appreciated by one skilled in the art, one or more embodiments of the present description may be provided as a method, system, or computer program product. Accordingly, one or more embodiments of the present description may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of the present description may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

One or more embodiments of the present description may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. One or more embodiments of the present specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.

The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the system embodiment, since it is substantially similar to the method embodiment, the description is simple, and for the relevant points, reference may be made to the partial description of the method embodiment. In the description of the specification, reference to the description of the term "one embodiment," "some embodiments," "an example," "a specific example," or "some examples," etc., means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the specification. In this specification, the schematic representations of the terms used above are not necessarily intended to refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, various embodiments or examples and features of different embodiments or examples described in this specification can be combined and combined by one skilled in the art without contradiction.

The above description is merely exemplary of one or more embodiments of the present disclosure and is not intended to limit the scope of one or more embodiments of the present disclosure. Various modifications and alterations to one or more embodiments described herein will be apparent to those skilled in the art. Any modification, equivalent replacement, improvement or the like made within the spirit and principle of the present specification should be included in the scope of the claims.

Claims

1. A method of risk identification of a target object, comprising:

acquiring latest risk characteristic data of a target object;

2. The method of claim 1, wherein the current risk profile of the target object is obtained using streaming calculations.

3. The method of claim 1, wherein the selected risk identification model comprises a simple classification model satisfying a number of training parameters less than a first threshold and a training time less than a second threshold.

4. The method of claim 3, wherein the selected risk identification model is a logistic regression model.

5. The method of claim 1, wherein the target object is a business, and the entity of the constructed target object comprises: enterprises, natural people, cases, domain names; the relation data between the entities adopts a triple data structure of a head node, a relation and a tail node.

6. The method of claim 5, the relationship data between the entities comprising: whether the natural person is a legal person of the enterprise, whether the enterprise is a parent company of another enterprise, whether the enterprise is the same registered place, and whether the natural person and the natural person are friends in a specified social platform.

7. The method of claim 5, wherein the up-to-date risk profile data includes an amount of the business transaction, a number of the business untrusted log-in devices.

8. A risk identification apparatus of a target object, comprising:

9. The apparatus of claim 8, the change characteristics module employs streaming calculations to obtain updated risk characteristic data for the target object.

10. The apparatus of claim 8, the selected risk identification model comprising a simple classification model satisfying a number of training parameters less than a first threshold and a training time less than a second threshold.

11. The apparatus of claim 10, the selected risk identification model being a logistic regression model.

12. The apparatus of claim 8, the target object being an enterprise, the entity of the object of the constructed target comprising: enterprises, natural people, cases, domain names; the relation data between the entities adopts a triple data structure of a head node, a relation and a tail node.

13. The apparatus of claim 12, the relationship data between the entities comprising: whether the natural person is a legal person of the enterprise, whether the enterprise is a parent company of another enterprise, whether the enterprise is the same registered place, and whether the natural person and the natural person are friends in a specified social platform.

14. The apparatus of claim 12, wherein the latest risk profile data obtained by the change profile module comprises the amount of the business transaction, the number of the non-trusted enterprise login devices.

15. A processing device slice processing device comprising: at least one processor and a memory for storing processor-executable instructions, the processor implementing the method of any one of claims 1-7 when executing the instructions.