CN112351441B

CN112351441B - Data processing method and device and electronic equipment

Info

Publication number: CN112351441B
Application number: CN201910720936.4A
Authority: CN
Inventors: 戚玉雷; 刘忱; 王建宏; 刘钰柏; 黄志豪; 曾柏炫; 吴晓雯
Original assignee: China Mobile Communications Group Co Ltd; China Mobile Group Guangdong Co Ltd
Current assignee: China Mobile Communications Group Co Ltd; China Mobile Group Guangdong Co Ltd
Priority date: 2019-08-06
Filing date: 2019-08-06
Publication date: 2023-08-15
Anticipated expiration: 2039-08-06
Also published as: CN112351441A

Abstract

The embodiment of the invention discloses a data processing method, a data processing device and electronic equipment, wherein the method comprises the following steps: acquiring behavior data aiming at communication numbers and attribute information of the communication numbers, wherein the communication numbers comprise first communication numbers with risk labels and second communication signal codes for new account opening in preset time, constructing a number risk knowledge graph based on the attribute information and the behavior data of the communication numbers, wherein the number risk knowledge graph comprises association relations between entity nodes corresponding to the communication numbers and entity nodes corresponding to the behavior data, determining risk probability of the second communication signal codes based on the number risk knowledge graph and the attribute information of the entity nodes corresponding to the communication numbers in the number risk knowledge graph, and judging whether channels corresponding to the second communication signal codes have risks or not based on the risk probability. By the processing method, whether the channel has risks can be effectively judged, so that the problem of risk prevention hysteresis is avoided.

Description

Data processing method and device and electronic equipment

Technical Field

The present invention relates to the field of computer technologies, and in particular, to a data processing method, a data processing device, and an electronic device.

Background

With the rapid development of communication services and economy, operators provide users with a plurality of channels for opening accounts of new numbers, and bring more convenient services to the users, but due to the diversity of the opening accounts, more opening accounts risk problems are generated, and how to control the opening accounts risk becomes the focus of attention of operators.

Currently, in order to control the risk of opening an account of a communication channel, an operator can obtain a blacklist of high-risk channels (such as channels with risk and channels reported by users and the like obtained by public security) according to historical risk communication events, then can manually monitor the high-risk channels, and if the risk of opening an account of the high-risk channels is monitored, process new risk numbers of opening an account of the high-risk channels.

However, the manner of monitoring whether the high-risk channel is at risk by the above-mentioned manual work has the following problems: firstly, the manual monitoring has the problems of higher cost and lower monitoring efficiency, and secondly, the monitoring mode is to treat the high-risk channel after the serious risk problem exists or the risk problem occurs in the account opening number of the high-risk channel, so that the risk prevention hysteresis problem exists.

Disclosure of Invention

The embodiment of the invention aims to provide a data processing method to solve the problems of higher cost, lower efficiency and risk prevention hysteresis in the prior art when risk monitoring is carried out on an open channel.

In order to solve the technical problems, the embodiment of the invention is realized as follows:

in a first aspect, an embodiment of the present invention provides a data processing method, where the method includes:

acquiring behavior data aiming at a communication number and attribute information of the communication number, wherein the communication number comprises a first communication number with a risk tag and a second communication number for newly opening an account in preset time;

constructing a number risk knowledge graph based on the attribute information of the communication number and the behavior data, wherein the number risk knowledge graph comprises an association relationship between an entity node corresponding to the communication number and an entity node corresponding to the behavior data;

determining risk probability of the second communication number based on the number risk knowledge graph and attribute information of the entity node corresponding to the communication number in the number risk knowledge graph;

and judging whether the channel corresponding to the second communication signal code has risk or not based on the risk probability.

In a second aspect, an embodiment of the present invention provides a data processing apparatus, including:

the system comprises a data acquisition module, a data processing module and a data processing module, wherein the data acquisition module is used for acquiring behavior data aiming at a communication number and attribute information of the communication number, and the communication number comprises a first communication number with a risk tag and a second communication number for newly opening an account in a preset time;

the map construction module is used for constructing a number risk knowledge map based on the attribute information of the communication number and the behavior data, wherein the number risk knowledge map comprises an association relationship between an entity node corresponding to the communication number and an entity node corresponding to the behavior data;

the probability determining module is used for determining the risk probability of the second communication number based on the number risk knowledge graph and the attribute information of the entity node corresponding to the communication number in the number risk knowledge graph;

and the risk judging module is used for judging whether the channel corresponding to the second communication signal code has risk or not based on the risk probability.

In a third aspect, an embodiment of the present invention provides an electronic device, including a processor, a memory, and a computer program stored on the memory and executable on the processor, where the computer program when executed by the processor implements the steps of the data processing method provided in the foregoing embodiment.

In a fourth aspect, an embodiment of the present invention provides a computer readable storage medium, where a computer program is stored on the computer readable storage medium, where the computer program when executed by a processor implements the steps of the data processing method provided in the foregoing embodiment.

As can be seen from the technical solution provided in the foregoing embodiment of the present invention, in the embodiment of the present invention, by acquiring the behavior data for the communication number and the attribute information of the communication number, where the communication number includes a first communication number with a risk tag and a second communication signal code for a new account opening within a predetermined time, based on the attribute information and the behavior data of the communication number, a number risk knowledge graph is constructed, where the number risk knowledge graph includes an association relationship between an entity node corresponding to the communication number and an entity node corresponding to the behavior data, and based on the number risk knowledge graph and the attribute information of the entity node corresponding to the communication number in the number risk knowledge graph, a risk probability of the second communication signal code is determined, and based on the risk probability, whether a channel corresponding to the second communication signal code has a risk is determined. Therefore, the risk probability of the second communication number which is newly opened in the preset time can be determined based on the constructed number risk knowledge graph, so that whether the channel corresponding to the second communication number is at risk or not is determined, the channel is not required to be monitored manually, the risk monitoring efficiency of the channel is improved, the monitoring cost is reduced, and meanwhile, the communication risk problem caused by the risk monitoring hysteresis is avoided.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings that are required in the embodiments or the description of the prior art will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments described in the present invention, and other drawings can be obtained according to the drawings without inventive effort for a person skilled in the art.

FIG. 1 is a flow chart of a data processing method according to the present invention;

FIG. 2 is a schematic diagram of a number risk knowledge graph constructed according to the present invention;

FIG. 3 is a schematic diagram of another number risk knowledge graph constructed according to the present invention;

FIG. 4 is a flow chart of another data processing method according to the present invention;

FIG. 5 is a schematic diagram of another number risk knowledge graph constructed according to the present invention;

FIG. 6 is a schematic diagram of a constructed communication knowledge graph according to the present invention;

FIG. 7 is a schematic diagram of a data processing apparatus according to the present invention;

fig. 8 is a schematic structural diagram of an electronic device according to the present invention.

Detailed Description

The embodiment of the invention provides a data processing method, a data processing device and electronic equipment.

In order to make the technical solution of the present invention better understood by those skilled in the art, the technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention, and it is apparent that the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, shall fall within the scope of the invention.

Example 1

As shown in fig. 1, an embodiment of the present invention provides a data processing method, where an execution body of the method may be a terminal device, where the terminal device may be a device such as a personal computer, or a mobile terminal device such as a mobile phone, a tablet computer, or the like, and the terminal device may be a terminal device that a user can use a communication service based on a communication number. The method specifically comprises the following steps:

in step S102, behavior data for a communication number and attribute information of the communication number are acquired.

The communication number may be a number for the user to communicate, and the communication number may include a first communication number with a risk tag and a second communication number for newly opening an account within a predetermined time, where the predetermined time may be any time, such as near three days, near ten days, and the like, and the risk tag may be a tag for identifying that the communication number is at risk according to a historical event. The behavior data may include call behavior data (including answering behavior data, hanging-up behavior data, etc.), short message behavior data, user on/off behavior data, base station data corresponding to communication behavior, etc. The attribute information of the communication number may include information such as a user age, a user identification number, an international mobile equipment identification number (IMEI, international Mobile Equipment Identity) of the terminal device used by the user, a power-on duration, a first-pass activation time difference, and the like.

In implementation, behavior data for the communication number may be obtained, for example, the behavior data may include data corresponding to communication behavior generated between the first communication number and the second communication code.

The first communication number may be a communication number with a risk tag, and the risk tag may be a tag determined based on a historical event. For example, if the communication number 1 was reported as a risk number by a plurality of users, a risk tag may be set for the communication number 1, that is, the communication number 1 is a communication number with a risk tag. The risk tag determination method may also be multiple, and may be different according to different practical application scenarios, which is not specifically limited in the embodiment of the present invention.

In step S104, a number risk knowledge graph is constructed based on the attribute information and behavior data of the communication number.

The number risk knowledge graph may include an association relationship between an entity node corresponding to the communication number and an entity node corresponding to the behavior data, and the number risk knowledge graph may be stored in the graph database.

In implementation, the constructed number risk knowledge graph can be composed of entity nodes and association relations, namely, the number risk knowledge graph can be composed of a plurality of triples (h, r and t), wherein h and t respectively represent a head entity node and a tail entity node of the association relation, and r represents the association relation between the two entity nodes. The association relationship (i.e., corresponding behavior data) between two entity nodes may be multiple, so different r values may represent different association relationships between two entity nodes. For example, r=1 may indicate that a call behavior relationship exists between two entity nodes, and r=2 may indicate that a sms behavior relationship exists between two entity nodes.

In addition, the entity nodes in the number risk knowledge graph can also comprise attribute information of the corresponding communication numbers. For example, there may be 3 communication numbers, namely, communication number 1, communication number 2 and communication number 3, where communication number 2 may be a first communication number with a risk tag, and communication number 1 and communication number 3 may be a second communication number for a new account opening in about ten days. In the ten days, the communication between the communication number 1 and the communication number 2 is performed, and the short message between the communication number 2 and the communication number 3 is performed. Based on the behavior data and the acquired attribute data of the communication number 1, the communication number 2 and the communication number 3, a number risk knowledge graph as shown in fig. 2 can be constructed. In addition, if there is no association relationship between two entity nodes (i.e. no behavior data exists between the communication numbers), the association relationship between the two entity nodes may be assigned a null value, i.e. the value of r in the corresponding triples (h, r, t) may be 0. When the behavior data is generated between the communication numbers corresponding to the two entity nodes, the null value can be updated so as to realize the full connection of the number risk knowledge graph.

In addition, each entity node may further include attribute information corresponding to the communication number, and if the entity node corresponds to the first communication number with the risk tag, the attribute information of the entity node may further include the risk tag in the constructed number risk knowledge graph. For example, in the number risk knowledge graph shown in fig. 2, the attribute information of the entity node corresponding to the communication number 2 may include a risk tag.

In step S106, the risk probability of the second communication code is determined based on the number risk knowledge graph and the attribute information of the entity node corresponding to the communication number in the number risk knowledge graph.

In implementation, after the number risk knowledge graph is constructed, the entity node corresponding to the second communication signal code can be determined in the number risk knowledge graph, then the entity node connected with the entity node is determined according to the association relation, and finally the risk probability of the entity node corresponding to the second communication signal code can be determined according to the attribute information of the entity node.

For example, communication number 1 and communication number 3 are second user numbers for new account opening in the last ten days, communication number 2 and communication number 4 are first user numbers with risk labels, communication number 1 and communication number 2 generate call behavior data, communication number 1 and communication number 3 generate call behavior data, communication number 1 and communication number 4 generate short message behavior data, and communication number 2 and communication number 3 generate short message behavior data. Based on the communication numbers and the behavior data, a number risk knowledge graph as shown in fig. 3 can be constructed, wherein the value represented by the association relationship is 1, which means that call behavior data is generated between the communication numbers corresponding to the two entity nodes, the value represented by the association relationship is 0.5, which means that short message behavior data is generated between the communication numbers corresponding to the two entity nodes, and the value represented by the association relationship is 0, which means that no behavior data is generated between the communication numbers corresponding to the two entity nodes.

In the number risk knowledge graph in fig. 3, the physical nodes corresponding to the communication number 1 and the communication number 3 are the physical nodes corresponding to the second communication signal code. Taking the entity node corresponding to the communication number 1 as an example, the entity node connected with the entity node, namely the entity node corresponding to the communication number 2, the entity node corresponding to the communication number 3 and the entity node corresponding to the communication number 4 can be obtained. Then, according to the attribute information of the three entity nodes, the risk probability of the entity node corresponding to the communication number 1 can be determined. For example, the risk probability corresponding to the entity node may be determined according to the number of entity nodes corresponding to the first communication number with the risk tag included in the connected entity nodes. For example, if the number of entity nodes corresponding to the first communication number with the risk tag is greater than 1 and less than 3, the risk probability may be 40%, and the number of entity nodes corresponding to the first communication number with the risk tag is greater than 3 and less than 10, and the corresponding risk probability may be 80%. Since the communication number 2 and the communication number 4 are both the first communication number with the risk tag, the risk probability of the entity node corresponding to the communication number 1 may be 40%.

The method for determining the risk probability of the entity node is an optional and realizable method, and in an actual application scene, there may be multiple methods for determining the risk probability, which is not particularly limited in the embodiment of the present invention.

In step S108, based on the risk probability, it is determined whether the target channel corresponding to the second communication signal code has a risk.

In implementation, whether the target channel corresponding to the second communication code has risk or not may be determined based on the risk probability of the second communication code. For example, if the risk probability of the second communication number exceeds a preset probability threshold (e.g., 90%), it may be determined that the target channel corresponding to the second communication number is at risk. And then, the second communication number with risk and the target channel with risk can be visually displayed in a visual display mode, so that management by management staff is facilitated.

In addition, other second communication numbers corresponding to the target channel can be acquired, and whether the target channel has risks or not is determined according to the number of the second communication numbers with the risk probability exceeding the preset probability value. For example, as shown in fig. 3, the risk probability of the communication number 1 is 40% when the communication number 1 is the second communication number, then the target channel corresponding to the communication number 1 can be obtained, then other second communication signal codes (such as the communication number 3) corresponding to the target channel are obtained, and if the risk probability of the communication number 3 is 91% and is greater than the preset probability threshold (90%), then the risk of the target channel can be determined.

The method for judging whether the channel has risks is optional and can be realized, and in practical application, the method for judging whether the channel has risks can be different according to different scenes, and the embodiment of the invention is not particularly limited.

The embodiment of the invention provides a data processing method, which is characterized in that behavior data aiming at a communication number and attribute information of the communication number are obtained, wherein the communication number comprises a first communication number with a risk tag and a second communication signal code which is newly opened in a preset time, a number risk knowledge graph is constructed based on the attribute information and the behavior data of the communication number, the number risk knowledge graph comprises an association relationship between an entity node corresponding to the communication number and an entity node corresponding to the behavior data, the risk probability of the second communication signal code is determined based on the number risk knowledge graph and the attribute information of the entity node corresponding to the communication number in the number risk knowledge graph, and whether a channel corresponding to the second communication signal code has risks is judged based on the risk probability. Therefore, the risk probability of the second communication number which is newly opened in the preset time can be determined based on the constructed number risk knowledge graph, so that whether the channel corresponding to the second communication number is at risk or not is determined, the channel is not required to be monitored manually, the risk monitoring efficiency of the channel is improved, the monitoring cost is reduced, and meanwhile, the communication risk problem caused by the risk monitoring hysteresis is avoided.

Example two

As shown in fig. 4, an embodiment of the present invention provides a data processing method, where an execution body of the method may be a terminal device, where the terminal device may be a device such as a personal computer, or may be a mobile terminal device such as a mobile phone, a tablet computer, or the like, and the terminal device may be a terminal device that a user can use a communication service based on a communication number. The method specifically comprises the following steps:

in step S402, behavior data for a communication number and attribute information of the communication number are acquired.

In step S404, a number risk knowledge graph is constructed based on the attribute information and behavior data of the communication number.

The specific processing procedures of the steps S402 to S404 can be referred to the relevant contents of the steps S102 to S104 in the first embodiment, and will not be described herein.

In step S406, the data to be processed corresponding to the preset number risk indicator is selected from the attribute information of the communication number.

In an implementation, the preset number risk indicator may be an indicator set based on a historical risk identification service, for example, the preset number risk indicator may be an age, a first-pass activation time difference (i.e. a time difference between an opening time of a communication number and a time of dialing a first-pass phone by using the communication number), whether the preset number risk indicator is one or more users (i.e. a user identification number corresponding to the communication number is associated with other communication numbers), and so on.

In implementation, data corresponding to the preset number risk index can be selected from the behavior data and used as data to be processed. For example, the preset number risk indicator corresponding to the behavior data may be an indicator of whether there is a communication behavior with the high-risk communication number, whether the communication behavior is in the high-risk roaming area, whether the high-risk IMEI is used, or the like.

In step S408, vectorization is performed on the data to be processed to obtain a risk vector of the communication number.

In an implementation, since there may be non-numeric data in the data to be processed, the data to be processed may be processed, and a risk vector of the communication number may be constructed based on the processed data (i.e., vectorized processing is performed on the data to be processed).

For example, the preset number risk indicator may include: whether the communication is carried out by one card with multiple households, the age, whether the communication behavior (including the conversation behavior and/or the short message behavior) is carried out with the high-risk communication number, whether the communication behavior is in a high-risk roaming area, whether the high-risk IMEI is used, the starting time of the terminal equipment corresponding to the communication number and the first-pass activation time difference are carried out.

Assuming that the subscriber corresponding to the communication number 1 has a plurality of communication numbers, the age is 36 years, the subscriber has a call behavior with the high-risk communication number, has no communication behavior in the high-risk roaming area (i.e. does not occur in the high-risk roaming area), does not use the high-risk IMEI, the starting time of the terminal equipment is 18 hours, and the first-pass activation time difference is 3 minutes.

Based on the above information, the data to be processed corresponding to the preset number risk index may be obtained as follows: yes, 36 years old, yes, no, 18 hours, 3 minutes.

For the boolean value data in the data to be processed, an assignment operation may be performed, for example, "yes" may correspond to a value of 1 and "no" may correspond to a value of 0.

For non-Boolean value data in the data to be processed, the formula can be based on

Performing normalization processing, wherein q is data needing to be normalized, max (q) is a preset index maximum value, and q ^′ Is the processed data. For example, the user age is 36 years, and assuming that the preset maximum age is 120 years, the processed age data is 36/120=0.3.

Processing the data to be processed based on the processing mode, and obtaining processed data: 1. 0.3, 1, 0, 0.75, 0.00104. The risk vector of the communication number 1 constructed by the method is [1, 0.3, 1, 0, 0.75 and 0.00104].

The above processing method for vectorizing the data to be processed is an optional and realizable processing method, and in different practical application scenarios, there may be a plurality of different processing methods, which is not specifically limited in the embodiment of the present invention.

In step S410, the risk probability of the second communication number is determined based on the number risk knowledge graph and the risk vector of the entity node corresponding to the communication number in the number risk knowledge graph.

In practical applications, the processing manner of the step S410 may be varied, and an alternative implementation manner is provided below, which can be seen from the following steps one to six.

Step one, acquiring a label value corresponding to a risk label of a first communication number, and acquiring a label value corresponding to a second communication signal code.

The tag value corresponding to the risk tag of the first communication number may be a preset arbitrary value, such as 1, 2, etc., the tag value corresponding to the second communication signal code may also be a preset arbitrary value, and the tag value corresponding to the second communication signal code may be a tag value corresponding to the first communication number, for example, if the tag value corresponding to the risk tag of the first communication number is 1, the tag value corresponding to the second communication number may be 0.

And step two, determining a second entity node connected with the first entity node based on the association relation between the entity nodes corresponding to the communication numbers in the number risk knowledge graph.

The first entity node may be any entity node in the number risk knowledge graph, and the first entity node/the second entity node may include an entity node corresponding to the first communication number and/or an entity node corresponding to the second communication signal code.

In implementation, as shown in fig. 3, the first entity node may be any entity node in the number risk knowledge graph constructed in fig. 3, and after the first entity node is determined, a second entity node connected to the first entity node may be obtained according to the association relationship. For example, assuming that the entity node corresponding to the communication number 1 is the first entity node, the second entity node connected to the entity node may be the entity node corresponding to the communication number 2, the entity node corresponding to the communication number 3, and the entity node corresponding to the communication number 4.

And thirdly, determining the similarity between the first entity node and the second entity node based on the risk vector of the first entity node and the risk vector of the second entity node.

In implementations, the risk vector of the first entity node and the risk vector of the second entity node may be substituted into the formula

To calculate the similarity between two entity nodes. Wherein omega _ij For the similarity between the i-th first entity node and the j-th second entity node, D is the dimension of the risk vector,the (d) th component in the risk vector of the (i) th first entity node,/th component in the risk vector of the (i) th first entity node>For the (d) th component in the risk vector of the (j) th second entity node, exp () is an exponential function based on a natural constant e, σ ² For presetting super parameters for controlling the similarity omega _ij The greater the similarity between two entity nodes, ω _ij The greater the value of (2).

Based on the above formula, the similarity between the first entity node and all the second entity nodes connected with the first entity node can be calculated. For example, as shown in fig. 5, taking the entity node corresponding to the communication number 1 as the first entity node, the similarity (assumed to be 0.9) between the entity node corresponding to the communication number 1 and the entity node corresponding to the communication number 2 can be calculated based on the above formula, the similarity (assumed to be 0.5) between the entity node corresponding to the communication number 1 and the entity node corresponding to the communication number 3, and the similarity (assumed to be 0.6) between the entity node corresponding to the communication number 1 and the entity node corresponding to the communication number 4.

And step four, determining the transmission probability based on the similarity, and constructing a probability transmission matrix of the first entity node by the transmission probability.

In an implementation, after determining the similarity between the first entity node and all the second entity nodes, the formula may be based on

And calculating the transmission probability between the first entity node and each second entity node, and then forming a probability transmission matrix of the first entity node by the transmission probability. Wherein T is _ij For the probability of transfer, ω, between the ith first entity node and the jth second entity node _ij And l is the number of the entity nodes corresponding to the first communication number with the risk tag in the second entity node, and h is the number of the entity nodes corresponding to the second communication signal code in the second entity node.

For example, as shown in fig. 5, assuming that the entity node corresponding to the communication number 1 is a first entity node, the similarity between the entity node corresponding to the communication number 1 and the second entity nodes is as shown in fig. 5, and based on the above formula, the probability of transmission between the entity node corresponding to the communication number 1 and each second entity node can be calculated. For example, the probability of transmission between the entity node corresponding to communication number 1 and the entity node corresponding to communication number 2 is 0.9/(0.9+0.5+0.6) =0.45, the probability of transmission between the entity node corresponding to communication number 1 and the entity node corresponding to communication number 3 is 0.5/(0.9+0.5+0.6) =0.25, and the probability of transmission between the entity node corresponding to communication number 1 and the entity node corresponding to communication number 4 is 0.6/(0.9+0.5+0.6) =0.3, thereby constructing a probability transmission matrix t= [0.45,0.25,0.3 ] of the first entity node corresponding to communication number 1 ] ^T 。

And fifthly, determining risk probability distribution of the first entity node based on a preset label propagation algorithm, label values of the second entity node and a probability transfer matrix of the first entity node.

In implementations, a target risk probability distribution for the first entity node may be determined based on the tag value of the second entity node and the probability transfer matrix of the first entity node.

For example, an initial risk probability distribution for the first entity node may be constructed based on the tag values of the second entity node. For example, as shown in fig. 5, the second entity node may include an entity node corresponding to the communication number 2, an entity node corresponding to the communication number 3, and an entity node corresponding to the communication number 4. The communication number 2 and the communication number 4 are first communication numbers with risk labels, the corresponding label value can be 2, the communication number 3 is a second communication number of new account opening in the last ten days, and the corresponding label value can be 1. According to the label value of the second entity node, an initial risk probability distribution f= [2,1,2] of the first entity node (i.e. the entity node corresponding to the communication number 1) can be constructed.

The initial risk probability distribution composed of the label values of the second entity node and the probability transfer matrix of the first entity node may then be substituted into the following formula

F _i+1 ＝T*F _i ，1≤i，

To obtain a target risk probability distribution of the first entity node, wherein F _i For the initial risk probability distribution of the first entity node, F _i+1 And T is the probability transfer matrix of the first entity node.

After the target risk probability distribution of the first entity node is obtained, whether the target risk probability distribution meets a preset convergence rule or not can be judged.

If the target risk probability distribution meets the preset convergence rule, the target risk probability distribution may be determined as a risk probability distribution of the first entity node.

In implementation, the preset convergence rule may be any convergence rule determined according to an actual application scenario, and may be different according to different application scenarios, which is not particularly limited in the embodiment of the present invention.

If the target risk probability distribution does not meet the preset convergence rule, whether the entity node corresponding to the first communication number exists in the second entity node can be detected.

In the implementation, taking fig. 5 as an example, if the target probability distribution of the first entity node corresponding to the communication number 1 does not meet the preset convergence rule, it may be detected whether there is an entity node corresponding to the first communication number in the second entity node connected to the entity node, that is, whether there is a first communication number with a risk tag in the communication number 2, the communication number 3, and the communication number 4.

If the second entity node exists in the entity nodes corresponding to the first communication number, the entity nodes corresponding to the first communication number can be determined to be target entity nodes.

In the implementation, taking fig. 5 as an example, assume that the entity node corresponding to the communication number 1 is the first entity node, and the entity node corresponding to the communication number 2 and the entity node corresponding to the communication number 4 are the target entity nodes.

And determining a risk probability matrix of the first entity node based on the target risk probability distribution of the first entity node.

The risk probability matrix of the first entity node may be the same as the target risk probability distribution of the first entity node, or may also be converted based on a preset matrix conversion rule, so as to obtain the risk probability matrix of the first entity node.

And setting the probability value corresponding to the target entity node in the risk probability matrix of the first entity node as an initial probability value.

The initial probability value may be a preset arbitrary probability value, or may be a value of the transmission probability determined in the probability transmission matrix of the first entity node in the step four.

In implementation, as shown in fig. 5, it is assumed that the first entity node (i.e. the entity node corresponding to the communication number 1) has an initial risk probability distribution F ₁ ＝[2，1，2]Probability transfer matrix t= [0.45,0.25,0.3 ] of first entity node] ^T The target risk probability distribution F thus determined ₂ ＝[0.9，0.25，0.6]. Assuming that the target risk probability distribution does not conform to a preset convergence rule, and detecting that the entity node corresponding to the communication number 2 and the entity node corresponding to the communication number 4 correspond to the first communication numberI.e. the target entity node). At this time, the target risk probability distribution F of the first entity node may be ₂ Risk probability matrix F converted into first entity node ₂ ’，F ₂ ' can be combined with F ₂ I.e. F ₂ ’＝F ₂ ＝[0.9，0.25，0.6]。

Then, the probability value corresponding to the target entity node can be set as the initial probability value, namely F ₂ The probability values (namely 0.9 and 0.6) corresponding to the communication number 2 and the communication number 4 in the' are set as initial probability values, and the set risk probability matrix F of the first entity node ₃ May be [0.45,0.25,0.3 ]]。

And determining the set risk probability matrix of the first entity node as a probability transfer matrix of the first entity node. I.e. the probability transfer matrix T of the first entity node is set to [0.45,0.25,0.3 ] ] ^T Based on the probability transfer matrix and the initial risk probability distribution F ₁ Determining a target risk probability distribution F ₄ ＝[0.9，05，0.6]The influence of the first communication number with the risk tag can thereby be limited.

Then, based on the label value of the second entity node and the probability transfer matrix of the first entity node, calculating the target risk probability distribution of the first entity node, and judging whether the obtained target risk probability distribution accords with a preset convergence rule. If the target risk probability distribution accords with the preset convergence rule, the target risk probability distribution can be used as the risk probability distribution of the first entity node. If the preset convergence rule is not satisfied, determining a risk probability matrix of the first entity node based on the target risk probability distribution, setting a probability value corresponding to the target entity node in the risk probability matrix as an initial probability value, and determining the set risk probability matrix as a probability transfer matrix of the first entity node. And then, calculating the target risk probability distribution of the first entity node again based on the label value of the second entity node, and judging whether the target risk probability distribution accords with the preset convergence rule or not until the target risk probability distribution meets the preset convergence rule (if the target risk probability distribution tends to be stable, the target risk probability distribution can be considered to meet the preset convergence rule).

And step six, determining the risk probability of the second communication number based on the risk probability distribution of the first entity node.

In the implementation, taking fig. 5 as an example, assume that the communication number 1 is a second communication number, and the risk probability distribution f= [0.45,0.25,0.3] of the entity node corresponding to the communication number 1, where 0.45 and 0.3 are the risk probabilities between the first entity node and the entity nodes corresponding to the first communication number (i.e. the communication number 2 and the communication number 4), respectively, and then 0.45+0.3=0.75 is the risk probability of the communication number 1.

In step S412, if the second communication number is determined to be a risk number based on the risk probability, the second communication signal code is determined to be a risk number.

In an implementation, if the risk probability of the second communication number is greater than the preset risk probability threshold, the second communication number may be determined to be a risk number, i.e. the second communication number is a risk number. As shown in fig. 5, the communication number 1 and the communication number 3 are second communication numbers, the risk probability corresponding to the communication number 1 is 0.75, the risk probability corresponding to the communication number 3 is 0.3, and if the risk probability threshold is 0.5, the communication number 1 is the risk number.

In step S414, the number of risk numbers corresponding to the target channel is determined based on the communication knowledge graph constructed in advance.

The communication knowledge graph may be formed by an entity node corresponding to the communication number, an entity node determined by the first channel corresponding to the communication number, an association relationship between entity nodes determined by the correspondence between the communication number and the first channel, and an association relationship between entity nodes determined by the behavior data.

In implementation, a first channel corresponding to the communication number and attribute information of the first channel may be obtained, where the attribute information of the first channel may include channel category information, channel location information, channel account opening capacity information, and the like.

After the first channel corresponding to the communication number and the attribute information of the first channel are obtained, a communication knowledge graph can be constructed based on the information and the communication number. As shown in fig. 6, the communication knowledge graph may include an entity node corresponding to the communication number, an entity node corresponding to the first channel, an association relationship between entity nodes determined based on the correspondence between the communication number and the first channel, and an association relationship between entity nodes determined by the behavior data.

In the pre-constructed communication knowledge graph, if the communication number corresponding to the first channel contains the second communication signal code, the first channel can be a target channel, and then the number of risk numbers in the communication number corresponding to the target channel can be obtained. For example, in the communication knowledge graph shown in fig. 6, if the communication number 1, the communication number 2 and the communication number 3 are the second communication number, the first channel 1 and the first channel 2 are the target channel 1 and the target channel 2, and if the communication number 1, the communication number 2 and the communication number 3 are all risk numbers, the number of risk numbers corresponding to the target channel 1 is 1, and the number of risk numbers corresponding to the target channel 2 is 2.

In step S416, it is determined whether or not the target channel has a risk based on the number of risk numbers corresponding to the target channel.

In implementation, whether the number of risk numbers corresponding to the target channel is greater than a preset number threshold may be determined to determine whether the target channel has a risk. Assuming that the preset number threshold is 1, in fig. 6, the target channel 2 (i.e., the first channel 1) is at risk.

In addition, whether the target channel has risks can be judged based on the attribute information of the target channel and the number of risk numbers corresponding to the target channel. For example, the number of risk numbers corresponding to the target channels having the same channel position information may be summarized based on the channel position information of the target channels, and whether the target channels have risks may be determined based on the summarized number of risk numbers.

In practical applications, the processing manner of the step S416 may be varied, and an alternative implementation manner is provided below, which can be seen from the following steps one to two.

Step one, based on a communication knowledge graph, the number of communication numbers corresponding to a target channel is obtained.

And step two, if the ratio of the number of the risk numbers corresponding to the target channel to the number of the communication numbers is larger than a preset risk threshold, the target channel is at risk.

Example III

The above data processing method provided by the embodiment of the present invention further provides a data processing device based on the same concept, as shown in fig. 7.

The data processing apparatus includes: a data acquisition module 701, a map construction module 702, a probability determination module 703 and a risk determination module 704, wherein:

a data acquisition module 701, configured to acquire behavior data for a communication number and attribute information of the communication number, where the communication number includes a first communication number with a risk tag and a second communication number that is newly opened in a predetermined time;

the map construction module 702 is configured to construct a number risk knowledge map based on attribute information of the communication number and the behavior data, where the number risk knowledge map includes an association relationship between an entity node corresponding to the communication number and an entity node corresponding to the behavior data;

a probability determining module 703, configured to determine a risk probability of the second communication number based on the number risk knowledge graph and attribute information of an entity node corresponding to the communication number in the number risk knowledge graph;

and a risk judging module 704, configured to judge whether a risk exists in the target channel corresponding to the second communication signal code based on the risk probability.

In an embodiment of the present invention, the probability determining module 703 includes:

the data acquisition unit is used for selecting data to be processed corresponding to a preset number risk index from the attribute information of the communication number;

the data processing unit is used for carrying out vectorization processing on the data to be processed to obtain a risk vector of the communication number;

the probability determining unit is used for determining the risk probability of the second communication number based on the number risk knowledge graph and the risk vector of the entity node corresponding to the communication number in the number risk knowledge graph.

In an embodiment of the present invention, the probability determining unit is configured to:

acquiring a label value corresponding to a risk label of the first communication number, and acquiring a label value corresponding to the second communication signal code;

determining a second entity node connected with the first entity node based on the association relation between the entity nodes corresponding to the communication numbers in the number risk knowledge graph, wherein the first entity node is any entity node in the number risk knowledge graph and comprises the entity node corresponding to the first communication number and/or the entity node corresponding to the second communication signal code;

Determining a similarity between the first entity node and the second entity node based on the risk vector of the first entity node and the risk vector of the second entity node;

determining a transmission probability based on the similarity, and constructing a probability transmission matrix of the first entity node by the transmission probability;

determining risk probability distribution of the first entity node based on a preset label propagation algorithm, a label value of the second entity node and a probability transfer matrix of the first entity node;

and determining the risk probability of the second communication number based on the risk probability distribution of the first entity node.

determining a target risk probability distribution of the first entity node based on the label value of the second entity node and the probability transfer matrix of the first entity node;

and if the target risk probability distribution meets a preset convergence rule, determining the target risk probability distribution as the risk probability distribution of the first entity node.

In an embodiment of the present invention, the apparatus further includes:

the detection module is used for detecting whether an entity node corresponding to the first communication number exists in the second entity node or not if the target risk probability distribution does not meet the preset convergence rule;

The node determining module is used for determining the entity node corresponding to the first communication number in the second entity node as a target entity node if the entity node corresponding to the first communication number exists in the second entity node;

the matrix conversion module is used for determining a risk probability matrix of the first entity node based on the target risk probability distribution of the first entity node;

the probability setting module is used for setting a probability value corresponding to the target entity node in the risk probability matrix of the first entity node as an initial probability value;

and the matrix determining module is used for determining the set risk probability matrix of the first entity node as a probability transfer matrix of the first entity node.

In an embodiment of the present invention, the risk determination module 704 includes:

the number determining unit is used for determining a risk number contained in the second communication number based on the risk probability;

the number determining unit is used for determining the number of the risk numbers corresponding to the target channels based on a pre-constructed communication knowledge graph, wherein the communication knowledge graph is composed of entity nodes corresponding to the communication numbers, entity nodes determined by first channels corresponding to the communication numbers, association relations between the entity nodes determined by the correspondence between the communication numbers and the first channels, and association relations between the entity nodes determined by the behavior data;

And the channel risk judging unit is used for judging whether the target channel has risk or not based on the number of the risk numbers corresponding to the target channel.

In an embodiment of the present invention, the channel risk judging unit is configured to:

based on the communication knowledge graph, acquiring the number of the communication numbers corresponding to the target channel;

and if the ratio of the number of the risk numbers corresponding to the target channel to the number of the communication numbers is larger than a preset risk threshold, the target channel is at risk.

The embodiment of the invention provides a data processing device, which is used for acquiring behavior data aiming at a communication number and attribute information of the communication number, wherein the communication number comprises a first communication number with a risk tag and a second communication signal code for newly opening an account in a preset time, constructing a number risk knowledge graph based on the attribute information and the behavior data of the communication number, wherein the number risk knowledge graph comprises an association relationship between an entity node corresponding to the communication number and an entity node corresponding to the behavior data, determining risk probability of the second communication signal code based on the number risk knowledge graph and the attribute information of the entity node corresponding to the communication number in the number risk knowledge graph, and judging whether a channel corresponding to the second communication signal code has risk or not based on the risk probability. Therefore, the risk probability of the second communication number which is newly opened in the preset time can be determined based on the constructed number risk knowledge graph, so that whether the channel corresponding to the second communication number is at risk or not is determined, the channel is not required to be monitored manually, the risk monitoring efficiency of the channel is improved, the monitoring cost is reduced, and meanwhile, the communication risk problem caused by the risk monitoring hysteresis is avoided.

Example IV

Figure 8 is a schematic diagram of a hardware architecture of an electronic device implementing various embodiments of the invention,

the electronic device 800 includes, but is not limited to: radio frequency unit 801, network module 802, audio output unit 803, input unit 804, sensor 805, display unit 806, user input unit 807, interface unit 808, memory 809, processor 810, and power supply 811. It will be appreciated by those skilled in the art that the electronic device structure shown in fig. 8 is not limiting of the electronic device and that the electronic device may include more or fewer components than shown, or may combine certain components, or a different arrangement of components. In the embodiment of the invention, the electronic equipment comprises, but is not limited to, a mobile phone, a tablet computer, a notebook computer, a palm computer, a vehicle-mounted terminal, a wearable device, a pedometer and the like.

The processor 810 is configured to obtain behavior data for a communication number and attribute information of the communication number, where the communication number includes a first communication number with a risk tag and a second communication number that is newly opened in a predetermined time;

the processor 810 is configured to construct a number risk knowledge graph based on the attribute information of the communication number and the behavior data, where the number risk knowledge graph includes an association relationship between an entity node corresponding to the communication number and an entity node corresponding to the behavior data;

The processor 810 is configured to determine a risk probability of the second communication number based on the number risk knowledge graph and attribute information of an entity node corresponding to the communication number in the number risk knowledge graph;

and the processor 810 is configured to determine whether a risk exists in the target channel corresponding to the second communication signal code based on the risk probability.

In addition, the processor 810 is further configured to select, from the attribute information of the communication number, data to be processed corresponding to a preset number risk indicator;

in addition, the processor 810 is further configured to perform vectorization processing on the data to be processed to obtain a risk vector of the communication number;

in addition, the processor 810 is further configured to determine a risk probability of the second communication number based on the number risk knowledge graph and a risk vector of the entity node corresponding to the communication number in the number risk knowledge graph.

In addition, the processor 810 is further configured to obtain a tag value corresponding to the risk tag of the first communication number, and obtain a tag value corresponding to the second communication signal code;

in addition, the processor 810 is further configured to determine, based on an association relationship between entity nodes corresponding to the communication numbers in the number risk knowledge graph, a second entity node connected to the first entity node, where the first entity node is any entity node in the number risk knowledge graph, and the first entity node includes an entity node corresponding to the first communication number and/or an entity node corresponding to the second communication signal code;

In addition, the processor 810 is further configured to determine a similarity between the first entity node and the second entity node based on the risk vector of the first entity node and the risk vector of the second entity node;

in addition, the processor 810 is further configured to determine a probability of delivery based on the similarity, and construct a probability delivery matrix of the first entity node from the probability of delivery;

in addition, the processor 810 is further configured to determine a risk probability distribution of the first entity node based on a preset label propagation algorithm, a label value of the second entity node, and a probability transfer matrix of the first entity node;

in addition, the processor 810 is further configured to determine a risk probability of the second communication number based on a risk probability distribution of the first entity node.

In addition, the processor 810 is further configured to determine a target risk probability distribution of the first entity node based on the tag value of the second entity node and the probability transfer matrix of the first entity node;

in addition, the processor 810 is further configured to determine the target risk probability distribution as a risk probability distribution of the first entity node if the target risk probability distribution meets a preset convergence rule.

In addition, the processor 810 is further configured to detect whether an entity node corresponding to the first communication number exists in the second entity node if the target risk probability distribution does not meet the preset convergence rule;

in addition, the processor 810 is further configured to determine, if the second entity node has an entity node corresponding to the first communication number, the entity node corresponding to the first communication number in the second entity node as a target entity node;

in addition, the processor 810 is further configured to determine a risk probability matrix of the first entity node based on a target risk probability distribution of the first entity node;

in addition, the processor 810 is further configured to set a probability value corresponding to the target entity node in the risk probability matrix of the first entity node as an initial probability value;

in addition, the processor 810 is further configured to determine the set risk probability matrix of the first entity node as a probability transfer matrix of the first entity node.

In addition, the processor 810 is further configured to determine a risk number included in the second communication number based on the risk probability;

In addition, the processor 810 is further configured to determine the number of risk numbers corresponding to the target channel based on a pre-constructed communication knowledge graph, where the communication knowledge graph is configured by an entity node corresponding to the communication number, an entity node determined by a first channel corresponding to the communication number, an association relationship between entity nodes determined by a correspondence between the communication number and the first channel, and an association relationship between entity nodes determined by the behavior data;

in addition, the processor 810 is further configured to determine whether a risk exists in the target channel based on the number of risk numbers corresponding to the target channel.

In addition, the processor 810 is further configured to obtain, based on the communication knowledge graph, the number of communication numbers corresponding to the target channel;

in addition, the processor 810 is further configured to, if a ratio of the number of risk numbers corresponding to the target channel to the number of communication numbers is greater than a preset risk threshold, risk exists in the target channel.

The embodiment of the invention provides electronic equipment, which is characterized in that behavior data aiming at a communication number and attribute information of the communication number are obtained, wherein the communication number comprises a first communication number with a risk tag and a second communication signal code for newly opening an account in a preset time, a number risk knowledge graph is constructed based on the attribute information and the behavior data of the communication number, the number risk knowledge graph comprises an association relationship between an entity node corresponding to the communication number and an entity node corresponding to the behavior data, the risk probability of the second communication signal code is determined based on the number risk knowledge graph and the attribute information of the entity node corresponding to the communication number in the number risk knowledge graph, and whether a channel corresponding to the second communication signal code has risks is judged based on the risk probability. Therefore, the risk probability of the second communication number which is newly opened in the preset time can be determined based on the constructed number risk knowledge graph, so that whether the channel corresponding to the second communication number is at risk or not is determined, the channel is not required to be monitored manually, the risk monitoring efficiency of the channel is improved, the monitoring cost is reduced, and meanwhile, the communication risk problem caused by the risk monitoring hysteresis is avoided.

It should be understood that, in the embodiment of the present invention, the radio frequency unit 801 may be used for receiving and transmitting signals during the process of receiving and transmitting information or communication, specifically, receiving downlink data from a base station, and then processing the received downlink data by the processor 810; and, the uplink data is transmitted to the base station. In general, the radio frequency unit 801 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, and the like. In addition, the radio frequency unit 801 may also communicate with networks and other electronic devices through a wireless communication system.

The electronic device provides wireless broadband internet access to the user through the network module 802, such as helping the user to send and receive e-mail, browse web pages, access streaming media, and the like.

The audio output unit 803 may convert audio data received by the radio frequency unit 801 or the network module 802 or stored in the memory 809 into an audio signal and output as sound. Also, the audio output unit 803 may also provide audio output (e.g., a call signal reception sound, a message reception sound, etc.) related to a specific function performed by the electronic device 800. The audio output unit 803 includes a speaker, a buzzer, a receiver, and the like.

The input unit 804 is used for receiving an audio or video signal. The input unit 804 may include a graphics processor (Graphics Processing Unit, GPU) 8081 and a microphone 8042, the graphics processor 8081 processing image data of still pictures or video obtained by an image capturing apparatus (such as a camera) in a video capturing mode or an image capturing mode. The processed image frames may be displayed on the display unit 806. The image frames processed by the graphics processor 8081 may be stored in the memory 809 (or other storage medium) or transmitted via the radio frequency unit 801 or the network module 802. The microphone 8042 can receive sound, and can process such sound into audio data. The processed audio data may be converted into a format output that can be transmitted to the mobile communication base station via the radio frequency unit 801 in case of a telephone call mode.

The electronic device 800 also includes at least one sensor 805 such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor and a proximity sensor, wherein the ambient light sensor can adjust the brightness of the display panel 8061 according to the brightness of ambient light, and the proximity sensor can turn off the display panel 8061 and/or the backlight when the electronic device 800 moves to the ear. As one of the motion sensors, the accelerometer sensor can detect the acceleration in all directions (generally three axes), and can detect the gravity and direction when stationary, and can be used for recognizing the gesture of the electronic equipment (such as horizontal and vertical screen switching, related games, magnetometer gesture calibration), vibration recognition related functions (such as pedometer and knocking), and the like; the sensor 805 may also include a fingerprint sensor, a pressure sensor, an iris sensor, a molecular sensor, a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, etc., which are not described herein.

The display unit 806 is used to display information input by a user or information provided to the user. The display unit 806 may include a display panel 8061, and the display panel 8061 may be configured in the form of a liquid crystal display (Liquid Crystal Display, LCD), an Organic Light-Emitting Diode (OLED), or the like.

The user input unit 807 is operable to receive input numeric or character information and to generate key signal inputs related to user settings and function controls of the electronic device. In particular, the user input unit 807 includes a touch panel 8071 and other input devices 8072. Touch panel 8071, also referred to as a touch screen, may collect touch operations thereon or thereabout by a user (e.g., operations of the user on touch panel 8071 or thereabout using any suitable object or accessory such as a finger, stylus, etc.). The touch panel 8071 may include two parts, a touch detection device and a touch controller. The touch detection device detects the touch azimuth of a user, detects a signal brought by touch operation and transmits the signal to the touch controller; the touch controller receives touch information from the touch detection device, converts it into touch point coordinates, sends the touch point coordinates to the processor 810, and receives and executes commands sent from the processor 810. In addition, the touch panel 8071 may be implemented in various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch panel 8071, the user input unit 807 can include other input devices 8072. In particular, other input devices 8072 may include, but are not limited to, physical keyboards, function keys (e.g., volume control keys, switch keys, etc.), trackballs, mice, joysticks, and so forth, which are not described in detail herein.

Further, the touch panel 8071 may be overlaid on the display panel 8061, and when the touch panel 8071 detects a touch operation thereon or thereabout, the touch operation is transmitted to the processor 810 to determine a type of touch event, and then the processor 810 provides a corresponding visual output on the display panel 8061 according to the type of touch event. Although in fig. 8, the touch panel 8071 and the display panel 8061 are two independent components for implementing the input and output functions of the electronic device, in some embodiments, the touch panel 8071 and the display panel 8061 may be integrated to implement the input and output functions of the electronic device, which is not limited herein.

The interface unit 808 is an interface to which an external device is connected to the electronic apparatus 800. For example, the external devices may include a wired or wireless headset port, an external power (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device having an identification module, an audio input/output (I/O) port, a video I/O port, an earphone port, and the like. The interface unit 808 may be used to receive input (e.g., data information, power, etc.) from an external device and transmit the received input to one or more elements within the electronic apparatus 800 or may be used to transmit data between the electronic apparatus 800 and an external device.

The memory 809 can be used to store software programs as well as various data. The memory 809 may mainly include a storage program area that may store an operating system, application programs required for at least one function (such as a sound playing function, an image playing function, etc.), and a storage data area; the storage data area may store data (such as audio data, phonebook, etc.) created according to the use of the handset, etc. In addition, the memory 809 may include high speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device.

The processor 810 is a control center of the electronic device, connects various parts of the entire electronic device using various interfaces and lines, and performs various functions of the electronic device and processes data by running or executing software programs and/or modules stored in the memory 809, and invoking data stored in the memory 809, thereby performing overall monitoring of the electronic device. The processor 810 may include one or more processing units; preferably, the processor 810 may integrate an application processor that primarily handles operating systems, user interfaces, applications, etc., with a modem processor that primarily handles wireless communications. It will be appreciated that the modem processor described above may not be integrated into the processor 810.

The electronic device 800 may also include a power supply 811 (e.g., a battery) for powering the various components, and the power supply 811 may preferably be logically coupled to the processor 810 through a power management system that provides for managing charge, discharge, and power consumption.

Preferably, the embodiment of the present invention further provides an electronic device, including a processor 810, a memory 809, and a computer program stored in the memory 809 and capable of running on the processor 810, where the computer program when executed by the processor 810 implements each process of the foregoing embodiment of the data processing method, and the same technical effects are achieved, and for avoiding repetition, a detailed description is omitted herein.

Example five

The embodiment of the invention also provides a computer readable storage medium, on which a computer program is stored, which when executed by a processor, implements the respective processes of the above-mentioned data processing method embodiment, and can achieve the same technical effects, and in order to avoid repetition, the description is omitted here. Wherein the computer readable storage medium is selected from Read-only memory (ROM), random access memory (RandomAccess Memory, RAM), magnetic disk or optical disk.

The embodiment of the invention provides a computer readable storage medium, which is used for acquiring behavior data of a communication number and attribute information of the communication number, wherein the communication number comprises a first communication number with a risk tag and a second communication signal code for newly opening an account in a preset time, constructing a number risk knowledge graph based on the attribute information and the behavior data of the communication number, wherein the number risk knowledge graph comprises an association relationship between an entity node corresponding to the communication number and an entity node corresponding to the behavior data, determining risk probability of the second communication signal code based on the number risk knowledge graph and the attribute information of the entity node corresponding to the communication number in the number risk knowledge graph, and judging whether a channel corresponding to the second communication signal code has risk or not based on the risk probability. Therefore, the risk probability of the second communication number which is newly opened in the preset time can be determined based on the constructed number risk knowledge graph, so that whether the channel corresponding to the second communication number is at risk or not is determined, the channel is not required to be monitored manually, the risk monitoring efficiency of the channel is improved, the monitoring cost is reduced, and meanwhile, the communication risk problem caused by the risk monitoring hysteresis is avoided.

It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

In one typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

The memory may include volatile memory in a computer-readable medium, random Access Memory (RAM) and/or nonvolatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of computer-readable media.

Computer readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of storage media for a computer include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium, which can be used to store information that can be accessed by a computing device. According to the definitions herein, the computer-readable medium does not include a transitory computer-readable medium (transmission medium), such as a modulated data signal and carrier wave.

It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article or apparatus that comprises the element.

The foregoing is merely exemplary of the present invention and is not intended to limit the present invention. Various modifications and variations of the present invention will be apparent to those skilled in the art. Any modification, equivalent replacement, improvement, etc. which come within the spirit and principles of the invention are to be included in the scope of the claims of the present invention.

Claims

1. A method of data processing, the method comprising:

judging whether a target channel corresponding to the second communication signal code has risk or not based on the risk probability;

the determining the risk probability of the second communication number based on the number risk knowledge graph and the attribute information of the entity node corresponding to the communication number in the number risk knowledge graph includes:

determining risk probability of the second communication number based on the risk label of the entity node with the connection relation with the entity node corresponding to the second communication signal code, which is determined by the number risk knowledge graph;

based on the risk probability, judging whether the target channel corresponding to the second communication signal code has risk or not, including:

And judging whether the target channel has risks or not based on the number of the second communication numbers, of which the risk probability is larger than a preset probability threshold, in the second communication numbers corresponding to the target channel.

2. The method of claim 1, wherein determining the risk probability of the second communication number based on the number risk knowledge graph and attribute information of the entity node corresponding to the communication number in the number risk knowledge graph comprises:

selecting data to be processed corresponding to a preset number risk index from the attribute information of the communication number;

vectorizing the data to be processed to obtain a risk vector of the communication number;

and determining the risk probability of the second communication number based on the number risk knowledge graph and the risk vector of the entity node corresponding to the communication number in the number risk knowledge graph.

3. The method according to claim 2, wherein determining the risk probability of the second communication number based on the number risk knowledge graph and the risk vector of the entity node corresponding to the communication number in the number risk knowledge graph comprises:

determining a second entity node connected with a first entity node based on an association relationship between entity nodes corresponding to the communication numbers in the number risk knowledge graph, wherein the first entity node is any entity node in the number risk knowledge graph and comprises the entity node corresponding to the first communication number and/or the entity node corresponding to the second communication signal code;

4. A method according to claim 3, wherein the determining the risk probability distribution of the first entity node based on a preset label propagation algorithm, the label value of the second entity node, and the probability transfer matrix of the first entity node comprises:

5. The method according to claim 4, wherein the method further comprises:

if the target risk probability distribution does not meet the preset convergence rule, detecting whether an entity node corresponding to the first communication number exists in the second entity node;

if the second entity node exists the entity node corresponding to the first communication number, determining the entity node corresponding to the first communication number in the second entity node as a target entity node;

Determining a risk probability matrix of the first entity node based on a target risk probability distribution of the first entity node;

setting a probability value corresponding to the target entity node in a risk probability matrix of the first entity node as an initial probability value;

and determining the set risk probability matrix of the first entity node as a probability transfer matrix of the first entity node.

6. The method of claim 1, wherein the determining whether the target channel corresponding to the second communication signal code has a risk based on the risk probability comprises:

determining a risk number contained in the second communication number based on the risk probability;

determining the number of the risk numbers corresponding to the target channels based on a pre-established communication knowledge graph, wherein the communication knowledge graph is formed by entity nodes corresponding to the communication numbers, entity nodes determined by first channels corresponding to the communication numbers, association relations between entity nodes determined by corresponding relations between the communication numbers and the first channels, and association relations between entity nodes determined by the behavior data;

And judging whether the target channel has risks or not based on the number of the risk numbers corresponding to the target channel.

7. The method of claim 6, wherein the determining whether the target channel is at risk based on the number of risk numbers corresponding to the target channel comprises:

8. A data processing apparatus, the apparatus comprising:

the risk judging module is used for judging whether the target channel corresponding to the second communication signal code has risk or not based on the risk probability;

wherein, the probability determination module is used for:

the risk judging module is used for:

9. An electronic device comprising a processor, a memory and a computer program stored on the memory and executable on the processor, which when executed by the processor implements the steps of the data processing method according to any one of claims 1 to 7.

10. A computer-readable storage medium, on which a computer program is stored, which computer program, when being executed by a processor, implements the steps of the data processing method according to any of claims 1 to 7.