CN114218397A

CN114218397A - Transaction relation map processing method and device, computer equipment and storage medium

Info

Publication number: CN114218397A
Application number: CN202111498680.0A
Authority: CN
Inventors: 梁永健; 覃鹏; 李辉; 龚苇; 禤栋雄
Original assignee: CCB Finetech Co Ltd
Current assignee: CCB Finetech Co Ltd
Priority date: 2021-12-09
Filing date: 2021-12-09
Publication date: 2022-03-22

Abstract

The application relates to a transaction relationship map processing method, a transaction relationship map processing device, a computer device, a storage medium and a computer program product, wherein the method comprises the following steps: performing map structure matching on the target transaction relation map and the plurality of reference abnormal maps, and determining a plurality of sub-map maps matched with the plurality of reference abnormal maps; determining a first similarity and a second similarity of each sub-map and a reference abnormal map; determining the third similarity of each sub-map and the original abnormal map; and performing abnormal user mining processing on the target transaction relation image according to the first similarity, the second similarity and the third similarity corresponding to each sub-graph spectrum. The transaction relation map processing method provided by the application can provide more reliable mining information for financial practitioners by processing the transaction relation map, so that the financial practitioners can quickly and accurately mine abnormal users according to the processed transaction relation map, and the auxiliary effect on the financial practitioners is improved.

Description

Transaction relation map processing method and device, computer equipment and storage medium

Technical Field

The present application relates to the field of big data processing technologies, and in particular, to a transaction relationship graph processing method, an apparatus, a computer device, a storage medium, and a computer program product.

Background

With the rapid development of digital technology in financial business, financial products are increasingly updated, and financial services are increasingly diversified. The traditional financial industry is also continuously shifted to the online, which is followed by the continuous update of financial violation behaviors, and the pursuit of the abnormal object for the benefit is also seamless. In order to combat the anomaly, financial practitioners need to analyze mass data to identify and locate the anomalous users from the mass data, thereby ensuring the safety of the financial transaction environment and the economic benefits of the wide range of users.

At present, when a financial practitioner analyzes mass data to determine an abnormal user, the abnormal user is usually determined based on a transaction relationship map of financial transactions, but the transaction relationship map of financial transactions is derived from transaction relationships of multiple users, so that the transaction relationships in the transaction relationship map are complex, and it is difficult to quickly and accurately determine the abnormal user through the transaction relationship map.

Disclosure of Invention

The application provides a transaction relation map processing method, a transaction relation map processing device, computer equipment, a storage medium and a computer program product, which can reduce the complexity of the transaction relation map, provide more reliable abnormal user identification data for financial practitioners, and assist the financial practitioners in quickly and accurately identifying abnormal users.

The first aspect of the present application provides a transaction relationship map processing method, including:

performing map structure matching on the target transaction relation map and the plurality of reference abnormal maps, and determining a plurality of sub-map maps matched with the plurality of reference abnormal maps; the transaction relation graph is used for representing transaction relations among a plurality of transaction objects, and the reference abnormal graph is used for representing transaction relations among a plurality of abnormal objects;

determining a first similarity and a second similarity of each sub-map and a reference abnormal map; the first similarity is used for representing the similarity degree of the graph structure of the sub-graph and the graph structure of the reference abnormal graph, and the second similarity is used for representing the similarity degree of the semantic information of the sub-graph and the semantic information of the reference abnormal graph;

determining the third similarity of each sub-map and the original abnormal map; the third similarity is used for representing the similarity degree of the knowledge graph information of the sub-graph and the knowledge graph information of the original abnormal graph;

and performing abnormal user mining processing on the target transaction relation image according to the first similarity, the second similarity and the third similarity corresponding to each sub-graph spectrum.

A second aspect of the application provides a trusted payment device, the device comprising:

the matching determination module is used for performing map structure matching on the target transaction relation map and the plurality of reference abnormal maps and determining a plurality of sub-map maps matched with the plurality of reference abnormal maps; the transaction relation graph is used for representing transaction relations among a plurality of transaction objects, and the reference abnormal graph is used for representing transaction relations among a plurality of abnormal objects;

the first determining module is used for determining the first similarity and the second similarity of each sub-map and the reference abnormal map; the first similarity is used for representing the similarity degree of the graph structure of the sub-graph and the graph structure of the reference abnormal graph, and the second similarity is used for representing the similarity degree of the semantic information of the sub-graph and the semantic information of the reference abnormal graph;

the second determining module is used for determining the third similarity of each sub-map and the original abnormal map; the third similarity is used for representing the similarity degree of the knowledge graph information of the sub-graph and the knowledge graph information of the original abnormal graph;

and the processing module is used for performing abnormal user mining processing on the target transaction relation image according to the first similarity, the second similarity and the third similarity corresponding to each sub-graph spectrum.

A third aspect of the application provides a computer device comprising a memory storing a computer program and a processor implementing the steps of the method of any one of the above when the processor executes the computer program:

a fourth aspect of the present application provides a computer readable storage medium having stored thereon a computer program which, when executed by a processor, performs the steps of the method of any one of the above.

A fifth aspect of the application provides a computer program product comprising a computer program which, when executed by a processor, performs the steps of the method of any one of the above.

The application provides a transaction relationship map processing method, a transaction relationship map processing device, a computer device, a storage medium and a computer program product, wherein the method comprises the following steps: performing map structure matching on the target transaction relation map and the plurality of reference abnormal maps, and determining a plurality of sub-map maps matched with the plurality of reference abnormal maps; the transaction relation graph is used for representing transaction relations among a plurality of transaction objects, and the reference abnormal graph is used for representing transaction relations among a plurality of abnormal objects; determining a first similarity and a second similarity of each sub-map and a reference abnormal map; the first similarity is used for representing the similarity degree of the graph structure of the sub-graph and the graph structure of the reference abnormal graph, and the second similarity is used for representing the similarity degree of the semantic information of the sub-graph and the semantic information of the reference abnormal graph; determining the third similarity of each sub-map and the original abnormal map; the third similarity is used for representing the similarity degree of the knowledge graph information of the sub-graph and the knowledge graph information of the original abnormal graph; and performing abnormal user mining processing on the target transaction relation image according to the first similarity, the second similarity and the third similarity corresponding to each sub-graph spectrum. According to the transaction relation map processing method, the transaction relation map and the abnormal map are compared from the map structure similarity dimension, the map semantic information similarity dimension and the knowledge map information dimension, and compared with the prior art, the comparison of the multi-dimensional similarity is only carried out through the comparison of the single-dimensional similarity, so that the obtained comparison result is more accurate; and the similarity comparison of the knowledge graph dimensions is added, the knowledge graph can reflect the graph information more comprehensively, the provided comparison information is deeper, and the accuracy of the comparison result is further increased, so that the transaction relationship graph obtained after the transaction relationship graph is processed by the method provided by the application can provide more reliable mining information for financial practitioners, so that the financial practitioners can quickly and accurately mine abnormal users according to the processed transaction relationship graph, and the auxiliary effect on the financial practitioners is improved.

Drawings

FIG. 1 is a diagram of an application environment of a transaction relationship graph processing method in one embodiment;

FIG. 2 is a schematic flow chart diagram of a transaction relationship graph processing method in another embodiment;

FIG. 3(a) is a graph of the effect of an atlas match;

FIG. 3(b) is a diagram showing the effect of another pattern matching;

FIG. 3(c) is a graph of the effect of another pattern matching;

FIG. 4 is a schematic flow chart diagram of a transaction relationship graph processing method in another embodiment;

FIG. 5 is a graph showing an effect of forming a reconstructed map;

FIG. 6 is a flow chart illustrating a transaction relationship graph processing method according to another embodiment;

FIG. 7 is a schematic flow chart diagram illustrating a transaction relationship graph processing method according to another embodiment;

FIG. 8 is an effect diagram of rearranging historical exception transaction relationship maps to obtain a plurality of original exception maps;

FIG. 9 is a schematic flow chart diagram illustrating a transaction relationship graph processing method according to another embodiment;

FIG. 10 is a graph showing the effect of obtaining a sub-map;

FIG. 11 is a block diagram of a transaction relationship map processing apparatus in one embodiment;

FIG. 12 is a diagram illustrating an internal structure of a computer device according to an embodiment.

Detailed Description

In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application.

The transaction relationship graph processing method provided by the embodiment of the application can be applied to the application environment shown in fig. 1. Wherein the terminal 102 communicates with the server 104 via a network. The data storage system may store data that the trust server 104 needs to process. The data storage system may be integrated on the server 104, or may be located on the cloud or other network server. The financial practitioner inputs a target transaction relation map to the server 104 through the terminal 102, the server 104 matches the target transaction map with a plurality of reference abnormal maps, screens out a plurality of sub-maps matched with the map structure of the reference abnormal maps from the target transaction map, then respectively calculates the sub-maps and the reference abnormal maps, as well as the map structure similarity, the semantic information similarity and the knowledge map information similarity of the sub-maps and the original abnormal maps, and finally carries out abnormal user mining processing on the target transaction relation map according to the plurality of similarities of each sub-map. The obtained comparison result is more accurate; and the similarity comparison of the knowledge graph dimensions is added, the knowledge graph can reflect the graph information more comprehensively, the provided comparison information is deeper, and the accuracy of the comparison result is further increased, so that the transaction relationship graph obtained after the transaction relationship graph is processed by the method provided by the application can provide more reliable mining information for financial practitioners, so that the financial practitioners can quickly and accurately mine abnormal users according to the processed transaction relationship graph, and the auxiliary effect on the financial practitioners is improved. The terminal 102 may be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, and the like. The server 104 may be implemented as a stand-alone server or as a server cluster comprised of multiple servers.

In one embodiment, as shown in fig. 2, a transaction relationship graph processing method is provided, which is described by taking the method as an example applied to the server in fig. 1, and includes the following steps:

step S202, performing graph structure matching on the target transaction relation graph and a plurality of reference abnormal graphs, and determining a plurality of sub-graph graphs matched with the plurality of reference abnormal graphs; the transaction relationship graph is used for representing transaction relationships among a plurality of transaction objects, and the reference abnormal graph is used for representing transaction relationships among a plurality of abnormal objects.

The target transaction relationship map may be obtained from a historical transaction database by a financial practitioner, or may be received from another server or terminal. The processing server provided by the present application may be a server specially configured by a financial institution for processing the transaction relationship map, or may be a common server, which may be used by all financial institutions and is communicated with all financial institutions to receive processing requests sent by different financial institutions, which is not limited in this application.

The target transaction relationship map is a transaction relationship map which is required to be processed by a financial institution so that a financial practitioner can perform abnormal user transaction, the transaction relationship map is established by taking transaction objects as nodes and taking transaction relationships among the transaction objects as node connection bases, and therefore the target transaction relationship map comprises a plurality of transaction objects and transaction relationships among the transaction objects. The target transaction relationship map may be a transaction relationship map of all transaction objects in a preset time period of the financial institution, may be divided by regions of the financial institution, and may be divided by transaction terminals of a certain region in a time period, and may also be a transaction relationship map of more transaction objects in a time period from a certain transaction terminal, which is not limited in this application.

The target trading relationship map may be obtained by the steps of: firstly, a server of a financial institution extracts information of all transaction objects in a certain time period (which can be information of names, codes, transaction account numbers and the like of the transaction objects) from a corresponding memory address according to requirements, then sorts the transaction objects according to time sequence (which can be sorted from far to near according to the time of the first transaction of the transaction objects, and the application is not limited), and further, obtains all transaction information of the corresponding transaction objects from the memory address according to the sequence based on the sorting of all transaction objects (the transaction information comprises objects transacted with the transaction objects, the times of transaction, specific information of the transaction, the time of the transaction and the like); finally, arranging each object according to the transaction relationship according to the arrangement method of the maps (generally arranging the objects into a tree shape), and generating a large map based on the maps of all the transaction objects after finishing the arrangement of the maps corresponding to all the transaction objects (a large transaction relationship map is obtained by connecting a plurality of small transaction relationship maps by adopting a Hash connection method, and the application is not limited), wherein the large map is the target transaction relationship map. The server of the financial institution can also be provided with a model specially establishing the transaction relationship map, and only all transaction objects needing to establish the transaction relationship map and the relationship of the transaction objects are required to be input into the model to obtain the target transaction relationship map. The present application is not limited thereto, and the above description is only illustrative.

The reference abnormal map is a transaction relation map obtained by the server of the financial institution according to the abnormal users and transaction relations of the abnormal users identified by history, and transaction objects in the reference abnormal map are all abnormal users marked by the server of the financial institution (the abnormal users can be users who have performed financial transactions prohibited by the financial institution). The reference abnormal map is obtained in a similar manner to the target transaction relationship map, except that when the server of the financial institution obtains the reference abnormal map, the obtained data are both the abnormal users identified by history and the transaction relationship data of the abnormal users, and then the reference abnormal map may be obtained based on the above manner, which is not limited in this application.

It should be noted that the reference abnormal graph is obtained according to a huge historical abnormal user and a corresponding transaction relationship, so that the application can provide a rich comparison object for the target transaction relationship graph. And the abnormal users and the corresponding transaction relations obtained by continuous recognition are added into a database of the reference abnormal map by the reference abnormal map, so that an abnormal map database for comparison is further enriched.

The graph structure matching representation matches the target transaction relation graph with the graph structures of the plurality of reference abnormal graphs, judges whether the graph structure of a transaction object in the target transaction relation graph is similar to or identical to the graph structure of the reference abnormal graph, if so, the server of the financial institution can preliminarily determine that the transaction object is possibly an abnormal user, and if not, the server of the financial institution can determine that the abnormal user does not exist in the target transaction relation graph, so that the similarity calculation step is not needed, and the comparison efficiency can be improved. Further, if the server of the financial institution determines that the graph structure in the target transaction relation graph is similar to or the same as the graph structure of the reference abnormal graph, the part of the graph with the similar or the same structure as the reference abnormal graph is divided to be used as a sub-graph, so that the sub-graph can participate in the similarity calculation process with the reference abnormal graph through the sub-graph. It should be noted that, a plurality of sub-graph graphs may not necessarily obtain the target transaction relationship graph through reduction, because there is a graph in the target transaction relationship graph that does not match with the graph structure of the reference abnormal graph.

The results of the atlas structure matching include: the atlas structures are the same, the atlas structures are similar, and the atlas structures are different. Illustratively, as shown in FIG. 3(a), the atlas representing the two atlases is identical in structure; illustratively, as shown in FIG. 3(b), the atlas structures representing the two atlases are similar; as shown in FIG. 3(c), the atlas structures representing the two atlases are not the same.

Step S204, determining a first similarity and a second similarity of each sub-map and a reference abnormal map; the first similarity is used for representing the similarity degree of the graph structure of the sub-graph and the graph structure of the reference abnormal graph, and the second similarity is used for representing the similarity degree of the semantic information of the sub-graph and the semantic information of the reference abnormal graph.

And after the target transaction relation maps are subjected to map structure matching with the plurality of reference abnormal maps based on the above, the preliminary screening of the target transaction relation maps is realized. Namely, a huge target transaction relationship map is divided into a plurality of sub-maps with simpler transaction relationships than the target transaction relationship map, so that the similarity calculation process is performed through the sub-maps and the reference abnormal map. Because the transaction relation of the sub-maps is simple, the similarity calculation between the sub-maps and the reference abnormal map can be more accurate, the calculation process is simpler, and meanwhile, the similarity calculation result can be quickly obtained. When similarity calculation is performed, only the similarity between the sub-graph spectrum and the reference graph spectrum, which have similar graph structures or are the same, is calculated.

The target transaction relation map is divided to obtain a plurality of sub-maps, the sub-maps and the reference maps can be converted into matrixes, and the first similarity of the two matrixes is calculated according to a similarity calculation formula based on a graph structure. Between the similarity calculation according to the two matrices, the similarity calculation may be performed after the two matrices are respectively subjected to iterative operations. Illustratively, the calculation can be made by the following formula:

SSimX＝{x₁(k)，x₂(k)，...x_i(k)}

SSimY＝{y₁(k)，y₂(k)，...y_i(k)}

wherein the SSimX represents a node similarity score matrix in the sub-map and the reference map; a similarity scoring matrix of edges in the SSimY sub-map and the reference map; x is the number of_i(k) Represents the sub-graph spectrum after K iterations andthe similarity of each node in the reference map; y is_i(k) And representing the similarity of each edge in the sub-graph spectrum and the reference graph after K iterations. Each transaction object in the sub-graph is a node, each abnormal user in the reference graph is a node, and the edges represent the connection line of the transaction relationship between the two nodes.

Estimating by averaging the similarity of the elements of the sub-map and reference map matrices, the formula is as follows:

n_iexpression map (sub-map n)₁And reference map n₂) The number of middle nodes; m is_iExpression map (sub-map m)₁And reference map m₂) The number of middle edges.

The target transaction relationship graph is divided to obtain a plurality of sub-graphs, and the second similarity of the two matrixes can be calculated according to a similarity calculation formula based on statistical semantic information. Illustratively, the calculation can be made by the following formula:

wherein p (e)_i|G₂) Representation map G₂Statistical language model of (atlas to be matched) can generate word e_iProbability of using e_iGenerating probabilities p (e) in a plurality of triplet models_i|f_j) Is expressed by the average value of (1), n and m are respectively reference spectra G₁And the atlas G to be matched₂The number of median subgraphs.

Step S206, determining a third similarity of each sub-map and the original abnormal map; and the third similarity is used for representing the similarity degree of the knowledge graph information of the sub-graph and the knowledge graph information of the original abnormal graph.

The target transaction relationship graph is divided into a plurality of sub-graph graphs, and the plurality of sub-graph graphs are input into a preset classifier to obtain a third similarity. The classifier is, for example, an SVDD classifier, which can obtain a spherical boundary around data in a vector space extracted from a knowledge map, so that the volume of the hypersphere is minimized, and thus the influence of outliers can be minimized, and the calculation formula is as follows:

wherein a is the center of the hypersphere, R represents the radius of the hypersphere, C is the penalty coefficient, and delta_iN is the number of points to be matched.

Here, it should be noted that the plurality of reference abnormal patterns are selected from a plurality of original abnormal patterns, and have abnormal patterns with similar or identical pattern structures to the sub-pattern patterns in the target trading relation pattern.

And S208, performing abnormal user mining processing on the target transaction relationship map according to the first similarity, the second similarity and the third similarity corresponding to each sub-map.

According to the above calculation steps, the first similarity, the second similarity and the third similarity of each sub-map to the reference abnormal map with similar or identical structure to the reference abnormal map are obtained, the minimum similarity of the three similarities may be used as the final similarity of the sub-map to the abnormal map, the maximum similarity of the three similarities may be used as the final similarity of the sub-map to the abnormal map, the sum of the three similarities may be used as the final similarity of the sub-map to the abnormal map, and the like, which is not limited in the present application. Different financial institutions may have different ways of determining. Determining the similarity between each sub-map and the abnormal map, determining whether the corresponding sub-map is a target sub-map based on a similarity threshold set by a financial institution, and finally determining a plurality of obtained target sub-maps, wherein the plurality of target sub-maps can be the result of mining abnormal users of the target transaction relationship map; the target transaction relationship graph may be obtained by combining a plurality of sub-graph graphs, and the obtained graph is used as a result of performing abnormal user mining on the target transaction relationship graph. The financial practitioner may identify the abnormal user according to the mining result of the abnormal user mining on the target transaction relationship map by the method. Due to the fact that the transaction relationship similarity between the transaction object in the processed map and the abnormal user is high, the method can assist financial practitioners in identifying the abnormal user quickly and accurately, and screening efficiency of the financial practitioners on the abnormal user is improved.

The transaction relationship map processing method provided by the application comprises the following steps: performing map structure matching on the target transaction relation map and the plurality of reference abnormal maps, and determining a plurality of sub-map maps matched with the plurality of reference abnormal maps; the transaction relation graph is used for representing transaction relations among a plurality of transaction objects, and the reference abnormal graph is used for representing transaction relations among a plurality of abnormal objects; determining a first similarity and a second similarity of each sub-map and a reference abnormal map; the first similarity is used for representing the similarity degree of the graph structure of the sub-graph and the graph structure of the reference abnormal graph, and the second similarity is used for representing the similarity degree of the semantic information of the sub-graph and the semantic information of the reference abnormal graph; determining the third similarity of each sub-map and the original abnormal map; the third similarity is used for representing the similarity degree of the knowledge graph information of the sub-graph and the knowledge graph information of the original abnormal graph; and performing abnormal user mining processing on the target transaction relation image according to the first similarity, the second similarity and the third similarity corresponding to each sub-graph spectrum. According to the transaction relation map processing method, the transaction relation map and the abnormal map are compared from the map structure similarity dimension, the map semantic information similarity dimension and the knowledge map information dimension, and compared with the prior art, the comparison of the multi-dimensional similarity is only carried out through the comparison of the single-dimensional similarity, so that the obtained comparison result is more accurate; and the similarity comparison of the knowledge graph dimensions is added, the knowledge graph can reflect the graph information more comprehensively, the provided comparison information is deeper, and the accuracy of the comparison result is further increased, so that the transaction relationship graph obtained after the transaction relationship graph is processed by the method provided by the application can provide more reliable mining information for financial practitioners, so that the financial practitioners can quickly and accurately mine abnormal users according to the processed transaction relationship graph, and the auxiliary effect on the financial practitioners is improved.

In an embodiment, the present embodiment is an optional method embodiment for obtaining the third similarity, and the method embodiment includes:

inputting the sub-maps into a preset classifier to obtain a third similarity of each sub-map and the original abnormal map; the classifier is obtained by performing single-classification learning on a plurality of original abnormal maps according to the knowledge map.

When the third similarity between the sub-map and the original abnormal map is calculated, the sub-map is input into a preset classifier, and the third similarity between the sub-map and the original abnormal map is determined through the recognition of the classifier. The classifier is obtained by performing single-class learning on the original abnormal map according to the knowledge map, so that the third similarity is determined by the similarity between the sub-map and the original abnormal map from the dimensionality of the knowledge map information. The plurality of original abnormal maps may be generated by the server of the financial institution according to the historical abnormal users and the corresponding transaction relationships stored in the memory, and the generation method is described above and will not be described herein.

In an embodiment, as shown in fig. 4, this embodiment is an optional method embodiment for performing exception user mining processing on a target transaction relationship image according to similarity, and the method embodiment includes the following steps:

step S402, performing weighting calculation according to the first similarity, the second similarity, the third similarity and a preset similarity weight corresponding to each sub-graph spectrum to obtain a reference similarity corresponding to each sub-graph spectrum; if the reference similarity corresponding to the sub-graph spectrum is greater than a first threshold, executing step S404; if the reference similarity corresponding to the sub-graph spectrum is less than or equal to the first threshold, executing step S406;

step S404, determining the sub-map as a target sub-map;

step S406, discarding the sub-map.

The first similarity, the second similarity and the third similarity corresponding to a plurality of sub-graph spectrums of the target transaction relationship graph are obtained through the steps, the server of the financial institution can preset weights for the first similarity, the second similarity and the third similarity, then the weighting summation of the corresponding weights is carried out through the first similarity, the second similarity and the third similarity to obtain the reference similarity of each sub-graph spectrum, the reference similarity characterizes the similarity of the sub-graph and the abnormal graph, the larger the reference similarity is, the more similar the sub-graph and the abnormal graph is, and the larger the probability of abnormal users existing in the sub-graph spectrum is. Exemplary first, second, and third similarities may be weighted 0.1:0.3: 0.6; then, after the reference similarity of the sub-map is obtained through calculation, the server of the financial institution may compare the reference similarity with a preset first threshold, and based on the principle that the greater the reference similarity, the more similar the sub-map and the abnormal map are, the greater the probability that the abnormal user exists in the sub-map is further indicated, the more the reference similarity is greater than the first threshold, the greater the probability that the abnormal user exists in the sub-map is, the sub-map is determined to be the target sub-map, which indicates that the sub-map can be used as a basis for mining the abnormal user by a subsequent financial practitioner. Further, if the reference similarity of the sub-map is less than or equal to a first threshold preset by a server of the financial institution, it indicates that the probability of the abnormal user existing in the sub-map is very small, and then the transaction object in the sub-map can be removed from the list of suspected abnormal users, and is not used as a basis for mining the abnormal user by a subsequent financial practitioner. It should be noted that the preset similarity weight may be determined by the financial institution according to the historical similarity data. The first threshold may also be determined by the financial institution based on historical similarity data.

Step S408, generating a reconstruction map based on all the target sub-map spectrums obtained in the step S404, and if the information entropy of the reconstruction map is larger than a second threshold, executing the step S410; if the information entropy of the reconstructed map is less than or equal to the second threshold, executing step S412;

step S410, performing abnormal user mining processing on the target transaction relation image according to the reconstructed map;

step S412, adjusting the preset similarity weight according to a preset adjustment rule; and updating the reference similarity corresponding to the sub-maps according to the first similarity score, the second similarity score, the third similarity score and the adjusted preset similarity weight of each sub-map.

The sub-maps are screened based on the steps to obtain a plurality of target sub-maps, the target sub-maps can be connected by using Hash connection to obtain a complete reconstruction map as far as possible, and therefore, a financial practitioner can conveniently mine abnormal users. After the reconstructed map is generated, the reconstructed map needs to be verified by calculating the information entropy of the reconstructed map. The calculation of the information entropy may be determined by an evaluation model or the like, which is not limited in this application. Illustratively, as shown in fig. 5, a plurality of target sub-maps are connected to form a reconstructed map.

Then, when verifying the reconstructed map, two results can be obtained: the information entropy of the reconstructed map is larger than a second threshold value, and the information entropy of the reconstructed map is smaller than or equal to the second threshold value, wherein the information entropy of the reconstructed map is larger than the second threshold value, so that the accuracy of mining the abnormal user of the reconstructed map obtained through the steps is high, and the reconstructed map can be output to assist a financial practitioner in mining the abnormal user quickly and accurately. The information entropy of the reconstructed map is smaller than or equal to the second threshold value, and the reconstructed map obtained through the steps is used for mining the abnormal user with low accuracy, and the method cannot well assist financial practitioners in fast and accurate mining of the abnormal user. Then, the server of the financial institution may adjust the initially used preset similarity weight according to a greedy algorithm and the like so as to re-determine the plurality of target sub-maps, generate a new reconstructed map according to the new target sub-map, and further verify the information entropy of the new reconstructed map until a reconstructed map with the information entropy larger than a second threshold is obtained, and the server of the financial institution may output the reconstructed map.

According to the transaction relation atlas processing method, the target sub-atlases are determined from the plurality of sub-atlases by setting the corresponding threshold values, the plurality of sub-atlases are screened to obtain the plurality of target sub-atlases, the plurality of target sub-atlases are connected to obtain the reconstruction atlas, a financial practitioner can conveniently mine an abnormal user according to the reconstruction atlas, meanwhile, a process of verifying the reconstruction atlas is added before outputting the reconstruction atlas, and the output atlas is further guaranteed to provide reliable data support for the financial practitioner to mine the abnormal user.

In an embodiment, as shown in fig. 6, fig. 6 is an alternative embodiment of the method for determining an original abnormal graph in this embodiment, where the method embodiment includes the following steps:

step S602, a plurality of historical abnormal trading relation maps are obtained, and the historical abnormal trading relation maps represent multidimensional trading relations among a plurality of abnormal objects.

The plurality of historical abnormal transaction relationship maps may be obtained by the server of the financial institution from the corresponding storage address, and the obtaining manner of the historical abnormal transaction relationship maps is described above and is not described herein again. It should be noted here that, if the multi-dimensional abnormal transaction relationships (i.e., node connection relationships of a multi-tree structure) shown in the historical abnormal transaction relationship graph are compared, the workload is very large, and the comparison accuracy is low.

Step S604, rearranging the plurality of historical abnormal transaction relation maps according to a preset topological sorting rule to obtain a plurality of original abnormal maps.

Based on the defects of the multi-dimensional abnormal transaction relationship maps in the comparison process, the server of the financial institution can rearrange the historical abnormal transaction relationship maps to obtain a plurality of original abnormal maps representing single transaction relationships among a plurality of abnormal objects before comparing the target transaction relationship maps.

Alternatively, as shown in fig. 7, the original abnormal map may be obtained by the following method:

step S702, sequentially selecting any one target abnormal object with zero in-degree from the historical abnormal relationship graph as a root node and selecting a plurality of other abnormal objects as subtrees, where the other abnormal objects are abnormal objects in the historical abnormal relationship graph, except the target abnormal object, which have a transaction relationship with the target abnormal object.

Step S704, an original abnormal graph is constructed according to the root node and the plurality of subtrees.

Wherein, the topology ranking can be performed on the abnormal user relationship graph through a kahn algorithm: selecting a plurality of abnormal objects with zero degree of income (representing that a certain abnormal object is an arc head and the number of arcs ending at a node of the abnormal object is zero, namely the abnormal object only has external transaction and has no transaction of other abnormal objects to the abnormal object) from a historical abnormal relation graph as root nodes in sequence, then randomly selecting a target abnormal object (node) with zero degree of income as the root node, then determining all abnormal objects with transaction relation with the target abnormal object from the historical abnormal relation graph as subtrees, and connecting the root nodes and the subtrees according to the connection relation of the transaction relation to obtain an original abnormal graph; then, aiming at the previous root node as the only transaction object with the degree of the previous root node being zero, randomly selecting a target abnormal object with the degree of the previous root node being zero as the root node from the historical abnormal relation map, then determining all abnormal objects with the target abnormal object as subtrees with the transaction relation from the historical abnormal relation map, connecting the root node and the subtrees according to the connection relation of the transaction relation, and obtaining an original abnormal map until no abnormal object with the degree of the previous root node being zero exists in the historical abnormal transaction relation map (namely, no predecessor node can be found).

Illustratively, as shown in fig. 8, Q is a graph of historical abnormal transaction relationships, where the nodes with zero in degree are: a. i, randomly selecting a as a root node, and the nodes having transaction relationship with a comprise: b. c, d, connecting a with b, c and d according to a transaction relationship to obtain an original abnormal map G1; then the node with zero in Q is: c. i, randomly selecting c as a root node, and the nodes having transaction relation with c comprise: h. e and f, connecting c with h, e and f according to a transaction relation to obtain an original abnormal map G2; then the node with zero in Q is: f. i, randomly selecting i as a root node, and then the nodes having transaction relation with i comprise: h. e, connecting the i, the h and the e according to a transaction relation to obtain an original abnormal map G3; then the nodes with zero in-degree in Q remain: and f, taking f as a root node, wherein the node having a transaction relationship with f comprises: j, connecting f and j according to the transaction relationship to obtain an original abnormal graph G4, and if no precursor node exists in the Q graph, completing the division of the historical abnormal transaction relationship graph, wherein the transaction relationship in Q is a multi-dimensional transaction relationship, and the transaction relationship in G1-G4 is a single transaction relationship.

According to the transaction relation map processing method, the historical abnormal transaction relation maps are rearranged according to the preset topological sorting rule, the transaction relation of each abnormal object in the historical abnormal transaction relation maps is simplified, more refined comparison can be conveniently carried out subsequently, and the comparison accuracy is improved.

In one embodiment, as shown in fig. 9, fig. 9 provides an alternative method embodiment for obtaining a plurality of reference anomaly maps for the present implementation, the method comprising:

step S902, transaction data of abnormal objects in a plurality of original abnormal maps are matched with transaction data of transaction objects in a target transaction relation map;

and step S904, screening the plurality of original abnormal maps according to the matching result to obtain a plurality of reference abnormal maps.

The method comprises the steps of processing a plurality of historical abnormal transaction relation maps to obtain a plurality of original abnormal maps, wherein the target transaction relation maps are not similar to the original abnormal maps, and if the target transaction relation maps are subjected to similarity calculation with the original abnormal maps, the complexity of calculation is increased, and meanwhile, the processing efficiency of the target transaction relation maps is reduced. Therefore, after a plurality of original abnormal maps are obtained, the target transaction relationship maps are matched with the original abnormal maps in map structures, part of maps of the target transaction relationship maps with similar or same structures are selected as sub-maps, the original abnormal maps with similar or same structures as the sub-maps are used as reference abnormal maps, the similarity of the sub-maps and the reference maps is calculated correspondingly, and the processing efficiency of the target transaction relationship maps is improved.

Illustratively, as shown in fig. 10, G1-G10 in fig. 10 are original abnormal maps, and after comparing with the target relationship map, reference abnormal maps G2, G4, G6, G7 and G8 with structures similar or identical to some structures in the target relationship map are obtained, and then structures identical to those of G2, G4, G6, G7 and G8 in the target trading relationship map are extracted as sub-maps.

According to the transaction relation map processing method, the reference abnormal map is screened from the original abnormal map by comparing the structures, the sub-maps are screened from the target transaction relation map, multiple purposes are achieved, the similarity between the sub-maps with the same or similar structures and the reference abnormal map is further calculated, the calculation process can be reduced, and the processing efficiency of the target transaction relation map is improved.

In one embodiment, the present embodiment is an alternative method embodiment of calculating entropy of information, and the method embodiment includes the following steps:

and inputting the reconstructed map into a preset evaluation model to obtain the information entropy of the target transaction relation map. The evaluation model calculation information entropy can be calculated by the following formula:

I(A，B)＝H(A)+H(B)-H(A，B)

wherein the content of the first and second substances,

wherein, P_A(a) Is the probability of occurrence of vector elements in the reconstructed map, P_B(a) Is the probability of the occurrence of vector elements in the original abnormal atlas, P_A，BAnd (a, b) is the probability of the occurrence of the two corresponding vector elements.

It should be understood that, although the steps in the flowcharts related to the embodiments as described above are sequentially displayed as indicated by arrows, the steps are not necessarily performed sequentially as indicated by the arrows. The steps are not performed in the exact order shown and described, and may be performed in other orders, unless explicitly stated otherwise. Moreover, at least a part of the steps in the flowcharts related to the embodiments described above may include multiple steps or multiple stages, which are not necessarily performed at the same time, but may be performed at different times, and the execution order of the steps or stages is not necessarily sequential, but may be rotated or alternated with other steps or at least a part of the steps or stages in other steps.

Based on the same inventive concept, the embodiment of the application also provides a transaction relationship map processing device for realizing the transaction relationship map processing method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the method, so that the specific limitations in one or more embodiments of the transaction relationship map processing device provided below may refer to the limitations on the transaction relationship map processing method in the above, and are not described herein again.

In one embodiment, as shown in fig. 11, there is provided a transaction relationship map processing apparatus 1000, including: a match determination module 1002, a first determination module 1004, a second determination module 1006, and a processing module 1008, wherein:

a matching determination module 1002, configured to perform map structure matching on the target transaction relationship map and the multiple reference exception maps, and determine multiple sub-map maps matched with the multiple reference exception maps; the transaction relation graph is used for representing transaction relations among a plurality of transaction objects, and the reference abnormal graph is used for representing transaction relations among a plurality of abnormal objects;

a first determining module 1004, configured to determine a first similarity and a second similarity between each sub-atlas and the reference abnormal atlas; the first similarity is used for representing the similarity degree of the graph structure of the sub-graph and the graph structure of the reference abnormal graph, and the second similarity is used for representing the similarity degree of the semantic information of the sub-graph and the semantic information of the reference abnormal graph;

a second determining module 1006, configured to determine a third similarity between each sub-map and the original abnormal map; the third similarity is used for representing the similarity degree of the knowledge graph information of the sub-graph and the knowledge graph information of the original abnormal graph;

the processing module 1008 is configured to perform abnormal user mining processing on the target transaction relationship image according to the first similarity, the second similarity, and the third similarity corresponding to each sub-graph spectrum.

In an embodiment, the second determining module 1006 is specifically configured to input the sub-maps into a preset classifier, so as to obtain a third similarity between each sub-map and the original abnormal map; the classifier is obtained by performing single-classification learning on a plurality of original abnormal maps according to the knowledge map. .

In an embodiment, the processing module 1008 is specifically configured to perform weighting calculation according to the first similarity, the second similarity, the third similarity and a preset similarity weight corresponding to each sub-graph spectrum, so as to obtain a reference similarity corresponding to each sub-graph spectrum; when the reference similarity corresponding to the sub-map is larger than a first threshold value, determining the sub-map as a target sub-map; and generating a reconstruction map based on all the target sub-map spectrums, and performing abnormal user mining processing on the target transaction relation image according to the reconstruction map when the information entropy of the reconstruction map is larger than a second threshold value.

In one embodiment, the above apparatus further comprises: the acquisition and arrangement module is used for acquiring a plurality of historical abnormal transaction relation maps, and the historical abnormal transaction relation maps represent multidimensional transaction relations among a plurality of abnormal objects; and rearranging the plurality of historical abnormal transaction relation maps according to a preset topological sorting rule to obtain a plurality of original abnormal maps.

In one embodiment, the above apparatus further comprises: the screening module is used for matching the transaction data of the abnormal objects in the original abnormal maps with the transaction data of the transaction objects in the target transaction relationship map; and screening the plurality of original abnormal maps according to the matching result to obtain a plurality of reference abnormal maps.

In an embodiment, the obtaining and arranging module is specifically configured to sequentially select, from the historical abnormal relationship graph, any one target abnormal object with an in-degree of zero as a root node and select a plurality of other abnormal objects as subtrees, where the other abnormal objects are abnormal objects in the historical abnormal relationship graph, except the target abnormal object, which have a trade relationship with the target abnormal object; and constructing an original abnormal graph according to the root node and the plurality of subtrees.

In one embodiment, the above apparatus further comprises: and the input module is used for inputting the reconstructed map into a preset evaluation model to obtain the information entropy of the target transaction relation map.

In one embodiment, the above apparatus further comprises: the adjustment updating module is used for adjusting the preset similarity weight according to a preset adjustment rule when the information entropy of the reconstructed map is less than or equal to a second threshold; and updating the reference similarity corresponding to the sub-maps according to the first similarity score, the second similarity score, the third similarity score and the adjusted preset similarity weight of each sub-map.

The modules in the transaction relationship map processing device can be wholly or partially realized by software, hardware and a combination thereof. The modules can be embedded in a hardware form or independent from a processor in the computer device, and can also be stored in a memory in the computer device in a software form, so that the processor can call and execute operations corresponding to the modules.

In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as shown in fig. 12. The computer device includes a processor, a memory, and a network interface connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The database of the computer device is used for storing transaction relationship map processing data. The network interface of the computer device is used for communicating with an external terminal through a network connection. The computer program is executed by a processor to implement a transaction relationship graph processing method.

Those skilled in the art will appreciate that the architecture shown in fig. 12 is merely a block diagram of some of the structures associated with the disclosed aspects and is not intended to limit the computing devices to which the disclosed aspects apply, as particular computing devices may include more or less components than those shown, or may combine certain components, or have a different arrangement of components.

In one embodiment, a computer device is provided, comprising a memory and a processor, the memory having a computer program stored therein, the processor implementing the following steps when executing the computer program:

In one embodiment, the processor, when executing the computer program, further performs the steps of: inputting the sub-maps into a preset classifier to obtain a third similarity of each sub-map and the original abnormal map; the classifier is obtained by performing single-classification learning on a plurality of original abnormal maps according to the knowledge map.

In one embodiment, the processor, when executing the computer program, further performs the steps of: performing weighting calculation according to the first similarity, the second similarity, the third similarity and a preset similarity weight corresponding to each sub-graph spectrum to obtain a reference similarity corresponding to each sub-graph spectrum; when the reference similarity corresponding to the sub-map is larger than a first threshold value, determining the sub-map as a target sub-map; and generating a reconstruction map based on all the target sub-map spectrums, and performing abnormal user mining processing on the target transaction relation image according to the reconstruction map when the information entropy of the reconstruction map is larger than a second threshold value.

In one embodiment, the processor, when executing the computer program, further performs the steps of: acquiring a plurality of historical abnormal transaction relation maps, wherein the historical abnormal transaction relation maps represent multidimensional transaction relations among a plurality of abnormal objects; and rearranging the plurality of historical abnormal transaction relation maps according to a preset topological sorting rule to obtain a plurality of original abnormal maps.

In one embodiment, the processor, when executing the computer program, further performs the steps of: matching transaction data of the abnormal objects in the original abnormal maps with transaction data of the transaction objects in the target transaction relation map; and screening the plurality of original abnormal maps according to the matching result to obtain a plurality of reference abnormal maps.

In one embodiment, the processor, when executing the computer program, further performs the steps of: sequentially selecting any one target abnormal object with zero in-degree from the historical abnormal relation graph as a root node and selecting a plurality of other abnormal objects as subtrees, wherein the other abnormal objects are abnormal objects which have transaction relations with the target abnormal object except the target abnormal object in the historical abnormal relation graph; and constructing an original abnormal graph according to the root node and the plurality of subtrees.

In one embodiment, the processor, when executing the computer program, further performs the steps of: and inputting the reconstructed map into a preset evaluation model to obtain the information entropy of the target transaction relation map.

In one embodiment, the processor, when executing the computer program, further performs the steps of: when the information entropy of the reconstructed map is less than or equal to a second threshold value, adjusting the preset similarity weight according to a preset adjustment rule; and updating the reference similarity corresponding to the sub-maps according to the first similarity score, the second similarity score, the third similarity score and the adjusted preset similarity weight of each sub-map.

In one embodiment, a computer-readable storage medium is provided, having a computer program stored thereon, which when executed by a processor, performs the steps of:

In one embodiment, the computer program when executed by the processor further performs the steps of: inputting the sub-maps into a preset classifier to obtain a third similarity of each sub-map and the original abnormal map; the classifier is obtained by performing single-classification learning on a plurality of original abnormal maps according to the knowledge map.

In one embodiment, the computer program when executed by the processor further performs the steps of: performing weighting calculation according to the first similarity, the second similarity, the third similarity and a preset similarity weight corresponding to each sub-graph spectrum to obtain a reference similarity corresponding to each sub-graph spectrum; when the reference similarity corresponding to the sub-map is larger than a first threshold value, determining the sub-map as a target sub-map; and generating a reconstruction map based on all the target sub-map spectrums, and performing abnormal user mining processing on the target transaction relation image according to the reconstruction map when the information entropy of the reconstruction map is larger than a second threshold value.

In one embodiment, the computer program when executed by the processor further performs the steps of: acquiring a plurality of historical abnormal transaction relation maps, wherein the historical abnormal transaction relation maps represent multidimensional transaction relations among a plurality of abnormal objects; and rearranging the plurality of historical abnormal transaction relation maps according to a preset topological sorting rule to obtain a plurality of original abnormal maps.

In one embodiment, the computer program when executed by the processor further performs the steps of: matching transaction data of the abnormal objects in the original abnormal maps with transaction data of the transaction objects in the target transaction relation map; and screening the plurality of original abnormal maps according to the matching result to obtain a plurality of reference abnormal maps.

In one embodiment, the computer program when executed by the processor further performs the steps of: sequentially selecting any one target abnormal object with zero in-degree from the historical abnormal relation graph as a root node and selecting a plurality of other abnormal objects as subtrees, wherein the other abnormal objects are abnormal objects which have transaction relations with the target abnormal object except the target abnormal object in the historical abnormal relation graph; and constructing an original abnormal graph according to the root node and the plurality of subtrees.

In one embodiment, the computer program when executed by the processor further performs the steps of: and inputting the reconstructed map into a preset evaluation model to obtain the information entropy of the target transaction relation map.

In one embodiment, the computer program when executed by the processor further performs the steps of: when the information entropy of the reconstructed map is less than or equal to a second threshold value, adjusting the preset similarity weight according to a preset adjustment rule; and updating the reference similarity corresponding to the sub-maps according to the first similarity score, the second similarity score, the third similarity score and the adjusted preset similarity weight of each sub-map.

In one embodiment, a computer program product is provided, comprising a computer program which, when executed by a processor, performs the steps of:

It should be noted that, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, presented data, etc.) referred to in the present application are information and data authorized by the user or sufficiently authorized by each party.

It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware instructions of a computer program, which can be stored in a non-volatile computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. Any reference to memory, database, or other medium used in the embodiments provided herein may include at least one of non-volatile and volatile memory. The nonvolatile Memory may include Read-Only Memory (ROM), magnetic tape, floppy disk, flash Memory, optical Memory, high-density embedded nonvolatile Memory, resistive Random Access Memory (ReRAM), Magnetic Random Access Memory (MRAM), Ferroelectric Random Access Memory (FRAM), Phase Change Memory (PCM), graphene Memory, and the like. Volatile Memory can include Random Access Memory (RAM), external cache Memory, and the like. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM), among others. The databases referred to in various embodiments provided herein may include at least one of relational and non-relational databases. The non-relational database may include, but is not limited to, a block chain based distributed database, and the like. The processors referred to in the embodiments provided herein may be general purpose processors, central processing units, graphics processors, digital signal processors, programmable logic devices, quantum computing based data processing logic devices, etc., without limitation.

The technical features of the above embodiments can be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the above embodiments are not described, but should be considered as the scope of the present specification as long as there is no contradiction between the combinations of the technical features.

The above-mentioned embodiments only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the present application. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present application shall be subject to the appended claims.

Claims

1. A transaction relationship graph processing method, the method comprising:

performing map structure matching on the target transaction relation map and a plurality of reference abnormal maps, and determining a plurality of sub-map maps matched with the plurality of reference abnormal maps; the transaction relation graph is used for representing transaction relations among a plurality of transaction objects, and the reference abnormal graph is used for representing transaction relations among a plurality of abnormal objects;

determining a first similarity and a second similarity of each sub-map and the reference abnormal map; the first similarity is used for representing the similarity degree of the graph structure of the sub-graph and the graph structure of the reference abnormal graph, and the second similarity is used for representing the similarity degree of the semantic information of the sub-graph and the semantic information of the reference abnormal graph;

determining a third similarity of each sub-map and the original abnormal map; the third similarity is used for representing the similarity degree of the knowledge graph information of the sub-graph and the knowledge graph information of the original abnormal graph;

and performing abnormal user mining processing on the target transaction relation map according to the first similarity, the second similarity and the third similarity corresponding to each sub-map.

2. The method of claim 1, wherein determining a third similarity of each of the sub-maps to the original anomaly map comprises:

inputting the sub-maps into a preset classifier to obtain a third similarity of each sub-map and the original abnormal map; the classifier is obtained by performing single-classification learning on the original abnormal maps according to the knowledge map.

3. The method according to claim 1, wherein the performing of abnormal user mining on the target transaction relationship image according to the first similarity, the second similarity and the third similarity corresponding to each sub-map comprises:

performing weighting calculation according to the first similarity, the second similarity, the third similarity and a preset similarity weight corresponding to each sub-map to obtain a reference similarity corresponding to each sub-map;

if the reference similarity corresponding to the sub-map is larger than a first threshold, determining the sub-map as a target sub-map;

and generating a reconstruction map based on all target sub-map spectrums, and if the information entropy of the reconstruction map is larger than a second threshold value, performing abnormal user mining processing on the target transaction relation image according to the reconstruction map.

4. The method of claim 2, wherein the original anomaly map is used to characterize a single trade relationship between a plurality of anomaly objects, the method further comprising:

acquiring a plurality of historical abnormal transaction relation maps, wherein the historical abnormal transaction relation maps represent multidimensional transaction relations among a plurality of abnormal objects;

and rearranging the plurality of historical abnormal transaction relation maps according to a preset topological sorting rule to obtain a plurality of original abnormal maps.

5. The method of claim 4, further comprising:

matching transaction data of abnormal objects in the original abnormal maps with transaction data of transaction objects in the target transaction relationship map;

and screening the plurality of original abnormal maps according to the matching result to obtain a plurality of reference abnormal maps.

6. The method according to claim 5, wherein the rearranging the plurality of historical exception transaction relationship maps according to a preset topological sorting rule to obtain a plurality of original exception maps comprises:

sequentially selecting any target abnormal object with zero in-degree from the historical abnormal relation graph as a root node and selecting a plurality of other abnormal objects as subtrees, wherein the other abnormal objects are abnormal objects which have a transaction relation with the target abnormal object except the target abnormal object in the historical abnormal relation graph;

and constructing the original abnormal graph according to the root node and the plurality of subtrees.

7. The method of claim 3, further comprising:

and inputting the reconstructed map into a preset evaluation model to obtain the information entropy of the target transaction relation map.

8. The method of claim 7, further comprising:

if the information entropy of the reconstructed map is smaller than or equal to the second threshold, adjusting the preset similarity weight according to a preset adjustment rule;

and updating the reference similarity corresponding to the sub-graph spectrum according to the first similarity score, the second similarity score, the third similarity score and the adjusted preset similarity weight of each sub-graph spectrum.

9. A transaction relationship map processing apparatus, the apparatus comprising:

the matching determination module is used for carrying out map structure matching on the target transaction relation map and the plurality of reference abnormal maps and determining a plurality of sub-map maps matched with the plurality of reference abnormal maps; the transaction relation graph is used for representing transaction relations among a plurality of transaction objects, and the reference abnormal graph is used for representing transaction relations among a plurality of abnormal objects;

and the processing module is used for performing abnormal user mining processing on the target transaction relation image according to the first similarity, the second similarity and the third similarity corresponding to each sub-map.

10. The apparatus of claim 9,

the second determining module is specifically configured to input the sub-maps into a preset classifier, so as to obtain a third similarity between each sub-map and the original abnormal map; the classifier is obtained by performing single-classification learning on the original abnormal maps according to the knowledge map.

11. The apparatus of claim 9,

the processing module is specifically configured to perform weighting calculation according to the first similarity, the second similarity, the third similarity and a preset similarity weight corresponding to each sub-spectrum to obtain a reference similarity corresponding to each sub-spectrum; when the reference similarity corresponding to the sub-map is larger than a first threshold value, determining the sub-map as a target sub-map; and generating a reconstruction map based on all target sub-map spectrums, and performing abnormal user mining processing on the target transaction relation image according to the reconstruction map when the information entropy of the reconstruction map is larger than a second threshold value.

12. The apparatus of claim 9, further comprising:

the acquisition and arrangement module is used for acquiring a plurality of historical abnormal transaction relation maps, and the historical abnormal transaction relation maps represent multidimensional transaction relations among a plurality of abnormal objects; and rearranging the plurality of historical abnormal transaction relation maps according to a preset topological sorting rule to obtain a plurality of original abnormal maps.

13. The apparatus of claim 12, further comprising:

the screening module is used for matching transaction data of the abnormal objects in the original abnormal maps with transaction data of the transaction objects in the target transaction relation map; and screening the plurality of original abnormal maps according to the matching result to obtain a plurality of reference abnormal maps.

14. The apparatus of claim 12,

the obtaining and arranging module is specifically configured to sequentially select, from the historical abnormal relationship graph, any one target abnormal object with an in-degree of zero as a root node and select a plurality of other abnormal objects as subtrees, where the other abnormal objects are abnormal objects in the historical abnormal relationship graph, except the target abnormal object, which have a trade relationship with the target abnormal object; and constructing the original abnormal graph according to the root node and the plurality of subtrees.

15. The apparatus of claim 9, further comprising:

and the input module is used for inputting the reconstruction map into a preset evaluation model to obtain the information entropy of the target transaction relation map.

16. The apparatus of claim 9, further comprising:

the adjustment updating module is used for adjusting the preset similarity weight according to a preset adjustment rule when the information entropy of the reconstructed map is smaller than or equal to the second threshold; and updating the reference similarity corresponding to the sub-graph spectrum according to the first similarity score, the second similarity score, the third similarity score and the adjusted preset similarity weight of each sub-graph spectrum.

17. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor, when executing the computer program, implements the steps of the method of any of claims 1 to 8.

18. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the method of any one of claims 1 to 8.

19. A computer program product comprising a computer program, characterized in that the computer program realizes the steps of the method of any one of claims 1 to 8 when executed by a processor.