CN115049397A

CN115049397A - Method and device for identifying risk account in social network

Info

Publication number: CN115049397A
Application number: CN202110257066.9A
Authority: CN
Inventors: 张小�
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2021-03-09
Filing date: 2021-03-09
Publication date: 2022-09-13

Abstract

The embodiment of the application discloses a method and a device for identifying a risk account in a social network, electronic equipment and a computer-readable storage medium. The method comprises the following steps: taking accounts in a social network as nodes, fusing various incidence relations among the accounts to construct edges among the nodes, and generating an account relation network graph structure corresponding to the social network; extracting depth feature representation of each account according to the neighbor node feature information of the account in the account relationship network graph structure and the account feature information of the account; predicting the risk probability of each account by combining the depth characteristic representation of the account and the account characteristic information; and identifying a risk account in the social network according to the predicted risk probability. According to the embodiment of the application, the quantity and the depth of the feature information used in the account risk probability prediction process are greatly improved, and the recognition effect of the risk account can be improved.

Description

Method and device for identifying risk account in social network

Technical Field

The application relates to the technical field of data processing, in particular to a method and device for identifying a risk account in a social network, electronic equipment and a computer-readable storage medium.

Background

At present, in order to identify a risk account existing in a social network, a classification algorithm model is mainly trained by constructing a corresponding label training data set, and a risk probability of the account is predicted according to feature information of the account through the trained classification algorithm model, wherein the greater the risk probability is, the greater the possibility that the account is a risk account is. However, this identification method is not suitable for actual risk scenarios, such as application scenarios for identifying accounts participating in gambling in social networks, and it is difficult to identify accounts participating in gambling with the above risk account identification method.

Disclosure of Invention

In order to solve the technical problem, embodiments of the present application provide a method and an apparatus for identifying a risk account in a social network, an electronic device, and a computer-readable storage medium.

According to an aspect of an embodiment of the present application, there is provided a method for identifying a risk account in a social network, including: taking accounts in a social network as nodes, fusing various incidence relations among the accounts to construct edges among the nodes, and generating an account relation network graph structure corresponding to the social network; extracting depth feature representation of each account according to the neighbor node feature information of the account in the account relationship network graph structure and the account feature information of the account; predicting the risk probability of each account by combining the depth characteristic representation of the account and the account characteristic information; and identifying a risk account in the social network according to the predicted risk probability.

According to an aspect of the embodiments of the present application, there is provided an apparatus for identifying a risk account in a social network, including: the network graph structure generating module is configured to take the accounts in the social network as nodes, fuse various incidence relations among the accounts to construct edges among the nodes, and generate an account relation network graph structure corresponding to the social network; the depth feature extraction module is configured to extract depth feature representation of each account according to neighbor node feature information of the account in the account relationship network graph structure and account feature information of the account; the risk probability prediction module is configured to predict the risk probability of each account by combining the depth characteristic representation of the account and the account characteristic information; and the account risk identification module is configured to identify a risk account in the social network according to the predicted risk probability.

According to an aspect of the embodiments of the present application, there is provided an electronic device including a processor and a memory, the memory having stored thereon computer-readable instructions, which when executed by the processor, implement the method of identifying a risk account in a social network as described above.

According to an aspect of embodiments herein, there is provided a computer-readable storage medium having stored thereon computer-readable instructions, which, when executed by a processor of a computer, cause the computer to perform the method of identifying a risk account in a social network as described above.

According to an aspect of an embodiment of the present application, there is provided a computer program product or a computer program comprising computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions to cause the computer device to perform the method for identifying a risk account in a social network provided in the various alternative embodiments described above.

In the technical scheme provided by the embodiment of the application, an account relation network graph structure is constructed by fusing multiple incidence relations among accounts, the depth characteristic representation of each account is extracted according to the neighbor node characteristic information of the accounts in the account relation network graph structure and the account characteristic information of the accounts, and finally the risk probability of the accounts is predicted by combining the depth characteristic representation of the accounts and the account characteristic information, so that the quantity and the depth of the characteristic information used in the account risk probability prediction process are greatly improved, the adaptation degree of a risk identification method is improved, and the identification effect of the risk accounts can be improved.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the application.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and together with the description, serve to explain the principles of the application. It is obvious that the drawings in the following description are only some embodiments of the application, and that for a person skilled in the art, other drawings can be derived from them without inventive effort. In the drawings:

FIG. 1 is a schematic illustration of an implementation environment to which the present application relates;

FIG. 2 is a flow diagram illustrating a method of identifying risk accounts in a social network according to an embodiment of the present application;

FIG. 3 is a diagram illustrating a distribution of neighboring nodes according to an embodiment of the present application;

FIG. 4 is a flow chart of step S110 in the embodiment shown in FIG. 2 in an exemplary embodiment;

FIG. 5 is a depiction of step S113 in the embodiment depicted in FIG. 4 in an exemplary embodiment;

fig. 6 is a schematic diagram illustrating a heterogeneous information fusion process characterized by a first association weight according to an embodiment of the application;

fig. 7 is a schematic diagram illustrating a heterogeneous information fusion process characterized by a second association weight according to an embodiment of the present application;

FIG. 8 is a flowchart of step S130 in the embodiment shown in FIG. 2 in an exemplary embodiment;

FIG. 9 is a flowchart overview of a risk account identification scheme shown in an exemplary embodiment of the present application;

FIG. 10 is a block diagram of an apparatus that identifies risk accounts in a social network, shown in an exemplary embodiment of the present application;

FIG. 11 illustrates a schematic structural diagram of a computer system suitable for use to implement the electronic device of the embodiments of the subject application.

Detailed Description

Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. The following description refers to the accompanying drawings in which the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the application, as detailed in the appended claims.

The block diagrams shown in the figures are functional entities only and do not necessarily correspond to physically separate entities. I.e. these functional entities may be implemented in the form of software, or in one or more hardware modules or integrated circuits, or in different networks and/or processor means and/or microcontroller means.

The flow charts shown in the drawings are merely illustrative and do not necessarily include all of the contents and operations/steps, nor do they necessarily have to be performed in the order described. For example, some operations/steps may be decomposed, and some operations/steps may be combined or partially combined, so that the actual execution sequence may be changed according to the actual situation.

It should also be noted that: reference to "a plurality" in this application means two or more. "and/or" describe the association relationship of the associated objects, meaning that there may be three relationships, e.g., A and/or B may mean: a exists alone, A and B exist simultaneously, and B exists alone. The character "/" generally indicates that the former and latter associated objects are in an "or" relationship.

Artificial Intelligence (AI) is a theory, method, technique and application system that uses a digital computer or a machine controlled by a digital computer to simulate, extend and expand human Intelligence, perceive the environment, acquire knowledge and use the knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technique of computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can react in a manner similar to human intelligence. Artificial intelligence is the research of the design principle and the implementation method of various intelligent machines, so that the machines have the functions of perception, reasoning and decision making.

The artificial intelligence technology is a comprehensive subject, and relates to the field of extensive technology, namely the technology of a hardware level and the technology of a software level. The artificial intelligence base technologies generally include technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technologies, operation/interaction systems, mechatronics, and the like. The artificial intelligence software technology mainly comprises a computer vision technology, a voice processing technology, a natural language processing technology, machine learning/deep learning and the like.

Machine Learning (ML) is a multi-domain cross discipline, and relates to a plurality of disciplines such as probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and the like. The special research on how a computer simulates or realizes the learning behavior of human beings so as to acquire new knowledge or skills and reorganize the existing knowledge structure to continuously improve the performance of the computer. Machine learning is the core of artificial intelligence, is the fundamental approach for computers to have intelligence, and is applied to all fields of artificial intelligence. Machine learning and deep learning generally include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and teaching learning.

The method and the apparatus for identifying a risk account in a social network, the electronic device, and the computer-readable storage medium provided by the embodiments of the present application will be described below based on an artificial intelligence technology and a machine learning technology.

Referring to fig. 1, fig. 1 is a schematic diagram of an implementation environment related to the present application. The embodiment environment comprises a social server 20 and a plurality of user terminals 10, and communication is performed between the user terminals 10 and the social server 20 through a wired or wireless network.

The user terminal 10 is operated by a social client, and the social server 20 provides data support for the operation of the social client, for example, instant messaging can be performed between different social clients based on the social server 20, so that a social network is formed. Different users exist in the social network in different account forms, and an account is also a user identifier used by the user in the social network.

In order to identify risk accounts in the social network, for example, to identify accounts participating in gambling, the social server 20 is loaded with a program for identifying risk accounts in the social network, constructs an account relationship network graph structure according to various association relations between the accounts in the social network and accounts, extracts depth feature representations of the accounts according to neighbor node feature information of the accounts in the account relationship network graph structure and account feature information of the accounts, and predicts risk probabilities of the accounts in combination with the depth feature representations of the accounts and the account feature information to identify the risk accounts in the social network according to the predicted risk probabilities, thereby identifying the risk accounts in the social network.

For the identified risk account, certain measures can be taken to fight against the risk account, such as logging off the risk account, limiting each transaction fund of the risk account to be below a small value, limiting the daily transaction times of the risk account, and the like. The attack measures taken for the risk account can be determined according to the actual application scene, and the attack measures are not limited in the process, so that a healthy and safe network social environment can be created.

It should be noted that, in the implementation environment shown in fig. 1, the user terminal 10 may be an electronic device such as a smart phone, a tablet, a notebook, a computer, or the like; the social server 20 may be an independent physical server, or a server cluster or a distributed system formed by a plurality of physical servers, where the plurality of physical servers may form a block chain, and the servers are nodes on the block chain; the social server 20 may also be a cloud server providing basic cloud computing services such as cloud services, a cloud database, cloud computing, cloud storage, web services, cloud communication, middleware services, domain name services, security services, a CDN (Content Delivery Network), a big data and artificial intelligence platform, and the like, which is not limited herein.

Fig. 2 is a flow diagram illustrating a method of identifying risk accounts in a social network according to an embodiment of the present application. The method may be applied to the implementation environment shown in fig. 1, and is specifically executed by the social server 20 or the user terminal 10 in the embodiment environment shown in fig. 1, for example. In other implementation environments, the method may be specifically executed by other electronic devices, and the embodiment is not limited thereto.

As shown in fig. 2, in an exemplary embodiment, the method may include steps S110 to S170, which are described in detail as follows:

step S110, taking the accounts in the social network as nodes, fusing various incidence relations among the accounts to construct edges among the nodes, and generating an account relation network graph structure corresponding to the social network.

It should be noted that, in the first place, a social network refers to a social network service, and in a broad sense, a social network includes hardware, software, services and applications, and is generally understood as a social relationship network structure composed of a plurality of nodes, where a node generally refers to an individual or an organization, and the nodes are connected in series through social relationships among the nodes.

In this embodiment, an account relationship network graph structure corresponding to a social network is constructed, which aims to represent connections between different accounts in the social network in a mesh graph form, and further extract deep feature information of the accounts in the social network through the connections between the accounts represented by the mesh graph. The deep feature information contains richer account feature information than the account feature information. The account characteristic information includes account behavior information, attribute tag information and the like, the account behavior information may include information related to account transaction behavior, operation behavior and the like, and the attribute tag information may include attribute information such as age, gender and the like of the account. The risk condition of the account is predicted by combining the extracted depth characteristic information and the extracted account characteristic information subsequently, so that the characteristic information based on the identification process of the risk account is richer than that in the prior art, a risk account identification scheme with higher fitness than that in the prior art is obtained, and the identification effect of the risk account can be improved.

In this embodiment, accounts in the social network are used as nodes in the account relationship network graph structure, and edges between the nodes are constructed by fusing multiple association relationships between the accounts. The account in the social network is also a user identifier used by the user in the social network, and the user in the social network may be an individual or an organization.

By collecting and analyzing account data of the accounts in multiple dimensions, the association relationship between the accounts can be obtained. For example, social operations performed between accounts may cause an association between the accounts, for example, if account a transfers a fund to account B, it may be determined that account a and account B have an association; the registration process of the account may also generate an association relationship between the accounts, for example, the account a and the account B are registered based on the same mobile phone number, and the account a and the account B have an association relationship therebetween; the transaction process of the account may also generate an association relationship between the accounts, for example, account a and account B have performed fund transactions on the same device, and account a and account B also have an association relationship; the information associated with the accounts may also generate an association relationship between the accounts, for example, account a and account B are associated with the same certificate number, and account a and account B have an association relationship, which is not listed here.

In this embodiment, there may be a plurality of ways of constructing an edge between nodes by fusing a plurality of association relationships between accounts, for example, if any two nodes have at least one of the plurality of association relationships, an edge may be formed between the two nodes; an edge can also be formed between any two nodes, an association weight is generated according to various association relations between the two corresponding nodes, and the generated association weight is given to the corresponding edge, so that the association degree between two node accounts connected by the edge is represented by the association weight corresponding to each edge. In an actual application scenario, a manner of constructing edges between nodes may be selected according to specific requirements, which is not limited in this embodiment.

Based on the constructed account relationship network graph structure, the method is very convenient for obtaining the association information among the accounts in the social network and is also convenient for obtaining the deep feature representation of each account based on the association information.

Step S130, extracting the depth feature representation of each account according to the neighbor node feature information of the account in the account relationship network graph structure and the account feature information of the account.

In this embodiment, the neighbor nodes of the account in the account relationship network graph structure may include nodes having direct association with the account, that is, edges between the neighbor nodes and the nodes representing the current account, and may further include nodes having indirect association with the account, where the nodes having indirect association have edges with the aforementioned nodes having direct association. For example, in the neighbor node distribution diagram corresponding to the account E shown in fig. 3, there are multiple neighbor nodes in the node corresponding to the account E, and the neighbor nodes have direct or indirect association with the node corresponding to the account E.

The neighbor node characteristic information includes not only the account characteristic information of each neighbor node but also an association relationship between the neighbor node and a node as a center and an association relationship between the neighbor nodes. As shown in fig. 3, edges also exist between neighboring nodes corresponding to the account E, so that the neighboring node feature information includes an association relationship between these neighboring nodes.

In the embodiment, the depth feature representation of each account is extracted according to the neighbor node feature information of the account in the account relationship network graph structure and the account feature information of the account, so that the obtained depth feature representation not only contains the account feature information of the account, but also integrates the account feature information of the neighbor node and the incidence relation between the neighbor node and the account, and the feature depth of each node account is greatly improved.

And S150, predicting the risk probability of each account by combining the depth characteristic representation of the account and the account characteristic information.

In this embodiment, the risk probability of each account is predicted by combining the depth feature representation of the account and the account feature information, for example, the depth feature and the account feature information of the account are used as the features to be processed, and the feature classification processing is performed on the features to be processed to obtain the risk probability of the corresponding account. The predicted risk probability is used to characterize the likelihood that the corresponding account is a risk account, e.g. in a risk scenario where an account in a social network is likely to participate in a wager, the higher the resulting risk probability, the greater the likelihood that the corresponding account will participate in the wager.

In this embodiment, the feature classification processing on the feature to be processed may be implemented by a classification algorithm model, which may include LightGBM |, LR (Logistic Regression), SoftMax and other models, and may be selected according to specific requirements.

And step S170, identifying a risk account in the social network according to the predicted risk probability.

Risk profile for an account the user describes whether the account is a risk account. As mentioned above, the predicted risk probability is used to characterize the possibility that the corresponding account is a risk account, if the obtained risk probability is greater than the risk threshold, the corresponding account may be identified as a risk account, and the account with the risk probability less than the risk threshold is correspondingly a non-risk account. The risk threshold is used to characterize the corresponding risk boundary and may be preset.

Or, in order to further improve the identification accuracy of the risk accounts, the risk accounts may be determined by combining risk scenes in the social network, where the risk scenes in the social network are application scenes corresponding to the method of the embodiment, and may include, for example, risk scenes in which the accounts in the social network may participate in illegal activities such as gambling and money laundering, and the method of the embodiment is used to identify the risk accounts, that is, the risk accounts may be hit accurately, so as to achieve a good internet social environment.

Specifically, for each account in the social network, if it is determined that the risk probability of the account is greater than the risk threshold, key features corresponding to describing risk scenarios in the social network are obtained, for example, in a risk scenario of identifying participation in gambling, the key features may include that the fund transaction time is night, the proportion of each fund transaction amount greater than the specified amount should be greater than a preset threshold proportion, and the like. These key features can be determined in conjunction with specific risk scenarios, with the important idea being to take further risk constraints to determine whether an account is a risk account. If it is determined that accounts with a risk probability greater than a risk threshold meet the key features, then the accounts are identified as risk accounts.

It can be seen that, in the embodiment, the risk account in the social network is identified by extracting the depth feature information of the account in the social network, predicting the risk probability of the account by combining the extracted depth feature information and the account feature information, and combining the predicted risk probability and the key feature corresponding to the risk scene, compared with a scheme of predicting the risk probability of the account only by aiming at the account feature information in the prior art, the risk account identification scheme provided in the embodiment has richer feature information in the identification process of the risk account, so that a risk account identification scheme with higher adaptability compared with the prior art is obtained, and the identification effect of the risk account can be improved.

Fig. 4 is a flow chart of step S110 in the embodiment shown in fig. 2 in an exemplary embodiment. In the embodiment shown in fig. 4, the multiple association relationships between the accounts include a fund relationship and a non-fund relationship, the fund relationship refers to a fund traffic situation between the accounts, and the non-fund relationship refers to an association situation existing between the accounts based on non-fund information, for example, whether two accounts are registered using the same mobile phone number, whether two accounts perform a fund transaction on the same device, and the like.

Therefore, the risk account identification scheme provided by the embodiment has a good identification effect on the account related to the risk of fund transaction in the risk scene related to the fund transaction safety of the account, for example, in the scene of identifying whether the account participates in illegal behaviors such as gambling, money laundering and the like, the risk account identification scheme provided by the embodiment can effectively identify the risk account.

As shown in fig. 4, in an exemplary embodiment, accounts in a social network are taken as nodes, and multiple association relations between the accounts are fused to construct edges between the nodes, so as to generate an account relation network graph structure corresponding to the social network, which may include steps S111 to S115, and the following details are introduced as follows:

and step S111, taking the account in the social network as a node, and generating an edge between any two nodes.

Considering that in an actual fund transaction scenario, there are many ways of measuring account association, even if there is no fund transaction behavior between different accounts, some illegal entities may utilize accounts under multiple certificates or devices and go to do malicious activities under multiple risk scenarios, and simply relying on the fund relationship easily causes that some two accounts with weak association degree are difficult to find, so that the finally constructed account relationship network diagram structure cannot very accurately describe the account association state in the social network, thereby affecting the subsequent account depth feature extraction and the prediction of account risk probability.

In order to avoid this problem, in this embodiment, after the accounts in the social network are used as nodes, edges between any two nodes are generated, and then, depending on the fund relationship and the non-fund relationship between the accounts corresponding to any two nodes, an association weight is given to the generated corresponding edge, so as to represent the relationship affinity between the two node accounts connected by the edge through the association weight, thereby making the finally obtained account relationship network graph structure conform to the account association state in the social network.

Step S113, determining the association weight between any two nodes according to the fund relationship and the non-fund relationship between accounts corresponding to any two nodes.

The fund relationship and the non-fund relationship between two accounts are also referred to as heterogeneous information, and if an account relationship network graph structure is respectively constructed for each kind of heterogeneous information, and the deep feature representation of each account is extracted for different account relationship network graph structures, the account relationship network graph structures are often somewhat redundant.

The fund relationship between the two accounts comprises one or more fund relationship types, when only one fund relationship type is contained, the association weight between any two nodes is also one, and the association weight is determined by the fund relationship type and the non-fund relationship; when the fund relationship type is multiple, the association weight between any two nodes is correspondingly multiple, and the multiple association weights are obtained according to different fund relationship types between any two nodes.

And step S115, adding the association weight as annotation information to the generated edge to form an account relationship network diagram structure.

In this embodiment, the association weights are added to the generated edges as the labeling information, so that the formed account relationship network graph structure contains the relationship affinity between two accounts connected to each edge, and in the subsequent process of extracting the depth feature information, the depth features of the accounts are obtained based on the association weights, so that the account depth features contain more comprehensive account information.

When any two nodes have multiple association weights, a corresponding account relationship network graph structure can be generated according to the association weights obtained between any two nodes according to the same fund relationship type, so that multiple account relationship network graph structures corresponding to the social network can be obtained. That is, in the obtained network graph structure of each account relationship, the association weight marked on each edge should be obtained based on the same fund relationship type.

Or, the sum of multiple association weights may also be calculated, and the calculation result is added to the generated edge as the labeling information, so as to generate an account relationship network graph structure corresponding to the social network based on fusion of multiple association weights between any two nodes. That is to say, even if there are multiple fund relationship types between any two accounts, only one account relationship network graph structure is finally obtained, and the association weight marked on each edge in the account relationship network graph structure is the sum of the association weights obtained according to the different fund relationship types between the corresponding two nodes, which is equivalent to the fusion of different account relationship network graph structures.

It should be further noted that, if it is determined that the association weight between two nodes is zero, an edge between the two nodes may be deleted, so that the finally generated account relationship network graph structure is simpler and more accurate.

Therefore, the method provided by the embodiment realizes isomorphism of the heterogeneous association information, and by marking the corresponding association weight on each edge in the account relationship network graph structure, a more accurate account relationship network graph structure can be established, so as to provide a basic condition for the accuracy of the depth feature information of each account extracted subsequently.

Fig. 5 is a description of step S113 in the embodiment shown in fig. 4 in an exemplary embodiment. As shown in fig. 5, determining the association weight between any two nodes according to the fund relationship and the non-fund relationship between the accounts corresponding to any two nodes may include steps S1131 to S1133, which are described in detail as follows:

step S1131, transaction opponent information and transaction fund information associated with any two nodes are obtained according to the fund relationship between accounts corresponding to any two nodes.

The embodiment describes that the fund relationship between accounts corresponding to any two nodes includes two fund relationship types, namely, transaction-opponent information and transaction fund information, where the transaction-opponent information is account information having a fund relationship with an account, for example, an account a has a fund relationship with an account B and an account C, and the account B and the account C both serve as transaction opponents of the account a; the transaction fund information refers to the specific fund transaction amount.

Step S1133, a first association weight between any two nodes is determined according to the information of the transaction opponents associated with any two nodes and the non-fund relationship between any two nodes, and a second association weight between any two nodes is determined according to the information of the transaction fund associated with any two nodes and the non-fund relationship between any two nodes.

For the first association weight between any two nodes, the number of common counterparties between the two nodes and the sum of the number of counterparties of all the nodes in the two nodes can be determined according to the counterparty information associated with the two nodes, the ratio of the number of common counterparties to the obtained sum is calculated, then the assignment corresponding to the non-fund relationship between the two nodes is determined, and the obtained ratio and the assignment are weighted and operated to obtain the first association weight between the two nodes.

The above process of obtaining the first association weight between any two nodes can be represented by the following formula:

any two nodes are corresponding nodes of an account A and an account B, w (A, B) represents a first association weight between the two nodes, N (A) n (B) represents the number of common counterparties between the account A and the account B, N (A) + N (B) represents the sum of the number of counterparties between the account A and the account B, D (A, B) represents corresponding assignment when a non-fund relationship comprises an account fund transaction device relationship, P (A, B) represents corresponding assignment when the non-fund relationship comprises a certificate number associated with the account, and I (A, B) represents corresponding assignment when the non-fund relationship comprises a mobile phone number used when the account is registered. The assignment conditions corresponding to the above various types of non-capital relationships are as follows:

wherein, device (a) represents a device for carrying out fund transaction on account a, device (B) represents a device for carrying out fund transaction on account B, phone (a) represents a mobile phone number used by account a when the account a is registered, phone (B) represents a mobile phone number used by account B when the account B is registered, idcard (a) represents a certificate number associated with account a, and idcard (B) represents a certificate number associated with account B.

The calculation process can be abstracted to the process shown in fig. 6, the calculated first association weight integrates transaction counterparty information between the two accounts, equipment for performing fund transaction, associated certificate, mobile phone number and other heterogeneous information, and the relationship network integration mainly based on the common transaction counterparty information between the two accounts is realized.

For the second association weight between any two nodes, the fund transaction total amount between any two nodes and the sum of the fund transaction total amounts of all the nodes can be determined according to fund transaction information associated with the two nodes, the ratio of the fund transaction total amount to the sum of the fund transaction total amounts of all the nodes is calculated, then assignment corresponding to non-fund relation between the two nodes is determined, and weighting and operation are performed on the obtained ratio and the assignment to obtain the first association weight between the two nodes.

The above process of obtaining the second association weight between any two nodes can be represented by the following formula:

wherein, W (A, B) represents a second association weight between the nodes corresponding to the account A and the account B, M (A) and m (B) represent the sum of the fund transaction amount between the account A and the account B, and D (A, B), P (A, B) and I (A, B) are calculated by the same process as the first association weight.

The calculation process can be abstracted to the process shown in fig. 7, the calculated first association weight integrates transaction fund information between the two accounts, equipment for performing fund transaction, associated certificates, mobile phone numbers and other heterogeneous information, and the relationship network integration mainly based on the current fund information between the two accounts is realized.

In this embodiment, a calculation process of an association weight between any two nodes is described based on a fund relationship between accounts corresponding to any two nodes, including two fund relationship types, namely, transaction opponent information and transaction fund information, and this calculation process can be generalized to a case where a fund relationship between accounts corresponding to any two nodes includes other fund relationship types, so as to obtain a plurality of association weights between any two nodes.

As described above, after obtaining a plurality of association weights between any two nodes, different account relationship network graph structures may be generated respectively, or one account relationship network graph structure may be generated based on fusion of the plurality of association weights, and may be selected according to actual requirements.

Fig. 8 is a flowchart of step S130 in the embodiment shown in fig. 2 in an exemplary embodiment. As shown in fig. 8, extracting the deep feature representation of each account according to the neighbor node feature information of the account in the account relationship network graph structure and the account feature information of the account may include steps S131 to S135, which are described in detail as follows:

step S131, according to the account characteristic information corresponding to each node in the account relationship network graph structure, generating an account characteristic graph corresponding to the account relationship network graph structure.

In this embodiment, the account feature map corresponding to the generated account relationship network map structure is an account feature map structure formed by arranging the account feature information of all accounts according to the association relationship between the accounts.

Step S133, performing feature aggregation processing on the account feature graph to obtain an aggregated feature graph corresponding to the account relationship network graph structure, where the aggregated feature graph includes aggregated feature representations corresponding to each node, and the aggregated feature representations aggregate neighbor node feature information of corresponding nodes.

In this embodiment, feature aggregation processing is performed on an account feature graph corresponding to an account relationship network graph structure, so as to aggregate neighbor node feature information of each node with account feature information of each node to obtain an aggregate feature representation of each node, thereby forming an aggregate feature graph including aggregate feature representations of all nodes.

In some embodiments, the aggregated feature map corresponding to the account relationship network map structure may be obtained by generating an adjacency matrix corresponding to the account feature map and performing graph convolution processing on the adjacency matrix. The generated adjacency matrix includes feature vectors of all nodes and Graph connection relations among the nodes, the Graph connection relations among the nodes include association weights marked on edges among the nodes, and Graph convolution processing for the adjacency matrix can be realized through a GCN (Graph neural Network) model. The graph convolution processing performed in this embodiment is full-graph convolution processing performed on the account feature graph, and node information can be fully utilized in the convolution process, and feature information of neighbor nodes is also fully utilized, so that a better feature aggregation effect is achieved.

In other embodiments, considering that it is difficult to implement the graph volume processing procedure in the foregoing embodiments in a social network that has a large-scale account node and a fast update speed of the account node, such as "WeChat", the embodiment performs the feature aggregation processing on the account feature graph in another manner, specifically including the following processes:

sampling a specified number of neighbor nodes aiming at each node in the account characteristic diagram to obtain a neighbor node set corresponding to each node; and aggregating the neighbor node characteristic information corresponding to the neighbor node set to the corresponding nodes to form an aggregation characteristic corresponding to each node in the account relation network graph structure so as to obtain an aggregation characteristic graph.

As also shown in fig. 3, the neighboring nodes sampled by the node corresponding to the account E include all nodes with black padding, and the depth feature representation extracted by the node corresponding to the account E is information that aggregates the relevant feature information and the associated weight of these neighboring nodes.

It can be seen that, in the embodiment, instead of directly convolving the whole account feature graph, the neighbor node set obtained by randomly sampling the neighbor nodes of each node is used as a sub-graph, and feature aggregation is performed on the sub-graph, so that the calculation pressure is greatly reduced, and the memory pressure of the electronic device executing the method of the embodiment is also reduced.

The embodiment can acquire the aggregation function obtained by training, perform aggregation operation on the neighbor node feature information corresponding to the neighbor node set and the account feature information of the corresponding node according to the aggregation function, and take the operation result as the aggregation feature of the corresponding node. Wherein the training of the aggregation function comprises a process of extracting a feature representation for each node in the account relationship network graph structure.

Therefore, the present embodiment does not directly learn the deep feature representation of the network node, but learns an aggregation function, and the aggregation function can aggregate the features of the neighboring nodes to the corresponding node as the center. After the aggregation function is obtained through learning, the aggregation function can be generalized to a new node in the social network or a new social network, so that the method is suitable for the social network which is similar to WeChat and has large-scale account nodes and high account node updating speed.

No matter which feature aggregation mode is adopted, the obtained aggregation feature representation of each account in the aggregation feature graph aggregates the feature information of the neighbor nodes of the corresponding node, so that the obtained aggregation feature of each node contains deeper feature information.

And step S135, taking the aggregation characteristic representation of each node as the depth characteristic representation of each corresponding account.

The obtained aggregation feature representation contains feature information related to neighbor nodes of the corresponding nodes, and the obtained aggregation feature representation is used as the depth feature representation of the corresponding nodes, so that the depth feature representation of each node can contain richer feature information, and more accurate data conditions are laid for the subsequent prediction of the risk condition of each account.

Therefore, the risk account identification scheme provided by the application integrates the feature information of the user account in different dimensions in the social network to construct an account relationship network graph structure, extracts the depth feature information of each node in the account relationship network graph structure through a graph volume mode or a graph learning mode, predicts the risk probability of the account by combining the depth feature information of each feature and the original account feature information, and can effectively improve the identification effect of the risk account.

The risk account identification scheme proposed by the present application can be represented by the flow shown in fig. 9:

firstly, an account relationship network graph structure is constructed according to various association relations in the social network, such as common transaction opponents, transaction funds, equipment for performing fund transaction, associated certificates, mobile phone numbers and the like, and deep feature representations of all nodes in the account relationship network graph structure are extracted. The method comprises the steps of taking an account corresponding to each node as a target account, combining each target account with depth feature representation and account feature information to predict risk probability of each target account, subsequently combining associated features corresponding to risk scenes in the current social network to further identify risk accounts in the social network, and further striking against the risk accounts, so that a healthy and safe internet social environment is created.

According to the risk account identification scheme, the node characteristic information in the identification process of the risk account is enriched by utilizing the depth characteristic information, so that the identification process of the risk account is more effective. The detailed risk account identification process has been described in the foregoing embodiments, and is not described herein again.

FIG. 10 is a block diagram illustrating an apparatus for identifying risk accounts in a social network in accordance with an exemplary embodiment of the present application. As shown in fig. 10, the apparatus includes:

a network graph structure generating module 210 configured to take accounts in the social network as nodes, and fuse multiple association relations among the accounts to construct edges among the nodes, so as to generate an account relation network graph structure corresponding to the social network; the depth feature extraction module 230 is configured to extract depth feature representations of the accounts according to the neighbor node feature information of the accounts in the account relationship network graph structure and the account feature information of the accounts; a risk probability prediction module 250 configured to predict risk probabilities of the respective accounts in combination with the depth feature representation of the accounts and the account feature information; an account risk identification module 270 configured to identify a risk account in the social network based on the predicted risk probability.

In the device provided by this embodiment, the risk accounts in the social network are identified by extracting the depth feature information of the accounts in the social network, predicting the risk probability of the accounts by combining the extracted depth feature information and the extracted account feature information, and combining the predicted risk probability and the key features corresponding to the risk scenes, compared with a scheme that only the risk probability of the accounts is predicted by aiming at the account feature information in the prior art, the risk account identification scheme provided by this embodiment is richer in feature information according to the identification process of the risk accounts, so that a risk account identification scheme with higher fitness than that in the prior art is obtained, and the identification effect of the risk accounts can be improved.

In another exemplary embodiment, the plurality of associated relationships include a funding relationship and a non-funding relationship; the network diagram structure generating module 210 includes:

the node and edge generating unit is configured to take an account in the social network as a node and generate an edge between any two nodes; the association weight determining unit is configured to determine an association weight between any two nodes according to a fund relationship and a non-fund relationship between accounts corresponding to any two nodes; and the graph structure forming unit is configured to add the association weight as annotation information to the generated edge so as to form an account relation network graph structure.

In another exemplary embodiment, any two nodes have a plurality of association weights therebetween, the plurality of association weights being obtained according to different fund relationship types between any two nodes; the pattern structure forming unit includes:

the graph structure fusion forming subunit is configured to calculate the sum of the multiple association weights, add the calculation result as labeling information to the generated edge, and generate an account relationship network graph structure corresponding to the social network based on fusion of the multiple association weights between any two nodes; or, the multi-graph structure forming subunit is configured to generate a corresponding account relationship network graph structure according to the association weight obtained between any two nodes according to the same fund relationship type, so as to obtain multiple account relationship network graph structures corresponding to the social network.

In another exemplary embodiment, the association weight determining unit includes:

the fund relationship type obtaining subunit is configured to obtain the transaction opponent information and the transaction fund information associated with any two nodes according to the fund relationship between the accounts corresponding to any two nodes; the multi-association weight obtaining subunit is configured to determine a first association weight between any two nodes according to the transaction opponent information associated with any two nodes and the non-fund relationship between any two nodes, and determine a second association weight between any two nodes according to the transaction fund information associated with any two nodes and the non-fund relationship between any two nodes.

In another exemplary embodiment, the multi-association weight obtaining subunit includes:

the first association weight acquisition subunit is configured to determine the number of common counterparties between any two nodes and the sum of the number of counterparties of all nodes in any two nodes according to counterparty information associated with any two nodes, and calculate the ratio of the number of common counterparties to the sum of the number of counterparties of all nodes; determining assignment corresponding to non-capital relation between any two nodes; carrying out weighted sum operation on the ratio and the assignment to obtain a first association weight between any two nodes;

the second association weight acquisition subunit is configured to determine the sum of the fund transaction total amount between any two nodes and the fund transaction total amount of all the nodes according to the fund transaction information associated with any two nodes, and calculate the ratio of the fund transaction total amount to the sum of the fund transaction total amount of all the nodes; determining assignment corresponding to non-fund relationship between any two nodes; and carrying out weighted sum operation on the ratio and the assignment to obtain a second association weight between any two nodes.

In another exemplary embodiment, the depth feature extraction module 230 includes:

the account characteristic graph generating unit is configured to generate an account characteristic graph corresponding to the account relationship network graph structure according to the account characteristic information corresponding to each node in the account relationship network graph structure; the feature aggregation processing unit is configured to perform feature aggregation processing on the account feature graph to obtain an aggregation feature graph corresponding to the account relationship network graph structure, wherein the aggregation feature graph contains aggregation feature representations corresponding to all nodes, and the aggregation feature representations aggregate neighbor node feature information of corresponding nodes; and the depth feature representation acquisition unit is configured to take the aggregation feature representation of each node as the depth feature representation of each corresponding account.

In another exemplary embodiment, the feature aggregation processing unit includes:

the neighbor node sampling subunit is configured to sample a specified number of neighbor nodes for each node in the account characteristic diagram to obtain a neighbor node set corresponding to each node; and the characteristic information aggregation subunit is configured to aggregate the neighbor node characteristic information corresponding to the neighbor node set into the corresponding node, and form an aggregation characteristic corresponding to each node in the account relationship network graph structure to obtain an aggregation characteristic graph.

In another exemplary embodiment, the feature information aggregating subunit includes:

the aggregation function obtaining subunit is configured to obtain an aggregation function obtained through training, and the training comprises a process of extracting depth feature representation for each node in the account relation network graph structure; and the aggregation operation subunit is configured to perform aggregation operation on the neighbor node characteristic information corresponding to the neighbor node set and the account characteristic information of the corresponding node according to an aggregation function, and take an operation result as the aggregation characteristic of the corresponding node.

the adjacency matrix generating subunit is configured to generate an adjacency matrix corresponding to the account characteristic graph, and the adjacency matrix contains characteristic vectors of all nodes and graph connection relations among the nodes; and the graph convolution processing subunit is configured to perform graph convolution processing on the adjacency matrix to obtain an aggregation characteristic graph corresponding to the account relationship network graph structure.

In another exemplary embodiment, the risk probability prediction module 250 includes:

and the feature classification processing unit is configured to perform feature classification processing on the features to be processed by taking the multiple depth feature representations of the accounts and the account feature information as the features to be processed so as to obtain the risk probability of the corresponding account.

In another exemplary embodiment, the account risk identification module 270 includes:

the key feature obtaining unit is configured to obtain a key feature for describing a risk scene in the social network if it is determined that the risk probability of the account is greater than a risk threshold; and the key feature comparison unit is configured to identify the account with the risk probability greater than the risk threshold as the risk account if the account with the risk probability greater than the risk threshold conforms to the key features.

It should be noted that the apparatus provided in the foregoing embodiment and the method provided in the foregoing embodiment belong to the same concept, and the specific manner in which each module and unit execute operations has been described in detail in the method embodiment, and is not described again here.

Embodiments of the present application also provide an electronic device comprising a processor and a memory, wherein the memory has stored thereon computer-readable instructions that, when executed by the processor, implement the method of identifying a risk account in a social network as described above.

FIG. 11 illustrates a schematic structural diagram of a computer system suitable for use in implementing the electronic device of an embodiment of the present application. It should be noted that the computer system 1600 of the electronic device shown in fig. 11 is only an example, and should not bring any limitation to the functions and the scope of use of the embodiments of the present application.

As shown in fig. 11, computer system 1600 includes a Central Processing Unit (CPU)1601, which can perform various appropriate actions and processes, such as executing the methods described in the above embodiments, according to a program stored in a Read-Only Memory (ROM) 1602 or a program loaded from a storage portion 1608 into a Random Access Memory (RAM) 1603. In the RAM 1603, various programs and data necessary for system operation are also stored. The CPU 1601, ROM 1602, and RAM 1603 are connected to each other via a bus 1604. An Input/Output (I/O) interface 1605 is also connected to the bus 1604.

The following components are connected to the I/O interface 1605: an input portion 1606 including a keyboard, a mouse, and the like; an output section 1607 including a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, a speaker, and the like; a storage portion 1608 including a hard disk and the like; and a communication section 1609 including a Network interface card such as a LAN (Local Area Network) card, a modem, or the like. The communication section 1609 performs communication processing via a network such as the internet. The driver 1610 is also connected to the I/O interface 1605 as needed. A removable medium 1611 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 1610 as necessary so that a computer program read out therefrom is mounted in the storage portion 1608 as necessary.

In particular, according to embodiments of the present application, the processes described above with reference to the flow diagrams may be implemented as computer software programs. For example, embodiments of the present application include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising a computer program for performing the method illustrated by the flow chart. In such embodiments, the computer program may be downloaded and installed from a network through the communication part 1609, and/or installed from the removable medium 1611. When the computer program is executed by a Central Processing Unit (CPU)1601, various functions defined in the system of the present application are executed.

It should be noted that the computer readable medium shown in the embodiments of the present application may be a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium may be, for example, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a Read-Only Memory (ROM), an Erasable Programmable Read-Only Memory (EPROM), a flash Memory, an optical fiber, a portable Compact Disc Read-Only Memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this application, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In this application, however, a computer readable signal medium may include a propagated data signal with a computer program embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. The computer program embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the foregoing.

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present application. Each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The units described in the embodiments of the present application may be implemented by software, or may be implemented by hardware, and the described units may also be disposed in a processor. Wherein the names of the elements do not in some way constitute a limitation on the elements themselves.

Another aspect of the present application also provides a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements the method of identifying a risk account in a social network as described above. The computer-readable storage medium may be included in the electronic device described in the above embodiment, or may exist separately without being incorporated in the electronic device.

Another aspect of the application also provides a computer program product or computer program comprising computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions to cause the computer device to perform the method for identifying a risk account in a social network provided in the above embodiments.

The above description is only a preferred exemplary embodiment of the present application, and is not intended to limit the embodiments of the present application, and those skilled in the art can easily make various changes and modifications according to the main concept and spirit of the present application, so that the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A method of identifying a risk account in a social network, comprising:

taking accounts in a social network as nodes, fusing various incidence relations among the accounts to construct edges among the nodes, and generating an account relation network graph structure corresponding to the social network;

extracting depth feature representation of each account according to the neighbor node feature information of the account in the account relationship network graph structure and the account feature information of the account;

predicting the risk probability of each account by combining the depth characteristic representation of the account and the account characteristic information;

and identifying a risk account in the social network according to the predicted risk probability.

2. The method of claim 1, wherein the plurality of associated relationships include a funding relationship and a non-funding relationship; the method for generating the account relationship network graph structure corresponding to the social network by taking the accounts in the social network as nodes and fusing various incidence relations among the accounts to construct edges among the nodes comprises the following steps:

taking an account in the social network as a node, and generating an edge between any two nodes;

determining the association weight between any two nodes according to the fund relationship and the non-fund relationship between accounts corresponding to any two nodes;

and adding the association weight as marking information to the generated edge to form the account relationship network graph structure.

3. The method according to claim 2, wherein there are a plurality of association weights between any two nodes, the plurality of association weights being obtained according to different fund relationship types between any two nodes; adding the association weight as annotation information to the generated edge to form the account relationship network graph structure, including:

calculating the sum of the multiple association weights, and adding a calculation result serving as marking information to the generated edge so as to generate an account relationship network graph structure corresponding to the social network based on fusion of the multiple association weights between any two nodes; alternatively, the first and second electrodes may be,

and generating a corresponding account relationship network graph structure according to the association weight obtained between any two nodes according to the same fund relationship type so as to obtain a plurality of account relationship network graph structures corresponding to the social network.

4. The method according to claim 2, wherein the determining the association weight between any two nodes according to the fund relationship and the non-fund relationship between the accounts corresponding to any two nodes comprises:

acquiring transaction opponent information and transaction fund information associated with any two nodes according to the fund relationship between accounts corresponding to the any two nodes;

determining a first association weight between any two nodes according to the transaction opponent information associated with any two nodes and the non-fund relationship between any two nodes, and determining a second association weight between any two nodes according to the transaction fund information associated with any two nodes and the non-fund relationship between any two nodes.

5. The method of claim 4, wherein determining a first association weight between any two nodes based on the counterparty information associated with the any two nodes and the non-funding relationship between the any two nodes comprises:

determining the number of common counterparties between any two nodes and the sum of the number of counterparties of all nodes in any two nodes according to the counterparty information related to any two nodes, and calculating the ratio of the number of common counterparties to the sum of the number of counterparties of all nodes;

determining an assignment corresponding to the non-fund relationship between any two nodes;

and carrying out weighted sum operation on the ratio and the assignment to obtain a first association weight between any two nodes.

6. The method of claim 4, wherein determining a second association weight between any two nodes according to transaction fund information associated with the any two nodes and a non-fund relationship between the any two nodes comprises:

determining the sum of the fund transaction total amount between any two nodes and the fund transaction total amount of all nodes according to the fund transaction information related to any two nodes, and calculating the ratio of the fund transaction total amount to the sum of the fund transaction total amounts of all nodes;

and carrying out weighted sum operation on the ratio and the assignment to obtain a second association weight between any two nodes.

7. The method according to claim 1, wherein the extracting the deep feature representation of each account according to the neighbor node feature information of the account in the account relationship network graph structure and the account feature information of the account comprises:

generating an account characteristic diagram corresponding to the account relationship network diagram structure according to the account characteristic information corresponding to each node in the account relationship network diagram structure;

performing feature aggregation processing on the account feature graph to obtain an aggregation feature graph corresponding to the account relationship network graph structure, wherein the aggregation feature graph contains aggregation feature representations corresponding to all nodes, and the aggregation feature representations aggregate neighbor node feature information of corresponding nodes;

and taking the aggregation characteristic representation of each node as the depth characteristic representation of each corresponding account.

8. The method according to claim 7, wherein the performing feature aggregation processing on the account feature map to obtain an aggregated feature map corresponding to the account relationship network map structure includes:

sampling a specified number of neighbor nodes aiming at each node in the account characteristic graph to obtain a neighbor node set corresponding to each node;

and aggregating the neighbor node characteristic information corresponding to the neighbor node set into corresponding nodes to form an aggregated characteristic corresponding to each node in the account relationship network graph structure so as to obtain the aggregated characteristic graph.

9. The method according to claim 8, wherein the aggregating neighbor node characteristic information corresponding to the neighbor node set into corresponding nodes to form an aggregated characteristic corresponding to each node in the account relationship network graph structure includes:

acquiring an aggregation function obtained by training, wherein the training comprises a process of extracting depth feature representation aiming at each node in an account relation network graph structure;

and carrying out aggregation operation on the neighbor node characteristic information corresponding to the neighbor node set and the account characteristic information of the corresponding node according to the aggregation function, and taking an operation result as the aggregation characteristic of the corresponding node.

10. The method according to claim 7, wherein the performing feature aggregation processing on the account feature map to obtain an aggregated feature map corresponding to the account relationship network map structure includes:

generating an adjacency matrix corresponding to the account characteristic graph, wherein the adjacency matrix contains characteristic vectors of all nodes and graph connection relations among the nodes;

and carrying out graph convolution processing on the adjacency matrix to obtain an aggregation characteristic graph corresponding to the account relationship network graph structure.

11. The method of claim 1, wherein the number of depth feature representations for an account is plural; the predicting the risk probability of each account by combining the depth feature representation of the account and the account feature information comprises the following steps:

and taking the multiple depth feature representations of the account and the account feature information as features to be processed, and performing feature classification processing on the features to be processed to obtain the risk probability of the corresponding account.

12. The method of claim 1, wherein identifying risk accounts in the social network based on the predicted risk probability comprises:

if the risk probability of the account is determined to be larger than a risk threshold value, key features corresponding to risk scenes in the social network are obtained;

and if the accounts with the risk probability larger than the risk threshold value accord with the key characteristics, identifying the accounts with the risk probability larger than the risk threshold value as risk accounts.

13. An apparatus that identifies risk accounts in a social network, comprising:

the network graph structure generating module is configured to take the accounts in the social network as nodes, fuse various incidence relations among the accounts to construct edges among the nodes, and generate an account relation network graph structure corresponding to the social network;

the depth feature extraction module is configured to extract depth feature representation of each account according to neighbor node feature information of the account in the account relationship network graph structure and account feature information of the account;

the risk probability prediction module is configured to predict the risk probability of each account by combining the depth characteristic representation of the account and the account characteristic information;

and the account risk identification module is configured to identify a risk account in the social network according to the predicted risk probability.

14. An electronic device, comprising:

a memory storing computer readable instructions;

a processor to read computer readable instructions stored by the memory to perform the method of any of claims 1-12.

15. A computer-readable storage medium having computer-readable instructions stored thereon, which, when executed by a processor of a computer, cause the computer to perform the method of any one of claims 1-12.