CN116167005A - Abnormality judgment method and device for target account, computer equipment and storage medium - Google Patents

Abstract

The application relates to a target account abnormality judgment method, device, computer equipment, storage medium and computer program product. The method comprises the following steps: inserting a target account number and a target entity extracted from target service data into a graph database as graph vertices, wherein the graph database comprises a plurality of graph nodes connected based on continuous edges, and the graph nodes comprise known entities, normal accounts and abnormal accounts; determining a graph node to be connected directly associated with the graph vertex based on the target service data, and establishing a connecting edge between the graph vertex and the graph node to be connected; and when the abnormal account directly or indirectly related to the target account exists, and the minimum number of continuous edges between the graph node where the related abnormal account is located and the graph vertex where the target account is located is smaller than or equal to a preset threshold value, carrying out abnormal judgment on the target account based on the minimum number of continuous edges, and obtaining an abnormal judgment result of the target account. By adopting the method, the hidden attribute of whether the target account number in the target business data is abnormal or not can be deeply mined.

Description

Abnormality judgment method and device for target account, computer equipment and storage medium

Technical Field

The present invention relates to the field of computer technologies, and in particular, to a method and apparatus for determining abnormality of a target account, a computer device, a storage medium, and a computer program product.

Background

With the development of computer technology, a graph database is widely used, which is a storage engine specially used for storing and retrieving huge information networks, and the implementation principle is that graphs are used for storing data, so that the data can be efficiently stored as graph nodes and connected edges, and the high-performance retrieval and inquiry of a point-edge structure formed by the graph nodes and the connected edges are allowed. For huge data produced by a business system, a graph database can be established through the data to perform data retrieval and data query.

However, the existing graph database can only retrieve and query stored existing data, and mining of hidden information is difficult to achieve for data not added to the graph database.

Disclosure of Invention

In view of the foregoing, it is desirable to provide an anomaly determination method, an anomaly determination device, a computer-readable storage medium, and a computer program product for a target account that can mine hidden information to determine an anomaly of the target account.

In a first aspect, the present application provides a method for determining abnormality of a target account. The method comprises the following steps:

extracting a target account number and a target entity from target service data;

inserting the target account number and the target entity into a graph database as graph vertices, wherein the graph database comprises a plurality of graph nodes connected based on continuous edges, the graph nodes comprise known account numbers and known entities, and the known account numbers comprise normal account numbers and abnormal account numbers;

determining a graph node to be connected directly associated with the graph vertex from the graph nodes based on the target service data, and establishing a connecting edge between the graph vertex and the graph node to be connected;

and when an abnormal account directly or indirectly associated with the target account exists, and the minimum number of continuous edges between the graph node where the associated abnormal account is located and the graph vertex where the target account is located is smaller than or equal to a preset threshold value, performing abnormal judgment on the target account based on the minimum number of continuous edges, and obtaining an abnormal judgment result of the target account.

In some embodiments, the performing the anomaly determination on the target account based on the minimum number of continuous edges to obtain an anomaly determination result of the target account includes:

Acquiring graph node propagation weight data and a related reference weight of the abnormal account;

calculating the propagation weight of the target account based on the reference weight, the graph node propagation weight data and the minimum number of continuous edges;

and when the propagation weight of the target account is greater than the preset weight data, judging that the target account is an abnormal account.

In some embodiments, when there is an abnormal account directly associated with or indirectly associated with the target account, and the minimum number of continuous edges between the graph node where the associated abnormal account is located and the graph vertex where the target account is located is less than or equal to a preset threshold, performing an abnormal judgment on the target account based on the minimum number of continuous edges, to obtain an abnormal judgment result of the target account, including:

traversing graph nodes with the number of connecting edges between the graph vertices being smaller than or equal to a preset threshold value by taking the graph vertex where the target account is located as a starting point;

when target graph nodes representing abnormal accounts exist in the traversed graph nodes, determining the minimum number of connecting edges between the target graph nodes and the graph vertexes where the target accounts are located;

and carrying out abnormality judgment on the target account based on the minimum continuous edge number to obtain an abnormality judgment result of the target account.

In some embodiments, when there is a target graph node representing an abnormal account in each traversed graph node, determining a minimum number of connected edges between the target graph node and a graph vertex where the target account is located includes:

when target graph nodes representing abnormal accounts exist in all traversed graph nodes, determining graph node links between the target graph nodes and graph vertices where the target accounts are located;

and taking the connecting edge number of the graph node links with the minimum number of the included graph nodes as the minimum connecting edge number between the target graph nodes and the graph vertexes of the target account.

In some embodiments, the abnormal account number in the graph node carries an abnormal account number flag; the anomaly judgment method of the target account number further comprises the following steps:

and when the abnormity judgment result of the target account is that the account is abnormal, marking the abnormal account at the top of the graph where the target account is located in the graph database.

In some embodiments, the method for determining abnormality of the target account further includes:

acquiring offline service data containing account information and entity information;

determining a direct association relationship between each known account and each known entity based on the offline service data according to the known account represented by the account information and the known entity represented by the entity information;

And constructing a graph database by taking each known account number and each known entity as graph nodes and the association relationship as the connecting edge between the graph nodes.

In a second aspect, the present application further provides an abnormality determination device for a target account. The device comprises:

the information extraction module is used for extracting a target account number and a target entity from the target business data;

the graph vertex inserting module is used for inserting the target account number and the target entity into a graph database as graph vertices, wherein the graph database comprises a plurality of graph nodes connected based on continuous edges, the graph nodes comprise known account numbers and known entities, and the known account numbers comprise normal account numbers and abnormal account numbers;

the connecting edge establishing module is used for determining a graph node to be connected directly associated with the graph vertex from all the graph nodes based on the target service data, and establishing a connecting edge between the graph vertex and the graph node to be connected;

and the abnormality judgment module is used for carrying out abnormality judgment on the target account based on the minimum number of continuous edges when the abnormal account directly associated or indirectly associated with the target account exists and the minimum number of continuous edges between the graph node where the associated abnormal account exists and the graph vertex where the target account exists is smaller than or equal to a preset threshold value, so as to obtain an abnormality judgment result of the target account.

In a third aspect, the present application also provides a computer device. The computer device comprises a memory storing a computer program and a processor which when executing the computer program performs the steps of:

extracting a target account number and a target entity from target service data;

inserting the target account number and the target entity into a graph database as graph vertices, wherein the graph database comprises a plurality of graph nodes connected based on continuous edges, the graph nodes comprise known account numbers and known entities, and the known account numbers comprise normal account numbers and abnormal account numbers;

determining a graph node to be connected directly associated with the graph vertex from the graph nodes based on the target service data, and establishing a connecting edge between the graph vertex and the graph node to be connected;

and when an abnormal account directly or indirectly associated with the target account exists, and the minimum number of continuous edges between the graph node where the associated abnormal account is located and the graph vertex where the target account is located is smaller than or equal to a preset threshold value, performing abnormal judgment on the target account based on the minimum number of continuous edges, and obtaining an abnormal judgment result of the target account.

In a fourth aspect, the present application also provides a computer-readable storage medium. The computer readable storage medium having stored thereon a computer program which when executed by a processor performs the steps of:

extracting a target account number and a target entity from target service data;

inserting the target account number and the target entity into a graph database as graph vertices, wherein the graph database comprises a plurality of graph nodes connected based on continuous edges, the graph nodes comprise known account numbers and known entities, and the known account numbers comprise normal account numbers and abnormal account numbers;

determining a graph node to be connected directly associated with the graph vertex from the graph nodes based on the target service data, and establishing a connecting edge between the graph vertex and the graph node to be connected;

and when an abnormal account directly or indirectly associated with the target account exists, and the minimum number of continuous edges between the graph node where the associated abnormal account is located and the graph vertex where the target account is located is smaller than or equal to a preset threshold value, performing abnormal judgment on the target account based on the minimum number of continuous edges, and obtaining an abnormal judgment result of the target account.

In a fifth aspect, the present application also provides a computer program product. The computer program product comprises a computer program which, when executed by a processor, implements the steps of:

extracting a target account number and a target entity from target service data;

inserting the target account number and the target entity into a graph database as graph vertices, wherein the graph database comprises a plurality of graph nodes connected based on continuous edges, the graph nodes comprise known account numbers and known entities, and the known account numbers comprise normal account numbers and abnormal account numbers;

determining a graph node to be connected directly associated with the graph vertex from the graph nodes based on the target service data, and establishing a connecting edge between the graph vertex and the graph node to be connected;

and when an abnormal account directly or indirectly associated with the target account exists, and the minimum number of continuous edges between the graph node where the associated abnormal account is located and the graph vertex where the target account is located is smaller than or equal to a preset threshold value, performing abnormal judgment on the target account based on the minimum number of continuous edges, and obtaining an abnormal judgment result of the target account.

According to the anomaly judgment method, the device, the computer equipment, the storage medium and the computer program product of the target account, the target account and the target entity are extracted from the target service data, the target account and the target entity are inserted into the graph database as incremental graph vertexes, graph nodes to be connected which are directly related to the graph vertexes are determined from all graph nodes based on the target service data, the continuous edges between the graph vertexes and the graph nodes to be connected are established, as the graph nodes comprise normal accounts, abnormal accounts and known entities, deep mining of the data relationship can be realized, when the abnormal account which is directly related or indirectly related to the target account exists in the graph database, and the minimum continuous edge number between the graph nodes where the related abnormal account is located and the graph vertexes where the related abnormal account is located is smaller than or equal to a preset threshold value, based on the association degree between the abnormal account and the target account which are characterized by the minimum continuous edge number, the prediction judgment is carried out on whether the target account is likely to be the abnormal account, the result of deep mining of whether the target account is the abnormal account is obtained, and whether the target in the target business data is the target is the hidden attribute is the target account is the deep or not is realized.

Drawings

FIG. 1 is an application environment diagram of a method for anomaly determination of a target account number in one embodiment;

FIG. 2 is a flowchart of a method for determining anomalies in a target account in one embodiment;

fig. 3 is a flowchart of a method for determining abnormality of a target account in another embodiment;

FIG. 4 is a flowchart of a method for determining anomalies in a target account in one embodiment;

FIG. 5 is a block diagram of an abnormality determination apparatus for a target account number in one embodiment;

fig. 6 is an internal structural diagram of a computer device in one embodiment.

Detailed Description

In order to make the objects, technical solutions and advantages of the present application more apparent, the present application will be further described in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the present application.

The abnormality judgment method of the target account number provided by the embodiment of the invention can be applied to an application environment shown in fig. 1. Wherein the terminal 102 communicates with the server 104 via a network. The data storage system may store data that the server 104 needs to process. The data storage system may be integrated on the server 104 or may be located on a cloud or other network server. The server 104 extracts a target account number and a target entity from target service data provided by the terminal 102, inserts the target account number and the target entity as graph vertices into a graph database, wherein the graph database comprises a plurality of graph nodes based on continuous edge connection, the graph nodes comprise a known account number and a known entity, and the known account number comprises a normal account number and an abnormal account number. The server 104 determines a graph node to be connected directly associated with the graph vertex from all graph nodes based on the target service data, and establishes a connecting edge between the graph vertex and the graph node to be connected; and when the abnormal account directly or indirectly related to the target account exists, and the minimum number of continuous edges between the graph node where the related abnormal account is located and the graph vertex where the target account is located is smaller than or equal to a preset threshold value, carrying out abnormal judgment on the target account based on the minimum number of continuous edges, and obtaining an abnormal judgment result of the target account. In some embodiments, the server 104 may also feed back the abnormality determination result of the target account to the terminal 102, or perform a service processing procedure corresponding to the abnormality determination result for the target service data based on the abnormality determination result of the target account. For example, in the wind control service scenario, when the result of the abnormality determination of the target account is that the account is abnormal, processing of the target service data is refused or processing of part of the data in the target service data is refused. And when the abnormality judgment result of the target account number is that the account number is not abnormal, normally processing the target business data.

The terminal 102 may be, but not limited to, various personal computers, notebook computers, smart phones, tablet computers, internet of things devices, and portable wearable devices, where the internet of things devices may be smart speakers, smart televisions, smart air conditioners, smart vehicle devices, and the like. The portable wearable device may be a smart watch, smart bracelet, headset, or the like. The server 104 may be implemented as a stand-alone server or as a server cluster of multiple servers.

In one embodiment, as shown in fig. 2, a method for determining abnormality of a target account is provided, and the method is applied to the server in fig. 1 for illustration, and includes the following steps:

step 202, extracting a target account number and a target entity from the target business data.

The target service data is service data which needs to be subjected to risk assessment, and specifically can be service data which can be obtained by target object authorization, wherein the service data comprises account information of the related target object and entity information related to the related target object. The target object related to the business data is an object which needs to be responsible for the business data, namely, a main object of risk assessment. The target account number refers to an account number characterized by account number information of the target object. The target account number belongs to only one object, but one object may have a plurality of different account numbers.

The target account number may specifically be an account number registered on a specific platform and bound to the identity of the object, for example, may be a mailbox account number, a mobile phone number, a social platform account number of the target object, and the like. The target entity may be an entity with a unique identification used by the target object recorded in the service data, for example, the target entity may include a terminal device with a device number, a profimac address, etc. The number of target entities may be one or more, and the specific number may be determined based on the data processing requirements. For example, the entity of the specified category may be extracted from the service data, or all the entities recorded in the service data may be extracted.

In step 204, the target account number and the target entity are inserted into a graph database as graph vertices, wherein the graph database comprises a plurality of graph nodes based on edge connection, the graph nodes comprise known account numbers and known entities, and the known account numbers comprise normal account numbers and abnormal account numbers.

Wherein the graph database is a database for recording a plurality of graph nodes and edges between the graph nodes. The graph nodes in the graph database include known accounts and known entities. The known account number and the known entity can be extracted based on offline business data, wherein the known account number comprises a normal account number and an abnormal account number. In a specific application, at least one of the abnormal account number and the normal account number can be specially marked by an account number marking mode to show distinction. For example, only the abnormal account number may be marked abnormally, the normal account number is not marked, and in the subsequent processing, the graph node carrying the abnormal mark is the abnormal account number. When different representation modes are adopted for the graph nodes corresponding to the known entity and the known account, the normal account can be marked, the abnormal account is not processed, the account without the mark is the abnormal account in the subsequent processing process, or the normal account and the abnormal account can be respectively marked according to the category.

And 206, determining a graph node to be connected directly associated with the graph vertex from all graph nodes based on the target service data, and establishing a connecting edge between the graph vertex and the graph node to be connected.

The graph nodes are used as existing nodes in the graph database, connection relations are established with other nodes in the graph database based on the connection edges, the graph vertexes are used as new nodes of the graph database, and connection relations are not established with other nodes in the graph database, so that the graph nodes to be connected, which are directly related to the graph vertexes, in all the graph nodes need to be determined based on target service data, and the connection edges between the graph vertexes and the graph nodes to be connected are established.

The graph vertex includes a mobile phone number, a wifmac address, a mobile device identifier, and the like of a target object, the graph nodes in the graph database include other entity information such as various account numbers, various addresses, and the like of other objects, data such as social relations, recent transaction records, and the like of the target object can be acquired from target service data acquired by authorization of the target object, and direct association relations between the mobile phone number, the wifmac address, the mobile device identifier, and other account numbers or other entities of the target object can be acquired based on the social relations, the recent transaction records, and the like of the target object, so that a connecting edge between the graph vertex and the graph nodes with the direct association relations is established by taking the direct association relations as a bridge, and the graph vertex is fused into the graph database as the graph node.

Step 208, when there is an abnormal account directly associated or indirectly associated with the target account, and the minimum number of continuous edges between the graph node where the associated abnormal account is located and the graph vertex where the target account is located is less than or equal to a preset threshold, performing abnormal judgment on the target account based on the minimum number of continuous edges, and obtaining an abnormal judgment result of the target account.

The direct association of the target account number and the other account numbers refers to the situation that the graph vertex where the target account number is located is connected with the graph node where the other account numbers are located through one connecting edge, and the indirect association of the target account number and the other account numbers refers to the situation that the graph vertex where the target account number is located is connected with the graph node where the other account numbers are located through at least two connecting edges. When only one connecting link exists between the graph node where the abnormal account is located and the graph vertex where the target account is located, the minimum number of connecting edges is the number of connecting edges contained in the connecting link; when the number of the connecting links between the graph node where the abnormal account is located and the graph vertex where the target account is located is greater than or equal to two, the minimum number of the connecting edges is the number of the connecting edges contained in the connecting link containing the minimum number of the graph nodes.

Further, when the server judges that the abnormal account directly or indirectly related to the target account exists in the graph database, and the minimum number of continuous edges between the graph node where the related abnormal account is located and the graph vertex where the target account is located is smaller than or equal to a preset threshold value, the server judges the abnormal account based on the minimum number of continuous edges, and an abnormal judgment result of the target account is obtained. The smaller the minimum number of continuous edges is, the larger the probability of abnormality of the target account is, and the larger the minimum number of continuous edges is, the smaller the probability of abnormality of the target account is. The server calculates the anomaly probability of the target account based on the minimum number of continuous edges, determines that the target account is anomalous when the anomaly probability of the target account is greater than or equal to a set threshold, and determines that the target account is not anomalous when the anomaly probability of the target account is less than the set threshold.

According to the anomaly judging method of the target account, the target account and the target entity are extracted from the target business data, the target account and the target entity are inserted into the graph database as incremental graph vertexes, graph nodes to be connected which are directly related to the graph vertexes are determined from all graph nodes based on the target business data, and the connection edges between the graph vertexes and the graph nodes to be connected are established.

In some embodiments, performing anomaly determination on the target account based on the minimum number of continuous edges to obtain an anomaly determination result of the target account, including:

Acquiring graph node propagation weight data and a reference weight value of an associated abnormal account; calculating the propagation weight of the target account based on the reference weight, the graph node propagation weight data and the minimum number of continuous edges; and when the propagation weight of the target account is greater than the preset weight data, judging that the target account is an abnormal account.

The reference weights of the associated abnormal accounts can be preset data, and the reference weights of different abnormal accounts can be the same or different. For example, the reference weights of the abnormal account numbers may each be set to 1. The reference weight of the abnormal account may be determined according to the abnormal level of the abnormal account, for example, the account with serious abnormal condition may be set to 1.5, the account with moderate abnormal condition may be set to 1.2, the account with light abnormal condition may be set to 1, and the reference weight may be set to 1.

The graph node propagation weight data may be preset data, and the graph node propagation weight data between different graph nodes may be the same or different. For example, the graph node propagation weight data may each be set to 0.9. For another example, the graph node propagation weight data can be determined according to the association strength between each graph node and the graph node where the abnormal account is located on the graph node link formed by taking the graph node where the abnormal account is located and the graph vertex where the target account is located as an endpoint, and the stronger the association between the graph node and the graph node where the abnormal account is located, the greater the propagation weight data. The association strength between the graph node and the abnormal account number can be determined by the minimum number of continuous edges between the graph node and the graph node where the abnormal account number is located, and the association is stronger as the minimum number of continuous edges is smaller. The graph node link formed by the graph node where the abnormal account is located and the graph vertex where the target account is located by using the endpoint includes a graph node 1 where the abnormal account is located, an intermediate graph node 2, an intermediate graph node 3 and a graph vertex 4 where the target account is located, wherein graph node propagation weight data between the graph node 1 and the intermediate graph node 2 is 0.9, graph node propagation weight data between the intermediate graph node 2 and the intermediate graph node 3 is 0.8, and graph node propagation weight data between the intermediate graph node 3 and the graph vertex 4 is 0.7.

Further, the server calculates the propagation weight of the target account based on the reference weight, the graph node propagation weight data and the minimum continuous edge number, when the propagation weight of the target account is greater than the preset weight data, the target account is judged to be an abnormal account, and when the propagation weight of the target account is less than or equal to the preset weight data, the target account is judged to be a normal account.

In one embodiment, the reference weight of the graph node starting from the abnormal account is set to 1 (r=1), and each 5 passes through a continuous edge multiplied by 0.9, and the propagation weight x=r×0.9 ⁿ Wherein n is a positive integer, representing the minimum number of consecutive edges. A threshold value m=0.7 is set, and if the propagation weight x exceeds the threshold value, the propagation weight x can be calculated byAnd judging that the account number is abnormal.

In this embodiment, the propagation weight is calculated by setting the reference weight, the graph node propagation weight data and the minimum number of continuous edges, so as to determine whether the abnormal account is determined, so that the determination process of the abnormal account can be simplified, and the data processing efficiency of the abnormal account determination can be improved.

In some embodiments, as shown in fig. 3, when there is an abnormal account directly associated with or indirectly associated with the target account, and the minimum number of edges between the graph node where the associated abnormal account is located and the graph vertex where the target account is located is less than or equal to a preset threshold, performing abnormal judgment on the target account based on the minimum number of edges, to obtain an abnormal judgment result of the target account, including:

Step 302, using the graph vertex where the target account is located as a starting point, traversing graph nodes with the number of connecting edges smaller than or equal to 5 and a preset threshold value.

And 304, when the target graph nodes representing the abnormal account exist in the traversed graph nodes, determining the minimum number of connecting edges between the target graph nodes and the graph vertexes where the target account are located.

And 306, performing anomaly judgment on the target account based on the minimum continuous edge number to obtain an anomaly judgment result of the target account.

0 specifically, the preset threshold may be set based on the actual application scenario. When the determination condition for the abnormal account needs to be configured more strictly, the preset threshold may be set to a smaller number of values, and the number of accounts determined to be the abnormal account is relatively larger at this time, and when the determination condition for the abnormal account needs to be configured more loosely, the preset threshold may be set to a larger number of values, and the number of accounts determined to be the abnormal account is relatively smaller at this time.

5 taking a preset threshold value as N (N is a positive integer) as an example, the server takes the peak of the graph where the target account number is located as the starting point

And traversing the graph nodes with the number of connecting edges less than or equal to N between the graph vertices, wherein the traversing result can be three situations of no target graph node representing the abnormal account, one target graph node representing the abnormal account and a plurality of target graph nodes representing the abnormal account. And if the target graph node representing the abnormal account does not exist, judging that the target account is a normal node. And if the target graph node representing the abnormal account exists, determining the minimum number of continuous edges between the target graph node and the graph vertex where the target account is located, and performing abnormal judgment on the target account based on the minimum number of continuous edges to obtain an abnormal judgment result of the target account, wherein the abnormal judgment mode is the same as that of the embodiment and is not repeated.

For the situation that a plurality of target graph nodes representing the abnormal account exist, the minimum number of connecting edges between each target graph node and the graph vertex where the target account is located can be respectively determined for each target graph node, the minimum value is taken for the minimum number of connecting edges of each target graph node, and the target account is subjected to abnormality judgment based on the minimum value, so that an abnormality judgment result of the target account is obtained. The minimum number of continuous edges between each target graph node and the graph vertex where the target account is located can be determined for each target graph node, the anomaly probability of the target account relative to each target graph node is determined based on each minimum number of continuous edges, and then whether the target account is anomalous is determined based on a plurality of anomaly probabilities.

In this embodiment, the server uses the graph vertex where the target account is located as a starting point, traverses graph nodes with the number of edges smaller than or equal to the preset threshold, and determines the minimum number of edges between the target graph node and the graph vertex where the target account is located when target graph nodes representing abnormal accounts exist in each traversed graph node, so that all graph nodes can be prevented from being traversed, the range of traversed graph nodes is reduced, the data processing efficiency can be effectively improved, and the occupation of data processing resources is reduced.

In some embodiments, when there is a target graph node characterizing the abnormal account in each graph node traversed, determining a minimum number of connected edges between the target graph node and a graph vertex where the target account is located includes:

when a target graph node representing the abnormal account exists in each traversed graph node, determining a graph node link between the target graph node and a graph vertex where the target account is located; and taking the number of the connecting edges of the graph node links with the minimum number of the included graph nodes as the minimum number of the connecting edges between the target graph nodes and the graph vertexes of the target account.

The method comprises the steps of determining a graph node link between a target graph node and a graph vertex where a target account is located, wherein the graph node link between the target graph node and the graph vertex where the target account is located refers to a link formed by connecting edges from the target graph node to an intermediate graph node where the graph vertex where the target account is located passes. The graph node link at least comprises a target graph node, a graph vertex where the target account number is located and at least one connecting edge. The number of graph nodes contained in the graph node links can be determined by determining the graph node links between the target graph node and the graph vertex where the target account is located, wherein the graph node link with the lowest number of graph nodes is the shortest link connecting the target graph node and the graph vertex where the target account is located, and the corresponding number of connecting edges is the minimum number of connecting edges.

In this embodiment, the server screens out the graph node links with the least number of graph nodes by determining the graph node links between the target graph node and the graph vertex where the target account is located, so as to quickly determine the minimum number of connecting edges between the target graph node and the graph vertex where the target account is located.

In some embodiments, the abnormal account number in the graph node carries an abnormal account number flag; the anomaly judgment method of the target account number further comprises the following steps: and when the abnormity judgment result of the target account is that the account is abnormal, marking the abnormal account at the vertex of the graph where the target account is located in the graph database.

The abnormal account identification is identification information for distinguishing a normal account from an abnormal account, and the abnormal account identification can be identified by specific characters, so that a server can quickly identify whether the graph node is the abnormal account when traversing the graph node, and processing efficiency is improved.

Further, for the target account with the account abnormality as the abnormality judgment result, the vertex of the graph where the target account is located can be marked with the abnormality account in the graph database, so that the data amplification of the graph database is realized, a basis is provided for the abnormality judgment of more subsequent incremental accounts, and the accuracy of the account abnormality judgment result is improved.

In some embodiments, the anomaly determination method of the target account number further includes:

acquiring offline service data containing account information and entity information; determining a direct association relationship between each known account and each known entity based on offline service data according to the known account represented by the account information and the known entity represented by the entity information; and constructing a graph database by taking each known account number and each known entity as graph nodes and taking the association relationship as the connecting edge between the graph nodes.

The offline service data refers to historical service data which can be acquired offline or processed offline. Based on the offline service data, account information and entity information contained in the account information can be extracted, an account represented by the account information is a known account, an entity represented by the entity information is a known entity, a server can determine a direct association relationship between each known account and each known entity based on the offline service data, and the server can construct a graph database by taking each known account and each known entity as graph nodes and the association relationship as a connecting edge between the graph nodes.

In the embodiment, the server extracts the known account number and the known entity through the offline service data, determines the direct association relationship between the known account number and the known entity, can quickly and conveniently construct a graph database, realizes the purpose of predicting the hidden information of the unknown node by using the known information of the known node,

In a specific application, an anomaly determination method of a target account is provided, and an account mark of a risk user in the wind control field is taken as an example, and the method can be realized through a graph database and a service system. The business system generates huge data at every moment, a relation diagram of clients, equipment, addresses and the like is established through the data, the method establishes the relation among entities through a diagram database, then the hidden information among the entities is found out through a diagram mining algorithm, and the hidden information is applied to actual wind control business.

Specifically, taking a server executing the anomaly judgment method of the target account number as an example of a graph computing platform, after the graph computing platform receives offline business wind control data, establishing an association relationship between a user account number (such as a mobile phone number, a mail box number and the like) and an equipment number, a witmac and other entities, wherein the equipment number, the witmac can be associated with a plurality of user account numbers, and if the associated user account number is marked with a label, such as "fake", judging the probability that a user to which the new user account number belongs is a "fake" client according to a certain algorithm for the newly received user account number.

Exemplary, as shown in fig. 4, the graph computing platform uses offline data to initialize and establish the association relationship between entities such as mobile phone number and equipment number, and wifmac, and marks the fake client with the fake label, and the graph computing platform acquires the wind control event in real time by consuming the wind control event kafka, then analyzes the wind control event, acquires the new information of entities such as mobile phone number, equipment number, wifmac, imei, and the like, inserts the new information into the graph database as graph vertices, and establishes the association relationship of edges between the entities. Then, the new mobile phone number is used as a starting point to find out whether the related entity in three hops has 'fake' clients, if so, the 'fake' clients are used as the starting point, the value is set to be 1 (r=1), each time one hop is multiplied by 0.9, if a plurality of paths are related to the mobile phone number, the maximum value max (r is 0.9 ⁿ ) The mobile phone number corresponds to the probability that the user is a fake client. The business system sets a threshold value, and if the probability exceeds the threshold value, the business system can judge the business system as a fake customer.

It should be understood that, although the steps in the flowcharts related to the above embodiments are sequentially shown as indicated by arrows, these steps are not necessarily sequentially performed in the order indicated by the arrows. The steps are not strictly limited to the order of execution unless explicitly recited herein, and the steps may be executed in other orders. Moreover, at least some of the steps in the flowcharts described in the above embodiments may include a plurality of steps or a plurality of stages, which are not necessarily performed at the same time, but may be performed at different times, and the order of the steps or stages is not necessarily performed sequentially, but may be performed alternately or alternately with at least some of the other steps or stages.

Based on the same inventive concept, the embodiment of the application also provides an abnormality determination device for the target account for realizing the abnormality determination method for the target account. The implementation scheme of the solution to the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitation in the embodiment of the abnormality determining device for one or more target accounts provided below may refer to the limitation of the abnormality determining method for the target account, which is not described herein.

In one embodiment, as shown in fig. 5, there is provided an abnormality determining apparatus for a target account, including: an information extraction module 502, a graph vertex insertion module 504, a connection edge establishment module 506, and an anomaly determination module 508, wherein:

the information extraction module 502 is configured to extract a target account number and a target entity from target service data;

a graph vertex inserting module 504, configured to insert the target account number and the target entity as graph vertices into a graph database, where the graph database includes a plurality of graph nodes based on edge connection, the graph nodes include a known account number and a known entity, and the known account number includes a normal account number and an abnormal account number;

A connection edge establishing module 506, configured to determine, from the graph nodes, a graph node to be connected directly associated with the graph vertex, based on the target service data, and establish a connection edge between the graph vertex and the graph node to be connected;

and the abnormality judgment module 508 is configured to perform abnormality judgment on the target account based on the minimum number of continuous edges when there is an abnormal account directly associated or indirectly associated with the target account and the minimum number of continuous edges between the graph node where the associated abnormal account is located and the graph vertex where the target account is located is less than or equal to a preset threshold, so as to obtain an abnormality judgment result of the target account.

In some embodiments, the anomaly determination module is further configured to obtain graph node propagation weight data and a reference weight of the associated anomaly account number; calculating the propagation weight of the target account based on the reference weight, the graph node propagation weight data and the minimum number of continuous edges; and when the propagation weight of the target account is greater than the preset weight data, judging that the target account is an abnormal account.

In some embodiments, the anomaly determination module is further configured to traverse graph nodes with a number of edges between the graph vertices being less than or equal to a preset threshold, with the graph vertex where the target account is located as a starting point; when target graph nodes representing abnormal accounts exist in the traversed graph nodes, determining the minimum number of connecting edges between the target graph nodes and the graph vertexes where the target accounts are located; and carrying out abnormality judgment on the target account based on the minimum continuous edge number to obtain an abnormality judgment result of the target account.

In some embodiments, the anomaly determination module is further configured to determine, when a target graph node representing an anomaly account number exists in each traversed graph node, a graph node link between the target graph node and a graph vertex where the target account number is located; and taking the connecting edge number of the graph node links with the minimum number of the included graph nodes as the minimum connecting edge number between the target graph nodes and the graph vertexes of the target account.

In some embodiments, the abnormal account number in the graph node carries an abnormal account number flag; the abnormality judgment device of the target account number further comprises an abnormality account number marking module, wherein the abnormality account number marking module is used for marking the abnormal account number on the top of the graph where the target account number is located in the graph database when the abnormality judgment result of the target account number is that the account number is abnormal.

In some embodiments, the anomaly determination device of the target account further includes a graph database module, configured to obtain offline service data including account information and entity information; determining a direct association relationship between each known account and each known entity based on the offline service data according to the known account represented by the account information and the known entity represented by the entity information; and constructing a graph database by taking each known account number and each known entity as graph nodes and the association relationship as the connecting edge between the graph nodes.

According to the abnormality judgment device for the target account, the target account and the target entity are extracted from the target business data, the target account and the target entity are inserted into the graph database as incremental graph vertexes, graph nodes to be connected which are directly related to the graph vertexes are determined from all graph nodes based on the target business data, and the connection edges between the graph vertexes and the graph nodes to be connected are established, and as the graph nodes comprise normal accounts, abnormal accounts and known entities, deep mining of the data relationship can be realized, when the abnormal account which is directly related to or indirectly related to the target account exists in the graph database, and the minimum connection edge number between the graph nodes where the related abnormal account exists and the graph vertexes where the related abnormal account exists is smaller than or equal to the preset threshold value, based on the association degree between the abnormal account represented by the minimum connection edge number and the target account, whether the target account is deep or not is likely to be abnormal is predicted and judged, so that the abnormality judgment result of the target account is obtained, and mining of the hidden attribute of whether the target account is abnormal in the target business data is abnormal or not is realized

All or part of the modules in the abnormality determination device of the target account number can be realized by software, hardware and a combination thereof. The above modules may be embedded in hardware or may be independent of a processor in the computer device, or may be stored in software in a memory in the computer device, so that the processor may call and execute operations corresponding to the above modules.

In one embodiment, a computer device is provided, which may be a server, the internal structure of which may be as shown in fig. 6. The computer device includes a processor, a memory, and a network interface connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database of the computer device is used for storing business data. The network interface of the computer device is used for communicating with an external terminal through a network connection. The computer program, when executed by a processor, implements a method for determining anomalies in a target account.

It will be appreciated by those skilled in the art that the structure shown in fig. 6 is merely a block diagram of some of the structures associated with the present application and is not limiting of the computer device to which the present application may be applied, and that a particular computer device may include more or fewer components than shown, or may combine certain components, or have a different arrangement of components.

In one embodiment, a computer device is provided comprising a memory and a processor, the memory having stored therein a computer program, the processor when executing the computer program performing the steps of:

extracting a target account number and a target entity from target service data; inserting the target account number and the target entity into a graph database as graph vertices, wherein the graph database comprises a plurality of graph nodes connected based on continuous edges, the graph nodes comprise known account numbers and known entities, and the known account numbers comprise normal account numbers and abnormal account numbers; determining a graph node to be connected directly associated with the graph vertex from the graph nodes based on the target service data, and establishing a connecting edge between the graph vertex and the graph node to be connected; and when an abnormal account directly or indirectly associated with the target account exists, and the minimum number of continuous edges between the graph node where the associated abnormal account is located and the graph vertex where the target account is located is smaller than or equal to a preset threshold value, performing abnormal judgment on the target account based on the minimum number of continuous edges, and obtaining an abnormal judgment result of the target account.

In one embodiment, the processor when executing the computer program further performs the steps of:

Acquiring graph node propagation weight data and a related reference weight of the abnormal account; calculating the propagation weight of the target account based on the reference weight, the graph node propagation weight data and the minimum number of continuous edges; and when the propagation weight of the target account is greater than the preset weight data, judging that the target account is an abnormal account.

In one embodiment, the processor when executing the computer program further performs the steps of:

traversing graph nodes with the number of connecting edges between the graph vertices being smaller than or equal to a preset threshold value by taking the graph vertex where the target account is located as a starting point; when target graph nodes representing abnormal accounts exist in the traversed graph nodes, determining the minimum number of connecting edges between the target graph nodes and the graph vertexes where the target accounts are located; and carrying out abnormality judgment on the target account based on the minimum continuous edge number to obtain an abnormality judgment result of the target account.

In one embodiment, the processor when executing the computer program further performs the steps of:

when target graph nodes representing abnormal accounts exist in all traversed graph nodes, determining graph node links between the target graph nodes and graph vertices where the target accounts are located; and taking the connecting edge number of the graph node links with the minimum number of the included graph nodes as the minimum connecting edge number between the target graph nodes and the graph vertexes of the target account.

In one embodiment, the processor when executing the computer program further performs the steps of:

and when the abnormity judgment result of the target account is that the account is abnormal, marking the abnormal account at the top of the graph where the target account is located in the graph database.

In one embodiment, the processor when executing the computer program further performs the steps of:

acquiring offline service data containing account information and entity information; determining a direct association relationship between each known account and each known entity based on the offline service data according to the known account represented by the account information and the known entity represented by the entity information; and constructing a graph database by taking each known account number and each known entity as graph nodes and the association relationship as the connecting edge between the graph nodes.

In one embodiment, a computer readable storage medium is provided having a computer program stored thereon, which when executed by a processor, performs the steps of:

extracting a target account number and a target entity from target service data; inserting the target account number and the target entity into a graph database as graph vertices, wherein the graph database comprises a plurality of graph nodes connected based on continuous edges, the graph nodes comprise known account numbers and known entities, and the known account numbers comprise normal account numbers and abnormal account numbers; determining a graph node to be connected directly associated with the graph vertex from the graph nodes based on the target service data, and establishing a connecting edge between the graph vertex and the graph node to be connected; and when an abnormal account directly or indirectly associated with the target account exists, and the minimum number of continuous edges between the graph node where the associated abnormal account is located and the graph vertex where the target account is located is smaller than or equal to a preset threshold value, performing abnormal judgment on the target account based on the minimum number of continuous edges, and obtaining an abnormal judgment result of the target account.

In one embodiment, the computer program when executed by the processor further performs the steps of:

acquiring graph node propagation weight data and a related reference weight of the abnormal account; calculating the propagation weight of the target account based on the reference weight, the graph node propagation weight data and the minimum number of continuous edges; and when the propagation weight of the target account is greater than the preset weight data, judging that the target account is an abnormal account.

In one embodiment, the computer program when executed by the processor further performs the steps of:

traversing graph nodes with the number of connecting edges between the graph vertices being smaller than or equal to a preset threshold value by taking the graph vertex where the target account is located as a starting point; when target graph nodes representing abnormal accounts exist in the traversed graph nodes, determining the minimum number of connecting edges between the target graph nodes and the graph vertexes where the target accounts are located; and carrying out abnormality judgment on the target account based on the minimum continuous edge number to obtain an abnormality judgment result of the target account.

In one embodiment, the computer program when executed by the processor further performs the steps of:

when target graph nodes representing abnormal accounts exist in all traversed graph nodes, determining graph node links between the target graph nodes and graph vertices where the target accounts are located; and taking the connecting edge number of the graph node links with the minimum number of the included graph nodes as the minimum connecting edge number between the target graph nodes and the graph vertexes of the target account.

In one embodiment, the computer program when executed by the processor further performs the steps of:

and when the abnormity judgment result of the target account is that the account is abnormal, marking the abnormal account at the top of the graph where the target account is located in the graph database.

In one embodiment, the computer program when executed by the processor further performs the steps of:

acquiring offline service data containing account information and entity information; determining a direct association relationship between each known account and each known entity based on the offline service data according to the known account represented by the account information and the known entity represented by the entity information; and constructing a graph database by taking each known account number and each known entity as graph nodes and the association relationship as the connecting edge between the graph nodes.

In one embodiment, a computer program product is provided comprising a computer program which, when executed by a processor, performs the steps of:

extracting a target account number and a target entity from target service data; inserting the target account number and the target entity into a graph database as graph vertices, wherein the graph database comprises a plurality of graph nodes connected based on continuous edges, the graph nodes comprise known account numbers and known entities, and the known account numbers comprise normal account numbers and abnormal account numbers; determining a graph node to be connected directly associated with the graph vertex from the graph nodes based on the target service data, and establishing a connecting edge between the graph vertex and the graph node to be connected; and when an abnormal account directly or indirectly associated with the target account exists, and the minimum number of continuous edges between the graph node where the associated abnormal account is located and the graph vertex where the target account is located is smaller than or equal to a preset threshold value, performing abnormal judgment on the target account based on the minimum number of continuous edges, and obtaining an abnormal judgment result of the target account.

In one embodiment, the computer program when executed by the processor further performs the steps of:

acquiring graph node propagation weight data and a related reference weight of the abnormal account; calculating the propagation weight of the target account based on the reference weight, the graph node propagation weight data and the minimum number of continuous edges; and when the propagation weight of the target account is greater than the preset weight data, judging that the target account is an abnormal account.

In one embodiment, the computer program when executed by the processor further performs the steps of:

traversing graph nodes with the number of connecting edges between the graph vertices being smaller than or equal to a preset threshold value by taking the graph vertex where the target account is located as a starting point; when target graph nodes representing abnormal accounts exist in the traversed graph nodes, determining the minimum number of connecting edges between the target graph nodes and the graph vertexes where the target accounts are located; and carrying out abnormality judgment on the target account based on the minimum continuous edge number to obtain an abnormality judgment result of the target account.

In one embodiment, the computer program when executed by the processor further performs the steps of:

when target graph nodes representing abnormal accounts exist in all traversed graph nodes, determining graph node links between the target graph nodes and graph vertices where the target accounts are located; and taking the connecting edge number of the graph node links with the minimum number of the included graph nodes as the minimum connecting edge number between the target graph nodes and the graph vertexes of the target account.

In one embodiment, the computer program when executed by the processor further performs the steps of:

and when the abnormity judgment result of the target account is that the account is abnormal, marking the abnormal account at the top of the graph where the target account is located in the graph database.

In one embodiment, the computer program when executed by the processor further performs the steps of:

acquiring offline service data containing account information and entity information; determining a direct association relationship between each known account and each known entity based on the offline service data according to the known account represented by the account information and the known entity represented by the entity information; and constructing a graph database by taking each known account number and each known entity as graph nodes and the association relationship as the connecting edge between the graph nodes.

The account information and entity information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, presented data, etc.) referred to in this application are information and data authorized by the user or sufficiently authorized by each party.

Those skilled in the art will appreciate that implementing all or part of the above described methods may be accomplished by way of a computer program stored on a non-transitory computer readable storage medium, which when executed, may comprise the steps of the embodiments of the methods described above. Any reference to memory, database, or other medium used in the various embodiments provided herein may include at least one of non-volatile and volatile memory. The nonvolatile Memory may include Read-Only Memory (ROM), magnetic tape, floppy disk, flash Memory, optical Memory, high density embedded nonvolatile Memory, resistive random access Memory (ReRAM), magnetic random access Memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric Memory (Ferroelectric Random Access Memory, FRAM), phase change Memory (Phase Change Memory, PCM), graphene Memory, and the like. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, and the like. By way of illustration, and not limitation, RAM can be in the form of a variety of forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), and the like. The databases referred to in the various embodiments provided herein may include at least one of relational databases and non-relational databases. The non-relational database may include, but is not limited to, a blockchain-based distributed database, and the like. The processors referred to in the embodiments provided herein may be general purpose processors, central processing units, graphics processors, digital signal processors, programmable logic units, quantum computing-based data processing logic units, etc., without being limited thereto.

The technical features of the above embodiments may be arbitrarily combined, and all possible combinations of the technical features in the above embodiments are not described for brevity of description, however, as long as there is no contradiction between the combinations of the technical features, they should be considered as the scope of the description.

The above examples only represent a few embodiments of the present application, which are described in more detail and are not to be construed as limiting the scope of the present application. It should be noted that it would be apparent to those skilled in the art that various modifications and improvements could be made without departing from the spirit of the present application, which would be within the scope of the present application. Accordingly, the scope of protection of the present application shall be subject to the appended claims.

Claims (10)

1. The method for judging the abnormality of the target account is characterized by comprising the following steps:

extracting a target account number and a target entity from target service data;

inserting the target account number and the target entity into a graph database as graph vertices, wherein the graph database comprises a plurality of graph nodes connected based on continuous edges, the graph nodes comprise known account numbers and known entities, and the known account numbers comprise normal account numbers and abnormal account numbers;

Determining a graph node to be connected directly associated with the graph vertex from the graph nodes based on the target service data, and establishing a connecting edge between the graph vertex and the graph node to be connected;

and when an abnormal account directly or indirectly associated with the target account exists, and the minimum number of continuous edges between the graph node where the associated abnormal account is located and the graph vertex where the target account is located is smaller than or equal to a preset threshold value, performing abnormal judgment on the target account based on the minimum number of continuous edges, and obtaining an abnormal judgment result of the target account.

2. The method according to claim 1, wherein the performing the anomaly determination on the target account based on the minimum number of continuous edges to obtain the anomaly determination result of the target account includes:

acquiring graph node propagation weight data and a related reference weight of the abnormal account;

calculating the propagation weight of the target account based on the reference weight, the graph node propagation weight data and the minimum number of continuous edges;

and when the propagation weight of the target account is greater than the preset weight data, judging that the target account is an abnormal account.

3. The method according to claim 1, wherein when there is an abnormal account directly associated or indirectly associated with the target account, and a minimum number of edges between a graph node where the associated abnormal account is located and a graph vertex where the target account is located is less than or equal to a preset threshold, performing an abnormal judgment on the target account based on the minimum number of edges, to obtain an abnormal judgment result of the target account, including:

traversing graph nodes with the number of connecting edges between the graph vertices being smaller than or equal to a preset threshold value by taking the graph vertex where the target account is located as a starting point;

when target graph nodes representing abnormal accounts exist in the traversed graph nodes, determining the minimum number of connecting edges between the target graph nodes and the graph vertexes where the target accounts are located;

and carrying out abnormality judgment on the target account based on the minimum continuous edge number to obtain an abnormality judgment result of the target account.

4. A method according to claim 3, wherein when there is a target graph node representing an abnormal account in each traversed graph node, determining a minimum number of connected edges between the target graph node and a graph vertex where the target account is located includes:

When target graph nodes representing abnormal accounts exist in all traversed graph nodes, determining each graph node link between the target graph node and the graph vertex where the target account is located;

and taking the connecting edge number of the graph node links with the minimum number of the included graph nodes as the minimum connecting edge number between the target graph nodes and the graph vertexes of the target account.

5. The method of claim 1, wherein the abnormal account number in the graph node carries an abnormal account number flag; the method further comprises the steps of:

and when the abnormity judgment result of the target account is that the account is abnormal, marking the abnormal account at the top of the graph where the target account is located in the graph database.

6. The method according to any one of claims 1 to 5, further comprising:

acquiring offline service data containing account information and entity information;

determining a direct association relationship between each known account and each known entity based on the offline service data according to the known account represented by the account information and the known entity represented by the entity information;

and constructing a graph database by taking each known account number and each known entity as graph nodes and the association relationship as the connecting edge between the graph nodes.

7. An abnormality determination device for a target account, the device comprising:

the information extraction module is used for extracting a target account number and a target entity from the target business data;

the graph vertex inserting module is used for inserting the target account number and the target entity into a graph database as graph vertices, wherein the graph database comprises a plurality of graph nodes connected based on continuous edges, the graph nodes comprise known account numbers and known entities, and the known account numbers comprise normal account numbers and abnormal account numbers;

the connecting edge establishing module is used for determining a graph node to be connected directly associated with the graph vertex from all the graph nodes based on the target service data, and establishing a connecting edge between the graph vertex and the graph node to be connected;

and the abnormality judgment module is used for carrying out abnormality judgment on the target account based on the minimum number of continuous edges when the abnormal account directly associated or indirectly associated with the target account exists and the minimum number of continuous edges between the graph node where the associated abnormal account exists and the graph vertex where the target account exists is smaller than or equal to a preset threshold value, so as to obtain an abnormality judgment result of the target account.

8. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor implements the steps of the method of any of claims 1 to 6 when the computer program is executed.

9. A computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, implements the steps of the method of any of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that the computer program, when being executed by a processor, implements the steps of the method of any of claims 1 to 6.

Images