CN117291609A

CN117291609A - Data analysis method and system for account risk monitoring system

Info

Publication number: CN117291609A
Application number: CN202311303357.2A
Authority: CN
Inventors: 柳德林
Original assignee: Shixi Information Technology Shanghai Co ltd
Current assignee: Shixi Information Technology Shanghai Co ltd
Priority date: 2023-10-09
Filing date: 2023-10-09
Publication date: 2023-12-26
Anticipated expiration: 2043-10-09

Abstract

The embodiment of the application provides a data analysis method and a system for an account risk monitoring system, wherein estimated risk operation data generated by an account risk estimation network are loaded into an observation network, a mapping label of the estimated risk operation data is determined by the observation network, first risk operation map embedded data of first estimated risk operation data and second risk operation map embedded data of first template risk marking data are extracted based on a map structure embedded network, the account risk estimation network is subjected to network weight parameter updating based on the difference between the mapping label generated by the observation network and a target mapping label and the difference between the first risk operation map embedded data and the second risk operation map embedded data until the estimated risk operation data can be judged to be the risk account operation data marked a priori by the observation network through testing of the observation network, and therefore the reliability of account risk estimation is improved.

Description

Data analysis method and system for account risk monitoring system

Technical Field

The application relates to the technical field of account wind control, in particular to a data analysis method and system for an account risk monitoring system.

Background

With the development of calculation of internet financial information, various internet financial institutions pay more and more attention to account risk behaviors (such as fraud, money laundering, etc.), and these internet financial institutions must identify abnormal situations of operation behaviors of various accounts, so as to perform corresponding wind control processing in time. How to ensure the reliability of account risk estimation so as to meet the requirements of financial institution wind control architecture is a technical problem to be solved in the current field.

Disclosure of Invention

In view of the foregoing, an object of the present application is to provide a data analysis method and system for an account risk monitoring system.

According to a first aspect of the present application, there is provided a data analysis method for an account risk monitoring system, applied to a cloud server, the method comprising:

acquiring first template account behavior data, wherein the first template account behavior data comprises first template account operation event data and first template risk annotation data corresponding to the first template account operation event data, and the first template risk annotation data is obtained by calibrating risk operation data of account operation nodes in the first template account operation event data;

Based on an account risk estimation network, performing account risk estimation on the first template account operation event data to generate first estimated risk operation data;

based on an observation network, observing based on a first operation knowledge vector of the first template account operation event data and a second operation knowledge vector of the first estimated risk operation data, and generating a first mapping tag of the first estimated risk operation data, wherein the first mapping tag is used for reflecting a risk attribute tag corresponding to the first estimated risk operation data;

encoding the first estimated risk operation data and the first template risk annotation data based on a graph structure embedded network, and generating first risk operation graph embedded data of the first estimated risk operation data and second risk operation graph embedded data of the first template risk annotation data;

based on the difference between the first mapping label and the target mapping label and the difference between the first risk operation chart embedded data and the second risk operation chart embedded data, updating network weight parameters of the account risk estimation network so that training errors of the updated account risk estimation network are not reduced continuously, wherein the target mapping label is used for reflecting the risk attribute label to be template risk labeling data obtained by carrying out risk operation data calibration on account operation nodes in account operation data, and the updated account risk estimation network is used for carrying out risk operation data prediction on account behavior data which are input randomly.

In a possible implementation manner of the first aspect, the generating, based on the observation network, a first mapping tag of the first estimated risk operation data based on a first operation knowledge vector of the first template account operation event data and a second operation knowledge vector of the first estimated risk operation data includes:

acquiring first interactive account operation data, wherein the first interactive account operation data is generated by carrying out characteristic interaction aggregation on the first template account operation event data and the first estimated risk operation data, and the first interactive account operation data comprises the first operation knowledge vector and the second operation knowledge vector;

based on the observation network, observing based on the first interactive account operation data, and generating a first mapping tag of the first estimated risk operation data;

the observation network includes a coding parameter layer and an observation parameter layer, and the generating, based on the observation network, a first mapping tag of the first estimated risk operation data based on the first interactive account operation data includes:

encoding the first interactive account operation data based on the encoding parameter layer, and generating an account operation dependency vector of the first interactive account operation data, wherein the account operation dependency vector is used for reflecting a contact knowledge vector between the first operation knowledge vector and the second operation knowledge vector;

Based on the observation parameter layer, observing based on the account operation dependency vector, and generating the first mapping tag;

the account operation dependency vector includes a plurality of entity account operation dependency vectors, the first operation knowledge vector includes a plurality of first entity operation knowledge vectors, the second operation knowledge vector includes a plurality of second entity operation knowledge vectors, the encoding the first interactive account operation data based on the encoding parameter layer, generating an account operation dependency vector of the first interactive account operation data, including:

and based on the coding parameter layer, respectively coding the corresponding entity operation data in the first interactive account operation data based on the plurality of first entity operation knowledge vectors and the plurality of second entity operation knowledge vectors, and generating entity account operation dependency vectors respectively corresponding to a plurality of operation entities.

In a possible implementation manner of the first aspect, the updating the network weight parameter of the account risk estimation network based on the difference between the first mapping tag and the target mapping tag and the difference between the first risk operation map embedded data and the second risk operation map embedded data includes:

Acquiring a first training error of the first estimated risk operation data based on the first mapping tag, the target mapping tag and first associated attribute information, wherein the first associated attribute information is used for reflecting the relation among the mapping tag determined by the observation network for any one account operation data, the target mapping tag of any one account operation data and the training error of any one account operation data;

acquiring second training errors of the first estimated risk operation data based on the first risk operation map embedded data, the second risk operation map embedded data and second associated attribute information, wherein the second associated attribute information is used for reflecting the relation between the risk operation map embedded data of any one estimated risk operation data, the risk operation map embedded data of template risk marking data corresponding to any one estimated risk operation data and the training errors of any one estimated risk operation data;

and updating the network weight information of the account risk estimation network based on the first training error and the second training error.

In a possible implementation manner of the first aspect, the observing network is configured to observe, based on a first operational knowledge vector of the first template account operational event data and a second operational knowledge vector of the first estimated risk operational data, and after generating a first mapping tag of the first estimated risk operational data, the method further includes:

Based on the difference between the first mapping label and a first setting mapping label corresponding to the first estimated risk operation data, updating the network weight parameter of the observation network so that the training error of the updated observation network does not continuously decrease any more, wherein the first setting mapping label is used for reflecting the risk attribute label and is the estimated risk operation data generated by the account risk based estimation network.

In a possible implementation manner of the first aspect, the method further includes:

acquiring second template risk annotation data corresponding to second template account operation event data, wherein the second template risk annotation data is obtained by calibrating risk operation data of account operation nodes in the second template account operation event data;

based on the observation network, observing based on a third operation knowledge vector of the second template account operation event data and a fourth operation knowledge vector of the second template risk annotation data, and generating a second mapping tag of the second template risk annotation data, wherein the second mapping tag is used for reflecting a risk attribute tag corresponding to the second template risk annotation data;

Based on the difference between the second mapping label and the second setting mapping label, updating the network weight parameter of the observation network so that the training error of the updated observation network is not reduced continuously, wherein the second mapping label is used for reflecting the risk attribute label which is template risk marking data obtained by carrying out risk operation data calibration on account operation nodes in account operation data.

acquiring second estimated risk operation data corresponding to second template account operation event data, wherein the second estimated risk operation data is obtained by carrying out account risk estimation on the second template account operation event data according to an account risk estimation network;

based on the observation network, observing based on a third operation knowledge vector of the second template account operation event data and a fifth operation knowledge vector of the second estimated risk operation data, and generating a third mapping tag of the second estimated risk operation data, wherein the third mapping tag is used for reflecting a risk attribute tag corresponding to the second estimated risk operation data;

And based on the difference between the third mapping label and the third setting mapping label, updating the network weight parameter of the observation network so that the training error of the updated observation network does not continuously decrease any more, wherein the third setting mapping label is used for reflecting the risk attribute label which is estimated risk operation data generated by an account risk estimation network.

scrambling the second template risk annotation data to generate third template risk annotation data;

based on the observation network, observing based on a third operation knowledge vector of the second template account operation event data and a sixth operation knowledge vector of the third template risk annotation data, and generating a fourth mapping tag of the third template risk annotation data, wherein the fourth mapping tag is used for reflecting a risk attribute tag corresponding to the third template risk annotation data;

Based on the difference between the fourth mapping tag and the fourth setting mapping tag, updating the network weight parameter of the observation network so that the training error of the updated observation network is not reduced continuously, wherein the fourth setting mapping tag is used for reflecting the risk attribute tag which is template risk marking data after marking and scrambling the account operation node in the account operation data;

the first mapping tag is used for reflecting comparison information of the risk duration degree of the first estimated risk operation data with a first set degree value and a second set degree value, the first set degree value is used for reflecting the risk duration degree of the scrambled template risk marking data, and the second set degree value is used for reflecting the risk duration degree of the template risk marking data.

In a possible implementation manner of the first aspect, the second operational knowledge vector of the first estimated risk operational data includes a plurality of second entity operational knowledge vectors, the first risk operational graph embedding data includes a plurality of first entity risk operational graph embedding data, the seventh operational knowledge vector of the first template risk labeling data includes a plurality of seventh entity operational knowledge vectors, the second risk operational graph embedding data includes a plurality of second entity risk operational graph embedding data, the graph structure-based embedding network encodes the first estimated risk operational data and the first template risk labeling data, and generates first risk operational graph embedding data of the first estimated risk operational data and second risk operational graph embedding data of the first template risk labeling data includes:

Based on the graph structure embedded network, encoding corresponding entity operation data in the first estimated risk operation data based on the plurality of second entity operation knowledge vectors respectively, and generating first entity risk operation graph embedded data corresponding to a plurality of operation entities respectively;

and based on the graph structure embedded network and the seventh entity operation knowledge vectors, respectively encoding the corresponding entity operation data in the first template risk annotation data to generate second entity risk operation graph embedded data corresponding to a plurality of operation entities.

In a possible implementation manner of the first aspect, the method further includes, before the updating of the network weight parameter for the account risk estimation network based on a difference between the first mapping tag and the target mapping tag and a difference between the first risk operation map embedded data and the second risk operation map embedded data:

scrambling the first template risk annotation data to generate fourth template risk annotation data; encoding the fourth template risk annotation data based on the graph structure embedded network to generate third risk operation graph embedded data of the fourth template risk annotation data;

The updating of the network weight parameter for the account risk estimation network based on the difference between the first mapping label and the target mapping label and the difference between the first risk operation map embedded data and the second risk operation map embedded data includes:

and updating the network weight parameters of the account risk estimation network based on the differences among the first risk operation chart embedded data, the second risk operation chart embedded data and the third risk operation chart embedded data and the differences between the first mapping label and the target mapping label.

According to a second aspect of the present application, there is provided a cloud server comprising a machine-readable storage medium storing machine-executable instructions and a processor, which when executing the machine-executable instructions, implements the aforementioned data analysis method for an account risk monitoring system.

According to a third aspect of the present application, there is provided a computer readable storage medium having stored therein computer executable instructions that, when executed, implement the aforementioned data analysis method for an account risk monitoring system.

According to any one of the aspects, in the application, the estimated risk operation data generated by the account risk estimation network is loaded into the observation network, the mapping label of the estimated risk operation data is determined by the observation network, the first risk operation map embedded data of the first estimated risk operation data and the second risk operation map embedded data of the first template risk marking data are extracted based on the map structure embedded network, the network weight parameter of the account risk estimation network is updated based on the difference between the mapping label generated by the observation network and the target mapping label and the difference between the first risk operation map embedded data and the second risk operation map embedded data until the performance of the estimated risk operation data generated by the account risk estimation network is large enough, and the estimated risk operation data can be determined as the prior marked risk account operation data by the observation network through the test of the observation network. Therefore, the observation network and the account risk estimation network can be used as a joint training network model, with the improvement of the performance of the observation network, template risk labeling data and estimated risk operation data generated by the account risk estimation network can be effectively distinguished, and the account risk estimation network is subjected to network weight parameter updating through the distinction between a mapping label generated by the observation network and a target mapping label and the distinction between first risk operation map embedded data and second risk operation map embedded data, so that the account risk estimation network can be promoted to pay more attention to the risk operation map embedded data of the account operation data, and the reliability of account risk estimation is improved.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are needed in the embodiments will be briefly described below, it being understood that the following drawings only illustrate some embodiments of the present application and therefore should not be considered limiting in scope, and other related drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

FIG. 1 is a flow chart of a method for analyzing data for an account risk monitoring system according to an embodiment of the present disclosure;

fig. 2 is a schematic component structure diagram of a cloud server for implementing the data analysis method for an account risk monitoring system according to an embodiment of the present application.

Detailed Description

For the purpose of making the objects, technical solutions and advantages of the embodiments of the present application more clear, the technical solutions of the embodiments of the present application will be clearly and completely described below according to the drawings in the embodiments of the present application, and it should be understood that the drawings in the present application are only for the purpose of illustration and description, and are not intended to limit the protection scope of the present application. In addition, it should be understood that the schematic drawings are not drawn to scale. A flowchart, as used in this application, illustrates operations implemented in accordance with some embodiments of the present application. It should be understood that the operations of the flow diagrams may be implemented out of order and that steps without logical context may be performed in reverse order or concurrently. Moreover, one or more other operations may be added to the flow chart or one or more operations may be destroyed from the flow chart as directed by those skilled in the art in light of the present disclosure.

In addition, the described embodiments are only some, but not all, of the embodiments of the present application. The components of the embodiments of the present application, which are generally described and illustrated in the figures herein, may be arranged and designed in a wide variety of different configurations. Thus, the following detailed description of the embodiments of the present application, as provided in the accompanying drawings, is not intended to limit the scope of the application, as claimed, but is merely intended to reflect selected embodiments of the application. All other embodiments, which can be made by those skilled in the art in light of the embodiments of the present application without undue burden, are within the scope of the present application.

Step S101, acquiring first template account behavior data, wherein the first template account behavior data comprises first template account operation event data and first template risk annotation data corresponding to the first template account operation event data, and the first template risk annotation data is obtained by calibrating risk operation data of account operation nodes in the first template account operation event data.

The first template account behavior data is training sample data for updating an account risk estimation network, the first template account behavior data comprises first template account operation event data, and the first template account operation event data comprises initial operation knowledge vectors of a plurality of template operation instances.

The first template risk annotation data is obtained by calibrating risk operation data of account operation nodes in first template account operation event data, and comprises annotation operation knowledge vectors of a plurality of template operation examples.

Step S102, account risk estimation is carried out on the first template account operation event data based on the account risk estimation network, and first estimated risk operation data are generated.

Step S103, based on an observation network, observing based on a first operation knowledge vector of first template account operation event data and a second operation knowledge vector of first estimated risk operation data, and generating a first mapping tag of the first estimated risk operation data, wherein the first mapping tag is used for reflecting a risk attribute tag corresponding to the first estimated risk operation data.

The observation network is a model for judging risk attribute labels corresponding to account operation data, wherein the first operation knowledge vector comprises initial operation knowledge vectors of a plurality of template operation examples in the first template account operation event data, the second operation knowledge vector comprises risk operation knowledge vectors of the plurality of template operation examples, and the risk operation knowledge vectors are used for reflecting account operation nodes corresponding to the corresponding template operation examples. The observation network observes based on the initial operation knowledge vectors of the template operation examples and the risk operation knowledge vectors of the template operation examples, and outputs a risk attribute label corresponding to the first estimated risk operation data, wherein the risk attribute label is used for reflecting the effect of the first estimated risk operation data.

Step S104, encoding the first estimated risk operation data and the first template risk labeling data based on the graph structure embedded network, and generating first risk operation graph embedded data of the first estimated risk operation data and second risk operation graph embedded data of the first template risk labeling data.

Step S105, based on the difference between the first mapping label and the target mapping label and the difference between the first risk operation chart embedded data and the second risk operation chart embedded data, updating the network weight parameter of the account risk estimation network, so that the training error of the updated account risk estimation network is not reduced any more, and the target mapping label is used for reflecting the risk attribute label as template risk labeling data obtained by performing risk operation data calibration on the account operation nodes in the account operation data, wherein the updated account risk estimation network is used for performing risk operation data prediction on any input account behavior data.

Because the risk attribute label used for reflecting the target mapping label is template risk labeling data obtained by carrying out risk operation data calibration on account operation nodes in account operation data, the difference between the first mapping label and the target mapping label is that: the first estimated risk operation data is distinguished from the risk prediction performance of the template risk annotation data.

Based on the steps, the estimated risk operation data generated by the account risk estimation network is loaded into the observation network, the mapping label of the estimated risk operation data is determined by the observation network, the first risk operation map embedded data of the first estimated risk operation data and the second risk operation map embedded data of the first template risk marking data are extracted based on the map structure embedded network, the network weight parameter of the account risk estimation network is updated based on the difference between the mapping label generated by the observation network and the target mapping label and the difference between the first risk operation map embedded data and the second risk operation map embedded data until the performance of the estimated risk operation data generated by the account risk estimation network is large enough, and the estimated risk operation data can be judged as the risk account operation data marked a priori by the observation network through the test of the observation network. Therefore, the observation network and the account risk estimation network can be used as a joint training network model, with the improvement of the performance of the observation network, template risk labeling data and estimated risk operation data generated by the account risk estimation network can be effectively distinguished, and the account risk estimation network is subjected to network weight parameter updating through the distinction between a mapping label generated by the observation network and a target mapping label and the distinction between first risk operation map embedded data and second risk operation map embedded data, so that the account risk estimation network can be promoted to pay more attention to the risk operation map embedded data of the account operation data, and the reliability of account risk estimation is improved.

Further method embodiments are provided below, the method comprising:

step S201, acquiring first template account behavior data, where the first template account behavior data includes first template account operation event data and first template risk annotation data corresponding to the first template account operation event data.

The first template account behavior data is training sample data for updating the network weight parameters of the account risk estimation network, and comprises first template account operation event data and first template risk annotation data corresponding to the first template account operation event data.

Wherein the first template account operational event data includes initial operational knowledge vectors for a plurality of template operational instances.

In an alternative embodiment, obtaining the first template account behavior data may include: the method comprises the steps of segmenting acquired template account operation event data and template risk annotation data corresponding to the template account operation event data, segmenting the template account operation event data and the template risk annotation data into a plurality of first template account operation event data and a plurality of first template risk annotation data, and subsequently updating network weight parameters of the account risk estimation network based on the plurality of first template account operation event data and the plurality of first template risk annotation data.

Step S202, performing account risk estimation on the first template account operation event data based on the account risk estimation network, and generating first estimated risk operation data.

Step S203, based on the observation network, the first operation knowledge vector of the first template account operation event data and the second operation knowledge vector of the first estimated risk operation data are observed, and a first mapping label of the first estimated risk operation data is generated, where the first mapping label is used to reflect a risk attribute label corresponding to the first estimated risk operation data.

The observation network is a model for judging risk attribute labels corresponding to account operation data, and has an account operation data risk operation prediction function. In an alternative embodiment, the observation network is preset with a plurality of risk attribute tags, and risk operation prediction is performed on the account operation data by determining which risk attribute tag in the preset plurality of risk attribute tags the account operation data belongs to.

In an alternative embodiment, the preset plurality of risk attribute tags may include at least two of risk account operation data obtained by calibrating risk operation data of account operation nodes in the account operation data, risk account operation data generated by an account risk estimation network, or risk account operation data obtained by labeling and scrambling account operation nodes in the account operation data.

In an alternative embodiment, the observation network is provided with at least one risk duration, the first mapping tag being for reflecting comparison information of the first estimated risk operation data with the at least one risk duration, based on which comparison information a risk attribute tag of the first estimated risk operation data can be determined. In an alternative embodiment, the first mapping tag is configured to reflect comparison information between a risk duration of the first estimated risk operation data and a first set level value and a second set level value, where the first set level value is configured to reflect a risk duration of the scrambled template risk annotation data, and the second set level value is configured to reflect a risk duration of the template risk annotation data, so that the risk duration of the estimated risk operation data can be determined based on the mapping tag generated by the observation network.

For example, if the risk duration of the estimated risk operation data does not exceed the first set level value, the comparison information is 0, and if the risk duration of the estimated risk operation data exceeds the first set level value, the comparison information is 1. Therefore, if the first mapping label is [0,0] and is used for reflecting that the risk duration degree of the estimated risk operation data does not exceed the first set degree value and the second set degree value, the mapping label is used for reflecting that the risk attribute label is template risk labeling data after labeling and scrambling the account operation nodes in the account operation data. If the first mapping tag is [1,0], the risk duration degree used for reflecting the estimated risk operation data exceeds a first set degree value, but does not exceed a second set degree value, and the risk attribute tag used for reflecting is the estimated risk operation data generated by the account risk estimation network. And if the first mapping label is [1,1], the first mapping label is used for reflecting that the risk duration degree of the estimated risk operation data exceeds a first set degree value and a second set degree value, and the mapping label is used for reflecting that the risk attribute label is template risk annotation data obtained by carrying out risk operation data calibration on account operation nodes in account operation data.

The first operation knowledge vector comprises initial operation knowledge vectors of a plurality of template operation examples in the first template account operation event data, the second operation knowledge vector comprises risk operation knowledge vectors of a plurality of template operation examples, and the risk operation knowledge vectors are used for reflecting account operation nodes corresponding to the corresponding template operation examples. Observing based on the first operational knowledge vector and the second operational knowledge vector, comprising: the risk prediction performance of the first estimated risk operation data is determined based on the initial operation knowledge vectors of the plurality of template operation instances and the risk operation knowledge vectors of the plurality of template operation instances, i.e., with reference to the first template account operation event data.

In an alternative embodiment, the observation network can only process one account operational data at a time, and therefore, when determining the risk prediction performance of the first estimated risk operational data with reference to the first template account operational event data, the first template account operational event data and the first estimated risk operational data may be subjected to feature interactions, first interaction account operational data is generated, the first interaction account operational data is loaded into the observation network, and the first interaction account operational data is processed by the observation network. In an alternative embodiment, based on an observation network, observing based on a first operational knowledge vector of first template account operational event data and a second operational knowledge vector of first estimated risk operational data, generating a first mapping tag of first estimated risk operational data, comprising: acquiring first interactive account operation data, wherein the first interactive account operation data is generated by carrying out characteristic interaction aggregation on first template account operation event data and first estimated risk operation data, and the first interactive account operation data comprises a first operation knowledge vector and a second operation knowledge vector; based on the observation network, the first mapping tag of the first estimated risk operation data is generated based on the first interactive account operation data.

When the first template account operation event data and the first estimated risk operation data are subjected to characteristic interaction processing, a first operation knowledge vector in the first template account operation event data and a second operation knowledge vector in the first estimated risk operation data are reserved, so that after the first interaction account operation data are loaded into an observation network, the observation network can observe the second operation knowledge vector of the first estimated risk operation data by taking the first operation knowledge vector of the first template account operation event data as a reference, and the operation knowledge vectors of the two account operation data are reserved in one account operation data by combining the two account operation data.

Wherein the first interactive account operation data includes a first operation knowledge vector and a second operation knowledge vector may refer to: each template operation instance in the first interactive account operation data corresponds to an initial operation knowledge vector and a risk operation knowledge vector of the template operation instance.

In an alternative embodiment, the observation network includes an encoding parameter layer and an observation parameter layer, and based on the observation network, the observation is based on the first interactive account operational data, generating a first mapping tag for the first estimated risk operational data, comprising: encoding the first interactive account operation data based on the encoding parameter layer to generate an account operation dependency vector of the first interactive account operation data, wherein the account operation dependency vector is used for reflecting a contact knowledge vector between the first operation knowledge vector and the second operation knowledge vector; based on the observation parameter layer, observation is performed based on the account operation dependency vector, and a first mapping tag is generated.

The first operation knowledge vector comprises initial operation knowledge vectors of a plurality of template operation examples in the first template account operation event data, the initial operation knowledge vectors can be used for reflecting account operation nodes corresponding to the corresponding template operation examples, the second operation knowledge vector comprises risk operation knowledge vectors of the plurality of template operation examples, and the risk operation knowledge vectors are used for reflecting account operation nodes corresponding to the corresponding template operation examples. Therefore, the linking knowledge vector between the first operation knowledge vector and the second operation knowledge vector may be an account operation node corresponding to the corresponding template operation instance for which the initial operation knowledge vector is used to reflect in the first operation knowledge vector, and whether the account operation node corresponding to the corresponding template operation instance for which the risk operation knowledge vector is used to reflect is the same account operation node, or may be an account operation node corresponding to a plurality of template operation instances continuously existing in the first operation knowledge vector, and whether the account operation node corresponding to a plurality of template operation instances continuously existing in the second operation knowledge vector is the same account operation node.

In an alternative embodiment, the account operation dependency vector includes a plurality of entity account operation dependency vectors that may be used to reflect the overall account operation dependency vector of the two account operation data. In an alternative embodiment, the first operational knowledge vector includes a plurality of first entity operational knowledge vectors, the second operational knowledge vector includes a plurality of second entity operational knowledge vectors, the first interactive account operational data is encoded based on the encoding parameter layer to generate an account operational dependency vector of the first interactive account operational data, comprising: based on the coding parameter layer, corresponding entity operation data in the first interactive account operation data are respectively coded based on a plurality of first entity operation knowledge vectors and a plurality of second entity operation knowledge vectors, and entity account operation dependency vectors respectively corresponding to a plurality of operation entities are generated, so that the plurality of entity account operation dependency vectors are generated, namely account operation dependency vectors of the first interactive account operation data are obtained.

In an alternative embodiment, based on the observation network, the observation is performed based on the first operational knowledge vector of the first template account operational event data and the second operational knowledge vector of the first estimated risk operational data, and after generating the first mapping tag of the first estimated risk operational data, the method further comprises: based on the difference between the first mapping label and a first setting mapping label corresponding to the first estimated risk operation data, updating the network weight parameter of the observation network so that the training error of the updated observation network is not reduced continuously, wherein the first setting mapping label is used for reflecting the risk attribute label and is the estimated risk operation data generated by the account risk based estimation network. The performance of the observation network can be improved by updating the network weight parameters of the observation network, so that the account risk estimation network is more difficult to cheat the observation network, the account risk estimation network is required to generate estimated risk operation data which is more similar to template risk annotation data, and the performance of the account risk estimation network is further improved.

The larger the difference between the first mapping tag and the first setting mapping tag, the lower the performance of the observed network, the smaller the difference between the first mapping tag and the first setting mapping tag, and the higher the accuracy of the observed network, and therefore, the network weight parameter of the observed network can be updated based on the difference between the first mapping tag and the first setting mapping tag.

In an alternative embodiment, updating the network weight parameter of the observation network based on a difference between the first mapping label and a first setting mapping label corresponding to the first estimated risk operation data includes: acquiring training errors of the first estimated risk operation data based on a first mapping tag, a first setting mapping tag and third associated attribute information, wherein the third associated attribute information is used for reflecting the relation among the mapping tag determined by an observation network for any one account operation data, the setting mapping tag of the any one account operation data and the training errors of the any one account operation data; based on the training error, network weight information of the observation network is updated.

In an alternative embodiment, second template risk annotation data corresponding to the second template account operation event data is obtained, and the second template risk annotation data is obtained according to risk operation data calibration of account operation nodes in the second template account operation event data; based on an observation network, observing based on a third operation knowledge vector of the second template account operation event data and a fourth operation knowledge vector of the second template risk marking data, and generating a second mapping label of the second template risk marking data, wherein the second mapping label is used for reflecting a risk attribute label corresponding to the second template risk marking data; based on the difference between the second mapping label and the second setting mapping label, updating the network weight parameter of the observation network so that the training error of the updated observation network is not reduced continuously, wherein the second mapping label is used for reflecting the risk attribute label which is template risk marking data obtained by carrying out risk operation data calibration on account operation nodes in account operation data.

The second mapping label is a mapping label determined by the decision model for the second template risk labeling data, but the second template account operation event data is actually obtained by calibrating the risk operation data for the account operation node in the second template account operation event data, so the actual risk attribute label of the second template account operation event data should be the template risk labeling data, that is, the actual mapping label is the second mapping label, therefore, based on the difference between the first mapping label and the second setting mapping label, the network weight parameter update is performed on the observation network, so that the training error of the observation network is reduced, the training error of the observation network is gradually reduced with multiple updates of the observation network until the training error is not reduced any more, and the performance of the observation network meets the condition.

In addition, the second template account operation event data and the first template account operation event data may be the same template account operation event data or may be different template account operation event data.

In addition, based on the difference between the second mapping tag and the second setting mapping tag, the manner of updating the network weight parameter of the observation network is similar to the manner of updating the network weight parameter of the observation network based on the difference between the first setting mapping tag corresponding to the first mapping tag and the first estimated risk operation data.

In an alternative embodiment, second estimated risk operation data corresponding to second template account operation event data is obtained, and the second estimated risk operation data is obtained by performing account risk estimation on the second template account operation event data according to an account risk estimation network; based on an observation network, observing based on a third operation knowledge vector of the second template account operation event data and a fifth operation knowledge vector of the second estimated risk operation data, and generating a third mapping tag of the second estimated risk operation data, wherein the third mapping tag is used for reflecting a risk attribute tag corresponding to the second estimated risk operation data; and based on the difference between the third mapping label and the third setting mapping label, updating the network weight parameter of the observation network so that the training error of the updated observation network is not reduced continuously, wherein the third setting mapping label is used for reflecting the risk attribute label which is estimated risk operation data generated by the account risk estimation network.

In addition, based on the difference between the third mapping tag and the third setting mapping tag, the manner of updating the network weight parameter for the observation network is similar to the manner of updating the network weight parameter for the observation network based on the difference between the first mapping tag and the first setting mapping tag corresponding to the first estimated risk operation data.

In an alternative embodiment, second template risk annotation data corresponding to the second template account operation event data is obtained, and the second template risk annotation data is obtained according to risk operation data calibration of account operation nodes in the second template account operation event data; scrambling the risk annotation data of the second template to generate risk annotation data of a third template; based on an observation network, observing based on a third operation knowledge vector of the second template account operation event data and a sixth operation knowledge vector of the third template risk marking data, and generating a fourth mapping tag of the third template risk marking data, wherein the fourth mapping tag is used for reflecting a risk attribute tag corresponding to the third template risk marking data; based on the difference between the fourth mapping label and the fourth setting mapping label, updating the network weight parameter of the observation network so that the training error of the updated observation network is not reduced continuously, wherein the fourth setting mapping label is used for reflecting the risk attribute label which is template risk labeling data after labeling and scrambling the account operation nodes in the account operation data.

In addition, based on the difference between the fourth mapping tag and the fourth setting mapping tag, the manner of updating the network weight parameter for the observation network is similar to the manner of updating the network weight parameter for the observation network based on the difference between the first mapping tag and the first setting mapping tag corresponding to the first estimated risk operation data.

In an alternative embodiment, the network weight parameter update is performed on the observation network based on a difference between the second mapping tag and the second setting mapping tag, a difference between the third mapping tag and the third setting mapping tag, and a difference between the fourth mapping tag and the fourth setting mapping tag.

In an alternative embodiment, updating the network weight parameter of the observation network based on the difference between the second mapping tag and the second setting mapping tag, the difference between the third mapping tag and the third setting mapping tag, and the difference between the fourth mapping tag and the fourth setting mapping tag may include: acquiring training errors based on the second mapping tag, the second setting mapping tag, the third setting mapping tag, the fourth setting mapping tag and third association attribute information, wherein the third association attribute information is used for reflecting the relation among the mapping tag determined by the observation network for any one account operation data, the setting mapping tag of the any one account operation data and the training errors of the any one account operation data; based on the training error, network weight information of the observation network is updated.

Step S204, encoding the first risk estimation operation data based on the graph structure embedded network to generate first risk operation graph embedded data of the first risk estimation operation data.

In an alternative embodiment, the graph structure embedding network may first extract risk operation graph embedding data of the operation entities estimating the risk operation data when encoding the first estimated risk operation data, and the risk operation graph embedding data of the plurality of operation entities constitute first risk operation graph embedding data of the first estimated risk operation data. In an alternative embodiment, the second operational knowledge vector of the first estimated risk operational data comprises a plurality of second entity operational knowledge vectors, the first risk operational graph embedded data comprises a plurality of first entity risk operational graph embedded data, the first estimated risk operational data is encoded based on a graph structure embedded network, the first risk operational graph embedded data of the first estimated risk operational data is generated, comprising: and based on the graph structure embedded network, encoding corresponding entity operation data in the first estimated risk operation data based on a plurality of second entity operation knowledge vectors respectively, and generating first entity risk operation graph embedded data corresponding to a plurality of operation entities respectively.

Step S205, encoding the first template risk marking data based on the graph structure embedded network, and generating second risk operation graph embedded data of the first template risk marking data.

The information in the first template account operation event data is rich, if the first template account operation event data is encoded, the risk operation chart embedded data of the first template account operation event data may be difficult to extract, and because the first template risk annotation data is obtained by calibrating the risk operation data of the account operation nodes in the first template account operation event data, the first template risk annotation data can be regarded as actual risk account operation data, and the account risk estimation information in the first template risk annotation data can restore the account operation nodes in the first template account operation event data, so that the first template risk annotation data is encoded, the risk operation chart embedded data not only can be extracted, but also can be better used for reflecting the risk operation chart embedded data of the first template account operation event data.

In an alternative embodiment, when the first template risk labeling data is encoded by the graph structure embedding network, risk operation graph embedding data of operation entities estimating risk operation data may be extracted first, and the risk operation graph embedding data of a plurality of operation entities form first risk operation graph embedding data of the first template risk labeling data. In an alternative embodiment, the seventh operational knowledge vector of the first template risk tagging data includes a plurality of seventh entity operational knowledge vectors, the second risk operational graph embedding data includes a plurality of second entity risk operational graph embedding data, the first template risk tagging data is encoded based on the graph structure embedding network, and the first risk operational graph embedding data of the first template risk tagging data is generated, including: and based on the graph structure embedded network, encoding the corresponding entity operation data in the first template risk annotation data based on a plurality of seventh entity operation knowledge vectors respectively, and generating second entity risk operation graph embedded data corresponding to a plurality of operation entities respectively. Because the problem of inaccurate risk operation chart embedded data occurs when global risk operation chart embedded data of account operation data are directly obtained, the chart structure embedded network firstly obtains entity operation data risk operation chart embedded data of operation entities, and obtains more accurate all risk operation chart embedded data by obtaining entity operation data risk operation chart embedded data of a plurality of operation entities.

And S206, scrambling the first template risk annotation data to generate fourth template risk annotation data.

And S207, encoding fourth template risk marking data based on the graph structure embedded network, and generating third risk operation graph embedded data of the fourth template risk marking data.

In an alternative embodiment, when the fourth template risk labeling data is encoded by the graph structure embedding network, risk operation graph embedding data of operation entities estimating the risk operation data may be extracted first, and the risk operation graph embedding data of the plurality of operation entities form first risk operation graph embedding data of the fourth template risk labeling data. In an alternative embodiment, the eighth operational knowledge vector of the fourth template risk tagging data includes a plurality of eighth entity operational knowledge vectors, the third risk operational graph embedding data includes a plurality of third entity risk operational graph embedding data, the fourth template risk tagging data is encoded based on the graph structure embedding network, and the first risk operational graph embedding data of the fourth template risk tagging data is generated, including: and based on the graph structure embedded network, encoding the corresponding entity operation data in the fourth template risk annotation data based on a plurality of eighth entity operation knowledge vectors, and generating third entity risk operation graph embedded data corresponding to a plurality of operation entities. Because the problem of inaccurate risk operation chart embedded data occurs when global risk operation chart embedded data of account operation data are directly obtained, the chart structure embedded network firstly obtains entity operation data risk operation chart embedded data of operation entities, and obtains more accurate all risk operation chart embedded data by obtaining entity operation data risk operation chart embedded data of a plurality of operation entities.

Step S208, updating the network weight parameter of the account risk estimation network based on the first risk operation map embedded data, the difference between the second risk operation map embedded data and the third risk operation map embedded data, and the difference between the first mapping label and the target mapping label.

Because the first mapping tag and the target mapping tag are determined according to the observation network, and the first risk operation map embedding data, the second risk operation map embedding data and the third risk operation map embedding data are determined according to the account risk estimation network, the first mapping tag and the target mapping tag may correspond to one piece of associated attribute information, and the first risk operation map embedding data, the second risk operation map embedding data and the third risk operation map embedding data may correspond to one piece of associated attribute information.

In an alternative embodiment, updating the account risk estimation network with network weight parameters based on the differences between the first risk profile embedded data, the second risk profile embedded data, and the third risk profile embedded data, and the differences between the first mapping tag and the target mapping tag, includes: acquiring a first training error of first estimated risk operation data based on a first mapping tag, a target mapping tag and first associated attribute information, wherein the first associated attribute information is used for reflecting the relation among the mapping tag determined by an observation network for any one account operation data, the target mapping tag of any one account operation data and the training error of any one account operation data; acquiring second training errors of the first estimated risk operation data based on the first risk operation map embedded data, the second risk operation map embedded data, the third risk operation map embedded data and second associated attribute information, wherein the second associated attribute information is used for reflecting the relation between the risk operation map embedded data of any one estimated risk operation data, the risk operation map embedded data of template risk marking data corresponding to any one estimated risk operation data, the risk operation map embedded data of the scrambled template risk marking data corresponding to any one estimated risk operation data and the training errors of any one estimated risk operation data; based on the first training error and the second training error, updating network weight information of the account risk estimation network.

In addition, updating the network weight information of the account risk estimation network based on the first training error and the second training error may include: and carrying out weighted calculation on the first training error and the second training error, and updating the network weight information of the account risk estimation network based on the training errors after weighted calculation.

In an alternative embodiment, after performing step S203, the following steps are performed directly: and updating the network weight parameters of the account risk estimation network based on the difference between the first mapping label and the target mapping label.

And if the observation network observes the plurality of estimated risk operation data generated by the account risk estimation network, and most of the generated mapping labels are used for reflecting the risk attribute labels of the estimated risk operation data to be template risk annotation data, the account risk estimation network training is completed.

The account risk estimation network and the observation network form a combined training network, and because the account risk estimation network generates estimated risk operation data, the observation network verifies whether the estimated risk operation data is generated account operation data or actual account operation data, and the learning purpose of the observation network is as follows: by updating the network weight parameters of the observation network, the observation network can more accurately distinguish template risk annotation data from estimated risk operation data generated by an account risk estimation network. While the learning purpose of the account risk estimation network is: by updating the network weight parameters of the account risk estimation network, the estimated risk operation data generated by the account risk estimation network is more accurate and is closer to the template risk annotation data, and the observation network can judge the estimated risk operation data as the template risk annotation data.

In an alternative embodiment, updating the network weight parameter of the account risk estimation network based on the difference between the first mapping tag and the target mapping tag may include: acquiring training errors of first estimated risk operation data based on a first mapping tag, a target mapping tag and first associated attribute information, wherein the first associated attribute information is used for reflecting the relation among the mapping tag determined by an observation network for any one account operation data, the target mapping tag of any one account operation data and the training errors of any one account operation data; based on the training error, updating network weight information of the account risk estimation network.

In an alternative embodiment, updating the network weight parameters of the account risk estimation network based on the differences between the first risk operation map embedded data, the second risk operation map embedded data, and the third risk operation map embedded data, and the differences between the first template risk labeling data and the first estimated risk operation data, and the differences between the first mapping tag and the target mapping tag may include: acquiring training errors of the account risk estimation network based on the first template risk annotation data, the first estimated risk operation data and the fourth associated attribute information, and updating network weight information of the account risk estimation network based on the training errors of the account risk estimation network and the first training errors and the second training errors of the first estimated risk operation data so that the training errors of the account risk estimation network do not continuously decline.

The fourth association attribute information is used for reflecting risk account operation data generated by the account risk estimation network for any one account operation data and the relation between the annotated account operation data of any one account operation data and training errors of the account risk estimation network.

In an alternative embodiment, updating the account risk estimation network with the network weight parameters based on the difference between the first risk operation map embedded data and the second risk operation map embedded data, and the difference between the first mapping tag and the target mapping tag may include: acquiring training errors of the first estimated risk operation data based on the first risk operation map embedded data, the second risk operation map embedded data and second associated attribute information, wherein the second associated attribute information is used for reflecting the relation between the risk operation map embedded data of any one estimated risk operation data, the risk operation map embedded data of the template risk marking data corresponding to any one estimated risk operation data and the training errors of any one estimated risk operation data; acquiring a first training error of first estimated risk operation data based on a first mapping tag, a target mapping tag and first associated attribute information, wherein the first associated attribute information is used for reflecting the relation among the mapping tag determined by an observation network for any one account operation data, the target mapping tag of any one account operation data and the training error of any one account operation data; based on the first training error and the second training error, updating network weight information of the account risk estimation network.

Based on the steps, estimated risk operation data generated by an account risk estimation network are loaded into an observation network, a mapping label of the estimated risk operation data is determined by the observation network, first risk operation map embedded data of the first estimated risk operation data and second risk operation map embedded data of first template risk marking data are extracted based on a map structure embedded network, network weight parameter updating is carried out on the account risk estimation network based on the difference between the mapping label generated by the observation network and a target mapping label and the difference between the first risk operation map embedded data and the second risk operation map embedded data, the account risk estimation network can be promoted to pay more attention to the risk operation map embedded data of the account operation data, and the accuracy of subsequent account risk estimation is improved.

In addition, the mapping tag is used to reflect the comparison information of the account operational data with the at least one risk duration, whereby the risk duration of the account operational data can be determined based on the mapping tag generated by the observation network.

Fig. 2 schematically illustrates a cloud server 100 that may be used to implement various embodiments described herein.

For one embodiment, fig. 2 shows a cloud server 100, the cloud server 100 having one or more processors 102, a control module (chipset) 104 coupled to one or more of the processor(s) 102, a memory 106 coupled to the control module 104, a non-volatile memory (NVM)/storage 108 coupled to the control module 104, one or more input/output devices 110 coupled to the control module 104, and a network interface 112 coupled to the control module 106.

The processor 102 may include one or more single-core or multi-core processors, and the processor 102 may include any combination of general-purpose or special-purpose processors (e.g., graphics processors, application processors, baseband processors, etc.). In some exemplary design considerations, the cloud server 100 can be a server device such as a gateway described in the embodiments of the present application.

In some example design considerations, cloud server 100 may include one or more computer-readable media (e.g., memory 106 or NVM/storage 108) having instructions 114 and one or more processors 102, in conjunction with the one or more computer-readable media, configured to execute instructions 114 to implement modules to perform actions described in this disclosure.

For one embodiment, the control module 104 may include any suitable interface controller to provide any suitable interface to one or more of the processor(s) 102 and/or any suitable device or component in communication with the control module 104.

The control module 104 may include a memory controller module to provide an interface to the memory 106. The memory controller modules may be hardware modules, software modules, and/or firmware modules.

Memory 106 may be used, for example, to load and store data and/or instructions 114 for cloud server 100. For one embodiment, memory 106 may comprise any suitable volatile memory, such as, for example, a suitable DRAM. In some exemplary design considerations, memory 106 may include a double data rate type four synchronous dynamic random access memory (DDR 4 SDRAM).

For one embodiment, control module 104 may include one or more input/output controllers to provide interfaces to NVM/storage 108 and input/output device(s) 110.

For example, NVM/storage 108 may be used to store data and/or instructions 114. NVM/storage 108 may include any suitable nonvolatile memory (e.g., flash memory) and/or may include any suitable nonvolatile storage(s) (e.g., one or more Hard Disk Drives (HDDs), one or more Compact Disc (CD) drives, and/or one or more Digital Versatile Disc (DVD) drives).

NVM/storage 108 may include storage resources that are physically part of the device on which cloud server 100 is installed, or may be accessible by the device without necessarily being part of the device. For example, NVM/storage 108 may be accessed via input/output device(s) 110 according to a network.

Input/output device(s) 110 may provide an interface for cloud server 100 to communicate with any other suitable device, and input/output device 110 may include a communication component, pinyin component, sensor component, and the like. The network interface 112 may provide an interface for the cloud server 100 to communicate in accordance with one or more networks, and the cloud server 100 may communicate wirelessly with one or more components of a wireless network in accordance with any of one or more wireless network standards and/or protocols, such as accessing a wireless network in accordance with a communication standard, such as WwFw, 2G, 3G, 4G, 5G, etc., or a combination thereof.

For one embodiment, one or more of the processor(s) 102 may be loaded with logic of one or more controllers (e.g., memory controller modules) of the control module 104. For one embodiment, one or more of the processor(s) 102 may be loaded together with logic of one or more controllers of the control module 104 to form a system level load. For one embodiment, one or more of the processor(s) 102 may be integrated on the same mold as logic of one or more controllers of the control module 104. For one embodiment, one or more of the processor(s) 102 may be integrated on the same die with logic of one or more controllers of the control module 104 to form a system on chip (SoC).

In various embodiments, cloud server 100 may be, but is not limited to being: cloud servers, desktop computing devices, or mobile computing devices (e.g., laptop computing devices, handheld computing devices, tablet computers, netbooks, etc.). In various embodiments, cloud server 100 may have more or fewer components and/or different architectures. For example, in some exemplary design considerations, cloud server 100 includes one or more cameras, keyboards, liquid Crystal Display (LCD) screens (including touch screen displays), non-volatile memory ports, multiple antennas, graphics chips, application Specific Integrated Circuits (ASICs), and speakers.

The foregoing has outlined rather broadly the more detailed description of embodiments of the present application, wherein specific examples are provided herein to illustrate the principles and embodiments of the present application, the above examples being provided solely to assist in the understanding of the methods of the present application and the core ideas thereof; meanwhile, as those skilled in the art will have modifications in the specific embodiments and application scope in accordance with the ideas of the present application, the present description should not be construed as limiting the present application in view of the above.

Claims

1. A data analysis method for an account risk monitoring system, applied to a cloud server, the method comprising:

2. The data analysis method for an account risk monitoring system of claim 1, wherein the generating a first mapping tag of the first estimated risk operation data based on the observation network, based on a first operational knowledge vector of the first template account operation event data and a second operational knowledge vector of the first estimated risk operation data, comprises:

3. The method of claim 1, wherein the updating the network weight parameters of the account risk estimation network based on the difference between the first map label and the target map label and the difference between the first risk operation map embedded data and the second risk operation map embedded data comprises:

4. The data analysis method for an account risk monitoring system of claim 1, wherein the observing based on the observation network, based on a first operational knowledge vector of the first template account operational event data and a second operational knowledge vector of the first estimated risk operational data, after generating a first mapped tag of the first estimated risk operational data, the method further comprises:

5. The method of data analysis for an account risk monitoring system of claim 1, further comprising:

6. The method of data analysis for an account risk monitoring system of claim 1, further comprising:

7. The method of data analysis for an account risk monitoring system of claim 1, further comprising:

8. The data analysis method for an account risk monitoring system of claim 1, wherein the second operational knowledge vector of the first estimated risk operational data comprises a plurality of second entity operational knowledge vectors, the first risk operational graph embedding data comprises a plurality of first entity risk operational graph embedding data, the seventh operational knowledge vector of the first template risk labeling data comprises a plurality of seventh entity operational knowledge vectors, the second risk operational graph embedding data comprises a plurality of second entity risk operational graph embedding data, the graph structure-based embedding network encodes the first estimated risk operational data and the first template risk labeling data, and generates first risk operational graph embedding data of the first estimated risk operational data and second risk operational graph embedding data of the first template risk labeling data, comprising:

9. The method of claim 1, wherein the method further comprises, prior to updating the network weight parameters for the account risk estimation network based on a distinction between the first map label and a target map label and a distinction between the first risk operation map embedded data and the second risk operation map embedded data:

10. A data analysis system for an account risk monitoring system, the data analysis system for an account risk monitoring system comprising a cloud server and a user terminal communicatively connected to the cloud server, the cloud server being specifically configured to: