CN118071512A

CN118071512A - Penetration risk analysis method, penetration risk analysis device, computer equipment and storage medium

Info

Publication number: CN118071512A
Application number: CN202410373147.9A
Authority: CN
Inventors: 陈舒杭
Original assignee: China Construction Bank Corp; CCB Finetech Co Ltd
Current assignee: China Construction Bank Corp; CCB Finetech Co Ltd
Priority date: 2024-03-29
Filing date: 2024-03-29
Publication date: 2024-05-24

Abstract

The disclosure relates to the technical field of big data processing, and particularly discloses a penetration risk analysis method, a penetration risk analysis device, computer equipment, a storage medium and a computer program product. The method comprises the following steps: acquiring object information of a risk object and a multi-association relationship map to which the risk object belongs under the condition that the risk object exists; searching risk nodes corresponding to the risk objects in a plurality of object nodes contained in the multi-association relation map based on the object information; the multi-association relationship map is used for representing at least two association relationships among the plurality of object nodes; based on the connection relation among the object nodes, determining a penetration type risk path comprising at least two path nodes by taking the risk nodes as path starting points; and determining a risk analysis result of the penetration type risk path according to the incidence relation existing among the path nodes in the penetration type risk path. The method can improve the penetrating supervision efficiency and reduce the penetrating supervision cost.

Description

Penetration risk analysis method, penetration risk analysis device, computer equipment and storage medium

Technical Field

The present application relates to the field of big data processing technology, and in particular, to a penetration risk analysis method, apparatus, computer device, storage medium, and computer program product.

Background

The implementation of the penetration type supervision on the field of the finance and technology innovation is a supervision means of the key layout in the current finance field, wherein the penetration type supervision is a finance supervision method, and aims to supervise all participants in the finance market, including financial institutions, market participants and investors, so as to ensure fair, transparent and compliant operation of the market. Such regulatory methodologies are intended to gain insight into various aspects of the marketplace in order to identify potential risks and misbehavior, and to take corresponding action to maintain marketing order and protect investor interests.

In the whole, the penetration type financial supervision of the financial field is currently in a fumbling stage, and although certain effects are achieved, the time cost and the calculation cost of the implementation are high, and the penetration type financial supervision cannot be promoted to be expanded comprehensively in the financial field.

Disclosure of Invention

In view of the foregoing, it is desirable to provide a method, apparatus, computer device, computer readable storage medium, and computer program product for through risk analysis that can improve through-penetration supervision efficiency and reduce through-penetration supervision costs.

In a first aspect, the present application provides a method of risk analysis by penetration, the method comprising:

acquiring object information of a risk object and a multi-association relationship map to which the risk object belongs under the condition that the risk object exists;

Based on the object information, searching a risk node corresponding to the risk object in a plurality of object nodes contained in the multi-association relation map; the multi-association relationship map is used for representing at least two association relationships among a plurality of object nodes;

determining a penetration type risk path comprising at least two path nodes by taking the risk nodes as path starting points based on the connection relation among the object nodes;

And determining a risk analysis result of the penetration risk path according to the association relation existing between the path nodes in the penetration risk path.

In one embodiment, the determining, based on the connection relationship between the object nodes, a penetration risk path including at least two path nodes with the risk node as a path start point includes:

Determining a penetration path comprising at least two path nodes from the multi-association relationship map by taking the risk node as a path starting point based on the connection relationship between the object nodes;

and determining the penetration risk path comprising at least two path nodes according to the node number of the path nodes contained in the penetration path and a preset node number threshold value.

In one embodiment, the determining the penetration risk path including at least two path nodes according to the number of the path nodes included in the penetration path and a preset threshold of the number of the nodes includes:

and under the condition that the number of the nodes of the path nodes contained in the penetration path is smaller than or equal to a preset threshold value of the number of the nodes, determining the penetration path containing at least two path nodes as a penetration risk path.

In one embodiment, the determining the penetration risk path including at least two path nodes according to the number of path nodes included in the penetration path and a preset threshold of the number of nodes includes:

Under the condition that the number of nodes of path nodes contained in the penetrating path is larger than a preset threshold value of the number of nodes, taking the risk nodes as path starting points, and determining path cut-off nodes from the path nodes according to the threshold value of the number of nodes;

And determining a part of paths from the risk node to the path cut-off node in the penetration type path as penetration type risk paths.

In one embodiment, the determining, based on the connection relationship between the object nodes, a penetration path including at least two path nodes from the multiple association relationship map with the risk node as a path start point includes:

Based on the connection relation between the object nodes, determining a plurality of initial node combination paths comprising at least two path nodes from the multi-association relation map by taking the risk nodes as path starting points;

And determining the initial node combination path meeting the association relation conditions as a penetration path according to the association relation existing between the path nodes of each initial node combination path and the preset association relation conditions.

In one embodiment, the determining, according to the association relationship existing between the path nodes in the through-type risk path, a risk analysis result of the through-type risk path includes:

Determining the relationship types of the association relationships existing between the path nodes in the penetration risk path;

Based on the relation type and preset weight configuration information, determining a corresponding related weight value between the path nodes;

And determining a risk analysis result of the penetrating risk path according to each related weight value.

In a second aspect, the present application also provides a through-type risk analysis device, the device comprising:

The information and map acquisition module is used for acquiring object information of the risk object and a multi-association relation map to which the risk object belongs under the condition that the risk object exists;

The node searching module is used for searching the risk node corresponding to the risk object in a plurality of object nodes contained in the multi-association relation map based on the object information; the multi-association relationship map is used for representing at least two association relationships among a plurality of object nodes;

the path determining module is used for determining a penetration type risk path comprising at least two path nodes by taking the risk nodes as path starting points based on the connection relation among the object nodes;

The risk analysis module is used for determining a risk analysis result of the penetrating type risk path according to the incidence relation existing between the path nodes in the penetrating type risk path.

In a third aspect, the present application also provides a computer device comprising a memory storing a computer program and a processor implementing the steps of the method described above when the processor executes the computer program.

In a fourth aspect, the present application also provides a computer readable storage medium having stored thereon a computer program which when executed by a processor performs the steps of the method described above.

In a fifth aspect, the application also provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the method described above.

According to the penetration risk analysis method, the device, the computer equipment, the storage medium and the computer program product, the object information of the risk object and the multi-association relation map of the risk object are obtained under the condition that the risk object exists, the risk nodes corresponding to the risk object are searched in a plurality of object nodes contained in the multi-association relation map based on the object information, and as the multi-association relation map can represent at least two association relations among the plurality of object nodes, the penetration risk path comprising at least two path nodes can be determined by taking the risk nodes as path starting points in the multi-association relation map based on the connection relation among the object nodes, and then the risk analysis result of the penetration risk path is determined according to the association relation among the path nodes in the penetration risk path. The object corresponding to the path node contained in the penetration type risk path can be regarded as the object with the association relation with the risk object, the risk analysis result corresponding to the object with the association relation with the risk object can be rapidly determined by carrying out the risk analysis on the penetration type risk path, the penetration type supervision efficiency is effectively improved, the risk analysis is carried out based on the preset multi-association relation map, and the supervision cost of the penetration type supervision can be effectively reduced.

Drawings

FIG. 1 is a diagram of an application environment of a method for risk analysis by penetration in one embodiment;

FIG. 2 is a flow chart of a method of risk analysis according to one embodiment;

FIG. 3 is a flow chart of determining a penetration risk path including at least two path nodes based on a connection relationship between object nodes and using the risk node as a path start point in one embodiment;

FIG. 4 is a flow chart of determining a penetration risk path including at least two path nodes according to the number of nodes of the path nodes included in the penetration path and a preset threshold value of the number of nodes in one embodiment;

FIG. 5 is a schematic flow chart of determining a penetration path including at least two path nodes from a multiple association map based on a connection relationship between object nodes and using a risk node as a path start point in one embodiment;

FIG. 6 is a flowchart illustrating a risk analysis result of determining a penetration risk path according to an association relationship existing between path nodes in the penetration risk path in an embodiment;

FIG. 7 is a flow chart of a method of risk analysis according to another embodiment;

FIG. 8 is a block diagram of a through-type risk analysis device in one embodiment;

fig. 9 is an internal structural diagram of a computer device in one embodiment.

Detailed Description

The present application will be described in further detail with reference to the drawings and examples, in order to make the objects, technical solutions and advantages of the present application more apparent. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the application. It should be noted that, in the embodiments of the present application, some existing solutions in the industry such as software, group, model, etc. may be mentioned, and they should be regarded as exemplary only for illustrating the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or must not use the solution.

The user information (including but not limited to user equipment information, user personal information, etc.) and the data (including but not limited to data for analysis, stored data, presented data, etc.) related to the present application are information and data authorized by the user or sufficiently authorized by each party. The technical scheme of the application obtains, stores, uses, processes and the like the data, which all meet the relevant regulations of national laws and regulations.

The penetration risk analysis method provided by the embodiment of the application can be applied to an application environment shown in fig. 1. Wherein the through-penetration supervisory system 102 is communicatively coupled to the business system 104. The data storage system may store data that the through-the-air supervisory system 102 needs to process. The data storage system may be integrated on the through-the-air supervisory system 102 or may be placed on the cloud or other network server. In the case of the risk object, the penetration type supervisory system 102 may acquire object information of the risk object and a multiple association relationship map to which the risk object belongs from the service system 104, find, from a plurality of object nodes included in the multiple association relationship map, risk nodes corresponding to the risk object, where the multiple association relationship map may be used to characterize at least two association relationships between the plurality of object nodes, determine a penetration type risk path including at least two path nodes based on a connection relationship between the object nodes, and determine a risk analysis result of the penetration type risk path according to the association relationship existing between the path nodes in the penetration type risk path, with the risk node as a path start point.

The penetration type supervisory system 102 is a supervisory system that performs supervisory actions such as risk monitoring, risk analysis, risk elimination, etc. on each business object in the business market based on business data. The pass-through supervisory system 102 may be integrated on any terminal, or may be implemented by a stand-alone server or a server cluster composed of a plurality of servers. The terminal may be, but not limited to, various personal computers, notebook computers, smartphones, tablet computers, and portable wearable devices, which may be smartwatches, smartbracelets, headsets, etc.

Business system 104 may be considered a financial institution, such as a bank, or a regulatory agency, such as a system server that performs business processes, manages business information, etc. Information data related to the business object can be recorded and stored in the business system 104, so that the business behavior of the business object can be managed conveniently. It will be appreciated that the business system 104 may also be implemented as a stand-alone server or as a cluster of servers.

In one embodiment, as shown in fig. 2, a method for risk analysis through penetration is provided, and the method is applied to the penetration type supervision system 102 in fig. 1, and is illustrated as an example, and includes the following steps:

S202, acquiring object information of the risk object and a multi-association relation map of the risk object when the risk object exists.

The object refers to a user object for business management of a business system, such as a personal user, an economic subject user and the like managed by the business system. The risk object is an object for determining that financial risk exists in the business processing process in the business management process.

The object information is unique identification information for identifying the object identity of the risk object in a distinguishing way, and the object information may include identification information of the risk object, such as user identification, user name, etc., and may also include identity information of the risk object, such as age, sex, occupation, city, etc.

The multi-association relationship map is relationship map data formed by each object node and association relationships existing between the object nodes, and the multi-association relationship map to which the risk object belongs refers to relationship map data which contains the object nodes corresponding to the risk object and can represent association relationships between the risk object and objects corresponding to other object nodes.

Specifically, in the case where there is a risk object, the penetration supervisory system may acquire object information of the risk object from the service system, and a multiple association relationship map to which the risk object belongs.

In one embodiment, the penetration type supervisory system may determine, according to the supervisory service data, whether a service object corresponding to the supervisory service data has a service risk, and determine, when it is determined that the service object has the service risk, the service object having the service risk as a risk object.

In one embodiment, the through-the-air supervisory system may determine that a risk object is present in response to a supervisory person's through-the-air supervisory request based on a risk object triggered by a supervisory terminal.

In one embodiment, the penetration type supervision system determines object information corresponding to the object identifier from the service system according to the object identifier of the risk object and a preset corresponding relationship between information and the identifier under the condition that the risk object is determined to exist, and then obtains a multi-association relationship map containing risk nodes corresponding to the risk object from a plurality of multi-association relationship maps according to a map index mode.

S204, searching risk nodes corresponding to the risk objects in a plurality of object nodes contained in the multi-association relation map based on the object information.

The multi-association relationship map is a relationship fusion relationship map which can be used for representing at least two association relationships among a plurality of object nodes, can be generated in advance by fusing a plurality of relationship maps representing the association relationships among the object nodes, and is configured in the penetration type supervision system.

In one embodiment, after acquiring a plurality of relationship maps for representing different association relationships between a plurality of object nodes, the penetration supervisory system may use each object node in any one of the relationship maps as a reference node to fuse the plurality of relationship maps. For example, a relationship map A, B, C is obtained, where a map is used to represent a first relationship between object nodes in the a map, B map is used to represent a second relationship between object nodes in the B map, and C map is used to represent a third relationship between object nodes in the C map. The penetrating supervision system can use each object node in the A map as a reference node to be fused to obtain an ABC multi-association relation map. For example, if there are connected a and b nodes in the a-map, it is represented that there is a first association relationship between the a and b nodes, at this time, it may be searched whether there is any other association relationship between the a and b nodes in the B, C nodes, if there is any, the association relationship between the a and b nodes in the B, C nodes may be nested into the current a-map, for example, all the association relationships between the a and b nodes are recorded on the connection line between the a and b nodes, so as to obtain a multi-association relationship map including the a and b nodes.

It can be appreciated that the types and the number of the association relationships can be determined according to more practical supervision requirements, for example, the association relationships can include at least two of business data association relationships, social relationship association relationships, resource configuration association relationships in an economic main body and resource exchange association relationships.

In one embodiment, the generation of each relationship graph and the generation of the corresponding multiple relationship graphs are described by taking the relationship including social relationship, resource allocation relationship and resource exchange relationship in the economic main body as an example.

Specifically, the penetration supervisory system determines a pattern type of a pattern to be constructed in response to a pattern construction instruction, and determines pattern construction information required for constructing the pattern based on the pattern type.

When a social relationship graph for representing the social relationship existing between the object nodes is constructed, personal user information and associated person information data related to the personal user information can be obtained, and the social relationship graph is constructed by natural artificial nodes.

When a resource allocation relation map for representing the resource allocation association relation in the economic main body is constructed, the economic main body information, the user information of the resource allocation user in the economic main body and the associated person information related to the resource allocation user can be obtained, and the resource allocation relation map is constructed by legal persons and natural artificial nodes.

When a resource exchange relation map for representing the resource exchange association relation among users is constructed, resource exchange detail data of exchangeable resource accounts in a system can be obtained, the users corresponding to the resource exchange accounts are taken as granularity, the details of the resource exchange among the users are summarized, and the resource exchange relation map is constructed.

After the social relationship graph, the resource allocation relationship graph and the resource exchange relationship graph are obtained, the object nodes in the resource exchange relationship graph are used as standard nodes, and the social relationship graph, the resource allocation relationship graph and the resource exchange relationship graph are overlapped and fused to obtain a multi-association relationship graph which can be used for simultaneously representing the social association relationship among the object nodes, the resource allocation association relationship in the economic main body and the resource exchange association relationship.

Specifically, because the multiple association relationship map obtained by the penetration type supervision system is the multiple association relationship map to which the risk object belongs, the penetration type supervision system can search the risk nodes corresponding to the risk object in the multiple object nodes contained in the multiple association relationship map based on the object information after obtaining the object information of the risk object.

In one embodiment, the penetration supervisory system may search for a risk node matching the object information based on the object information according to a correspondence between the object nodes of the multiple association relationship map and the object information.

S206, determining a penetration risk path comprising at least two path nodes by taking the risk nodes as path starting points based on the connection relation among the object nodes.

The connection relationship between the object nodes can represent at least one association relationship existing between the object nodes.

The penetration risk path takes a risk node as a path starting point, and a combined path comprising at least two path nodes is determined based on the connection relation among all object nodes. Each path node on the penetration type risk path has a direct or indirect association relation with the risk node. For example, the current risk node is an a node, a connection relationship exists between an a node and a b node, that is, a direct association relationship exists between the a node and the b node, a connection relationship exists between the b node and a c node, that is, an indirect association relationship exists between the c node and the a node, and so on, and the finally constructed penetration risk path can be a, b, c, e, h and j.

Specifically, after determining the risk nodes of the risk objects in the multi-association relationship graph, the penetration type supervision system may determine a penetration type risk path including at least two path nodes by using the risk nodes as path nodes based on connection relationships between the object nodes in the multi-association relationship graph. Each object node that forms the through-type risk path, including the risk node, may be referred to as a path node.

S208, determining a risk analysis result of the penetration risk path according to the association relation existing among the path nodes in the penetration risk path.

The risk analysis result is result data obtained after risk analysis is performed on the penetrating type risk path, and the risk analysis result may be a risk value of the penetrating type risk path, a risk value of each path node on the penetrating type risk path, a risk grade corresponding to each path node on the penetrating type risk path, or the like.

Specifically, after determining the penetration risk path with the risk node as the path start point, the penetration supervision system may determine the risk analysis result of the penetration risk path according to the association relationship existing between the path nodes in the penetration risk path.

In one embodiment, a risk analysis model may be preset in the penetration type supervisory system, after the penetration type supervisory system obtains the penetration type risk path with the risk node as the path starting point, the penetration type risk path and the multiple association relationship map of the risk object may be input into the risk analysis model, and then the risk analysis result of the penetration type risk path may be obtained through the risk analysis model.

In the above-mentioned penetration risk analysis method, in the case that there is a risk object, object information of the risk object and a multiple association relationship map to which the risk object belongs are obtained, and based on the object information, among a plurality of object nodes included in the multiple association relationship map, risk nodes corresponding to the risk object are searched, and because the multiple association relationship map can represent at least two association relationships between the plurality of object nodes, a penetration risk path including at least two path nodes can be determined in the multiple association relationship map by using the risk nodes as path starting points, and then a risk analysis result of the penetration risk path is determined according to association relationships existing between the path nodes in the penetration risk path. The object corresponding to the path node contained in the penetration type risk path can be regarded as the object with the association relation with the risk object, the risk analysis result corresponding to the object with the association relation with the risk object can be rapidly determined by carrying out the risk analysis on the penetration type risk path, the penetration type supervision efficiency is effectively improved, the risk analysis is carried out based on the preset multi-association relation map, and the supervision cost of the penetration type supervision can be effectively reduced.

Determination of the penetration risk path is an important step in performing penetration supervision, and the determination scheme of the penetration risk path will be described below through several embodiments.

In one embodiment, as shown in fig. 3, S206, determining a penetration risk path including at least two path nodes with the risk node as a path start point based on a connection relationship between the object nodes includes:

s302, determining a penetration path comprising at least two path nodes from the multi-association relation map by taking the risk nodes as path starting points based on the connection relation among the object nodes.

The penetration path may be considered as a candidate path of the penetration risk path, and includes penetration risk paths, where the number of nodes of the path nodes of the penetration path is greater than or equal to the number of nodes of the path nodes in the penetration risk path.

Specifically, after determining the risk nodes of the risk objects in the multi-association relationship graph, the penetration type supervision system may determine a penetration type path including at least two path nodes by using the risk nodes as path nodes based on the connection relationship between the object nodes in the multi-association relationship graph.

S304, determining the penetration risk path comprising at least two path nodes according to the node number of the path nodes contained in the penetration path and a preset node number threshold.

The threshold value of the number of nodes is preset to control the path length of the penetration risk path, and it can be understood that the threshold value of the number of nodes can be determined by a supervisor according to actual supervision requirements, for example, when supervision is actually performed, if six degrees of supervision forces are considered to be enough to perform favorable supervision on each object node, the threshold value of the number of nodes can be determined to be six nodes. It can be appreciated that a path between two path nodes may be referred to as a degree, and when the preset threshold number of nodes is six, the penetration risk path may be considered as a penetration six-degree path.

Specifically, after obtaining the penetration path, the penetration supervisory system may determine the number of nodes of the path nodes included in the penetration path according to the penetration path, compare the number of nodes of the path nodes included in the penetration path with a preset threshold of the number of nodes, and determine a penetration risk path including at least two path nodes according to the comparison result.

In this embodiment, by presetting the threshold value of the number of nodes, the path length of the penetration type risk path can be limited, so that the calculation complexity of risk analysis on the penetration type risk path in the later stage is effectively reduced, and the penetration type supervision efficiency is further improved.

Further in one embodiment, S304, determining a penetration risk path including at least two path nodes according to a node number of path nodes included in the penetration path and a preset node number threshold value includes:

And determining the penetration path comprising at least two path nodes as the penetration risk path under the condition that the number of the path nodes contained in the penetration path is smaller than or equal to a preset node number threshold value.

Specifically, when the number of nodes of the path nodes included in the penetration path is less than or equal to the preset threshold of the number of nodes, the number of path nodes in the current penetration path can be considered to be less, that is, the number of object nodes having a direct or indirect association relationship with the risk nodes corresponding to the risk objects is less, and path length limitation is not required, so that the penetration supervisory system can directly determine the penetration path including at least two path nodes as the penetration risk path when the number of nodes of the path nodes included in the penetration path is less than or equal to the preset threshold of the number of nodes.

In this embodiment, through directly determining the penetration paths including the path nodes with the number of nodes smaller than or equal to the preset threshold value of the number of nodes as the penetration risk paths, penetration supervision on the risk object can be completed under the condition of lower computational complexity, so that risk analysis on other object nodes associated with the risk object is realized, the effectiveness of penetration supervision is effectively improved, and the complexity of penetration supervision is reduced.

In addition to the above case that the threshold value of the number of nodes is less than or equal to the preset threshold value of the number of nodes, in another embodiment, as shown in fig. 4, S304, determining, according to the number of nodes of the path nodes included in the through path and the preset threshold value of the number of nodes, a through risk path including at least two path nodes includes:

S402, when the number of nodes of path nodes contained in the penetrating path is larger than a preset threshold value of the number of nodes, taking the risk nodes as path starting points, and determining path cut-off nodes from the path nodes according to the threshold value of the number of nodes.

Specifically, when the number of nodes of the path nodes included in the penetration path is greater than a preset threshold of the number of nodes, the number of path nodes in the current penetration path can be considered to be greater, that is, the number of object nodes having a direct or indirect association relationship with the risk nodes corresponding to the risk objects is greater, and path length limitation needs to be performed on the object nodes, so that the penetration supervisory system can determine the path cut-off node from the path nodes according to the threshold of the number of nodes by taking the risk nodes as the path starting point when the number of nodes of the path nodes included in the penetration path is greater than the preset threshold of the number of nodes.

Taking the penetration type path as a- > b- > c- > d- > e- > f- > g, and the preset node number threshold is 6 nodes for illustration, when the penetration type supervisory system determines that the node number of the path nodes included in the penetration type path is 7, the penetration type supervisory system can determine that the node number of the path nodes included in the penetration type path is greater than the preset node number threshold, and the penetration type supervisory system uses the risk node a as a path starting point, and can determine that the path cut-off node is f from all the path nodes according to the node number threshold, namely, the 6 nodes.

S404, determining a part of paths from the risk nodes to the path cutoff nodes in the penetration paths as penetration risk paths.

In particular, the penetration supervisory system may determine that a portion of the penetration path that includes a path from the risk node to the path cutoff node is a penetration risk path. For example, when a path cut-off node is determined to be f of a through path a- > b- > c- > d- > e- > f- > g from the path nodes, a- > b- > c- > d- > e- > f can be determined to be a through risk path.

In this embodiment, when the number of nodes of the path nodes included in the penetration path is greater than a preset threshold value of the number of nodes, the path length of the penetration risk path can be limited by determining that a part of paths from the risk nodes to the path cut-off nodes in the penetration path are penetration risk paths, so that the computational complexity of risk analysis of the penetration risk path in the later stage is effectively reduced, and the penetration supervision efficiency is further improved.

Further, as shown in fig. 5, in one embodiment, S302, based on the connection relationship between the object nodes, uses the risk node as the path start point, determines a penetration path including at least two path nodes from the multiple association relationship map, including:

S502, based on the connection relation among the object nodes, determining a plurality of initial node combination paths comprising at least two path nodes from the multi-association relation map by taking the risk nodes as path starting points.

The initial node combination path can be considered as a candidate path of the penetration path, and each path node on the initial node combination path has a direct or indirect association relationship with the risk node.

Specifically, after determining the risk nodes of the risk objects in the multi-association relationship graph, the penetration type supervision system may determine an initial node combination path including at least two path nodes by using the risk nodes as path nodes based on connection relationships between the object nodes in the multi-association relationship graph. Under the condition that the number of the initial node combination paths is multiple, the penetration type supervisory system can select penetration type paths meeting the association relation conditions from the preset association relation conditions.

S504, according to the association relation existing among the path nodes of each initial node combination path and the preset association relation condition, determining the initial node combination path meeting the association relation condition as a penetration path.

Wherein, the association relation condition is a preset screening condition for screening the penetration path. The association condition is related to the type and/or the number of association relationships existing among the path nodes, and can be determined by a supervisor in advance according to the risk association requirement of the penetration type supervision. It can be understood that the more the association relations among the nodes are, the higher the corresponding risk association relations are, so that based on preset association relation conditions, a penetration type path with high risk association relation with the risk nodes can be screened out from a plurality of initial node combination paths, the risk association relation between the penetration type risk path and the risk nodes determined based on the penetration type path can be improved, and the penetration type supervision effectiveness of the penetration type supervision system on the risk objects is improved.

Specifically, after obtaining multiple initial node combination paths, the penetration type supervisory system may determine whether each initial node combination path satisfies an association condition according to an association relationship existing between path nodes of each initial node combination path, and after determining that an initial node combination path satisfying the association condition exists, determine the initial node combination path satisfying the association condition as a penetration type path.

In one embodiment, the association condition may be that at least two association relationships exist between the risk node and the directly associated path node.

In one embodiment, the association condition may be that a specific association exists between the risk node and the directly associated path node.

In the above embodiment, by presetting the association condition and screening the association dimension of the multiple initial node combination paths, the higher risk association exists between the penetration type path and the risk node, which are used for determining the penetration type risk path, and the risk association between the penetration type risk path and the risk node, which are determined based on the penetration type path, can be improved, so that the penetration type supervision effectiveness of the penetration type supervision system on the risk object is improved.

After the through risk path corresponding to the risk node is obtained, in an embodiment, as shown in fig. 6, S208, determining a risk analysis result of the through risk path according to an association relationship existing between path nodes in the through risk path, includes:

S602, determining the relationship types of the association relationships existing among path nodes in the penetration risk path.

The relationship types of the association relationship may include types and numbers of the association relationship. It can be understood that the types and the numbers of the association relations existing between the path nodes are different, and the correlations between the path nodes are also different.

In one embodiment, in the case of the same type, the correlation between the path nodes and the number of the association relations are positively correlated. The greater the number of associations that exist between path nodes, the higher the corresponding correlation. For example, two association relations exist between the a node and the b node, three association relations exist between the a node and the c node, wherein the two association relations are identical to the two association relations exist between the a node and the b node, and the correlation between the natural a node and the c node is larger than that between the a node and the b node.

In one embodiment, the correlation between path nodes may be related to both the number and type of associations. For example, four association relations may exist between the nodes, where the first association relation has the highest risk association relation, and even if the a node and the b node only have the first association relation and the second association relation, the a node and the c node have the second association relation, the third association relation and the fourth association relation, the correlation between the a node and the b node may be considered to be greater than the correlation between the a node and the c node.

Specifically, after determining the penetration risk path, the penetration supervision system may determine, according to the multiple association relationship graphs, relationship types of association relationships existing between path nodes in the penetration risk path.

S604, determining corresponding related weight values among path nodes based on the relation types and preset weight configuration information.

The weight configuration information may represent a corresponding relationship between each relationship type and a weight value, and is used to configure a corresponding weight value for a segment path formed by every two path nodes.

In one embodiment, taking the relationship type including social association, resource allocation association and resource exchange association in the economic main body as an example, the preset weight allocation information may be that for a node path where the social association, the resource allocation association and the resource exchange association exist simultaneously between two path nodes, and the related weight value is 1.5. For the node paths with the resource exchange association relationship and the social association relationship between the two path nodes, the related weight value is 1.1. For the node paths with the resource exchange association relationship and the resource configuration association relationship in the economic main body between the two path nodes, the related weight value is 1.3. And for the path related weight values with only the resource exchange association relationship and no resource exchange relationship between the two path nodes, the weight values are 1.

Specifically, the penetration type supervision system may search preset weight configuration information according to the relationship types of the association relationships existing between the path nodes in the penetration type risk path, and determine the relevant weight value corresponding to the node path formed by the path nodes.

S606, determining a risk analysis result of the penetration risk path according to each relevant weight value.

Specifically, the penetration type supervisory system may determine a risk analysis result of the penetration type risk path according to the respective corresponding related weight values of the node paths formed by the path nodes in the penetration type risk path.

In one embodiment, the risk analysis results in a risk weight value for the pass-through risk path. Specifically, the penetration type supervisory system may sum the relevant weight values corresponding to the node paths formed by the path nodes in the penetration type risk paths, so as to obtain the risk weight value of the penetration type risk path.

In one embodiment, the penetration type supervisory system may further perform an averaging process on the relevant weight values corresponding to the node paths formed by the path nodes in the penetration type risk path, so as to obtain a risk weight value of the penetration type risk path.

In one embodiment, the risk analysis result may also be a risk level of the through-the-type risk path. Specifically, the penetration type supervision system may obtain a risk weight value of the penetration type risk path for each relevant weight value corresponding to a node path formed by each path node in the penetration type risk path, and then find a risk level corresponding to the risk weight value of the penetration type risk path according to a preset corresponding relation between the risk weight value and the risk level, and determine the risk level as a risk analysis result of the penetration type risk path.

Further, in an embodiment, when there are multiple penetration risk paths, the penetration monitoring system responds to a risk early warning event for a risk object, and may determine a risk early warning path for performing risk early warning from each penetration risk path according to a preset risk early warning rule, and generate corresponding early warning prompt information based on each path node in the risk early warning path. The risk early warning rule may be determined according to actual requirements of supervision, for example, the risk early warning rule may be to select a penetrating risk path with the highest risk weight value from multiple penetrating risk paths as the risk early warning path. The risk weight values of the multiple penetrating risk paths can be sorted in descending order from high to low, and then a preset number, for example 3 penetrating risk paths, are selected from the beginning to serve as risk early warning paths.

In one embodiment, as shown in fig. 7, a penetration risk analysis method is provided, which specifically includes the following steps:

first, the penetration supervisory system needs to build various relationship maps.

Specifically, the penetration type supervision system can construct a social relationship graph for representing social association relationships existing between object nodes by acquiring personal user information and associated person information data related to the personal user information through natural artificial nodes. The resource allocation relation map for representing the resource allocation association relation in the economic main body is constructed by obtaining the economic main body information, the user information of the resource allocation users in the economic main body, such as the user information of enterprise stakeholders, high-level management and the like, and the associated person information related to the resource allocation users through legal persons and natural artificial nodes. The resource exchange relation map for representing the association relation of the resource exchange among the users is constructed by acquiring the resource exchange detail data of the exchangeable resource accounts in the system, such as the demand deposit account transaction detail data, and summarizing the details of the resource exchange among the users by taking the users corresponding to the resource exchange accounts as granularity.

For three relationships existing between every two nodes at the same time, the node path is added with a risk weight of 1.5, for the node path which has a resource exchange association relationship and a social association relationship existing between every two nodes at the same time, the node path is added with a risk weight of 1.1, and for the node path which has a resource exchange association relationship and an economic main body internal resource configuration association relationship existing between every two nodes at the same time. And for the node paths with only resource exchange association relationship and no resource exchange relationship between every two nodes, adding a risk weight 1.

When the risk management system is actually used, the risk nodes corresponding to the risk objects are searched from a plurality of object nodes of the multi-association relationship map under the condition that the risk objects are determined to exist.

Based on the connection relation among the object nodes, taking the risk nodes as path starting points, taking one section of path between every two object nodes as one degree, penetrating through the six-degree path, and obtaining each penetrating type risk path of the risk nodes.

Adding the additional risk weights between every two path nodes in each penetration risk path, calculating the risk weight of each penetration risk path, sequencing the penetration risk paths according to the risk weight value from high to low, and screening out the penetration risk path corresponding to the highest risk weight. And carrying out risk conduction early warning based on the penetrating risk path corresponding to the highest risk weight.

In this embodiment, the social association relationship, the association relationship map corresponding to the resource allocation association relationship in the economic main body and the association relationship map corresponding to the resource exchange association relationship are overlapped and fused, so that more hidden indirect association relationships between objects can be found, a wider risk influence surface can be discovered, for example, a resource exchange relationship exists between A and B, and a resource exchange relationship does not exist between C, but C is actually a resource allocation association object of B, for example, C is actually a stakeholder of B, and C can be directly associated with B through the resource allocation relationship map, and meanwhile, is indirectly associated with A. C may also be impacted to some extent based on the relationship between A, B, C when A is at risk. And the risk weight is added to the relation path, the relation penetration path is creatively subjected to risk metering, quantitative analysis of risk conduction is realized, a risk link with deep influence degree and wide influence degree can be found, and the risk analysis method has important significance for monitoring risks of supervision parties or banking financial institutions. Finally, based on graph analysis technology of graph number separation, the rapid construction of the relationship graph of massive structured data can be realized, and the calculation force and time cost can be saved to a certain extent.

It should be understood that, although the steps in the flowcharts related to the embodiments described above are sequentially shown as indicated by arrows, these steps are not necessarily sequentially performed in the order indicated by the arrows. The steps are not strictly limited to the order of execution unless explicitly recited herein, and the steps may be executed in other orders. Moreover, at least some of the steps in the flowcharts described in the above embodiments may include a plurality of steps or a plurality of stages, which are not necessarily performed at the same time, but may be performed at different times, and the order of the steps or stages is not necessarily performed sequentially, but may be performed alternately or alternately with at least some of the other steps or stages.

Based on the same inventive concept, the embodiment of the application also provides a penetration risk analysis device for realizing the penetration risk analysis method. The implementation of the solution provided by the apparatus is similar to that described in the above method, so the specific limitations of one or more embodiments of the penetration risk analysis apparatus provided below may be referred to above for the limitations of the penetration risk analysis method, and will not be repeated here.

In one embodiment, as shown in fig. 8, there is provided a through-the-air risk analysis device 800 comprising: information and map acquisition module 801, node finding module 802, path determination module 803 and risk analysis module 804, wherein:

The information and map acquisition module 801 is configured to acquire object information of a risk object and a multiple association relationship map to which the risk object belongs when the risk object exists;

the node searching module 802 is configured to search, based on the object information, for a risk node corresponding to the risk object from a plurality of object nodes included in the multiple association relationship map; the multi-association relationship map is used for representing at least two association relationships among the plurality of object nodes;

A path determining module 803, configured to determine a penetration risk path including at least two path nodes with the risk node as a path start point based on a connection relationship between the object nodes;

The risk analysis module 804 is configured to determine a risk analysis result of the penetration risk path according to an association relationship existing between path nodes in the penetration risk path.

In one embodiment, the path determination module includes:

The transmission path determining unit is used for determining a transmission path comprising at least two path nodes from the multi-association relationship map by taking the risk node as a path starting point based on the connection relationship among the object nodes;

the risk path determining unit is used for determining the penetration type risk path comprising at least two path nodes according to the number of the path nodes contained in the penetration type path and a preset threshold value of the number of the nodes.

In an embodiment, the risk path determination unit is specifically configured to:

the part of the path from the risk node to the path cut-off node in the penetration path is determined as the penetration risk path.

In one embodiment, the pass-through path determination unit comprises:

A combined path determining subunit, configured to determine, based on the connection relationship between the object nodes, a plurality of initial node combined paths including at least two path nodes from the multiple association relationship map with the risk node as a path start point;

And the penetrating path determining subunit is used for determining the initial node combination path meeting the association relation condition as a penetrating path according to the association relation existing among the path nodes of each initial node combination path and the preset association relation condition.

In one embodiment, the risk analysis module includes:

the relationship type determining module is used for determining relationship types of association relationships existing among path nodes in the penetration type risk path;

the related weight value determining module is used for determining the corresponding related weight value among the path nodes based on the relation type and preset weight configuration information;

And the risk analysis result determining module is used for determining the risk analysis result of the penetrating type risk path according to each relevant weight value.

The various modules in the through-the-air risk analysis device described above may be implemented in whole or in part by software, hardware, and combinations thereof. The above modules may be embedded in hardware or may be independent of a processor in the computer device, or may be stored in software in a memory in the computer device, so that the processor may call and execute operations corresponding to the above modules.

In one embodiment, a computer device is provided, which may be a server integrated with a pass-through supervisory system, the internal structure of which may be as shown in fig. 9. The computer device includes a processor, a memory, and a network interface connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database of the computer equipment is used for storing data such as object information, multi-association relation maps, penetration risk paths, risk analysis results and the like. The network interface of the computer device is used for communicating with an external terminal through a network connection. The computer program is executed by a processor to implement a method of through-the-air risk analysis.

It will be appreciated by persons skilled in the art that the architecture shown in fig. 9 is merely a block diagram of some of the architecture relevant to the present inventive arrangements and is not limiting as to the computer device to which the present inventive arrangements are applicable, and that a particular computer device may include more or fewer components than shown, or may combine some of the components, or have a different arrangement of components.

In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, the processor implementing specific implementation steps of the above-described through-risk analysis method when executing the computer program.

In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, which when executed by a processor implements the steps of the above-described through-the-air risk analysis method.

In one embodiment, a computer program product is provided, comprising a computer program which, when executed by a processor, implements the steps of the above-described through-the-air risk analysis method.

Those skilled in the art will appreciate that implementing all or part of the above described methods may be accomplished by way of a computer program stored on a non-transitory computer readable storage medium, which when executed, may comprise the steps of the embodiments of the methods described above. Any reference to memory, database, or other medium used in embodiments provided herein may include at least one of non-volatile and volatile memory. The nonvolatile Memory may include Read-Only Memory (ROM), magnetic tape, floppy disk, flash Memory, optical Memory, high density embedded nonvolatile Memory, resistive random access Memory (ReRAM), magneto-resistive random access Memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric Memory (Ferroelectric Random Access Memory, FRAM), phase change Memory (PHASE CHANGE Memory, PCM), graphene Memory, and the like. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, and the like. By way of illustration, and not limitation, RAM can be in various forms such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), etc. The databases referred to in the embodiments provided herein may include at least one of a relational database and a non-relational database. The non-relational database may include, but is not limited to, a blockchain-based distributed database, and the like. The processor referred to in the embodiments provided in the present application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, or the like, but is not limited thereto.

The technical features of the above embodiments may be arbitrarily combined, and all possible combinations of the technical features in the above embodiments are not described for brevity of description, however, as long as there is no contradiction between the combinations of the technical features, they should be considered as the scope of the description.

The foregoing examples illustrate only a few embodiments of the application and are described in detail herein without thereby limiting the scope of the application. It should be noted that it will be apparent to those skilled in the art that several variations and modifications can be made without departing from the spirit of the application, which are all within the scope of the application. Accordingly, the scope of the application should be assessed as that of the appended claims.

Claims

1. A method of through-the-air risk analysis, the method comprising:

2. The method according to claim 1, wherein determining a penetration risk path including at least two path nodes based on the connection relationship between the object nodes with the risk node as a path start point comprises:

3. The method of claim 2, wherein determining the through-type risk path including at least two path nodes according to the number of nodes of the path nodes included in the through-type path and a preset threshold of the number of nodes comprises:

4. The method according to claim 2, wherein determining the penetration risk path including at least two path nodes according to the number of path nodes included in the penetration path and a preset threshold of the number of nodes includes:

5. The method according to claim 2, wherein determining a penetration path including at least two path nodes from the multiple association map based on the connection relationship between the object nodes with the risk node as a path start point comprises:

6. The method according to any one of claims 1-5, wherein determining the risk analysis result of the through-type risk path according to the association relationship existing between the path nodes in the through-type risk path includes:

7. A penetration risk analysis device, the device comprising:

8. The apparatus of claim 7, wherein the path determination module comprises:

The penetration path determining unit is used for determining a penetration path comprising at least two path nodes from the multi-association relationship map by taking the risk node as a path starting point based on the connection relationship among the object nodes;

And the risk path determining unit is used for determining the penetration type risk path comprising at least two path nodes according to the node number of the path nodes contained in the penetration type path and a preset node number threshold value.

9. The apparatus according to claim 8, wherein the risk path determination unit is specifically configured to:

10. The apparatus according to claim 8, wherein the risk path determination unit is specifically configured to:

11. The apparatus of claim 8, wherein the pass-through path determination unit comprises:

A combined path determining subunit, configured to determine, based on a connection relationship between the object nodes, a plurality of initial node combined paths including at least two path nodes from the multiple association relationship map with the risk node as a path start point;

and the penetrating path determining subunit is used for determining the initial node combination path meeting the association relation condition as a penetrating path according to the association relation existing between the path nodes of each initial node combination path and the preset association relation condition.

12. The apparatus of any one of claims 7-11, wherein the risk analysis module comprises:

The relation type determining module is used for determining the relation type of the association relation existing between the path nodes in the penetration risk path;

The related weight value determining module is used for determining the corresponding related weight value between the path nodes based on the relation type and preset weight configuration information;

And the risk analysis result determining module is used for determining the risk analysis result of the penetrating risk path according to each related weight value.

13. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor implements the steps of the method of any of claims 1 to 6 when the computer program is executed.

14. A computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, implements the steps of the method of any of claims 1 to 6.

15. A computer program product comprising a computer program, characterized in that the computer program, when being executed by a processor, implements the steps of the method of any of claims 1 to 6.