CN118153959A

CN118153959A - Risk identification method, apparatus, device and storage medium

Info

Publication number: CN118153959A
Application number: CN202410377694.4A
Authority: CN
Inventors: 李亭轩
Original assignee: Industrial and Commercial Bank of China Ltd ICBC
Current assignee: Industrial and Commercial Bank of China Ltd ICBC
Filing date: 2024-03-29
Publication date: 2024-06-07

Abstract

The disclosure provides a risk identification method, which can be applied to the technical field of artificial intelligence and the technical field of financial science and technology. The risk identification method comprises the following steps: determining a map recognition result of the target object based on the object attribute information of the target object and a preset knowledge map; under the condition that the characteristic object of the map identification result meets the preset risk level, adding attribute information of the target object and business information to be processed into a model prompt template according to the information type to obtain risk identification prompt information, wherein the model prompt template comprises a template for indicating a large language model to execute an expected task; inputting the risk identification prompt information into the large language model to obtain a model identification result; and obtaining a target risk recognition result of the target object processing the service to be processed based on the model recognition result and the map recognition result. The disclosure also provides a risk identification device, equipment and a storage medium.

Description

Risk identification method, apparatus, device and storage medium

Technical Field

The present disclosure relates to the field of artificial intelligence technology and financial technology, and more particularly, to a risk identification method, apparatus, device, and storage medium.

Background

With the rapid development of the internet and mobile communication technology, online services have been shown to increase in an explosive manner. But online services bring great convenience to users and the risk is rapidly aggravated. Therefore, in order to avoid risk, the risk of the business needs to be pre-warned or even avoided.

However, because the internet has the characteristics of convenience, concealment and the like, a certain time is required to be consumed for risk identification of the service, so that the service processing efficiency is low, and the user experience is reduced.

Disclosure of Invention

In view of the foregoing, the present disclosure provides a risk identification method, apparatus, electronic device, and storage medium.

According to a first aspect of the present disclosure, there is provided a risk identification method, comprising: determining a graph recognition result of a target object based on object attribute information of the target object and a preset knowledge graph, wherein the preset knowledge graph comprises nodes and edges, node information of the nodes represents object attribute information of the object and risk level labels related to the target object, and edge information of the edges represents association relations between two nodes connected with the edges; under the condition that the map recognition result represents that the object meets a preset risk level, adding the attribute information and the service information to be processed of the target object into a model prompt template according to the information type to obtain risk recognition prompt information, wherein the model prompt template comprises a template for indicating the large language model to execute an expected task; inputting the risk identification prompt information into the large language model to obtain a model identification result; and obtaining a target risk recognition result of the target object for processing the service to be processed based on the model recognition result and the map recognition result.

According to an embodiment of the present disclosure, the obtaining, based on the model identification result and the graph identification result, a target risk identification result of the target object for processing the service to be processed includes: determining an abnormal behavior recognition result based on the historical behavior time sequence information and the behavior matching rule of the target object under the condition that the model recognition result and the map recognition result are not matched, wherein the abnormal behavior recognition result represents whether abnormal historical behavior information exists in the historical behavior time sequence information; determining an abnormal attribute identification result based on the attribute information of the target object, the service information of the service to be processed and an attribute matching rule, wherein the abnormal attribute identification result represents whether abnormal attribute information exists in the attribute information; obtaining a rule recognition result based on the abnormal behavior recognition result and the abnormal attribute recognition result; and obtaining a target risk recognition result of the target object based on the rule recognition result, the model recognition result and the map recognition result.

According to an embodiment of the present disclosure, adding the attribute information and the service information to be processed of the target object to a model prompt template according to an information type to obtain risk identification prompt information includes: determining the model prompt template from a plurality of preset model prompt templates based on a service type, wherein the preset model prompt template comprises a task type for indicating a large language model to execute tasks, and the task type is determined based on the service type; and adding the attribute information of the target object and the service information of the service to be processed into the model prompt template based on the information type and an information position mapping table to obtain the risk identification prompt information, wherein the information position mapping table comprises a mapping relation between the information type and the filling position.

According to an embodiment of the present disclosure, the attribute information includes an object identifier; the determining the graph recognition result of the target object based on the object attribute information of the target object and the preset knowledge graph includes: and determining a graph recognition result of the target object based on a risk level label of the target node under the condition that the preset knowledge graph comprises node information of the target node, wherein the target node is matched with the object label, and the node information comprises the risk level label of the target object.

According to an embodiment of the present disclosure, the attribute information includes an object identifier; the determining the graph recognition result of the target object based on the object attribute information of the target object and the preset knowledge graph includes: determining an associated object with an associated relation with the target object from the preset knowledge graph under the condition that node information of the target node is not included in the preset knowledge graph, wherein the target node is matched with the object identifier, and the node information includes a risk level label of the target object; determining an association graph recognition result of the association object based on the risk level label of the association object; and determining the graph recognition result of the target object based on the correlation graph recognition result of the correlation object.

According to an embodiment of the present disclosure, the above method further includes: processing a plurality of reference samples and a map to generate prompt information by using the large language model to obtain a relation map, wherein the reference samples comprise attribute information of a reference object and historical service processing information of the reference object, the relation map comprises nodes and edges, the edge information of the edges represents an association relation between two nodes connected with the edges, and the node information of the nodes represents object attribute information of the reference object; processing the reference risk identification prompt information of each of the plurality of reference samples by using the large language model to obtain a reference object model identification result of each of the plurality of reference samples, wherein the reference risk identification prompt information of each of the plurality of reference samples is generated based on the plurality of reference samples, and the reference risk identification prompt information is used for instructing the large language model to execute a task of performing risk identification on the reference samples; and obtaining the preset knowledge graph based on the reference object model identification result of each of the plurality of reference objects and the relation graph.

According to an embodiment of the present disclosure, the above-mentioned reference object model identification result includes at least one of: the obtaining of the preset knowledge graph based on the reference object model recognition result and the relation graph of each of the plurality of reference objects includes: determining, for each of the reference objects, a data amount of the first reference recognition result and a data amount of the second reference recognition result based on the reference object model recognition result; obtaining a risk level tag of the reference object based on the data amount of the first reference identification result, the data type of the first reference identification result, the data amount of the second reference identification result and the data type of the second reference identification result; and obtaining the preset knowledge graph based on the risk level label and the relation graph.

A second aspect of the present disclosure provides a risk identification apparatus, comprising: the first determining module is used for determining a graph recognition result of the target object based on object attribute information of the target object and a preset knowledge graph, wherein the preset knowledge graph comprises nodes and edges, node information of the nodes represents object attribute information of the object and risk level labels related to the target object, and edge information of the edges represents association relations between two nodes connected with the edges; the adding module is used for adding the attribute information and the business information to be processed of the target object into a model prompt template according to the information type under the condition that the map recognition result represents that the object meets the preset risk level, so as to obtain risk recognition prompt information, wherein the model prompt template comprises a template for indicating the large language model to execute an expected task; the input module is used for inputting the risk identification prompt information into the large language model to obtain a model identification result and the second determination module is used for obtaining a target risk identification result of the target object for processing the service to be processed based on the model identification result and the map identification result.

A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the risk identification method.

A fourth aspect of the present disclosure also provides a computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the risk identification method described above.

According to the embodiment of the disclosure, the risk level of the target user is determined through the preset knowledge graph, the risk recognition mode is determined through the association relation between the pre-constructed risk level and the risk recognition mode, a large amount of service processing time consumed by the risk recognition is reduced, different risk recognition modes are executed for target objects with different risk levels, simple risk recognition is performed for target objects with lower risk levels, complex risk recognition is performed for target objects with higher risk levels, and the risk recognition efficiency is improved while the risk recognition precision is improved.

Drawings

The foregoing and other objects, features and advantages of the disclosure will be more apparent from the following description of embodiments of the disclosure with reference to the accompanying drawings, in which:

FIG. 1 schematically illustrates an application scenario diagram of risk identification methods, apparatus, devices, media and program products according to embodiments of the present disclosure;

FIG. 2 schematically illustrates a flow chart of a risk identification method according to an embodiment of the present disclosure;

Fig. 3 schematically illustrates a data flow diagram for generating a preset knowledge-graph, according to an embodiment of the present disclosure;

FIG. 4 schematically illustrates a flow chart of determining a pattern recognition result according to an embodiment of the disclosure;

FIG. 5 schematically illustrates a schematic diagram of generating risk identification hint information according to embodiments of the present disclosure;

FIG. 6 schematically illustrates a flow chart of generating risk identification results in accordance with a particular embodiment of the present disclosure;

fig. 7 schematically illustrates a block diagram of a risk identification apparatus according to an embodiment of the present disclosure; and

Fig. 8 schematically illustrates a block diagram of an electronic device adapted to implement a risk identification method according to an embodiment of the disclosure.

Detailed Description

Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood that the description is only exemplary and is not intended to limit the scope of the present disclosure. In the following detailed description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the present disclosure. It may be evident, however, that one or more embodiments may be practiced without these specific details. In addition, in the following description, descriptions of well-known structures and techniques are omitted so as not to unnecessarily obscure the concepts of the present disclosure.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The terms "comprises," "comprising," and/or the like, as used herein, specify the presence of stated features, steps, operations, and/or components, but do not preclude the presence or addition of one or more other features, steps, operations, or components.

All terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art unless otherwise defined. It should be noted that the terms used herein should be construed to have meanings consistent with the context of the present specification and should not be construed in an idealized or overly formal manner.

Where a convention analogous to "at least one of A, B and C, etc." is used, in general such a convention should be interpreted in accordance with the meaning of one of skill in the art having generally understood the convention (e.g., "a system having at least one of A, B and C" would include, but not be limited to, systems having a alone, B alone, C alone, a and B together, a and C together, B and C together, and/or A, B, C together, etc.).

In the technical solution of the present disclosure, the related user information (including, but not limited to, user personal information, user image information, user equipment information, such as location information, etc.) and data (including, but not limited to, data for analysis, stored data, displayed data, etc.) are information and data authorized by the user or sufficiently authorized by each party, and the related data is collected, stored, used, processed, transmitted, provided, disclosed, applied, etc. in compliance with relevant laws and regulations and standards, necessary security measures are taken, no prejudice to the public order colloquia is provided, and corresponding operation entries are provided for the user to select authorization or rejection.

In the scenario of using personal information to make an automated decision, the method, the device and the system provided by the embodiment of the disclosure provide corresponding operation inlets for users, so that the users can choose to agree or reject the automated decision result; if the user selects refusal, the expert decision flow is entered. The expression "automated decision" here refers to an activity of automatically analyzing, assessing the behavioral habits, hobbies or economic, health, credit status of an individual, etc. by means of a computer program, and making a decision. The expression "expert decision" here refers to an activity of making a decision by a person who is specializing in a certain field of work, has specialized experience, knowledge and skills and reaches a certain level of expertise.

In the process of performing service risk identification, generally, in response to a service execution request, in the process of executing service processing, the risk identification is performed on the service, so that the service processing efficiency is low, and the user experience is reduced. Therefore, the application provides a risk identification method, which not only identifies the risk level of the user in advance, but also establishes the association relation between the risk level of the user and the risk identification method in advance, and adopts different risk identification methods aiming at users with different risk levels, thereby improving the service safety, the processing efficiency and the user experience.

The embodiment of the disclosure provides a risk identification method, which comprises the following steps: determining a graph recognition result of the target object based on object attribute information of the target object and a preset knowledge graph, wherein the preset knowledge graph comprises nodes and edges, node information of the nodes represents object attribute information of the object and risk level labels related to the target object, and edge information of the edges represents association relations between two nodes connected with the edges; under the condition that the characteristic object of the map identification result meets the preset risk level, adding attribute information of the target object and business information to be processed into a model prompt template according to the information type to obtain risk identification prompt information, wherein the model prompt template comprises a template for indicating a large language model to execute an expected task; inputting the risk identification prompt information into the large language model to obtain a model identification result; and obtaining a target risk recognition result of the target object processing the service to be processed based on the model recognition result and the map recognition result.

Fig. 1 schematically illustrates an application scenario diagram of a risk identification method according to an embodiment of the present disclosure.

As shown in fig. 1, an application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, and a third terminal device 103. The network 104 is a medium used to provide a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.

The user may interact with the server 105 via the network 104 using the first terminal device 101, the second terminal device 102, the third terminal device 103, to receive or send messages etc. Various communication client applications, such as a shopping class application, a web browser application, a search class application, an instant messaging tool, a mailbox client, social platform software, etc. (by way of example only) may be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103.

The first terminal device 101, the second terminal device 102, the third terminal device 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smartphones, tablets, laptop and desktop computers, and the like.

The server 105 may be a server providing various services, such as a background management server (by way of example only) providing support for websites browsed by the user using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as the user request, and feed back the processing result (e.g., the web page, information, or data obtained or generated according to the user request) to the terminal device.

It should be noted that, the risk identification method provided by the embodiments of the present disclosure may be generally performed by the server 105. Accordingly, the risk identification apparatus provided by the embodiments of the present disclosure may be generally provided in the server 105. The risk identification method provided by the embodiments of the present disclosure may also be performed by a server or a server cluster that is different from the server 105 and is capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103 and/or the server 105. Accordingly, the risk identification apparatus provided by the embodiments of the present disclosure may also be provided in a server or a server cluster that is different from the server 105 and is capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103 and/or the server 105.

It should be understood that the number of terminal devices, networks and servers in fig. 1 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation.

The risk identification method of the disclosed embodiment will be described in detail below with reference to fig. 2 to 6 based on the scenario described in fig. 1.

Fig. 2 schematically illustrates a flow chart of a risk identification method according to an embodiment of the present disclosure.

As shown in fig. 2, the risk identification of this embodiment includes operations S210 to S240.

In operation S210, a graph recognition result of the target object is determined based on the object attribute information of the target object and the preset knowledge graph.

According to embodiments of the present disclosure, the target object may include an initiating object of a business or may include a responding object of a business, such as a business buyer or seller, etc. needs to conduct. Specifically, the target object identification may be determined by acquiring service information. Traversing a preset object attribute information table through the target object identifier to obtain object attribute information of the target object.

According to the embodiment of the disclosure, the preset knowledge graph may be a pre-constructed knowledge graph, and the preset knowledge graph may be stored in a database after construction is completed and called when the target object initiates the service to be processed. The preset knowledge graph comprises nodes and edges, node information of the nodes represents object attribute information of an object and risk level labels related to the target object, and edge information of the edges represents association relations between two nodes connected with the edges.

According to an embodiment of the disclosure, each node in the preset knowledge graph may correspond to an object, each edge may represent an association between two nodes connected to the edge, and the association relationship between the nodes may include an affinity relationship and a transaction relationship between the objects.

According to embodiments of the present disclosure, the object attribute information may include business-related information of the target object, such as asset information and consumption information of the target object, and the like. The risk level tag may be used to identify a risk level of the target object, and the risk level tag may be related to object attribute information of the target object, or may be related to object attribute information of an object associated with the target object and the risk level tag.

According to the embodiment of the disclosure, after the preset knowledge graph is constructed, node information and side information of the preset knowledge graph can be updated, and new nodes and new sides can be added.

According to embodiments of the present disclosure, the atlas recognition result of the target object may characterize the risk level of the target object.

In operation S220, when it is determined that the graph recognition result indicates that the target object meets the predetermined risk level, attribute information and service information to be processed of the target object are added to the model prompt template according to the information type, so as to obtain risk recognition prompt information.

According to an embodiment of the present disclosure, the model hint templates include templates for instructing a large language model to perform an intended task.

According to embodiments of the present disclosure, the risk level tag may include multiple risk levels, such as a high risk level, a medium risk level, a low risk level, and the like. The predetermined risk level may be a higher risk level, such as a high risk level.

According to an embodiment of the disclosure, the information types may include attribute information, service information to be processed, and the like, and the information of different information types corresponds to different positions in the model prompt template. Specifically, attribute information and service information to be processed may be added to the model hint template based on a correspondence between the information type and the model hint template.

According to embodiments of the present disclosure, the model hint template may include hint information that drives the large language model (Large Language Model, LLM) to output a model recognition result, for guiding the large language model to output the model recognition result according to the attribute information and the business information to be processed.

According to the embodiment of the disclosure, the risk identification prompt information can be obtained after the attribute information and the service information to be processed are filled in by the model prompt template. Therefore, the risk identification prompt information comprises information of both the to-be-processed service information and the object attribute information of the target object, and covers the source of service risk generation from both the service itself and the service target object.

According to embodiments of the present disclosure, in case the target object does not meet the predetermined risk level, a simple risk identification manner, such as information verification, may be adopted, avoiding unnecessary consumption of computing resources.

According to the embodiment of the disclosure, different risk identification modes are adopted for the target objects with different risk levels, so that the risk identification efficiency is improved, the service processing efficiency is further improved, and the user experience is improved.

In operation S230, the risk identification prompt information is input into the large language model to obtain a model identification result.

According to the embodiment of the disclosure, the large language model can be obtained through pre-training, and business risks can be identified according to risk identification prompt information.

Because the classification model can only identify one classification task, the application range is limited, but in practical application, different services have different identification standards, even one service may have multiple identification standards, so that multiple classification models need to be deployed in a production environment, the on-line reasoning cost is high, and the flexibility is poor. Based on this, embodiments of the present disclosure no longer identify business risk using classification models, but rather use large language models that can understand context semantics.

According to the embodiment of the disclosure, since the large language model can understand the upper and lower Wen Yuyi, the large language model can understand various recognition standards, when the large language model is utilized for risk recognition, attribute information and service information to be processed are not input, but the attribute information and the service information to be processed, and the model prompt template are taken as inputs, so that the large language model can understand the recognition standards of the model prompt template first, and then the attribute information and the service information to be processed are recognized. The model prompt template identifies the features of the risk service, so that the large language model can identify the risk condition of the service based on the features of various risk services, and a model identification result is obtained.

In operation S240, a target risk recognition result of the target object processing the service to be processed is obtained based on the model recognition result and the map recognition result.

According to the embodiment of the disclosure, the accuracy of the target risk recognition result is further improved by determining the target risk recognition result by using the model recognition result and the map recognition result. Specifically, whether the model recognition result and the map recognition result are matched or not can be confirmed, then the target risk recognition result is confirmed, and the target risk recognition result can be obtained by respectively configuring different weights for the model recognition result and the map recognition result.

According to the embodiment of the disclosure, the risk level of the target user is determined through the preset knowledge graph, the risk recognition mode is determined through the association relation between the pre-constructed risk level and the risk recognition mode, a large amount of service processing time consumed by the risk recognition is reduced, different risk recognition modes are executed for target objects with different risk levels, simple risk recognition is performed for target objects with lower risk levels, complex risk recognition is performed for target objects with higher wind direction levels, and the risk recognition efficiency is improved while the risk recognition precision is improved.

According to an embodiment of the present disclosure, a method for generating a preset knowledge graph includes: processing a plurality of reference samples and the atlas by using a large language model to generate prompt information, and obtaining a relation atlas; processing the reference risk identification prompt information of each of the plurality of reference samples by using the large language model to obtain the reference object model identification result of each of the plurality of reference samples; and obtaining a preset knowledge graph based on the reference object model identification result and the relation graph of each of the plurality of reference objects.

According to an embodiment of the present disclosure, the reference sample includes attribute information of a reference object and history service processing information of the reference object, the relationship map includes nodes and edges, edge information of the edges represents an association relationship between two nodes connected to the edges, and node information of the nodes represents object attribute information of the reference object.

According to an embodiment of the present disclosure, the attribute information may include business-related information of the reference object. The historical business process information may include process information for businesses associated with the reference object, such as business type, whether it is a risk business, and the like.

According to embodiments of the present disclosure, the atlas generation hint information may drive the large language model to generate a relational atlas from the reference sample. The node information in the relation map only comprises attribute information of the reference object and historical service processing information of the reference object, and does not comprise risk level of the reference object.

According to an embodiment of the present disclosure, reference risk identification hint information for each of a plurality of reference samples is generated based on the plurality of reference samples, the reference risk identification hint information being used to instruct a large language model to perform a task of risk identification of the reference samples.

According to the embodiment of the disclosure, the reference risk identification information can drive the large language model to generate a reference object model identification result according to attribute information of the reference object and historical service processing information of the reference object, wherein the reference object model identification result can be used for representing the risk of the reference object.

According to the embodiment of the disclosure, since the attribute information of the reference object and the historical service processing information of the reference object have complex data and large data volume, and a large number of different kinds of classification models are needed for identifying the reference sample by using the classification model, the structure of the model can be simplified by using the large language model, different tasks can be completed only by controlling the prompt information of the large language model, and the processing efficiency is improved.

According to the embodiment of the disclosure, under the condition that the risk of the reference object is represented by the reference object model identification result, the association relationship between the reference objects is determined by combining the relationship graph, and the preset knowledge graph is obtained.

According to the embodiment of the disclosure, different prompt messages are utilized to instruct the large language model to execute tasks corresponding to the prompt messages, so that the universality of the large language model is improved. And constructing a preset knowledge graph through a large language model, and improving the construction efficiency of the preset knowledge graph.

According to an embodiment of the present disclosure, a preset knowledge graph is obtained based on a reference object model recognition result and a relationship graph of each of a plurality of reference objects, including: determining, for each reference object, a data amount of a first reference recognition result and a data amount of a second reference recognition result based on the reference object model recognition result; obtaining a risk level label of the reference object based on the data amount of the first reference identification result, the data type of the first reference identification result, the data amount of the second reference identification result and the data type of the second reference identification result; and obtaining a preset knowledge graph based on the risk level label and the relationship graph.

According to an embodiment of the present disclosure, the reference object model recognition result includes at least one of: a first reference identification result opposite to the abnormal reference attribute information and a second reference identification result opposite to the abnormal history service information.

According to an embodiment of the present disclosure, the abnormality reference attribute information may include abnormality attribute information of the reference object, such as credit abnormality information or the like. The first reference identification result may be abnormal attribute information in the reference attribute information of each reference object, and the data amount of the first reference identification result may be the number of abnormal reference attribute information of each reference object, or may be the proportion of the abnormal reference attribute information in the reference attribute information.

According to embodiments of the present disclosure, the abnormal history business information may include abnormal business information of the reference object, such as abnormal transactions, etc. The second reference identification result may be abnormal historical service information in the historical service information of each reference object, and the data amount of the second reference identification result may be the number of the abnormal historical service information of each reference object, or may be the proportion of the abnormal historical service information in the historical service information.

According to an embodiment of the present disclosure, the first reference identification result may include a plurality of data types, where different data types correspond to different degrees of importance, and thus, by assigning different weights to different data types, a higher weight may be assigned to a data type with a high degree of importance, and a lower weight may be assigned to a data type with a low degree of importance. Specifically, the data amount of each data type may also be counted separately for the data types of the different first reference identification results.

According to an embodiment of the present disclosure, the second reference identification result may include a plurality of data types, different data types corresponding to different degrees of importance, so that a higher weight may be assigned to a data type with a high degree of importance and a lower weight may be assigned to a data type with a low degree of importance by assigning different weights to different data types. Specifically, the data amount of each data type may also be counted separately for the data types of the different second reference identification results.

According to the embodiment of the disclosure, the risk level tag of the reference object may be obtained based on the data amount of the first reference identification result, the data type of the first reference identification result, the data amount of the second reference identification result, and the data type of the second reference identification result. Specifically, the risk value of the data type can be obtained by multiplying the weights of different data types and the data amount matched with the data type, and the risk value of each data type is added to obtain the risk value of the reference object. According to a preset risk threshold value and a risk value, determining a risk interval in which a reference object is located, and configuring a corresponding risk level label for the reference object.

According to the embodiment of the disclosure, a risk level label is inserted into node information of a relationship map to obtain a preset knowledge map.

According to the embodiment of the disclosure, the reference object model identification result is further divided into the abnormal reference attribute information and the abnormal history service processing information, different weights are distributed, the division granularity is fine, and the accuracy and the effectiveness of the risk level label are further improved.

Fig. 3 schematically illustrates a data flow diagram for generating a preset knowledge-graph, according to an embodiment of the present disclosure.

As shown in fig. 3, a relationship graph 330 is obtained by processing a reference sample 310 and graph generation hint information 320 through a large language model. The reference risk identification hint information 340 is processed through the large language model to obtain a reference object model identification result 350. The reference object model recognition result 350 includes a first reference recognition result 360 and a second reference recognition result 370, and the risk level tag 380 is obtained using the first reference recognition result 360 and the second reference recognition result 370. The risk level label 380 is filled into the node information of the relationship map 330 to obtain a preset knowledge map 390.

According to the embodiment of the disclosure, in the case that the node information of the target node is included in the preset knowledge graph, the graph recognition result of the target object is determined based on the risk level label of the target node.

According to an embodiment of the present disclosure, the attribute information includes an object identifier, the target node is matched with the object identifier, and the node information includes a risk level tag of the target object.

According to embodiments of the present disclosure, a target node that matches a target object may be determined based on an object identification of the target object. And further, the risk level label of the target object can be obtained from the node information of the target node.

According to the embodiment of the disclosure, in the case that the preset knowledge graph includes node information of the target node, the risk level label matched with the target object may be directly obtained from the preset knowledge graph, and the risk level label is used as the graph recognition result of the target object.

According to the embodiment of the disclosure, the map recognition result of the target object can also be obtained by acquiring the risk level label of the object associated with the target object and combining the risk level label of the target object. Specifically, associated objects with different degrees of association may be assigned different weights, for example, a direct associated object of the target object may be assigned a higher weight, and an indirect associated object of the target object may be assigned a lower weight.

According to the embodiment of the disclosure, under the condition that the node information of the target node is included in the preset knowledge graph, the graph recognition result is directly determined through the risk level label, so that the processing efficiency of risk recognition can be improved.

According to an embodiment of the present disclosure, determining a graph recognition result of a target object based on object attribute information of the target object and a preset knowledge graph includes: under the condition that node information of a target node is not included in a preset knowledge graph, determining an associated object with an associated relation with the target object from the preset knowledge graph; determining an association graph recognition result of the association object based on the risk level label of the association object; and determining a graph recognition result of the target object based on the correlation graph recognition result of the correlation object.

According to embodiments of the present disclosure, the association object may include a direct association object with the target object, or may include an indirect association object with the target object. Specifically, the node directly associated with the object is connected to the target node through one edge, and the indirectly associated object is connected to the target node through at least two edges. The associated object having an association relationship with the target object can also be determined by setting an edge threshold, for example, an object connected with the target object through at most five edges is an associated object of the target object.

According to embodiments of the present disclosure, a target node that matches a target object may be determined based on an object identification of the target object. And further, an associated object having an associated relation with the target object can be determined.

According to the embodiment of the disclosure, the association map recognition result of the associated object can be obtained by acquiring the risk level label of the object associated with the target object. And determining the spectrum recognition result of the target object based on the association spectrum recognition result of the association object. Specifically, associated objects with different degrees of association may be assigned different weights, for example, a direct associated object of the target object may be assigned a higher weight, and an indirect associated object of the target object may be assigned a lower weight. Multiplying the weight of the associated object with the associated spectrum recognition result to obtain the spectrum recognition result of the target object.

According to the embodiment of the disclosure, the pattern recognition result of the target object lacking the object attribute information is obtained through the association pattern recognition result of the associated object of the target object, so that the data accuracy is improved, and meanwhile, the risk recognition efficiency is improved.

Fig. 4 schematically illustrates a flowchart of determining a pattern recognition result according to an embodiment of the present disclosure.

As shown in fig. 4, determining the map recognition result includes operations S401 to S405.

In operation S401, it is determined whether node information of the target node is included in the preset knowledge-graph. If it is determined that the node information of the target node is included in the preset knowledge graph, operation S402 is performed, otherwise operation S403 is performed.

In operation S402, a graph recognition result of the target object is determined based on the risk level label of the target node.

In operation S403, an association object having an association relationship with the target object is determined from a preset knowledge graph.

In operation S404, an association graph recognition result of the association object is determined based on the risk level tag of the association object.

In operation S405, a graph recognition result of the target object is determined based on the association graph recognition result of the association object.

According to an embodiment of the present disclosure, according to an information type, attribute information of a target object and service information to be processed are added to a model prompt template to obtain risk identification prompt information, including: determining a model hint template from a plurality of predetermined model hint templates based on the traffic type; and adding the attribute information of the target object and the service information of the service to be processed into a model prompt template based on the information type and the information position mapping table to obtain risk identification prompt information.

According to an embodiment of the present disclosure, the predetermined model hint template includes a task type for instructing the large language model to perform a task, the task type being determined based on the business type. For different service types, different predetermined model hint templates are corresponding, for example, service type a corresponds to predetermined model hint template a. Different traffic types correspond to different task types.

According to the embodiment of the disclosure, different service type identifiers can be allocated to the preset model prompt templates, and the model prompt matched with the service type can be determined through the service type identifiers.

According to an embodiment of the present disclosure, the information type may include attribute information of the target object and service information of the service to be processed. The information location mapping table includes a mapping relationship between information types and filling locations, specifically, the model prompt template may include a plurality of filling locations, but different filling locations correspond to different information types, so that the mapping relationship between the information types and the filling locations in all the predetermined model prompt templates may be stored in the information location mapping table, and the mapping relationship between the information types and the filling locations of the corresponding model prompt template may be queried through the information type identification.

According to the embodiment of the disclosure, attribute information of the target object and service information of the service to be processed can be filled into the model prompt template according to the mapping relation and the information type, so that risk identification prompt information is obtained.

According to the embodiment of the disclosure, the large language model is driven to execute tasks of different task types based on the service types, and the model prompt template is automatically generated through the information position mapping table, so that the richness of the large language model is improved, and the processing efficiency is improved.

Fig. 5 schematically illustrates a schematic diagram of generating risk identification hint information according to an embodiment of the present disclosure.

As shown in fig. 5, a database may store a plurality of predetermined model hint templates 504, and a model hint template 505 is determined from the plurality of predetermined model hint templates 504 according to a business type 503.

According to the embodiment of the present disclosure, the filling positions of the attribute information 501 and the service information 502 to be processed in the model prompt template 505 may be determined according to the information types of the attribute information 501 and the service information 502 to be processed, respectively, and the information position mapping tables stored in the database.

As shown in fig. 5, attribute information 501 and service information 502 to be processed are filled into a model prompt template 505 according to the filling position, so as to obtain risk identification prompt information 506.

According to an embodiment of the present disclosure, obtaining a target risk recognition result of a target object for processing a service to be processed based on a model recognition result and a graph recognition result, includes: under the condition that the model identification result and the map identification result are not matched, determining an abnormal behavior identification result based on historical behavior time sequence information and behavior matching rules of the target object; determining an abnormal attribute identification result based on the attribute information of the target object, the service information of the service to be processed and the attribute matching rule; obtaining a rule recognition result based on the abnormal behavior recognition result and the abnormal attribute recognition result; and obtaining a target risk recognition result of the target object based on the rule recognition result, the model recognition result and the map recognition result.

According to the embodiment of the disclosure, whether the model identification result is matched with the pattern identification result or not can be determined, the accuracy of the model identification result is judged, and under the condition that the model identification result is matched with the pattern identification result, the model identification result can be directly determined to be the target risk identification result of the target object, so that the processing efficiency of risk identification is improved.

According to the embodiment of the disclosure, in the case that the model identification result and the map identification result are not matched, rule matching can be performed through historical behavior time sequence information, attribute information and service information of the service to be processed of the target object, so that a rule identification result is obtained.

According to the embodiment of the disclosure, the historical behavior time sequence information of the target object is matched through the behavior matching rule, so that an abnormal behavior recognition result of the target object is obtained. The abnormal behavior recognition result represents whether abnormal historical behavior information exists in the historical behavior time sequence information.

According to the embodiment of the disclosure, aiming at the attribute information of the target object and the service information of the service to be processed, matching is carried out through an attribute matching rule, and an abnormal attribute identification result of the target object is obtained. The abnormal attribute identification result characterizes whether the attribute information has abnormal attribute information.

According to the embodiment of the disclosure, the rule recognition result may be obtained by respectively assigning different weights to the abnormal behavior recognition result and the abnormal attribute recognition result.

According to the embodiment of the disclosure, the accuracy of risk identification is further improved by performing rule matching.

According to the embodiment of the disclosure, the target risk recognition result of the target object can be obtained by respectively configuring different weights for the rule recognition result, the model recognition result and the map recognition result. In particular, in the case where the model recognition result and the map recognition result do not match, the model recognition result may be assigned a lower weight.

According to the embodiment of the disclosure, under the condition that the model identification result and the map identification result are not matched, the target risk identification result is obtained by utilizing rule matching, so that the accuracy of the risk identification result is improved, and meanwhile, the processing efficiency of risk identification is improved.

Fig. 6 schematically illustrates a flow chart for generating risk identification results in accordance with a specific embodiment of the present disclosure.

As shown in fig. 6, generating the risk identification result includes operations S601 to S604.

In operation S601, it is determined whether the model recognition result and the map recognition result match. In the case where it is determined that the model recognition result and the map recognition result match, operation S602 is performed, otherwise operation S603 is performed.

In operation S602, a risk recognition result of the target object is determined based on the model recognition result.

In operation S603, rule matching is performed by using a preset matching rule based on the historical behavior timing information, attribute information and service information of the service to be processed of the target object, and a rule recognition result of the target object is determined.

According to embodiments of the present disclosure, the preset matching rules may include a behavior matching rule and an attribute matching rule. The behavior matching rule is used for carrying out rule matching on historical behavior time sequence information of the target object to obtain an abnormal behavior identification result, the attribute matching rule is used for carrying out rule matching on attribute information of the target object and service information of the service to be processed to obtain an abnormal attribute identification result, and the rule identification result of the target object is determined based on the abnormal behavior identification result and the abnormal attribute identification result.

In operation S604, a target risk recognition result of the target object is obtained based on the rule recognition result, the model recognition result, and the map recognition result.

Based on the risk identification method, the disclosure further provides a risk identification device. The device will be described in detail below in connection with fig. 7.

Fig. 7 schematically shows a block diagram of a risk identification apparatus according to an embodiment of the present disclosure.

As shown in fig. 7, the risk identification apparatus 700 of this embodiment includes a first determination module 710, an addition module 720, an acquisition module 730, and a second determination module 740.

The first determining module 710 is configured to determine a graph recognition result of the target object based on object attribute information of the target object and a preset knowledge graph, where the preset knowledge graph includes nodes and edges, node information of the nodes represents object attribute information of the object and risk level labels related to the target object, and edge information of the edges represents an association relationship between two nodes connected to the edges. In an embodiment, the first determining module 710 may be configured to perform the operation S210 described above, which is not described herein.

The adding module 720 is configured to, when it is determined that the graph recognition result indicates that the object meets the predetermined risk level, add, according to the information type, attribute information of the target object and the service information to be processed to a model prompt template to obtain risk recognition prompt information, where the model prompt template includes a template for instructing the large language model to execute the expected task. In an embodiment, the adding module 720 may be configured to perform the operation S220 described above, which is not described herein.

The input module 730 is configured to input risk identification prompt information into the large language model, and obtain a model identification result. In an embodiment, the input module 730 may be used to perform the operation S230 described above, which is not described herein.

The second determining module 740 is configured to obtain a target risk recognition result of the target object for processing the service to be processed based on the model recognition result and the graph recognition result. In an embodiment, the second determining module 740 may be configured to perform the operation S240 described above, which is not described herein.

According to an embodiment of the present disclosure, the second determination module 740 includes a behavior matching sub-module, an attribute matching sub-module, a rule determination sub-module, and a risk identification sub-module.

The behavior matching sub-module is used for determining an abnormal behavior identification result based on the historical behavior time sequence information and the behavior matching rule of the target object under the condition that the model identification result and the map identification result are not matched, wherein the abnormal behavior identification result represents whether abnormal historical behavior information exists in the historical behavior time sequence information.

The attribute matching sub-module is used for determining an abnormal attribute identification result based on the attribute information of the target object, the service information of the service to be processed and the attribute matching rule, wherein the abnormal attribute identification result represents whether the attribute information has abnormal attribute information or not.

The rule determination submodule is used for obtaining a rule recognition result based on the abnormal behavior recognition result and the abnormal attribute recognition result.

And the risk identification sub-module is used for obtaining a target risk identification result of the target object based on the rule identification result, the model identification result and the map identification result.

According to an embodiment of the present disclosure, the add-in module 720 includes a template determination sub-module and a template filling sub-module.

The template determination submodule is used for determining a model prompt template from a plurality of preset model prompt templates based on the service type, wherein the preset model prompt template comprises a task type for indicating the large language model to execute tasks, and the task type is determined based on the service type.

The template adding sub-module is used for adding the attribute information of the target object and the service information of the service to be processed into the model prompt template based on the information type and the information position mapping table to obtain risk identification prompt information, wherein the information position mapping table comprises a mapping relation between the information type and the filling position.

According to an embodiment of the present disclosure, the attribute information includes an object identification. The first determination module 710 includes a first determination sub-module.

The first determining submodule is used for determining a graph recognition result of the target object based on the risk level label of the target node under the condition that node information of the target node is included in the preset knowledge graph, wherein the target node is matched with the object identifier, and the node information includes the risk level label of the target object.

According to an embodiment of the present disclosure, the attribute information includes an object identification. The first determination module 710 includes a second determination sub-module, a third determination sub-module, and a fourth determination sub-module.

And the second determining submodule is used for determining an associated object with an associated relation with the target object from the preset knowledge graph under the condition that node information of the target node is not included in the preset knowledge graph, wherein the target node is matched with the object identifier, and the node information includes a risk level label of the target object.

And the third determining submodule is used for determining the association map recognition result of the association object based on the risk level label of the association object.

And the fourth determining submodule is used for determining the spectrum recognition result of the target object based on the association spectrum recognition result of the association object.

According to an embodiment of the present disclosure, the risk recognition apparatus 700 further includes a relationship map generation module, a recognition result generation module, and a preset map generation module.

The relation map generation module is used for processing a plurality of reference samples and maps to generate prompt information by utilizing a large language model to obtain a relation map, wherein the reference samples comprise attribute information of a reference object and historical service processing information of the reference object, the relation map comprises nodes and edges, the edge information of the edges represents the association relation between two nodes connected with the edges, and the node information of the nodes represents the object attribute information of the reference object.

The recognition result generation module is used for processing the reference risk recognition prompt information of each of the plurality of reference samples by using the large language model to obtain the recognition result of the reference object model of each of the plurality of reference samples, wherein the reference risk recognition prompt information of each of the plurality of reference samples is generated based on the plurality of reference samples, and the reference risk recognition prompt information is used for indicating the large language model to execute the task of performing risk recognition on the reference samples.

The preset map generation module is used for obtaining a preset knowledge map based on the reference object model identification result and the relation map of each of the plurality of reference objects.

According to an embodiment of the present disclosure, the reference object model recognition result includes at least one of: a first reference identification result opposite to the abnormal reference attribute information and a second reference identification result opposite to the abnormal history business process information.

According to an embodiment of the present disclosure, the preset map generation module includes a data amount determination sub-module, a label determination sub-module, and a map determination sub-module.

And the data quantity determining sub-module is used for determining the data quantity of the first reference identification result and the data quantity of the second reference identification result based on the reference object model identification result for each reference object.

The tag determination sub-module is used for obtaining a risk level tag of the reference object based on the data volume of the first reference identification result, the data type of the first reference identification result, the data volume of the second reference identification result and the data type of the second reference identification result.

The map determining sub-module is used for obtaining a preset knowledge map based on the risk level label and the relation map.

According to an embodiment of the present disclosure, any of the first determining module 710, the adding module 720, the acquiring module 730, and the second determining module 740 may be combined in one module to be implemented, or any of the modules may be split into a plurality of modules. Or at least some of the functionality of one or more of the modules may be combined with, and implemented in, at least some of the functionality of other modules. According to embodiments of the present disclosure, at least one of the first determination module 710, the addition module 720, the acquisition module 730, and the second determination module 740 may be implemented at least in part as hardware circuitry, such as a Field Programmable Gate Array (FPGA), a Programmable Logic Array (PLA), a system on a chip, a system on a substrate, a system on a package, an Application Specific Integrated Circuit (ASIC), or may be implemented in hardware or firmware in any other reasonable way of integrating or packaging circuitry, or in any one of or a suitable combination of three of software, hardware, and firmware. Or at least one of the first determination module 710, the adding module 720, the obtaining module 730, and the second determination module 740 may be at least partially implemented as computer program modules, which when executed, may perform the respective functions.

As shown in fig. 8, an electronic device 800 according to an embodiment of the present disclosure includes a processor 801 that can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM) 802 or a program loaded from a storage section 808 into a Random Access Memory (RAM) 803. The processor 801 may include, for example, a general purpose microprocessor (e.g., a CPU), an instruction set processor and/or an associated chipset and/or a special purpose microprocessor (e.g., an Application Specific Integrated Circuit (ASIC)), or the like. The processor 801 may also include on-board memory for caching purposes. The processor 801 may include a single processing unit or multiple processing units for performing the different actions of the method flows according to embodiments of the disclosure.

In the RAM 803, various programs and data required for the operation of the electronic device 800 are stored. The processor 801, the ROM 802, and the RAM 803 are connected to each other by a bus 804. The processor 801 performs various operations of the method flow according to the embodiments of the present disclosure by executing programs in the ROM 802 and/or the RAM 803. Note that the program may be stored in one or more memories other than the ROM 802 and the RAM 803. The processor 801 may also perform various operations of the method flows according to embodiments of the present disclosure by executing programs stored in the one or more memories.

According to an embodiment of the present disclosure, the electronic device 800 may also include an input/output (I/O) interface 805, the input/output (I/O) interface 805 also being connected to the bus 804. The electronic device 800 may also include one or more of the following components connected to the I/O interface 805: an input portion 806 including a keyboard, mouse, etc.; an output portion 807 including a display such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and a speaker; a storage section 808 including a hard disk or the like; and a communication section 809 including a network interface card such as a LAN card, a modem, or the like. The communication section 809 performs communication processing via a network such as the internet. The drive 810 is also connected to the I/O interface 805 as needed. A removable medium 811 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 810 as needed so that a computer program read out therefrom is mounted into the storage section 808 as needed.

The present disclosure also provides a computer-readable storage medium that may be embodied in the apparatus/device/system described in the above embodiments; or may exist alone without being assembled into the apparatus/device/system. The computer-readable storage medium carries one or more programs which, when executed, implement methods in accordance with embodiments of the present disclosure.

According to embodiments of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, which may include, for example, but is not limited to: a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this disclosure, a computer-readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. For example, according to embodiments of the present disclosure, the computer-readable storage medium may include ROM 802 and/or RAM 803 and/or one or more memories other than ROM 802 and RAM 803 described above.

Embodiments of the present disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowcharts. The program code, when executed in a computer system, causes the computer system to implement the item recommendation method provided by embodiments of the present disclosure.

The above-described functions defined in the system/apparatus of the embodiments of the present disclosure are performed when the computer program is executed by the processor 801. The systems, apparatus, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the disclosure.

In one embodiment, the computer program may be based on a tangible storage medium such as an optical storage device, a magnetic storage device, or the like. In another embodiment, the computer program may also be transmitted, distributed, and downloaded and installed in the form of a signal on a network medium, and/or from a removable medium 811 via a communication portion 809. The computer program may include program code that may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the foregoing.

In such an embodiment, the computer program may be downloaded and installed from a network via the communication section 809, and/or installed from the removable media 811. The above-described functions defined in the system of the embodiments of the present disclosure are performed when the computer program is executed by the processor 801. The systems, devices, apparatus, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the disclosure.

According to embodiments of the present disclosure, program code for performing computer programs provided by embodiments of the present disclosure may be written in any combination of one or more programming languages, and in particular, such computer programs may be implemented in high-level procedural and/or object-oriented programming languages, and/or assembly/machine languages. Programming languages include, but are not limited to, such as Java, c++, python, "C" or similar programming languages. The program code may execute entirely on the user's computing device, partly on the user's device, partly on a remote computing device, or entirely on the remote computing device or server. In the case of remote computing devices, the remote computing device may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computing device (e.g., connected via the Internet using an Internet service provider).

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

Those skilled in the art will appreciate that the features recited in the various embodiments of the disclosure and/or in the claims may be provided in a variety of combinations and/or combinations, even if such combinations or combinations are not explicitly recited in the disclosure. In particular, the features recited in the various embodiments of the present disclosure and/or the claims may be variously combined and/or combined without departing from the spirit and teachings of the present disclosure. All such combinations and/or combinations fall within the scope of the present disclosure.

The embodiments of the present disclosure are described above. These examples are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the embodiments cannot be used advantageously in combination. The scope of the disclosure is defined by the appended claims and equivalents thereof. Various alternatives and modifications can be made by those skilled in the art without departing from the scope of the disclosure, and such alternatives and modifications are intended to fall within the scope of the disclosure.

Claims

1. A risk identification method, the method comprising:

Determining a graph recognition result of a target object based on object attribute information of the target object and a preset knowledge graph, wherein the preset knowledge graph comprises nodes and edges, node information of the nodes represents the object attribute information of the target object and risk level labels related to the target object, and edge information of the edges represents an association relationship between two nodes connected with the edges;

Under the condition that the map recognition result represents that the target object meets a preset risk level, adding the attribute information and the service information to be processed of the target object into a model prompt template according to an information type to obtain risk recognition prompt information, wherein the model prompt template comprises a template for indicating the large language model to execute an expected task;

Inputting the risk identification prompt information into the large language model to obtain a model identification result; and

And obtaining a target risk identification result of the target object for processing the service to be processed based on the model identification result and the map identification result.

2. The method of claim 1, wherein the step of determining the position of the substrate comprises,

The obtaining the target risk recognition result of the target object for processing the service to be processed based on the model recognition result and the map recognition result includes:

Determining an abnormal behavior recognition result based on the historical behavior time sequence information and the behavior matching rule of the target object under the condition that the model recognition result and the map recognition result are not matched, wherein the abnormal behavior recognition result represents whether abnormal historical behavior information exists in the historical behavior time sequence information;

Determining an abnormal attribute identification result based on the attribute information of the target object, the service information of the service to be processed and an attribute matching rule, wherein the abnormal attribute identification result represents whether abnormal attribute information exists in the attribute information;

obtaining a rule recognition result based on the abnormal behavior recognition result and the abnormal attribute recognition result; and

And obtaining a target risk recognition result of the target object based on the rule recognition result, the model recognition result and the map recognition result.

3. The method of claim 1, wherein the step of determining the position of the substrate comprises,

The step of adding the attribute information and the service information to be processed of the target object into a model prompt template according to the information type to obtain risk identification prompt information, comprising:

Determining a model hint template from a plurality of predetermined model hint templates based on a business type, wherein the predetermined model hint templates include a task type for instructing a large language model to perform a task, the task type being determined based on the business type; and

And adding the attribute information of the target object and the service information of the service to be processed into the model prompt template based on the information type and an information position mapping table to obtain the risk identification prompt information, wherein the information position mapping table comprises a mapping relation between the information type and the filling position.

4. The method of claim 1, wherein the attribute information comprises an object identification;

The determining the graph recognition result of the target object based on the object attribute information of the target object and the preset knowledge graph comprises the following steps:

And under the condition that node information of a target node is included in the preset knowledge graph, determining a graph recognition result of the target object based on a risk level label of the target node, wherein the target node is matched with the object identifier, and the node information includes the risk level label of the target object.

5. The method according to claim 1 or 4, wherein the attribute information comprises an object identification;

Determining an associated object with an associated relation with the target object from the preset knowledge graph under the condition that node information of the target node is not included in the preset knowledge graph, wherein the target node is matched with the object identifier, and the node information includes a risk level label of the target object;

Determining an association graph recognition result of the association object based on the risk level label of the association object; and

And determining the graph recognition result of the target object based on the correlation graph recognition result of the correlation object.

6. The method according to claim 1, wherein the method further comprises:

Processing a plurality of reference samples and a map by using the large language model to generate prompt information, and obtaining a relation map, wherein the reference samples comprise attribute information of a reference object and historical service processing information of the reference object, the relation map comprises nodes and edges, the edge information of the edges represents an association relationship between two nodes connected with the edges, and the node information of the nodes represents object attribute information of the reference object;

processing the reference risk identification prompt information of each of the plurality of reference samples by using the large language model to obtain a reference object model identification result of each of the plurality of reference samples, wherein the reference risk identification prompt information of each of the plurality of reference samples is generated based on the plurality of reference samples, and the reference risk identification prompt information is used for indicating the large language model to execute a task of performing risk identification on the reference samples; and

And obtaining the preset knowledge graph based on the reference object model identification result of each of the plurality of reference objects and the relation graph.

7. The method according to claim 1, characterized in that: the reference object model recognition result comprises at least one of the following: a first reference identification result opposed to the abnormality reference attribute information and a second reference identification result opposed to the abnormality history business process information,

The obtaining the preset knowledge graph based on the reference object model recognition result and the relation graph of each of the plurality of reference objects includes:

Determining, for each of the reference objects, a data amount of the first reference recognition result and a data amount of the second reference recognition result based on the reference object model recognition result;

Obtaining a risk level tag of the reference object based on the data amount of the first reference identification result, the data type of the first reference identification result, the data amount of the second reference identification result and the data type of the second reference identification result; and

And obtaining the preset knowledge graph based on the risk level label and the relation graph.

8. A risk identification device, the device comprising:

The first determining module is used for determining a graph recognition result of the target object based on object attribute information of the target object and a preset knowledge graph, wherein the preset knowledge graph comprises nodes and edges, node information of the nodes represents object attribute information of the object and risk level labels related to the target object, and edge information of the edges represents association relations between two nodes connected with the edges;

the adding module is used for adding the attribute information and the business information to be processed of the target object into a model prompt template according to the information type under the condition that the map recognition result represents that the object meets the preset risk level, so as to obtain risk recognition prompt information, wherein the model prompt template comprises a template for indicating the large language model to execute an expected task;

the input module is used for inputting the risk identification prompt information into the large language model to obtain a model identification result; and

And the second determining module is used for obtaining a target risk identification result of the target object for processing the service to be processed based on the model identification result and the map identification result.

9. An electronic device, comprising:

One or more processors;

Storage means for storing one or more computer programs,

Characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, on which a computer program/instruction is stored, characterized in that the computer program/instruction, when executed by a processor, implements the steps of the method according to any one of claims 1-7.