TWI804575B - Method and apparatus, computer readable storage medium, and computing device for identifying high-risk users - Google Patents

Abstract

The embodiment of this specification provides a method and device for determining high-risk users. According to the method, first, based on the set of abnormal rules, high-risk business request events and corresponding first users with high risks are determined, and then based on the crowd relationship map Carry out risk diffusion, and add the second user who has a specific association relationship with the first user in the map as a high-risk user and add it to the high-risk user set. Further, the exception rule set can be updated based on the high-risk user set. In this way, high-risk users can be identified more efficiently.

Description

Method and apparatus, computer readable storage medium, and computing device for identifying high-risk users

One or more embodiments of this specification are related to the field of computer technology, especially related to the method and device for determining high-risk users through computers.

With the development of computer and Internet technology, more and more businesses are realized through computing platforms, such as commodity trading, money payment, financial lending, insurance claims and so on. However, in the execution and processing of many businesses, if the background of the business requester and the requested business are not reviewed, it is likely to bring greater risks. For example, some lawbreakers may use electronic platforms to carry out financial fraud and borrowing money. Cash out, insurance fraud, etc.

In the prior art, in order to prevent and reduce the above-mentioned risks, risk review is often performed manually. In some platforms, some simple rules are also set to assist humans in making judgments. However, this method is very inefficient and difficult to meet the needs of rapid business development; moreover, the accuracy of identifying high-risk users and high-risk events depends on the experience of the salesperson who manually audits, the accuracy is difficult to ensure, and omissions often occur .

Therefore, an improved solution is desired to reduce business risk by efficiently identifying and determining high-risk users.

One or more embodiments of this specification describe a method and device, which can spread identified high-risk users based on a crowd relationship graph, so as to more efficiently and accurately identify high-risk users.

According to a first aspect, a method for determining a high-risk user is provided, including: acquiring event information of a service request event to be evaluated, where the event information includes user information of a first user involved in the service request event; Based on at least the set of abnormal rules and the user information of the first user, determine whether the service request event is a high-risk event; Add the first user and the second user to a high-risk user set with a second user with a specific association relationship with the first user; update the abnormal rule set based on the high-risk user set.

According to a possible design, the abnormal rule set includes a plurality of user characteristics, and a plurality of determination rules set for the plurality of user characteristics.

In a possible design, the above multiple user features include one or more of the following: user basic attribute features, user behavior features, user relationship features, and user location features.

According to one embodiment, judging whether a service request event is a high-risk event based on the set of abnormal rules specifically includes: comparing the user information of the first user with the plurality of judging rules; The above business request events are high-risk events. In a possible design, judging whether the service request event is a high-risk event further includes: when further receiving a first verification result, determining that the service request event is a high-risk event, wherein the first verification result It is a manual verification result for verifying the business request event as a high-risk event. Or, when the second verification result is further received, it is determined that the business request event is a non-high-risk event, wherein the second verification result is a manual verification of the business request event as a non-high-risk event Result; in this case, the method further includes, according to the second verification result, updating the exception rule set. According to a possible design, the crowd relationship graph is established based on one or more of the following relationships: transaction relationship, equipment relationship, capital relationship, and social relationship. In one embodiment, based on the crowd relationship graph, determining the second user who has a specific relationship with the first user specifically includes: determining at least one group containing the first user from the crowd relationship graph; A high-risk group is determined from the at least one group according to the proportion of high-risk users in each group, wherein the proportion of high-risk users in each group is the intersection of the group and the set of high-risk users The ratio of the number M of users of the group to the total number N of users of the group; A user in the high-risk group is determined as the second user. In a possible design, the method further includes, based on the group relationship graph, determining a third user associated with the second user, and adding the third user to the high-risk user set. In one embodiment, updating the abnormal rule set based on the high-risk user set specifically includes: updating the multiple user features and/or the multiple decision rules based on the statistics of the user features of each user in the high-risk user set . According to a second aspect, an apparatus for determining a high-risk user is provided, comprising: An event acquiring unit configured to acquire event information of a service request event to be evaluated, where the event information includes user information of the first user involved in the service request event; The event judging unit is configured to judge whether the service request event is a high-risk event based at least on the exception rule set and the user information of the first user; The user determining unit is configured to determine the second user who has a specific association relationship with the first user based on the crowd relationship graph when the service request event is determined to be a high-risk event, and associate the first user with the first user The second user is added to the high-risk user set; The first updating unit is configured to update the abnormal rule set based on the high-risk user set. According to a third aspect, there is provided a computer-readable storage medium on which a computer program is stored, and when the computer program is executed in the computer, the computer is made to execute the method of the first aspect. According to a fourth aspect, there is provided a computing device, including a memory and a processor, wherein executable codes are stored in the memory, and when the processor executes the executable codes, the first state is realized. kind of method. Through the method and device provided by the embodiment of this specification, firstly, high-risk business request events and high-risk users are determined based on the set of abnormal rules, and then high-risk users are diffused based on the crowd relationship map. In this way, from a single business request event , multiple high-risk users can be identified, greatly improving identification efficiency. Furthermore, in the case of spreading to more high-risk users, the newly identified high-risk users are used to update the abnormal rule set, so as to optimize the abnormal rule set, so that the abnormal rule set can be further improved in subsequent judgments. Improve judgment accuracy.

The solution provided in this manual will be described below with reference to the drawings. Fig. 1 is a schematic diagram of an implementation scene of an embodiment disclosed in this specification. In this implementation scenario, a user requests a business event from the computing platform, such as applying for an insurance claim. For this incident, the computing platform first determines whether the user is a high-risk user, and if so, carries out risk "diffusion" based on the user's network to discover other high-risk users. Correspondingly, the computing platform includes an exception rule engine and a diffusion engine, and the exception rule engine makes a preliminary judgment on the user's business application event according to the preset exception rules. In some cases, human review can also be assisted. Once the current service application event is determined to be a high-risk event, the current user is also determined to be a high-risk user. Further, the diffusion engine is used to diffuse high-risk users based on the current user's relationship network. This is based on the observation and statistics that many high-risk incidents have the characteristics of "gangs", that is, they require the cooperation of multiple people to complete. In this way, when a certain user is identified as a high-risk user, the user's network can be further analyzed, and groups with "gang" characteristics can be excavated from it, so as to determine other associated high-risk users. In this way, multiple high-risk users can be identified from a single service request event, greatly improving identification efficiency. Furthermore, in the case of spreading to more high-risk users, the newly identified high-risk users can be fed back to the abnormal rule engine, so as to optimize the abnormal rule engine, so that the abnormal rule engine can, in subsequent judgments, Further improve the judgment accuracy. The specific execution process of the above scenario is described below. Fig. 2 shows a flowchart of a method for determining high-risk users according to an embodiment. The subject of execution of this method can be any system, device, device, platform or server with computing and processing capabilities, such as the computing platform shown in Figure 1, more specifically, various backgrounds that need to analyze and control business risks Servers, such as Alipay servers, insurance business servers, financial approval servers, etc. As shown in Figure 2, the method includes the following steps: step 21, obtain relevant information of the service request event, the relevant information includes user information of the first user involved in the service request event; step 22, at least based on abnormal rules Gathering and the user information to determine whether the service request event is a high-risk event; step 23, in the case of determining that the service request event is a high-risk event, based on the crowd relationship map, determine whether there is a relationship with the first user Add the first user and the second user to the high-risk user set for the second user of the specific association relationship; Step 24, update the abnormal rule set based on the high-risk user set. The execution manner of each of the above steps is described below. First, in step 21, the relevant information of the service request event to be evaluated is obtained. It can be understood that the service request event to be evaluated may be a request event for various potentially risky services, for example, applying for a loan, applying for an insurance claim, and the like. For the sake of clarity and distinction, the user involved in the service request event is referred to as the first user hereinafter. Generally, the first user may be the requester of the above service request event. According to an embodiment, various information related to the service request event can be obtained in step 21, including event information related to the event itself, and user information related to the user involved in the service request event (ie, the first user). The above-mentioned event information includes, for example, the type of service requested, the requested amount, the time and location of the request, etc., and the user information may further include various features. In one embodiment, the user information includes basic user attributes, such as gender, age, registration duration, contact information and other basic information. In one embodiment, the user information includes user behavior characteristics. More specifically, the user behavior characteristics may include behavior information related to the user's business operations, such as the number of transactions, the average transaction amount, the number of claims applications, the number of approved claims, the average claim amount, and the like. In one embodiment, the user behavior feature may be a dynamically changing feature and updated based on the above event information. For example, when the first user sends out this business request event of applying for a claim, it is necessary to update its user behavior characteristics, such as updating parameters such as the number of times of applying for a claim. In one embodiment, the user information also includes user relationship characteristics, for example, the number of contacts with a fund transaction exceeding a certain amount, a list of contacts with a transaction frequency exceeding a certain number, and the like. In one embodiment, the user information also includes user location characteristics, such as the location where each transaction occurs, the range of location change, and so on. In more embodiments, the user information may also include more aspects of user characteristics. It can be understood that correspondingly, in step 21, the user information of the first user involved in the above-mentioned service request event may be obtained, and the user information includes part or all of the user features in the above-mentioned aspects. Next, in step 22, it is determined whether the service request event is a high-risk event. The determining process includes at least step 221, in which it is judged whether the above-mentioned service request event is a high-risk event based on the exception rule set and the user information of the above-mentioned first user. The exception rule set is a pre-set rule set, which includes several rules, and these rules are used to judge whether the business application event and/or the involved users have abnormal risks. Initially, the set of exception rules may be set by business personnel based on practical experience; as the method of the embodiment advances, it will be continuously updated and adjusted. Generally, the exception rule set includes multiple user characteristics and multiple determination rules set for the multiple user characteristics. Wherein, similar to the foregoing, the multiple user features include one or more of the following: user basic attribute features, user behavior features, user relationship features, user location features, and the like. Figure 3 shows a specific example of an exception rule set. As shown in Figure 3, the set of abnormal rules includes at least the following user characteristics: age, registration duration (these two characteristics belong to the basic attribute characteristics of the user), the average claim amount, and the number of claims (these two characteristics belong to the user behavior characteristics), The number of contacts whose capital transactions exceed 1,000 yuan (this feature belongs to the user relationship feature), etc. According to the above-mentioned user characteristics, judgment rules are respectively set. Specifically, for the user characteristic "age", the set judgment rule is 30 to 40 years old; for the user characteristic "registration time", the set judgment rule is less than 3 months; for the number of claims applications, the set judgment rule is greater than 3 times; for the average claim amount, the set judgment rule is greater than 10,000 yuan; and so on. Based on such a set of abnormal rules, a preliminary judgment can be made on whether the service request event acquired in step 21 is a high-risk event. Specifically, each corresponding user feature in the user information of the first user may be compared with the plurality of determination rules; when the comparison result meets a predetermined condition, it is determined that the service request event is a high-risk event. The foregoing predetermined condition may be, for example, that a predetermined number or a predetermined proportion of the determination rules among the plurality of determination rules included in the exception rule set are satisfied. For example, in a specific example, the abnormal rule set contains 10 user characteristics and corresponding judgment rules, then the predetermined condition can be set as, when any 8 judgment rules are satisfied, the current user is considered to be a high-risk user , the current business request event is a high-risk event. Alternatively, the above-mentioned predetermined condition can be set as a more complex rule expression, for example, assuming that the exception rule set contains at least 5 determination rules of A, B, C, D, E, then the predetermined condition can be, for example, A AND (B OR C OR D) The logical operation formula of AND E. In one embodiment, it is determined directly based on the comparison result between the user information of the first user and the exception rule set in step 221 whether the above-mentioned service request event is a high-risk event. In another embodiment, after step 221 makes a preliminary judgment on the above-mentioned business request event based on the set of abnormal rules, step 222 (as shown by the dotted line in FIG. 2 ) is also included, in which the above-mentioned business request is finally determined in combination with the result of manual verification. Whether the event is a high-risk event. That is to say, if step 221 judges that the above-mentioned service request event is a high-risk event based on the exception rule set, then send the event to the manual review module, and receive a verification result for the event from the manual review module. In step 222, if the received verification result is that the service request event is manually verified as a high-risk event, then it is determined that the service request event is a high-risk event. On the other hand, if the verification result received is that the business request event is manually verified as a non-high-risk event, then it is determined that the business request event is a non-high-risk event, and, in step 223, according to such verification As a result, the set of exception rules is updated. It can be understood that the occurrence of step 223 means that there is a deviation in the judgment of the abnormal rule set. Therefore, it is necessary to update the exception rule set according to the result of manual verification, that is, the result of manual correction, so as to avoid the same deviation in the future. In one embodiment, for the business request events determined to be high risk based on the exception rule set, a part of them is selected and sent to the manual review module, thereby reducing the workload of manual review. In one embodiment, the consistency ratio between the manual verification result and the judgment result based on the abnormal rule set is counted, and the ratio of events sent to the manual verification module for verification is determined according to the ratio. For example, the higher the consistency between the manual verification result and the judgment result based on the exception rule set, the fewer business request events can be sent to the manual verification module for verification. When the consistency between the manual verification result and the judgment result based on the abnormal rule set reaches a certain high percentage threshold, such as 98%, then manual verification can be omitted, and whether the business request event is a high-risk event can be determined directly based on the abnormal rule set. Based on the above, in step 22, at least based on the set of abnormal rules (optionally also based on manual verification), it is determined whether the service request event acquired in step 21 is a high-risk event. If the event is determined to be a high-risk event, then correspondingly, the first user will be determined to be a high-risk user, and then, in step 23, based on the crowd relationship map, determine the second user who has a specific relationship with the first user, And both the first user and the second user are added to the high-risk user set. In other words, if it is determined that the first user is a high-risk user, based on the crowd relationship graph, the high-risk users are "diffused" to find other potential high-risk users closely related to the first user. The diffusion of the above high-risk users should be based on the pre-established crowd relationship map. The crowd relationship graph can be pre-established in various ways. In one embodiment, the crowd relationship graph is established based on the transaction relationship of the crowd. For example, if a commodity purchase transaction is reached between two users, a transaction association is established between the two users. The transaction relationship between users can be determined by obtaining and analyzing the transaction records of a large number of users, and then a crowd relationship map can be established. In one embodiment, the crowd relationship graph is established based on the device relationships of the crowd. For example, when two or more user accounts use the same terminal device to log in, it can be determined that there is a device association between the two or more user accounts. Two or more user accounts associated with devices may be multiple accounts registered by the same entity user, or may be accounts corresponding to multiple users that are closely related (such as family members, colleagues, etc.). The device relationship can be determined by obtaining the corresponding physical terminal information when the user logs into his account. In one embodiment, the crowd relationship graph is built based on financial relationships. For example, when there are fund transfer operations such as transfer and receipt between two users, a fund association is established between the two users. The financial relationship between users can be determined by obtaining and analyzing the records of users' capital operations using electronic wallets, and then a crowd relationship map can be established based on the financial relationship. In one embodiment, the group relationship graph is established based on social relationships. Nowadays, people increasingly use social applications for interaction. For example, two users can interact with each other through chatting, sending red envelopes, file transfers, etc. through social applications, so a social relationship can be established between the two users. The social relationship between groups of people can be determined based on a large number of social interactions captured by social applications, and then a group relationship graph can be established. Although several examples have been given above, it can be understood that the group relationship graph can also be established based on more kinds of group association relationships. Moreover, the crowd relationship graph can be established based on several kinds of crowd associations at the same time. In one embodiment, the group relationship graph can be formed in the form of a node network. In this form, the crowd relationship graph includes a plurality of nodes, each node corresponds to a user, and the nodes in the relationship are connected to each other. In one embodiment, the connection between nodes can have various attributes, such as connection type, connection strength, etc., wherein the connection type includes, for example, financial connection (connection based on financial relationship), social connection (connection based on social interaction), etc. connection, etc.), connection strength can include, for example, strong connection, weak connection, etc. Fig. 4 shows an example of a crowd relationship graph according to one embodiment. As shown in FIG. 4 , in this example, the group relationship graph includes multiple nodes, and each node corresponds to a user. The connection between the nodes indicates that there is an association relationship between the users. Assume that the crowd relationship graph in Figure 4 is established based on the financial and social relationships of the crowd. Correspondingly, the connections between nodes can be financial connections or social connections. In the example in FIG. 4 , different connection types are shown in different line styles, that is, social connections between nodes are shown in dotted lines, and financial connections between nodes are shown in solid lines. Also, the strength of the connection is shown by the thickness of the connection line. For example, thick lines show strong connections and thin lines show weak connections. More specifically, the thick solid line can show a strong financial connection (for example, the financial interaction exceeds a certain amount threshold, such as 10,000 yuan), and the thin solid line shows a weak financial connection (for example, the financial interaction does not exceed the above-mentioned amount threshold) The thick dashed line can show a strong social connection (for example, the interaction frequency exceeds a frequency threshold, such as 10 times a day), and the thin dashed line shows a weak social connection (for example, the interaction frequency does not exceed the above frequency threshold). It can be understood that the group relationship graph can also be formed in other forms, such as table form, graph form and so on. A crowd relationship graph can be established based on a single crowd relationship, or based on multiple crowd relationships (for example, based on two relationships in Figure 4). Here, the form and formation process of the group relationship map are not limited. Based on such a crowd relationship map, in step 23, when it is determined that the first user is a high-risk user, a second user who has a specific relationship with the first user is determined in the crowd relation map, and the second user is also identified as a high-risk user. risky users. In an embodiment, the above-mentioned specific relationship includes a specific type of relationship, for example, a fund relationship. In an embodiment, the above-mentioned specific association relationship includes an association relationship of a specific strength, such as a strong association relationship. Certainly, the specific association relationship may also be an association relationship of a specific type and a specific strength. In addition, those skilled in the art may also make other limitations on the above specific association relationship based on the characteristics of the relationship between high-risk users in the collected samples. In one embodiment, considering the characteristics of "groups" among high-risk users in many business scenarios, firstly, groups with certain characteristics are extracted from the crowd relationship graph as high-risk groups, and Other users in the high-risk group including the first user are determined as high-risk second users. Fig. 5 shows the flow of steps for determining the second user, that is, the sub-steps of step 23, according to an embodiment. As shown in FIG. 5 , in order to spread the risk to other users based on the first user, at step 51 , at least one group including the first user is determined from the crowd relationship graph. In different embodiments, groups can be defined in different ways. For example, in social applications, some users can form communities autonomously. Then, in the crowd map based on social relations, groups can be determined based on the communities formed by users themselves. In another embodiment, multiple users including a certain number of users and having a certain connection relationship among users may be regarded as a group. For example, a group can be set to contain 3 to 20 users, and these users have an association relationship between each other; or, in another example, the group can be set to have a strong financial relationship between each several users. It can be understood that, according to different ways of defining groups, the same user may belong to multiple groups. In step 51, all possible groups to which the high-risk first user belongs are determined from the crowd relationship graph. However, these groups are not necessarily all high-risk groups. Therefore, next, in step 52, the groups determined in step 51 are further analyzed, and a high-risk group is selected from them. In one embodiment, according to the proportion of high-risk users in a group, it is determined whether the group is a high-risk group. Specifically, the high-risk user ratio of a certain group is the ratio of the number M of users in the group that have been determined as high-risk users to the total number N of users in the group. In practice, according to one embodiment, a high-risk user set is used to record identified high-risk users. In this case, the number of users M is the number of users in the intersection of the above-mentioned group and the high-risk user set. When the proportion of high-risk users in the group is determined, the proportion can be compared with a preset judgment threshold, such as 70%, to determine whether the group is a high-risk group according to the comparison result, for example, the high-risk group A group whose proportion of risky users is higher than the above-mentioned decision threshold is determined as a high-risk group. On this basis, in step 53, other users in the high-risk group to which the first user belongs are determined as second users, that is, high-risk users, and both the first user and the second user are added to the set of high-risk users. FIG. 6 shows a schematic diagram of a specific example of spreading from a first user to a second user based on a crowd relationship graph. As shown in FIG. 6 , it is assumed that in step 51 , three groups to which the first user belongs are determined from the group relationship graph: group A, group B and group C. Next, in step 52, the proportion of high-risk users in each of the three groups is determined. In one example, a "coloring" method is used to mark previously identified high-risk users in the group. In other words, in the previous processing, once a user is added to the high-risk user set, the user is colored in the crowd relationship graph at the same time. In this way, in step 52, the proportion of high-risk users in each group is judged, that is, the concentration of dyed users in the group is judged. In the example shown in FIG. 6 , group A includes 10 users, and only the first user has been identified as a high-risk user, and the proportion of high-risk users is 10%. Group B contains 8 users, of which 6 users including the first user are dyed, and the proportion of high-risk users is 75%. Group C contains 12 users, of which 3 are dyed, and the proportion of high-risk users is 25%. If the ratio threshold is set to 70%, it can be determined that group B is a high-risk group. Next, in step 53, other users in group B, especially users who have not been dyed (not yet identified as high risk), namely user 10 and user 20, are determined as the second users. After the second user is determined, both the first user and the second user are added to the high-risk user set. In one example, the first user and the second user are colored in the crowd relationship graph, so as to facilitate subsequent diffusion analysis. In an embodiment, after the first user is determined based on the high-risk service request event, and then diffused to the second user based on the first user, further diffusion is performed based on the second user. That is to say, in one embodiment, on the basis of determining the second user, based on the above group relationship map, determine the third user who has a specific relationship with the second user, and add the third user to the high-risk user concentrated. The process of determining the third user who has a specific relationship with the second user based on the second user is consistent with the above-described process of determining the second user based on the first user, and the details will not be repeated here. It should be understood that the above diffusion process can be repeated continuously, that is, after the third user is determined, the fourth user associated with it is found based on the third user, and so on, until no new high-risk users appear until. At this time, the high-risk user set has been diffused and updated. In addition to the high-risk first user determined by the service request event in step 21, it also includes other high-risk users based on the diffusion of the first user, that is, the first user Second user. Therefore, returning to FIG. 2 , in step 24 , based on the high-risk user set, the aforementioned exception rule set is updated. As mentioned above, the exception rule set may include multiple user characteristics, and multiple determination rules set for these user characteristics. In one embodiment, at step 24, the plurality of user characteristics and/or the plurality of determination rules may be updated based on statistics of user characteristics of each user in the high-risk user set. Specifically, in an example, the original set of abnormal rules is shown in FIG. 3 , where the determination rule set for the average claim amount is greater than 10,000 yuan. Assume that as shown in FIG. 6 , based on the first user spreading high-risk users to user 10 and user 20 , both users 10 and 20 are added to the high-risk user set. The newly added high-risk users (user 10 and user 20) have a statistical value of 8,000 yuan for this user characteristic, that is, the average claim amount. Accordingly, the judgment rule for the average claim amount can be modified to be greater than 8,000 yuan. In another example, the original exception rule set includes, for example, 10 user characteristics and corresponding determination rules. Assuming that the newly added high-risk users show strong regularity in a user characteristic other than the above 10 user characteristics, for example, the frequency of capital flow exceeds a certain threshold, then this user characteristic and the corresponding threshold can be added to the exception rule set, thereby updating the exception rule set. In one embodiment, for the diffused high-risk user set, sampling detection can be performed by using a combination of abnormal rule set and manual verification in reverse. For example, select 5% of high-risk users in the high-risk user concentration, and use abnormal rule sets and manual verification to determine whether they are really high-risk users. When the accuracy rate of sampling detection is lower than a certain threshold, adjust the algorithm process of diffusion based on the crowd relationship map, such as adjusting the threshold for determining the proportion of high-risk groups, etc., to make the diffusion process of high-risk users more accurate. Looking back on the above process, first determine high-risk business request events and high-risk users based on the set of abnormal rules, and then spread high-risk users based on the crowd relationship graph. In this way, multiple high-risk users can be identified from a single business request event. Risk users, greatly improving the identification efficiency. Furthermore, in the case of spreading to more high-risk users, the newly identified high-risk users are used to update the abnormal rule set, so as to optimize the abnormal rule set, so that the abnormal rule set can be further improved in subsequent judgments. Judgment accuracy. According to another embodiment, an apparatus for determining high-risk users is also provided. Fig. 7 shows a schematic block diagram of an apparatus for determining high-risk users according to an embodiment. As shown in FIG. 7 , the device 700 for determining high-risk users includes: an event acquiring unit 710 configured to acquire event information of a service request event to be evaluated, the event information including the first The user information of a user; the event judging unit 720 is configured to judge whether the service request event is a high-risk event based on at least the abnormal rule set and the user information of the first user; the user determining unit 730 is configured to determine the In the case that the service request event is a high-risk event, based on the crowd relationship map, determine the second user who has a specific relationship with the first user, and add the first user and the second user to the high-risk user list set; a first updating unit 740 configured to update the abnormal rule set based on the high-risk user set. In one embodiment, the exception rule set includes multiple user characteristics, and multiple determination rules set for the multiple user characteristics. Further, in an embodiment, the above-mentioned multiple user features include one or more of the following: user basic attribute features, user behavior features, user relationship features, and user location features. According to one embodiment, the event judging unit 720 is configured to: compare the user information of the first user with the above-mentioned multiple judging rules; when the comparison result meets a predetermined condition, judge the service request event as a high-risk event. Further, in one embodiment, the device 700 further includes a manual review unit (not shown), or is connected to an external manual review unit. In such a case, the event judging unit 720 is further configured to, when judging that the business request event is a high-risk event based on the exception rule set, also send the above business request event to the manual review unit, and from the manual review The unit receives verification results. Specifically, when the event judging unit 720 further receives the first verification result, it determines that the business request event is a high-risk event, wherein the first verification result is that the business request event is verified as a high-risk event manual verification results. On the other hand, when the event judging unit 720 further receives the second verification result, it determines that the business request event is not a high-risk event, wherein the second verification result is that the business request event is verified as a non-high-risk event. Manual verification results for high-risk events. Correspondingly, the apparatus 700 further includes a second updating unit 750 configured to update the exception rule set according to the second verification result. According to one embodiment, the group relationship graph based on the user determining unit 730 is established according to one or more of the following relationships: transaction relationship, equipment relationship, capital relationship, and social relationship. In one embodiment, the user determination unit 730 further includes: a group determination module 731 configured to determine at least one group including the first user from the group relationship graph; a group selection module 732 configured to According to the proportion of high-risk users in each group, select a high-risk group from the at least one group, wherein the proportion of high-risk users in each group is the intersection of the group and the set of high-risk users The ratio of the number M of users in the group to the total number N of users in the group; and a determining module 733 configured to determine users in the high-risk group as the second users. According to an embodiment, the user determining unit 730 is further configured to determine a third user associated with the second user based on the group relationship graph, and add the third user to the high-risk user set. According to an implementation manner, the first updating unit 740 is configured to: update the plurality of user characteristics and/or the plurality of determination rules based on statistics of user characteristics of each user in the high-risk user set. Through the above devices, multiple high-risk users can be identified from a single service request event, greatly improving the identification efficiency. Moreover, the newly identified high-risk users can also be used to update and optimize the abnormal rule set, so that the abnormal rule set can further improve the judgment accuracy in subsequent judgments. According to another embodiment, there is also provided a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed in the computer, the computer is made to execute the method described in conjunction with FIG. 2 . According to yet another aspect of the embodiment, a computing device is also provided, including a memory and a processor, wherein executable codes are stored in the memory, and when the processor executes the executable codes, the implementation described in conjunction with FIG. 2 is implemented. described method. Those skilled in the art should be aware that, in the above one or more examples, the functions described in the present invention may be implemented by hardware, software, firmware or any combination thereof. When implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium. The specific implementation manners described above have further described the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above descriptions are only specific implementation modes of the present invention and are not intended to limit the scope of the present invention. Protection scope, any modification, equivalent replacement, improvement, etc. made on the basis of the technical solution of the present invention shall be included in the protection scope of the present invention.

700‧‧‧Devices used to identify high-risk users 710‧‧‧event acquisition unit 720‧‧‧event judgment unit 730‧‧‧user determination unit 731‧‧‧Group determination module 732‧‧‧Group selection module 733‧‧‧Determine the module 740‧‧‧The first update unit 750‧‧‧Second update unit

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings that need to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following descriptions are only some embodiments of the present invention. For Those of ordinary skill in the art can also obtain other drawings based on these drawings without making creative efforts. Figure 1 shows a schematic diagram of an implementation scenario of an embodiment disclosed in this specification; FIG. 2 shows a flowchart of a method for determining high-risk users according to an embodiment; Figure 3 shows a specific example of an exception rule set; Figure 4 shows an example of a crowd relationship graph according to one embodiment; FIG. 5 shows a flow of steps for determining a second user according to an embodiment; FIG. 6 shows a schematic diagram of a specific example of spreading from a first user to a second user based on a crowd relationship graph; Fig. 7 shows a schematic block diagram of an apparatus for determining high-risk users according to an embodiment.

Claims (18)

A method for determining a high-risk user, the method comprising: acquiring relevant information of a service request event to be evaluated, the relevant information including user information of a first user involved in the service request event; at least based on an abnormal rule set and the first The user information of the user determines whether the business request event is a high-risk event, wherein the abnormal rule set includes multiple user characteristics, and multiple judgment rules set for the multiple user characteristics; when the business request event is determined to be a high-risk event In the case of a risk event, determine the first user as a high-risk user, and based on the crowd relationship graph, determine the second user who has a specific relationship with the first user, and add the first user and the second user to the A high-risk user set, wherein the group relationship graph includes a plurality of nodes, each node corresponds to a user, and nodes with associated relationships are connected to each other; and based on the statistics of user characteristics of each user in the high-risk user set, update the A plurality of user characteristics, and/or the plurality of decision rules. The method according to claim 1, wherein the plurality of user features include one or more of the following: user basic attribute features, user behavior features, user relationship features, and user location features. The method according to claim 1, wherein, based at least on the exception rule set and the user information of the first user, judging whether the service request event is a high-risk event includes: combining the user information of the first user with the plurality of judgments rules for comparison and when the comparison result meets the predetermined condition, it is judged that the service request event is a high-risk event. The method according to claim 3, wherein, at least based on the set of abnormal rules and the user information of the first user, judging whether the service request event is a high-risk event further includes: when further receiving the first verification result, It is determined that the service request event is a high-risk event, wherein the first verification result is a manual verification result of verifying the service request event as a high-risk event. The method according to claim 3, wherein, based at least on the exception rule set and the user information of the first user, judging whether the service request event is a high-risk event further includes: when the second verification result is further received, Determining that the business request event is a non-high-risk event, wherein the second verification result is a manual verification result of verifying the business request event as a non-high-risk event; the method also includes updating the abnormality according to the second verification result collection of rules. The method according to claim 1, wherein the group relationship graph is established based on one or more of the following relationships: transaction relationship, equipment relationship, capital relationship, and social relationship. The method according to claim 1 or 6, wherein, based on the crowd relationship graph, determining the second user who has a specific relationship with the first user includes: determining at least one user that includes the first user from the crowd relationship graph Groups; according to the proportion of high-risk users in each group, select a high-risk group from the at least one group, wherein the proportion of high-risk users in each group is, the interaction between the group and the high-risk user set the ratio of the number M of concentrated users to the total number N of users in the group; and determining the users in the high-risk group as the second users. The method according to claim 1, further comprising, based on the group relationship graph, determining a third user associated with the second user, and adding the third user to the high-risk user set. A device for determining a high-risk user, the device comprising: an event acquiring unit configured to acquire event information of a service request event to be evaluated, the event information including user information of a first user involved in the service request event; an event judging unit , configured to determine whether the service request event is a high-risk event based at least on the basis of an abnormal rule set and the user information of the first user, wherein the abnormal rule set includes a plurality of user characteristics, and multiple user characteristics set for the plurality of user characteristics a determination rule; the user determination unit is configured to determine the first user as a high-risk user when the service request event is determined to be a high-risk event, and determine that there is a specific association with the first user based on the crowd relationship graph The second user of the relationship, the first user and the second user are added to the high-risk user set, wherein the group relationship graph includes a plurality of nodes, each node corresponds to a user, and the nodes in the relationship are connected to each other ;as well as The first updating unit is configured to update the plurality of user characteristics and/or the plurality of determination rules based on statistics of user characteristics of each user in the high-risk user set. The device according to claim 9, wherein the plurality of user features include one or more of the following: user basic attribute features, user behavior features, user relationship features, and user location features. The device as described in claim 9, wherein the event judging unit is configured to: compare the user information of the first user with the plurality of judging rules; and when the comparison result meets a predetermined condition, judge the service request The event is a high risk event. The device according to claim 11, wherein the event judging unit is further configured to: when further receiving the first verification result, determine that the service request event is a high-risk event, wherein the first verification result is the The business request event is verified as a manual verification result of a high-risk event. The device according to claim 11, wherein the event judging unit is further configured to: when further receiving a second verification result, determine that the service request event is a non-high-risk event, wherein the second verification result is A manual verification result of verifying that the service request event is not a high-risk event; the device further includes a second updating unit configured to update the exception rule set according to the second verification result. The device according to claim 9, wherein the group relationship graph is established based on one or more of the following relationships: transaction relationship, equipment relationship, capital relationship, and social relationship. The device according to claim 9 or 14, wherein the user determination unit includes: a group determination module configured to determine at least one group containing the first user from the crowd relationship graph; a group selection module , configured to select a high-risk group from the at least one group according to the high-risk user ratio of each group, wherein the high-risk user ratio of each group is, the intersection of the group and the high-risk user set The ratio of the number M of concentrated users to the total number N of users in the group; and a determination module configured to determine the users in the high-risk group as the second users. In the device according to claim 9, the user determining unit is further configured to determine a third user associated with the second user based on the group relationship graph, and add the third user to the high-risk user set. A computer-readable storage medium, on which a computer program is stored, and when the computer program is executed in the computer, the computer is made to perform the method described in any one of claims 1-8. A computing device, comprising a memory and a processor, characterized in that executable code is stored in the memory, and when the processor executes the executable code, the method as described in any one of claims 1 to 8 is implemented .

Images