WO2021169631A1 - 欺诈人员识别方法、装置、设备和存储介质 - Google Patents

欺诈人员识别方法、装置、设备和存储介质 Download PDF

Info

Publication number
WO2021169631A1
WO2021169631A1 PCT/CN2021/071059 CN2021071059W WO2021169631A1 WO 2021169631 A1 WO2021169631 A1 WO 2021169631A1 CN 2021071059 W CN2021071059 W CN 2021071059W WO 2021169631 A1 WO2021169631 A1 WO 2021169631A1
Authority
WO
WIPO (PCT)
Prior art keywords
suspect
fraud
information
preset
suspect information
Prior art date
Application number
PCT/CN2021/071059
Other languages
English (en)
French (fr)
Inventor
顾臣务
Original Assignee
深圳壹账通智能科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳壹账通智能科技有限公司 filed Critical 深圳壹账通智能科技有限公司
Publication of WO2021169631A1 publication Critical patent/WO2021169631A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/03—Credit; Loans; Processing thereof
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/30—Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
    • G06F16/36—Creation of semantic tools, e.g. ontology or thesauri
    • G06F16/367—Ontology
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication
    • G06F9/546—Message passing systems or structures, e.g. queues

Definitions

  • This application relates to the field of big data processing, and in particular to methods, devices, equipment and storage media for identifying fraudsters.
  • Fraud detection is currently an important problem faced by financial institutions at home and abroad, and it threatens people's property safety. All financial institutions are trying to adopt various methods and technologies to detect and identify fraud.
  • the inventor realizes that the identification of fraudsters in the prior art is based on the fraudster database determined by the public security.
  • the server obtains the suspect's information, queries the fraudster's database, and judges whether there is fraud in the fraudster's database that is the same as the suspect's information.
  • Personnel information so that the fraudulent identification method cannot locate and identify the existence of group fraud in real time. Due to the lack of real-time, banks and other institutions cannot detect potential fraud groups in time, and the fraud identification function is greatly reduced.
  • the main purpose of this application is to provide a method, device, equipment, and storage medium for identifying fraudsters, which aims to solve the current technical problems of low real-time and accuracy in identifying fraudsters.
  • this application provides a method for identifying fraudsters.
  • the method for identifying fraudsters includes the following steps: when a fraud identification request is received, the suspect information corresponding to the fraud identification request is obtained, and the suspect information Input into the message queue; process the suspect information in the message queue through a graph computing model, and obtain the suspect information corresponding to the intimacy of the suspect and each fraudster in the preset fraud gang map; if the intimacy is greater than Or equal to the preset intimacy threshold, the suspect is added as a new fraudster to the preset fraud gang map, and the recognition result is output.
  • the present application also provides a fraudulent identification device
  • the fraudulent identification device includes: a request receiving module for obtaining the suspect corresponding to the fraud identification request when the fraud identification request is received Information, and input the suspect information into the message queue; the information processing module is used to process the suspect information in the message queue through a graph computing model to obtain the suspect information corresponding to the suspect and the preset fraud gang The intimacy of each fraudster in the map; the result output module is used to add the suspect as a new fraudster to the preset fraud gang map if the intimacy is greater than or equal to the preset intimacy threshold, and Output the recognition result.
  • this application also provides a fraudulent identification device;
  • the fraudulent identification device includes a memory, a processor, and a computer program stored on the memory and capable of running on the processor, wherein: when the computer program is executed by the processor, the following method is implemented: when a fraud identification request is received, the suspect information corresponding to the fraud identification request is obtained, and the suspect information is input into a message queue; Process the suspect information in the message queue through the graph computing model, and obtain the suspect information corresponding to the intimacy between the suspect and the fraudsters in the preset fraud gang map; if the intimacy is greater than or equal to the preset intimacy Threshold, the suspect is added as a new fraudster to the preset fraud gang map, and the recognition result is output.
  • this application also provides a computer storage medium; the computer storage medium stores a computer program, and when the computer program is executed by a processor, the following method is implemented: when a fraud identification request is received, the The suspect information corresponding to the fraud identification request, and the suspect information is input into the message queue; the suspect information in the message queue is processed through the graph calculation model to obtain the suspect information corresponding to the suspect and the preset fraud The intimacy of each fraudster in the gang map; if the intimacy is greater than or equal to the preset intimacy threshold, the suspect is added as a new fraudster to the preset fraud gang map, and the recognition result is output.
  • the graph computing model is used to process the suspect information in the message queue to identify the suspect, which reduces the pressure of processing the suspect information on the server, and ensures the real-time and accuracy of suspect identification in a big data environment.
  • FIG. 1 is a schematic diagram of the device structure of the hardware operating environment involved in the solution of the embodiment of the present application.
  • Fig. 2 is a schematic flowchart of the first embodiment of the method for identifying fraudsters under this application.
  • FIG. 3 is a schematic diagram of functional modules of an embodiment of a fraudulent identification device according to this application.
  • the technical solution of this application can be applied to the fields of artificial intelligence, smart city, blockchain and/or big data technology.
  • the data involved in this application can be stored in a database, or can be stored in a blockchain, such as distributed storage through a blockchain, which is not limited in this application .
  • Figure 1 is a hardware operating environment server (also known as fraudulent identification equipment) involved in the embodiment of the application.
  • the fraudulent identification equipment can be composed of a separate fraud identification device or Other devices are combined with the fraudulent identification device to form a schematic diagram of the structure.
  • the server in the embodiment of the present application refers to a computer that manages resources and provides services for users, and is generally divided into a file server, a database server, and an application server.
  • the computer or computer system running the above software is also called a server.
  • the server has higher requirements in terms of stability, security, performance, etc.; as shown in Figure 1, the server may include: a processor 1001, such as a central processing unit (Central Processing Unit, CPU), network interface 1004, user interface 1003, memory 1005, communication bus 1002, chipset, disk system, network and other hardware.
  • the communication bus 1002 is used to implement connection and communication between these components.
  • the user interface 1003 may include a display screen (Display) and an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface.
  • the network interface 1004 may optionally include a standard wired interface and a wireless interface (such as WIreless-FIdelity, WIFI interface).
  • the memory 1005 may be a high-speed random access memory (random access memory, RAM), or a non-volatile memory (non-volatile memory), such as a disk memory.
  • the memory 1005 may also be a storage device independent of the aforementioned processor 1001.
  • the server may also include a camera, an RF (Radio Frequency, radio frequency) circuit, a sensor, an audio circuit, and a WiFi module; an input unit, a display screen, and a touch screen; the network interface may be optional.
  • RF Radio Frequency, radio frequency
  • the server structure shown in FIG. 1 does not constitute a limitation on the server, and may include more or fewer components than shown in the figure, or a combination of certain components, or different component arrangements.
  • the computer software product is stored in a storage medium (storage medium: also called computer storage medium, computer medium, readable medium, readable storage medium, computer readable storage medium, or directly called medium, etc., storage medium
  • storage medium can be a non-volatile readable storage medium, such as RAM, magnetic disk, optical disk, and includes several instructions to make a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) execute this application
  • the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a computer program.
  • the network interface 1004 is mainly used to connect to a back-end database and perform data communication with the back-end database;
  • the user interface 1003 is mainly used to connect to a client (client, also called a client or terminal, in this embodiment of the application)
  • the terminal can be a fixed terminal or a mobile terminal, such as smart air conditioners with networking functions, smart lights, smart power supplies, smart speakers, self-driving cars, PCs, smart phones, tablets, e-book readers, portable computers, etc., terminals It contains sensors such as light sensors, motion sensors and other sensors, which will not be repeated here), to communicate with the client; and the processor 1001 can be used to call the computer program stored in the memory 1005 and execute the following embodiments of the present application Provide the steps in the fraudulent identification method.
  • a preset fraud gang map is constructed in advance.
  • the fraudulent identification method in this embodiment is applied to a server (also called a fraudulent identification device), and the server is based on fraudulent activities.
  • a fraud gang map to use the fraud gang map to identify fraudsters. Due to the intricate relationship network in the fraud gang, the fraud gang map often has a lag, and various financial institutions cannot locate in real time based on the fraud gang map. And to identify the existence of gang fraud, therefore, there may still be situations where financial institutions cannot detect potential fraud gangs in time.
  • fraud identification is performed through the fraud relationship graph.
  • Most of the fraud relationship graph modeling uses batch processing to process graph data. Whenever a new batch of data arrives, the server set up in the organization re-calculates the graph based on the new data. Generate a fraud relationship graph.
  • the simultaneous influx of large quantities of data slows down server processing efficiency and makes it difficult to complete the map update instantaneously. As a result, the timely accuracy of modeling cannot be guaranteed.
  • the relationship network in the fraud group is intricate and complicated. As the data increases, the server processing pressure is also increasing. Exponential enhancement, especially the burden on the server, it is difficult to guarantee the timeliness of response.
  • This application provides a solution, which includes: when a fraud identification request is received, obtaining suspect information corresponding to the fraud identification request, and inputting the suspect information into a message queue; and processing the information through a graph computing model
  • the suspect information in the message queue is obtained, and the suspect information corresponds to the intimacy between the suspect and the fraudsters in the preset fraud gang map; if the intimacy is greater than or equal to the preset intimacy threshold, the suspect The person is added as a new fraudster to the preset fraud gang map, and the recognition result is output.
  • the pressure on the server is reduced by the message queue, and the real-time and accuracy of identification of fraudsters are improved.
  • the fraudulent identification method includes the following steps.
  • Step S10 When a fraud identification request is received, the suspect information corresponding to the fraud identification request is obtained, and the suspect information is input into the message queue.
  • the server receives the fraud identification request.
  • the triggering method of the fraud identification request is not specifically limited. That is, the fraud identification request can be triggered by the user.
  • the virtual button in the display interface of the mobile terminal triggers a fraud identification request based on the suspect information.
  • the mobile terminal sends the fraud identification request to the server, and the server receives the fraud identification request; in addition, the fraud identification request can also be automatically triggered by the server, for example, When the server detects that the credit user database is updated, the server obtains the updated suspect information in the credit user database, and the server triggers a fraud identification request based on the suspect information.
  • the server When the server receives the fraud identification request, the server obtains the suspect information corresponding to the fraud identification request.
  • the suspect information includes but is not limited to: the suspect's name, contact information, face image, fingerprint information, home address information, and transaction account Information and asset information.
  • the server inputs the suspect information into the message queue.
  • the suspect information is input into the message queue, and then the suspect information is obtained from the message queue.
  • the uneven suspect information is processed through the message queue. For a uniform information flow, then as a producer, the suspect information is continuously delivered to the consumer.
  • the high throughput of the message queue effectively solves the coordination and concurrency problems between the producer and the consumer.
  • the server obtains the message length of the message queue, and the server determines whether to start the multi-thread model to process the suspect information according to the message length of the message queue, specifically: in the message queue
  • the server determines whether to start the multi-thread model to process the suspect information according to the message length of the message queue, specifically: in the message queue
  • the message length of is greater than the preset length
  • at least two task threads of the execution graph calculation model are created, and asynchronous task threads are used to process the suspect information in the message queue.
  • the server compares the message length of the message queue with the preset length, and judges whether the message length of the message queue is greater than the preset length.
  • the preset length can be set according to specific factors such as server performance, message processing steps, and message processing duration, for example, preset The length is set to 20.
  • the server determines that the message length of the message queue is less than or equal to the preset length
  • the server uses a single thread to synchronously process the suspect information in the message queue.
  • the server determines that the message length of the message queue is greater than the preset length
  • the server Create at least two task threads for the execution graph calculation model, and the server uses asynchronous task threads to process the suspect information in the message queue.
  • Step S20 Process the suspect information in the message queue through a graph computing model, and obtain the intimacy of the suspect information corresponding to the suspect and each fraudster in the preset fraud group graph.
  • the server processes the suspect information in the message queue through the graph computing model, and obtains the suspect information corresponding to the intimacy between the suspect and the fraudsters in the preset fraud gang map.
  • the graph calculation model is a traversal algorithm, such as Neo4j, OrientDB, DEX and Infinite Graph.
  • the graph calculation model sequentially calculates the similarity between the suspect information and the information of the fraudsters in the preset fraud group graph, and the server regards the similarity as the suspect The information corresponds to the intimacy between the suspect and the fraudsters in the preset fraud gang map.
  • the graph calculation model is a super-step algorithm, such as GoldenOrb, Giraph, Pregel, and Hama; the graph calculation model takes the suspect information and the preset fraud gang map as input, and the graph calculation model establishes a new node based on the suspect information.
  • Set a custom function for suspect information (the custom function can be a AND or NOT function); the graph calculation model determines the establishment of the association between the new node and the fraudsters in the fraud group graph according to the custom function, and graph calculation The model quantifies the relationship between the newly added nodes and each node in the fraud gang map, and obtains the suspect information corresponding to the intimacy of the suspects and the fraudsters in the fraud gang map.
  • Step S30 if the intimacy is greater than or equal to the preset intimacy threshold, the suspect is added as a new fraudster to the preset fraud gang map, and the recognition result is output.
  • the intimacy threshold is preset in the server, and the preset intimacy threshold is flexibly set according to the specific situation. For example, the preset intimacy threshold is set to 60, and the server compares the intimacy between the suspect and each fraudster with the preset intimacy threshold. If the intimacy is greater than or equal to the preset intimacy threshold, the server adds the suspect as a new fraudster to the preset fraud gang map, and the server outputs the identification result of the suspect information corresponding to the suspect as a fraudster.
  • the graph computing model is used to process the suspect information in the message queue for suspect identification, which reduces the pressure of processing suspect information on the server, and ensures the real-time and accuracy of suspect identification in a big data environment.
  • This embodiment is a detailed step of step S10 in the first embodiment.
  • the difference between this embodiment and the first embodiment of the present application is as follows.
  • Step S11 When a fraud identification request is received, the suspect information corresponding to the fraud identification request is obtained, and the account transaction information in the suspect information is extracted, where the account transaction information includes account transaction time, transaction frequency, Transaction amount and counterparty account information.
  • the server When the server receives the fraud identification request, the server obtains the suspect information corresponding to the fraud identification request, and the server extracts the account transaction information in the fraudster information, where the account transaction information includes account transaction time, transaction frequency, transaction limit and counterparty account information .
  • Step S12 Analyze the account transaction information to obtain the fraud risk value of the suspect corresponding to the suspect information.
  • the server analyzes the account transaction information, for example, the server determines whether the account information of the other party matches the account information of the reported fraud; the server determines whether the transaction time is night; the server determines whether there is a large amount of frequent transfers, etc., the server will analyze the results of each Perform a weighted average to obtain the fraud risk value of the suspect corresponding to the suspect's information.
  • step S13 if the fraud risk value is less than the preset risk value, then the fraud suspect is eliminated.
  • the server eliminates the suspected fraud, The server outputs the suspect information corresponding to the suspect is not a fraudster.
  • Step S14 if the fraud risk value is greater than or equal to the preset risk value, enter the suspect information into the message queue.
  • the server determines that the suspect information may be fraudulent, and the server inputs the suspect information into the message queue for further identification of the suspect information.
  • the account transaction information in the fraudulent personnel information performs simple fraud identification. Under the premise of ensuring the accuracy of the identification, the efficiency of fraud identification can be improved by reducing the amount of data processing on the server.
  • This embodiment is a detailed step of step S20 in the first embodiment.
  • the difference between this embodiment and the first embodiment of the present application is as follows.
  • Step S21 Input the suspect information in the message queue into the graph calculation model, and determine whether the suspect corresponding to the suspect information has an associated relationship with the fraudster in the preset fraud group graph.
  • the server inputs the suspect information in the message queue into the graph calculation model, processes the suspect information through the graph calculation model, and judges whether the suspect corresponding to the suspect information has an association relationship with the fraudster in the preset fraud group graph, specifically : Step a1, input the suspect information in the message queue into a graph calculation model, and create a new node and a custom function corresponding to the suspect information through the graph calculation model; step a2, obtain a preset fraud gang The vertex identifiers of the corresponding vertices of each fraudster in the graph, and the custom values on the associated edges of the vertices, use the custom values as the input parameters of the custom function to run the custom function to obtain the custom The running result of the function; step a3, modify the connection status of each vertex and the associated edge of each vertex according to the running result, and determine whether there is an associated edge connected to the newly added node; if there is a connection to the newly added node Associated side, it is determined that the suspect corresponding to the suspect information has an associated relationship with
  • a graph calculation model is preset in the server, and the server uses the graph calculation model to determine whether the suspect corresponding to the suspect information has an association relationship with the fraudster in the preset fraud group graph, that is, the graph calculation model sets the fraud group graph Direction, the graph computing model obtains the vertex identifier corresponding to each vertex in the fraud gang map, the graph computing model sets a modifiable custom value at each vertex to associate with the vertex identifier, and the graph computing model associates each line in the fraud gang map with a direction An edge is associated with its source vertex, and its target vertex identifier is recorded.
  • the graph calculation model will execute the custom function in parallel, and modify the state of itself and its outgoing edge according to the message sent to each vertex in the previous super step (S-1) , And send messages to other vertices, or even modify the topology of the entire graph, and finally determine whether there is an associated edge connected to the newly added node; if there is an associated edge connected to the newly added node, it is determined that the suspect information corresponds to the suspect and
  • the fraudsters in the fraud gang map are preset to have an association relationship.
  • Step S21 If the suspect information corresponding to the suspect has an association relationship with the fraudster in the preset fraud gang map, then the association relationship is quantified to obtain the intimacy between the suspect and the fraudster .
  • the server will quantify the relationship. For example, the server will use the custom value beside the association as the intimacy between the suspect and the fraudster ;
  • the suspect information is processed through the graph computing model to achieve real-time processing of fraud data.
  • This embodiment is the step before step S10 in the first embodiment.
  • the difference between this embodiment and the first embodiment of this application lies in: monitoring the active frequency of each fraudster in the preset fraud group graph; deleting the preset The first fraudster whose active frequency is zero in the fraud group graph; obtain the second fraudster whose active frequency is greater than the preset first frequency in the preset fraud group graph, and collect the information of the user who has the highest frequency of contact with the second fraudster User information, using the user information as suspect information, and triggering a fraud identification request based on the suspect information.
  • the server monitors the active frequency of each fraudster in the preset fraud group graph; the server deletes the first fraudster whose active frequency is zero in the preset fraud group graph; the server acquires the preset fraud group graph whose active frequency is greater than the expected Set the frequency (the preset frequency can be set according to the specific scenario, for example, the preset frequency is set to twice a week), the server determines the user with the highest frequency of contact with the second fraudster, the server collects the user information of the user, and the server Taking the collected user information as the suspect information, the server triggers a fraud identification request based on the suspect information.
  • the preset frequency can be set according to the specific scenario, for example, the preset frequency is set to twice a week
  • the server monitors the fraudsters in the preset fraud gang map, the server regards the user with the most frequent contact with the fraudster as the suspect, and the server automatically triggers the fraud identification request to realize the automatic real-time update of the fraud gang map.
  • This embodiment is a step after step S20 in the first embodiment.
  • the difference between this embodiment and the first embodiment of this application is that if the intimacy is less than the preset intimacy threshold, the suspect information is saved to A preset suspect database; monitors the suspect information in the preset suspect database, and triggers a fraud identification request based on the suspect information when the update frequency of the suspect information is greater than the preset second frequency.
  • the intimacy is less than the preset intimacy threshold
  • the server determines that the suspect corresponding to the suspect's information is not associated with each fraudster in the preset fraud gang map, and the server saves the suspect's information to the preset suspect
  • the server monitors the suspect information in the preset suspect database.
  • the server counts the update frequency of each suspect information.
  • the server A fraud identification request is triggered based on the suspect information, and a fraud identification request is triggered based on the suspect information.
  • the suspect information is monitored. If the suspect information is updated, the server counts the update frequency of the suspect information, and the server automatically triggers the fraud identification request to realize the automatic real-time update of the fraud group graph.
  • an embodiment of the present application also proposes a fraudulent identification device.
  • the fraudulent identification device includes a request receiving module 10, which is used to obtain a fraud identification request corresponding to the fraud identification request when a fraud identification request is received.
  • the suspect information, and the suspect information is input into the message queue;
  • the information processing module 20 is used to process the suspect information in the message queue through the graph calculation model, and obtain the suspect information corresponding to the suspect and the predictor.
  • the result output module 30 is used to add the suspect as a new fraudster to the preset fraud gang if the intimacy is greater than or equal to the preset intimacy threshold In the map, and output the recognition result.
  • the request receiving module 10 includes: an information obtaining unit, configured to obtain suspect information corresponding to the fraud identification request when a fraud identification request is received, and extract information from the suspect information Account transaction information, where the account transaction information includes account transaction time, transaction frequency, transaction limit, and counterparty account information; a risk analysis unit is used to analyze the account transaction information to obtain the suspect information corresponding to the suspect The first judging unit is used to exclude fraud suspicion if the fraud risk value is less than the preset risk value; the second judging unit is used to if the fraud risk value is greater than or equal to the preset risk value, Then input the suspect information into the message queue.
  • an information obtaining unit configured to obtain suspect information corresponding to the fraud identification request when a fraud identification request is received, and extract information from the suspect information
  • Account transaction information where the account transaction information includes account transaction time, transaction frequency, transaction limit, and counterparty account information
  • a risk analysis unit is used to analyze the account transaction information to obtain the suspect information corresponding to the suspect
  • the first judging unit is used to exclude fraud suspicion if
  • the information processing module 20 includes: a relationship judgment submodule, which is used to input the suspect information in the message queue into the graph calculation model to judge whether the suspect information corresponds to the suspect and There is an association relationship between the fraudsters in the preset fraud gang map; the conversion sub-module is used to quantify the association relationship if there is an association relationship between the suspect corresponding to the suspect information and the fraudsters in the preset fraud gang map To get the intimacy between the suspect and the fraudster.
  • a relationship judgment submodule which is used to input the suspect information in the message queue into the graph calculation model to judge whether the suspect information corresponds to the suspect and There is an association relationship between the fraudsters in the preset fraud gang map
  • the conversion sub-module is used to quantify the association relationship if there is an association relationship between the suspect corresponding to the suspect information and the fraudsters in the preset fraud gang map To get the intimacy between the suspect and the fraudster.
  • the relationship judgment sub-module includes: a function creation unit, configured to input the suspect information in the message queue into a graph calculation model, and create the suspect information correspondence through the graph calculation model The new node and custom function; the function running unit is used to obtain the vertex identifier of the corresponding vertex of each fraudster in the preset fraud gang map, and the custom value on the associated edge of the vertex, and use the custom value as The input parameters of the custom function run the custom function to obtain the running result of the custom function; the association judgment unit is used to modify the connection state of each vertex and the associated edge of each vertex according to the running result, and judge Whether there is an associated edge connected to the newly added node; if there is an associated edge connected to the newly added node, it is determined that the suspect corresponding to the suspect information has an associated relationship with the fraudster in the preset fraud group graph.
  • a function creation unit configured to input the suspect information in the message queue into a graph calculation model, and create the suspect information correspondence through the graph calculation model The new node and custom
  • the device for identifying fraudsters includes: a thread task creation module, which is used to create at least two task threads that execute graph calculation models when the message length of the message queue is greater than a preset length.
  • the asynchronous task thread processes the suspect information in the message queue.
  • the device for identifying fraudsters includes: a monitoring module for monitoring the active frequency of each fraudster in the preset fraud group graph; a deletion module for deleting the preset fraud group graph The first fraudster whose active frequency is zero; the collection module is used to obtain the second fraudster whose active frequency is greater than the preset first frequency in the preset fraud group graph, and collect the second fraudster with the highest frequency of contact with the second fraudster The user information of the user, using the user information as the suspect information, and triggering a fraud identification request based on the suspect information.
  • the fraudulent identification device includes: an information storage module, configured to save the suspect information to a preset suspect database if the intimacy is less than a preset intimacy threshold; information The update module is used to monitor the suspect information in the preset suspect database and request a trigger module to trigger fraud identification based on the suspect information when the update frequency of the suspect information is greater than the preset second frequency ask.
  • each functional module of the fraudulent identification device can refer to the various embodiments of the fraudulent identification method of the present application, which will not be repeated here.
  • the embodiment of the present application also proposes a computer storage medium.
  • a computer program is stored on the computer storage medium, and when the computer program is executed by a processor, the operations in the fraudulent identification method provided in the foregoing embodiments are implemented.
  • the computer storage medium may be a computer-readable storage medium.
  • the storage media involved in this application, such as computer storage media, may be non-volatile or volatile.
  • the description is relatively simple, and for related parts, please refer to the part of the description of the method embodiment.
  • the device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separate. Some or all of the modules can be selected according to actual needs to achieve the objectives of the solution of the present application. Those of ordinary skill in the art can understand and implement it without creative work.
  • the technical solution of this application essentially or the part that contributes to the existing technology can be embodied in the form of a software product, and the computer software product is stored in a storage medium (such as ROM/RAM) as described above. , Magnetic disks, optical disks), including several instructions to make a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) execute the methods described in the various embodiments of the present application.
  • a terminal device which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Finance (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Business, Economics & Management (AREA)
  • Technology Law (AREA)
  • Strategic Management (AREA)
  • Marketing (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Animal Behavior & Ethology (AREA)
  • Computational Linguistics (AREA)
  • Data Mining & Analysis (AREA)
  • Databases & Information Systems (AREA)
  • Economics (AREA)
  • Development Economics (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

一种欺诈人员识别方法、装置、设备和存储介质，该方法包括以下步骤：在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，并将所述嫌疑人信息输入至消息队列中（S10）；通过图计算模型处理所述消息队列中的嫌疑人信息，得到所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中各欺诈人员的亲密度（S20）；若所述亲密度大于或等于预设亲密度阈值，则将所述嫌疑人作为新的欺诈人员添加到预设欺诈团伙图谱中，并输出识别结果（S30）。该方法通过图计算模型处理消息队列中的嫌疑人信息进行嫌疑人识别，减少了嫌疑人信息处理压力，保证了大数据环境下嫌疑人识别的实时性和准确性。

Description

欺诈人员识别方法、装置、设备和存储介质
本申请要求于2020年2月29日提交中国专利局、申请号为202010134476.X，发明名称为“欺诈人员识别方法、装置、设备和存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及大数据处理领域，尤其涉及欺诈人员识别方法、装置、设备和存储介质。
 背景技术
欺诈检测是目前国内外各金融机构面临的一个重要问题，它威胁到人们的财产安全。各金融机构都试图采取各种手段和技术进行欺诈的检测和识别。
发明人意识到，现有技术中欺诈人员识别是基于公安确定的欺诈人员数据库，在欺诈识别时服务器获取嫌疑人信息，查询欺诈人员数据库，判断欺诈人员数据库中是否存在与嫌疑人信息相同的欺诈人员信息，这样欺诈人员识别方式无法实时定位和识别团伙欺诈的存在，由于实时性的缺失导致银行等机构无法及时发现潜在欺诈团伙，欺诈识别功能大打折扣。
 技术问题
本申请的主要目的在于提供一种欺诈人员识别方法、装置、设备和存储介质，旨在解决当前欺诈人员识别的实时性和准确性不高的技术问题。
 技术解决方案
为实现上述目的，本申请提供欺诈人员识别方法，所述欺诈人员识别方法包括以下步骤：在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，并将所述嫌疑人信息输入至消息队列中；通过图计算模型处理所述消息队列中的嫌疑人信息，得到所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中各欺诈人员的亲密度；若所述亲密度大于或等于预设亲密度阈值，则将所述嫌疑人作为新的欺诈人员添加到预设欺诈团伙图谱中，并输出识别结果。
此外，为实现上述目的，本申请还提供一种欺诈人员识别装置，所述欺诈人员识别装置包括：请求接收模块，用于在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，并将所述嫌疑人信息输入至消息队列中；信息处理模块，用于通过图计算模型处理所述消息队列中的嫌疑人信息，得到所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中各欺诈人员的亲密度；结果输出模块，用于若所述亲密度大于或等于预设亲密度阈值，则将所述嫌疑人作为新的欺诈人员添加到预设欺诈团伙图谱中，并输出识别结果。
此外，为实现上述目的，本申请还提供一种欺诈人员识别设备；所述欺诈人员识别设备包括：存储器、处理器及存储在所述存储器上并可在所述处理器上运行的计算机程序，其中：所述计算机程序被所述处理器执行时实现以下方法：在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，并将所述嫌疑人信息输入至消息队列中；通过图计算模型处理所述消息队列中的嫌疑人信息，得到所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中各欺诈人员的亲密度；若所述亲密度大于或等于预设亲密度阈值，则将所述嫌疑人作为新的欺诈人员添加到预设欺诈团伙图谱中，并输出识别结果。
此外，为实现上述目的，本申请还提供计算机存储介质；所述计算机存储介质上存储有计算机程序，所述计算机程序被处理器执行时实现以下方法：在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，并将所述嫌疑人信息输入至消息队列中；通过图计算模型处理所述消息队列中的嫌疑人信息，得到所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中各欺诈人员的亲密度；若所述亲密度大于或等于预设亲密度阈值，则将所述嫌疑人作为新的欺诈人员添加到预设欺诈团伙图谱中，并输出识别结果。
 有益效果
本申请实施例中通过图计算模型处理消息队列中的嫌疑人信息进行嫌疑人识别，减少了服务器嫌疑人信息处理压力，保证了大数据环境下嫌疑人识别的实时性和准确性。
 附图说明
图1是本申请实施例方案涉及的硬件运行环境的装置结构示意图。
图2为本申请欺诈人员识别方法第一实施例的流程示意图。
图3为本申请欺诈人员识别装置一实施例的功能模块示意图。
本申请目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。
 本发明的实施方式
应当理解，此处所描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
本申请的技术方案可应用于人工智能、智慧城市、区块链和/或大数据技术领域。可选的，本申请涉及的数据如亲密度、风险值和/或识别结果等可存储于数据库中，或者可以存储于区块链中，比如通过区块链分布式存储，本申请不做限定。
如图1所示，图1是本申请实施例方案涉及的硬件运行环境的服务器(又叫欺诈人员识别设备，其中，欺诈人员识别设备可以是由单独的欺诈人员识别装置构成，也可以是由其他装置与欺诈人员识别装置组合形成)结构示意图。
本申请实施例服务器指一个管理资源并为用户提供服务的计算机，通常分为文件服务器、数据库服务器和应用程序服务器。运行以上软件的计算机或计算机系统也被称为服务器。相对于普通PC(personal computer)个人计算机来说，服务器在稳定性、安全性、性能等方面都要求较高；如图1所示，该服务器可以包括：处理器1001，例如中央处理器(Central Processing Unit，CPU)，网络接口1004，用户接口1003，存储器1005，通信总线1002、芯片组、磁盘系统、网络等硬件等。其中，通信总线1002用于实现这些组件之间的连接通信。用户接口1003可以包括显示屏(Display)、输入单元比如键盘(Keyboard)，可选用户接口1003还可以包括标准的有线接口、无线接口。网络接口1004可选的可以包括标准的有线接口、无线接口(如无线保真WIreless-FIdelity，WIFI接口)。存储器1005可以是高速随机存取存储器(random access memory，RAM)，也可以是稳定的存储器(non-volatilememory)，例如磁盘存储器。存储器1005可选的还可以是独立于前述处理器1001的存储装置。
可选地，服务器还可以包括摄像头、RF(Radio Frequency，射频)电路，传感器、音频电路、WiFi模块；输入单元，比显示屏，触摸屏；网络接口可选除无线接口中除WiFi外，蓝牙、探针等。本领域技术人员可以理解，图1中示出的服务器结构并不构成对服务器的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
如图1所示，该计算机软件产品存储在一个存储介质(存储介质：又叫计算机存储介质、计算机介质、可读介质、可读存储介质、计算机可读存储介质或者直接叫介质等，存储介质可以是非易失性可读存储介质，如RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，空调器，或者网络设备等)执行本申请各个实施例所述的方法，作为一种计算机存储介质的存储器1005中可以包括操作系统、网络通信模块、用户接口模块以及计算机程序。
在图1所示的服务器中，网络接口1004主要用于连接后台数据库，与后台数据库进行数据通信；用户接口1003主要用于连接客户端(客户端，又叫用户端或终端，本申请实施例终端可以固定终端也可以是移动终端，如，带联网功能的智能空调、智能电灯、智能电源、智能音箱、自动驾驶汽车、PC、智能手机、平板电脑、电子书阅读器、便携计算机等，终端中包含传感器比如光传感器、运动传感器以及其他传感器，在此不再赘述)，与客户端进行数据通信；而处理器1001可以用于调用存储器1005中存储的计算机程序，并执行本申请以下实施例提供的欺诈人员识别方法中的步骤。
基于上述硬件运行环境的装置结构，提出了欺诈人员识别方法实施例。
本申请欺诈人员识别方法实施例的步骤执行之前，预先构建预设欺诈团伙图谱，具体地：本实施例中的欺诈人员识别方法运用于服务器(又叫欺诈人员识别设备)，服务器根据诈骗活动的特定的特征和行为模式，构建欺诈团伙图谱，以利用欺诈团伙图谱对欺诈人员进行识别，由于欺诈团伙中的关系网络错综复杂，欺诈团伙图谱往往存在滞后性，各个金融机构无法根据欺诈团伙图谱实时定位和识别团伙欺诈的存在，因而，还是可能存在金融机构无法及时发现潜在欺诈团伙的情况。
本申请中通过欺诈关系图谱进行欺诈识别，欺诈关系图谱建模大都是用批处理的形式处理图数据，每当一批新数据到来时，机构中设置的服务器根据这些新数据重新进行图计算来生成欺诈关系图谱。然而大批量数据同时涌入使得服务器处理效率变缓，很难瞬时完成图谱更新，导致建模的及时准确性得不到保证，欺诈团伙中的关系网络错综复杂，随着数据增加服务器处理压力也呈指数型增强，对服务器的负担尤其明显，很难保证响应的及时性。
本申请提供一种解决方案，包括：在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，并将所述嫌疑人信息输入至消息队列中；通过图计算模型处理所述消息队列中的嫌疑人信息，得到所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中各欺诈人员的亲密度；若所述亲密度大于或等于预设亲密度阈值，则将所述嫌疑人作为新的欺诈人员添加到预设欺诈团伙图谱中，并输出识别结果。本申请实施例中通过消息队列减少了服务器的压力，提高了欺诈人员识别的实时性和准确性。
参照图2，在本申请欺诈人员识别方法的第一实施例中，所述欺诈人员识别方法包括以下步骤。
步骤S10，在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，并将所述嫌疑人信息输入至消息队列中。
服务器接收欺诈识别请求，欺诈识别请求的触发方式不做具体限定，即，欺诈识别请求可以用户主动触发的，例如，用户在智能手机、平板电脑等移动终端输入待识别的嫌疑人信息，并点击移动终端显示界面中的虚拟按键，以基于嫌疑人信息触发欺诈识别请求，移动终端将欺诈识别请求发送至服务器，服务器接收欺诈识别请求；此外，欺诈识别请求还可以是服务器自动触发的，例如，服务器检测到信贷用户数据库更新时，服务器获取信贷用户数据库中更新的嫌疑人信息，服务器基于嫌疑人信息触发欺诈识别请求。
服务器在接收到欺诈识别请求时，服务器获取欺诈识别请求对应的嫌疑人信息，其中，嫌疑人信息包括但不仅限于：嫌疑人姓名、联系方式、人脸图像、指纹信息、家庭住址信息、交易账户信息和资产信息。服务器将嫌疑人信息输入至消息队列中，本实施例中将嫌疑人信息输入至消息队列中，然后从消息队列中获取嫌疑人信息，本实施例中通过消息队列将不均匀的嫌疑人信息处理为均匀的信息流，接着再作为生产者将嫌疑人信息源源不断地输送给消费者，消息队列高吞吐量有效的解决了生产者与消费者之间的协调、并发问题。
本实施例中，服务器嫌疑人信息输入至消息队列之后，服务器获取消息队列的消息长度，服务器根据消息队列的消息长度，判断是否启动多线程模型处理嫌疑人信息，具体地：在所述消息队列的消息长度大于预设长度时，创建至少两个执行图计算模型的任务线程，采用异步任务线程处理所述消息队列中的嫌疑人信息。
服务器将消息队列的消息长度与预设长度进行比较，判断消息队列的消息长度是否大于预设长度，预设长度可以根据服务器性能、消息处理步骤、消息处理时长等具体因素设置，例如，预设长度设置为20条，服务器确定消息队列的消息长度小于或等于预设长度时，服务器采用单线程同步处理该消息队列中的嫌疑人信息，服务器确定消息队列的消息长度大于预设长度时，服务器创建至少两个执行图计算模型的任务线程，服务器采用异步任务线程处理消息队列中的嫌疑人信息。
步骤S20，通过图计算模型处理所述消息队列中的嫌疑人信息，得到所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中各欺诈人员的亲密度。
服务器通过图计算模型处理消息队列中的嫌疑人信息，得到嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中各欺诈人员的亲密度。
方式一：图计算模型为遍历算法，如Neo4j、OrientDB、DEX和Infinite Graph，图计算模型依次计算嫌疑人信息和预设欺诈团伙图谱中各欺诈人员信息的相似度，服务器将相似度作为嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中各欺诈人员的亲密度。
方式二：图计算模型为超步算法，如GoldenOrb、Giraph、Pregel和Hama；图计算模型将嫌疑人信息和预设欺诈团伙图谱作为输入，图计算模型根据嫌疑人信息建立新增节点，并根据嫌疑人信息设置自定义函数(自定义函数可以是一个与或非的函数)；图计算模型根据自定义函数，确定建立新增节点和欺诈团伙图谱中各欺诈人员之间的关联关系，图计算模型将新增节点和欺诈团伙图谱中各个节点之间的关联关系进行量化，得到嫌疑人信息对应嫌疑人员与欺诈团伙图谱中各欺诈人员的亲密度。
步骤S30，若所述亲密度大于或等于预设亲密度阈值，则将所述嫌疑人作为新的欺诈人员添加到预设欺诈团伙图谱中，并输出识别结果。
服务器中预设亲密度阈值，预设亲密度阈值根据具体情况灵活设置，例如预设亲密度阈值设置为60，服务器将嫌疑人与各欺诈人员的亲密度与预设亲密度阈值进行比对，若亲密度大于或等于预设亲密度阈值，服务器将嫌疑人作为新的欺诈人员添加到预设欺诈团伙图谱中，服务器输出该嫌疑人信息对应嫌疑人是欺诈人员的识别结果。
在本实施例中通过图计算模型处理消息队列中的嫌疑人信息进行嫌疑人识别，减少了服务器嫌疑人信息处理压力，保证了大数据环境下嫌疑人识别的实时性和准确性。
进一步地，在本申请第一实施例的基础上，提出了本申请欺诈人员识别方法的第二实施例。
本实施例是第一实施例中步骤S10的细化步骤，本实施例与本申请第一实施例的区别在于如下。
步骤S11，在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，提取所述嫌疑人信息中的账户交易信息，其中，所述账户交易信息包括账户交易时间、交易频率、交易额度和对方账户信息。
服务器在接收到欺诈识别请求时，服务器获取欺诈识别请求对应的嫌疑人信息，服务器提取欺诈人员信息中的账户交易信息，其中，账户交易信息包括账户交易时间、交易频率、交易额度和对方账户信息。
步骤S12，对所述账户交易信息进行分析，得到所述嫌疑人信息对应嫌疑人的欺诈风险值。
服务器对账户交易信息进行分析，例如，服务器判断对方账户信息是否与已报案受骗人账户信息匹配；服务器判断交易时间是否为夜间；服务器判断是否存在大额频繁转账等等，服务器将各个分析的结果进行加权平均，得到嫌疑人信息对应嫌疑人的欺诈风险值。
步骤S13，若所述欺诈风险值小于预设风险值，则排除欺诈嫌疑。
若欺诈风险值小于预设风险值(预设风险值是指预先设置的风险阈值，预设风险值可以根据具体场景灵活设置，例如，预设风险值设置为10分)，服务器排除欺诈嫌疑，服务器输出该嫌疑人信息对应嫌疑人不是欺诈人员。
步骤S14，若所述欺诈风险值大于或等于预设风险值，则将所述嫌疑人信息输入至消息队列中。
若欺诈风险值大于或等于预设风险值，服务器判定该嫌疑人信息可能存在欺诈的情况，服务器将嫌疑人信息输入至消息队列中，以进行嫌疑人信息进一步地识别，在本实施例中根据欺诈人员信息中的账户交易信息进行简单的欺诈识别，在保证识别准确率的前提下，又可以通过减少服务器的数据处理量，提高欺诈识别的效率。
进一步地，在本申请上述实施例的基础上，提出了本申请欺诈人员识别方法的第三实施例。
本实施例是第一实施例中步骤S20的细化步骤，本实施例与本申请第一实施例的区别在于如下。
步骤S21，将所述消息队列中的嫌疑人信息输入至图计算模型，判断所述嫌疑人信息对应嫌疑人是否与预设欺诈团伙图谱中的欺诈人员存在关联关系。
服务器将消息队列中的嫌疑人信息输入至图计算模型，通过图计算模型处理嫌疑人信息，判断所述嫌疑人信息对应嫌疑人是否与预设欺诈团伙图谱中的欺诈人员存在关联关系，具体地：步骤a1，将所述消息队列中的嫌疑人信息输入至图计算模型，通过所述图计算模型创建所述嫌疑人信息对应的新增节点和自定义函数；步骤a2，获取预设欺诈团伙图谱中各欺诈人员对应顶点的顶点标识，及所述顶点关联边上的自定义值，将所述自定义值作为所述自定义函数的入参运行所述自定义函数，得到所述自定义函数的运行结果；步骤a3，根据所述运行结果修改各顶点及各顶点关联边的连接状态，并判断是否存在与所述新增节点连接的关联边；若存在与所述新增节点连接的关联边，则判定所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中的欺诈人员存在关联关系。
本实施例中服务器中预设有图计算模型，服务器通过图计算模型判断嫌疑人信息对应嫌疑人是否与预设欺诈团伙图谱中的欺诈人员存在关联关系，即，图计算模型设置欺诈团伙图谱的方向，图计算模型获取欺诈团伙图谱中每个顶点对应的顶点标识，图计算模型在每个顶点设置一个可修改的自定义值与顶点标识关联，图计算模型将欺诈团伙图谱中每条有向边与其源顶点关联，并记录了其目标顶点标识。图计算模型在每个超步S中，都会并行执行自定义函数，并根据每个顶点接收到的前一个超步(S-1)中发送给的消息，修改其自身及其出射边的状态，并发送消息给其他顶点，甚至是修改整个图的拓扑结构，最终判断是否存在与新增节点连接的关联边；若存在与新增节点连接的关联边，则判定嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中的欺诈人员存在关联关系。
步骤S21，若所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中的欺诈人员存在关联关系，则将所述关联关系进行量化，得到所述嫌疑人与所述欺诈人员之间的亲密度。
若嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中的欺诈人员存在关联关系，服务器将关联关系进行量化，例如，服务器将关联边上的自定义值作为嫌疑人与欺诈人员之间的亲密度；在本实施例中通过图计算模型处理嫌疑人信息，实现了欺诈数据实时处理。
进一步地，在本申请上述实施例的基础上，提出了本申请欺诈人员识别方法的第四实施例。
本实施例是第一实施例中步骤S10之前的步骤，本实施例与本申请第一实施例的区别在于：监测所述预设欺诈团伙图谱中各欺诈人员的活跃频率；删除所述预设欺诈团伙图谱中活跃频率为零的第一欺诈人员；获取所述预设欺诈团伙图谱中活跃频率大于预设第一频率的第二欺诈人员，采集与所述第二欺诈人员联系频率最高用户的用户信息，将所述用户信息作为嫌疑人信息，并基于所述嫌疑人信息触发欺诈识别请求。
本实施例中，服务器监测预设欺诈团伙图谱中各欺诈人员的活跃频率；服务器删除预设欺诈团伙图谱中活跃频率为零的第一欺诈人员；服务器获取预设欺诈团伙图谱中活跃频率大于预设频率(预设频率可以根据具体场景设置，例如预设频率设置为每周两次)的第二欺诈人员，服务器确定与第二欺诈人员联系频率最高用户，服务器采集该用户的用户信息，服务器将采集到的用户信息作为嫌疑人信息，服务器基于嫌疑人信息触发欺诈识别请求。
本实施例中服务器通过对预设欺诈团伙图谱中各欺诈人员进行监控，服务器将与欺诈人员联系频率最高的用户作为嫌疑人，服务器自动触发欺诈识别请求，实现欺诈团伙图谱的自动实时更新。
进一步地，在本申请上述实施例的基础上，提出了本申请欺诈人员识别方法的第五实施例。
本实施例是第一实施例中步骤S20之后的步骤，本实施例与本申请第一实施例的区别在于：若所述亲密度小于预设亲密度阈值，则将所述嫌疑人信息保存至预设嫌疑人数据库；监测所述预设嫌疑人数据库中的嫌疑人信息，在所述嫌疑人信息更新频率大于预设第二频率时，基于所述嫌疑人信息触发欺诈识别请求。
即，本实施例中亲密度小于预设亲密度阈值，服务器判定嫌疑人信息对应的嫌疑人与预设欺诈团伙图谱中的各个欺诈人员不存在关联关系，服务器将嫌疑人信息保存至预设嫌疑人数据库，与此同时，服务器监测预设嫌疑人数据库中的嫌疑人信息，在嫌疑人信息更新时，服务器统计各个嫌疑人信息的更新频率，在嫌疑人信息更新频率大于预设频率时，服务器基于嫌疑人信息触发欺诈识别请求，基于所述嫌疑人信息触发欺诈识别请求。
本实施例中监测嫌疑人信息，若嫌疑人信息更新，服务器统计嫌疑人员信息的更新频率，服务器自动触发欺诈识别请求，实现欺诈团伙图谱的自动实时更新。
此外，参照图3，本申请实施例还提出一种欺诈人员识别装置，所述欺诈人员识别装置包括：请求接收模块10，用于在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，并将所述嫌疑人信息输入至消息队列中；信息处理模块20，用于通过图计算模型处理所述消息队列中的嫌疑人信息，得到所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中各欺诈人员的亲密度；结果输出模块30，用于若所述亲密度大于或等于预设亲密度阈值，则将所述嫌疑人作为新的欺诈人员添加到预设欺诈团伙图谱中，并输出识别结果。
在一本实施例中，所述请求接收模块10，包括：信息获取单元，用于在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，提取所述嫌疑人信息中的账户交易信息，其中，所述账户交易信息包括账户交易时间、交易频率、交易额度和对方账户信息；风险分析单元，用于对所述账户交易信息进行分析，得到所述嫌疑人信息对应嫌疑人的欺诈风险值；第一判定单元，用于若所述欺诈风险值小于预设风险值，则排除欺诈嫌疑；第二判定单元，用于若所述欺诈风险值大于或等于预设风险值，则将所述嫌疑人信息输入至消息队列中。
在一本实施例中，所述信息处理模块20，包括：关系判断子模块，用于将所述消息队列中的嫌疑人信息输入至图计算模型，判断所述嫌疑人信息对应嫌疑人是否与预设欺诈团伙图谱中的欺诈人员存在关联关系；转化子模块，用于若所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中的欺诈人员存在关联关系，则将所述关联关系进行量化，得到所述嫌疑人与所述欺诈人员之间的亲密度。
在一实施例中，所述关系判断子模块，包括：函数创建单元，用于将所述消息队列中的嫌疑人信息输入至图计算模型，通过所述图计算模型创建所述嫌疑人信息对应的新增节点和自定义函数；函数运行单元，用于获取预设欺诈团伙图谱中各欺诈人员对应顶点的顶点标识，及所述顶点关联边上的自定义值，将所述自定义值作为所述自定义函数的入参运行所述自定义函数，得到所述自定义函数的运行结果；关联判断单元，用于根据所述运行结果修改各顶点及各顶点关联边的连接状态，并判断是否存在与所述新增节点连接的关联边；若存在与所述新增节点连接的关联边，则判定所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中的欺诈人员存在关联关系。
在一实施例中，所述的欺诈人员识别装置，包括：线程任务创建模块，用于在所述消息队列的消息长度大于预设长度时，创建至少两个执行图计算模型的任务线程，采用异步任务线程处理所述消息队列中的嫌疑人信息。
在一实施例中，所述的欺诈人员识别装置，包括：监测模块，用于监测所述预设欺诈团伙图谱中各欺诈人员的活跃频率；删除模块，用于删除所述预设欺诈团伙图谱中活跃频率为零的第一欺诈人员；采集模块，用于获取所述预设欺诈团伙图谱中活跃频率大于预设第一频率的第二欺诈人员，采集与所述第二欺诈人员联系频率最高用户的用户信息，将所述用户信息作为嫌疑人信息，并基于所述嫌疑人信息触发欺诈识别请求。
在一实施例中，所述的欺诈人员识别装置，包括：信息保存模块，用于若所述亲密度小于预设亲密度阈值，则将所述嫌疑人信息保存至预设嫌疑人数据库；信息更新模块，用于监测所述预设嫌疑人数据库中的嫌疑人信息，请求触发模块，用于在所述嫌疑人信息更新频率大于预设第二频率时，基于所述嫌疑人信息触发欺诈识别请求。
其中，欺诈人员识别装置的各个功能模块实现的步骤可参照本申请欺诈人员识别方法的各个实施例，此处不再赘述。
此外，本申请实施例还提出一种计算机存储介质。
所述计算机存储介质上存储有计算机程序，所述计算机程序被处理器执行时实现上述实施例提供的欺诈人员识别方法中的操作。
可选的，该计算机存储介质可以为计算机可读存储介质。本申请涉及的存储介质如计算机存储介质可以是非易失性的，也可以是易失性的。
需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体/操作/对象与另一个实体/操作/对象区分开来，而不一定要求或者暗示这些实体/操作/对象之间存在任何这种实际的关系或者顺序；术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者系统不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者系统所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者系统中还存在另外的相同要素。
对于装置实施例而言，由于其基本相似于方法实施例，所以描述得比较简单，相关之处参见方法实施例的部分说明即可。以上所描述的装置实施例仅仅是示意性的，其中作为分离部件说明的单元可以是或者也可以不是物理上分开的。可以根据实际的需要选择中的部分或者全部模块来实现本申请方案的目的。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
上述本申请实施例序号仅仅为了描述，不代表实施例的优劣。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在如上所述的一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，空调器，或者网络设备等)执行本申请各个实施例所述的方法。
以上仅为本申请的优选实施例，并非因此限制本申请的专利范围，凡是利用本申请说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本申请的专利保护范围内。

Claims (20)

  1. 一种欺诈人员识别方法，其中，所述欺诈人员识别方法包括以下步骤：
    在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，并将所述嫌疑人信息输入至消息队列中；
    通过图计算模型处理所述消息队列中的嫌疑人信息，得到所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中各欺诈人员的亲密度；
    若所述亲密度大于或等于预设亲密度阈值，则将所述嫌疑人作为新的欺诈人员添加到预设欺诈团伙图谱中，并输出识别结果。
  2. 如权利要求1所述的欺诈人员识别方法，其中，所述在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，并将所述嫌疑人信息输入至消息队列中的步骤，包括：
    在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，提取所述嫌疑人信息中的账户交易信息，其中，所述账户交易信息包括账户交易时间、交易频率、交易额度和对方账户信息；
    对所述账户交易信息进行分析，得到所述嫌疑人信息对应嫌疑人的欺诈风险值；
    若所述欺诈风险值小于预设风险值，则排除欺诈嫌疑；
    若所述欺诈风险值大于或等于预设风险值，则将所述嫌疑人信息输入至消息队列中。
  3. 如权利要求1所述的欺诈人员识别方法，其中，所述通过图计算模型处理所述消息队列中的嫌疑人信息，得到所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中各欺诈人员的亲密度的步骤，包括：
    将所述消息队列中的嫌疑人信息输入至图计算模型，判断所述嫌疑人信息对应嫌疑人是否与预设欺诈团伙图谱中的欺诈人员存在关联关系；
    若所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中的欺诈人员存在关联关系，则将所述关联关系进行量化，得到所述嫌疑人与所述欺诈人员之间的亲密度。
  4. 如权利要求3所述的欺诈人员识别方法，其中，所述将所述消息队列中的嫌疑人信息输入至图计算模型，判断所述嫌疑人信息对应嫌疑人是否与预设欺诈团伙图谱中的欺诈人员存在关联关系的步骤，包括：
    将所述消息队列中的嫌疑人信息输入至图计算模型，通过所述图计算模型创建所述嫌疑人信息对应的新增节点和自定义函数；
    获取预设欺诈团伙图谱中各欺诈人员对应顶点的顶点标识，及所述顶点关联边上的自定义值，将所述自定义值作为所述自定义函数的入参运行所述自定义函数，得到所述自定义函数的运行结果；
    根据所述运行结果修改各顶点及各顶点关联边的连接状态，并判断是否存在与所述新增节点连接的关联边；若存在与所述新增节点连接的关联边，则判定所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中的欺诈人员存在关联关系。
  5. 如权利要求1所述的欺诈人员识别方法，其中，所述在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，并将所述嫌疑人信息输入至消息队列中的步骤之后，包括：
    在所述消息队列的消息长度大于预设长度时，创建至少两个执行图计算模型的任务线程，采用异步任务线程处理所述消息队列中的嫌疑人信息。
  6. 如权利要求1所述的欺诈人员识别方法，其中，所述在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，并将所述嫌疑人信息输入至消息队列中的步骤之前，包括：
    监测所述预设欺诈团伙图谱中各欺诈人员的活跃频率；
    删除所述预设欺诈团伙图谱中活跃频率为零的第一欺诈人员；
    获取所述预设欺诈团伙图谱中活跃频率大于预设第一频率的第二欺诈人员，采集与所述第二欺诈人员联系频率最高用户的用户信息，将所述用户信息作为嫌疑人信息，并基于所述嫌疑人信息触发欺诈识别请求。
  7. 如权利要求1至6任意一项所述的欺诈人员识别方法，其中，所述通过图计算模型处理所述消息队列中的嫌疑人信息，得到所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中各欺诈人员的亲密度的步骤之后，包括：
    若所述亲密度小于预设亲密度阈值，则将所述嫌疑人信息保存至预设嫌疑人数据库；
    监测所述预设嫌疑人数据库中的嫌疑人信息，在所述嫌疑人信息更新频率大于预设第二频率时，基于所述嫌疑人信息触发欺诈识别请求。
  8. 一种欺诈人员识别装置，其中，所述欺诈人员识别装置包括：
    请求接收模块，用于在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，并将所述嫌疑人信息输入至消息队列中；
    信息处理模块，用于通过图计算模型处理所述消息队列中的嫌疑人信息，得到所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中各欺诈人员的亲密度；
    结果输出模块，用于若所述亲密度大于或等于预设亲密度阈值，则将所述嫌疑人作为新的欺诈人员添加到预设欺诈团伙图谱中，并输出识别结果。
  9. 一种欺诈人员识别设备，其中，所述欺诈人员识别设备包括：存储器、处理器及存储在所述存储器上并可在所述处理器上运行的计算机程序，其中：
    所述计算机程序被所述处理器执行时实现以下方法：
    在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，并将所述嫌疑人信息输入至消息队列中；
    通过图计算模型处理所述消息队列中的嫌疑人信息，得到所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中各欺诈人员的亲密度；
    若所述亲密度大于或等于预设亲密度阈值，则将所述嫌疑人作为新的欺诈人员添加到预设欺诈团伙图谱中，并输出识别结果。
  10. 如权利要求9所述的欺诈人员识别设备，其中，所述在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，并将所述嫌疑人信息输入至消息队列中时，具体实现：
    在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，提取所述嫌疑人信息中的账户交易信息，其中，所述账户交易信息包括账户交易时间、交易频率、交易额度和对方账户信息；
    对所述账户交易信息进行分析，得到所述嫌疑人信息对应嫌疑人的欺诈风险值；
    若所述欺诈风险值小于预设风险值，则排除欺诈嫌疑；
    若所述欺诈风险值大于或等于预设风险值，则将所述嫌疑人信息输入至消息队列中。
  11. 如权利要求9所述的欺诈人员识别设备，其中，所述通过图计算模型处理所述消息队列中的嫌疑人信息，得到所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中各欺诈人员的亲密度时，具体实现：
    将所述消息队列中的嫌疑人信息输入至图计算模型，判断所述嫌疑人信息对应嫌疑人是否与预设欺诈团伙图谱中的欺诈人员存在关联关系；
    若所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中的欺诈人员存在关联关系，则将所述关联关系进行量化，得到所述嫌疑人与所述欺诈人员之间的亲密度。
  12. 如权利要求9所述的欺诈人员识别设备，其中，所述在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，并将所述嫌疑人信息输入至消息队列中的步骤之后，所述计算机程序被所述处理器执行时还用于实现：
    在所述消息队列的消息长度大于预设长度时，创建至少两个执行图计算模型的任务线程，采用异步任务线程处理所述消息队列中的嫌疑人信息。
  13. 如权利要求9所述的欺诈人员识别设备，其中，所述在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，并将所述嫌疑人信息输入至消息队列中的步骤之前，所述计算机程序被所述处理器执行时还用于实现：
    监测所述预设欺诈团伙图谱中各欺诈人员的活跃频率；
    删除所述预设欺诈团伙图谱中活跃频率为零的第一欺诈人员；
    获取所述预设欺诈团伙图谱中活跃频率大于预设第一频率的第二欺诈人员，采集与所述第二欺诈人员联系频率最高用户的用户信息，将所述用户信息作为嫌疑人信息，并基于所述嫌疑人信息触发欺诈识别请求。
  14. 如权利要求9至13任意一项所述的欺诈人员识别设备，其中，所述通过图计算模型处理所述消息队列中的嫌疑人信息，得到所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中各欺诈人员的亲密度的步骤之后，所述计算机程序被所述处理器执行时还用于实现：
    若所述亲密度小于预设亲密度阈值，则将所述嫌疑人信息保存至预设嫌疑人数据库；
    监测所述预设嫌疑人数据库中的嫌疑人信息，在所述嫌疑人信息更新频率大于预设第二频率时，基于所述嫌疑人信息触发欺诈识别请求。
  15. 一种计算机存储介质，其中，所述计算机存储介质上存储有计算机程序，所述计算机程序被处理器执行时实现以下方法：
    在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，并将所述嫌疑人信息输入至消息队列中；
    通过图计算模型处理所述消息队列中的嫌疑人信息，得到所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中各欺诈人员的亲密度；
    若所述亲密度大于或等于预设亲密度阈值，则将所述嫌疑人作为新的欺诈人员添加到预设欺诈团伙图谱中，并输出识别结果。
  16. 如权利要求15所述的计算机存储介质，其中，所述在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，并将所述嫌疑人信息输入至消息队列中时，具体实现：
    在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，提取所述嫌疑人信息中的账户交易信息，其中，所述账户交易信息包括账户交易时间、交易频率、交易额度和对方账户信息；
    对所述账户交易信息进行分析，得到所述嫌疑人信息对应嫌疑人的欺诈风险值；
    若所述欺诈风险值小于预设风险值，则排除欺诈嫌疑；
    若所述欺诈风险值大于或等于预设风险值，则将所述嫌疑人信息输入至消息队列中。
  17. 如权利要求15所述的计算机存储介质，其中，所述通过图计算模型处理所述消息队列中的嫌疑人信息，得到所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中各欺诈人员的亲密度时，具体实现：
    将所述消息队列中的嫌疑人信息输入至图计算模型，判断所述嫌疑人信息对应嫌疑人是否与预设欺诈团伙图谱中的欺诈人员存在关联关系；
    若所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中的欺诈人员存在关联关系，则将所述关联关系进行量化，得到所述嫌疑人与所述欺诈人员之间的亲密度。
  18. 如权利要求15所述的计算机存储介质，其中，所述在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，并将所述嫌疑人信息输入至消息队列中的步骤之后，所述计算机程序被处理器执行时还用于实现：
    在所述消息队列的消息长度大于预设长度时，创建至少两个执行图计算模型的任务线程，采用异步任务线程处理所述消息队列中的嫌疑人信息。
  19. 如权利要求15所述的计算机存储介质，其中，所述在接收到欺诈识别请求时，获取所述欺诈识别请求对应的嫌疑人信息，并将所述嫌疑人信息输入至消息队列中的步骤之前，所述计算机程序被处理器执行时还用于实现：
    监测所述预设欺诈团伙图谱中各欺诈人员的活跃频率；
    删除所述预设欺诈团伙图谱中活跃频率为零的第一欺诈人员；
    获取所述预设欺诈团伙图谱中活跃频率大于预设第一频率的第二欺诈人员，采集与所述第二欺诈人员联系频率最高用户的用户信息，将所述用户信息作为嫌疑人信息，并基于所述嫌疑人信息触发欺诈识别请求。
  20. 如权利要求15至19任意一项所述的计算机存储介质，其中，所述通过图计算模型处理所述消息队列中的嫌疑人信息，得到所述嫌疑人信息对应嫌疑人与预设欺诈团伙图谱中各欺诈人员的亲密度的步骤之后，所述计算机程序被处理器执行时还用于实现：
    若所述亲密度小于预设亲密度阈值，则将所述嫌疑人信息保存至预设嫌疑人数据库；
    监测所述预设嫌疑人数据库中的嫌疑人信息，在所述嫌疑人信息更新频率大于预设第二频率时，基于所述嫌疑人信息触发欺诈识别请求。
PCT/CN2021/071059 2020-02-29 2021-01-11 欺诈人员识别方法、装置、设备和存储介质 WO2021169631A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010134476.X 2020-02-29
CN202010134476.XA CN111415241A (zh) 2020-02-29 2020-02-29 欺诈人员识别方法、装置、设备和存储介质

Publications (1)

Publication Number Publication Date
WO2021169631A1 true WO2021169631A1 (zh) 2021-09-02

Family

ID=71492751

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/071059 WO2021169631A1 (zh) 2020-02-29 2021-01-11 欺诈人员识别方法、装置、设备和存储介质

Country Status (2)

Country Link
CN (1) CN111415241A (zh)
WO (1) WO2021169631A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113850665A (zh) * 2021-09-14 2021-12-28 江苏中交车旺科技有限公司 基于物流金融知识图谱的防控欺诈方法和系统
CN114499966A (zh) * 2021-12-27 2022-05-13 奇安盘古(上海)信息技术有限公司 诈骗流量聚合分析方法、装置、电子设备及存储介质
CN114925167A (zh) * 2022-05-20 2022-08-19 武汉众智数字技术有限公司 一种基于知识图谱的案件处理方法和系统
CN115150130A (zh) * 2022-06-08 2022-10-04 北京天融信网络安全技术有限公司 攻击团伙的跟踪分析方法、装置、设备及存储介质
CN116543181A (zh) * 2023-05-10 2023-08-04 北京微聚智汇科技有限公司 一种基于图像背景特征识别的反团伙欺诈方法及系统

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111415241A (zh) * 2020-02-29 2020-07-14 深圳壹账通智能科技有限公司 欺诈人员识别方法、装置、设备和存储介质
CN112785423A (zh) * 2021-02-07 2021-05-11 撼地数智(重庆)科技有限公司 一种欺诈风险节点的挖掘方法、装置、设备及存储介质
CN114169458A (zh) * 2021-12-13 2022-03-11 平安科技（深圳）有限公司 一种欺诈人员识别方法及装置、存储介质、计算机设备

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150264079A1 (en) * 2013-03-06 2015-09-17 Facebook, Inc. Detection of lockstep behavior
CN108334647A (zh) * 2018-04-12 2018-07-27 阿里巴巴集团控股有限公司 保险欺诈识别的数据处理方法、装置、设备及服务器
CN109191281A (zh) * 2018-08-21 2019-01-11 重庆富民银行股份有限公司 一种基于知识图谱的团体欺诈识别系统
CN109299811A (zh) * 2018-08-20 2019-02-01 众安在线财产保险股份有限公司 一种基于复杂网络的欺诈团伙识别和风险传播预测的方法
CN110070364A (zh) * 2019-03-27 2019-07-30 北京三快在线科技有限公司 基于图模型检测团伙欺诈的方法和装置、存储介质
CN111415241A (zh) * 2020-02-29 2020-07-14 深圳壹账通智能科技有限公司 欺诈人员识别方法、装置、设备和存储介质

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108764917A (zh) * 2018-05-04 2018-11-06 阿里巴巴集团控股有限公司 一种欺诈团伙的识别方法和装置
CN109670933A (zh) * 2018-09-26 2019-04-23 深圳壹账通智能科技有限公司 识别用户角色的方法、用户设备、存储介质及装置
CN110111110A (zh) * 2019-04-01 2019-08-09 北京三快在线科技有限公司 基于知识图谱检测欺诈的方法和装置、存储介质
CN110827159B (zh) * 2019-11-11 2023-11-03 上海交通大学 基于关系图的金融医疗保险诈骗预警方法、装置及终端

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150264079A1 (en) * 2013-03-06 2015-09-17 Facebook, Inc. Detection of lockstep behavior
CN108334647A (zh) * 2018-04-12 2018-07-27 阿里巴巴集团控股有限公司 保险欺诈识别的数据处理方法、装置、设备及服务器
CN109299811A (zh) * 2018-08-20 2019-02-01 众安在线财产保险股份有限公司 一种基于复杂网络的欺诈团伙识别和风险传播预测的方法
CN109191281A (zh) * 2018-08-21 2019-01-11 重庆富民银行股份有限公司 一种基于知识图谱的团体欺诈识别系统
CN110070364A (zh) * 2019-03-27 2019-07-30 北京三快在线科技有限公司 基于图模型检测团伙欺诈的方法和装置、存储介质
CN111415241A (zh) * 2020-02-29 2020-07-14 深圳壹账通智能科技有限公司 欺诈人员识别方法、装置、设备和存储介质

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113850665A (zh) * 2021-09-14 2021-12-28 江苏中交车旺科技有限公司 基于物流金融知识图谱的防控欺诈方法和系统
CN114499966A (zh) * 2021-12-27 2022-05-13 奇安盘古(上海)信息技术有限公司 诈骗流量聚合分析方法、装置、电子设备及存储介质
CN114925167A (zh) * 2022-05-20 2022-08-19 武汉众智数字技术有限公司 一种基于知识图谱的案件处理方法和系统
CN115150130A (zh) * 2022-06-08 2022-10-04 北京天融信网络安全技术有限公司 攻击团伙的跟踪分析方法、装置、设备及存储介质
CN115150130B (zh) * 2022-06-08 2023-11-10 北京天融信网络安全技术有限公司 攻击团伙的跟踪分析方法、装置、设备及存储介质
CN116543181A (zh) * 2023-05-10 2023-08-04 北京微聚智汇科技有限公司 一种基于图像背景特征识别的反团伙欺诈方法及系统

Also Published As

Publication number Publication date
CN111415241A (zh) 2020-07-14

Similar Documents

Publication Publication Date Title
WO2021169631A1 (zh) 欺诈人员识别方法、装置、设备和存储介质
TWI804575B (zh) 確定高風險用戶的方法及裝置、電腦可讀儲存媒體、和計算設備
WO2020211388A1 (zh) 基于预测模型的行为预测方法、装置、设备及存储介质
WO2021239004A1 (zh) 异常社群检测方法、装置、计算机设备及存储介质
WO2021056737A1 (zh) 高频业务数据的数据压缩方法、装置、设备及存储介质
WO2021169268A1 (zh) 数据处理方法、装置、设备和存储介质
CN112162965B (zh) 一种日志数据处理的方法、装置、计算机设备及存储介质
WO2020177450A1 (zh) 信息归并方法、交易查询方法、装置、计算机及存储介质
CN111800292B (zh) 基于历史流量的预警方法、装置、计算机设备及存储介质
WO2021056739A1 (zh) 性能分析方法、装置、计算机设备及存储介质
CN111598713A (zh) 基于相似度权重更新的团伙识别方法、装置及电子设备
CN111125263A (zh) 预约请求的管理方法、预约功能实体以及可读存储介质
WO2022198996A1 (zh) 数据更新方法及装置、系统、设备、存储介质和程序
CN115544558A (zh) 敏感信息检测方法、装置、计算机设备及存储介质
CN113595886A (zh) 即时通讯消息的处理方法、装置、电子设备及存储介质
CN113923037A (zh) 一种基于可信计算的异常检测优化装置、方法及系统
CN112235367A (zh) 一种实体行为关系消息订阅方法、系统、终端及存储介质
CN111598714A (zh) 一种基于二阶段无监督的团伙识别方法、装置及电子设备
CN110738571A (zh) 一种交易风险控制的方法以及相关装置
CN116708430A (zh) 注册中心集群调度方法、装置、计算机设备及存储介质
CN116992462A (zh) 基于大数据传输场景的明文信息下线方法及其相关设备
CN114860847B (zh) 应用于大数据平台的数据链路处理方法、系统及介质
CN113095788B (zh) 问题分发方法、装置、电子设备以及存储介质
CN115378746B (zh) 网络入侵检测规则生成方法、装置、设备以及存储介质
CN113159915B (zh) 基于大数据的智能金融信用动态评估方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21760475

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21760475

Country of ref document: EP

Kind code of ref document: A1