WO2023065870A1 - 资源转移信息检测方法、装置、设备和存储介质 - Google Patents

资源转移信息检测方法、装置、设备和存储介质 Download PDF

Info

Publication number
WO2023065870A1
WO2023065870A1 PCT/CN2022/117568 CN2022117568W WO2023065870A1 WO 2023065870 A1 WO2023065870 A1 WO 2023065870A1 CN 2022117568 W CN2022117568 W CN 2022117568W WO 2023065870 A1 WO2023065870 A1 WO 2023065870A1
Authority
WO
WIPO (PCT)
Prior art keywords
resource transfer
node
time
resource
path
Prior art date
Application number
PCT/CN2022/117568
Other languages
English (en)
French (fr)
Inventor
李文豪
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2023065870A1 publication Critical patent/WO2023065870A1/zh
Priority to US18/326,652 priority Critical patent/US20230315538A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
    • G06F9/5061—Partitioning or combining of resources
    • G06F9/5077—Logical partitioning of resources; Management or configuration of virtualized resources
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
    • G06F9/5061—Partitioning or combining of resources
    • G06F9/5072—Grid computing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/08—Payment architectures
    • G06Q20/10—Payment architectures specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/02—Banking, e.g. interest calculation or account maintenance

Definitions

  • the present application relates to the field of computer technology, in particular to a resource transfer information detection method, device, computer equipment, storage medium and computer program product.
  • resource transfer information detection In many cases, it is necessary to detect resource transfer information, for example, to detect transfer operations of resources whose source is not authenticated. At present, it is mainly based on manual detection, resulting in low efficiency of resource transfer information detection.
  • a method for detecting resource transfer information comprising:
  • the resource transfer identifier set includes multiple resource transfer identifiers
  • each resource transfer identifier pair is two resource transfer identifier pairs in the resource transfer identifier set. Composed of resource transfer identifiers;
  • the time difference condition is the time difference condition that the target resource flows from the reference node to the current search node and the candidate node in sequence.
  • a device for detecting resource transfer information comprising:
  • An identification set acquisition module configured to acquire a resource transfer identification set; the resource transfer identification set includes a plurality of resource transfer identifications;
  • a transfer direction determining module configured to acquire resource transfer identifier pairs corresponding to the resource transfer identifier set, and determine a resource transfer direction corresponding to the resource transfer identifier pair; each resource transfer identifier pair is the resource transfer identifier set It consists of two resource transfer identifiers that have a resource transfer relationship in ;
  • a relational graph acquisition module configured to use the resource transfer identifiers in the resource transfer identifier set as nodes in the resource transfer graph, and connect the resource transfer identifiers to the corresponding nodes according to the resource transfer direction with directed edges , to obtain the resource transfer relationship diagram;
  • a node determining module configured to determine the current search node in the currently searched current resource transfer path in the process of searching the resource transfer path for the resource transfer relationship graph, and point the current resource transfer path to the current
  • the node of the search node is used as a reference node, and the node pointed to by the current search node in the resource transfer relationship graph is used as a candidate node;
  • a time determination module configured to determine a first resource transfer time between the current search node and the reference node, and a second resource transfer time between the current search node and the candidate node;
  • a node adding module configured to add the candidate node to the current resource transfer path when the first resource transfer time and the second resource transfer time satisfy a time difference condition, so as to detect a target resource transfer path ;
  • the time difference condition is a time difference condition that the target resource flows from the reference node to the current search node and the candidate node in sequence.
  • a computer device includes a memory and a processor.
  • the memory stores computer-readable instructions.
  • the processor executes the resource transfer information detection method of the present application.
  • a non-volatile computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the processor executes the method for detecting resource transfer information of the present application.
  • a computer program product or computer program comprising computer readable instructions stored in a computer readable storage medium from which a processor of a computer device reads the Computer-readable instructions, the processor executes the computer-readable instructions, so that the computer device executes the method for detecting resource transfer information of the present application.
  • FIG. 1 is an application environment diagram of a method for detecting resource transfer information in some embodiments
  • FIG. 2 is a schematic flowchart of a method for detecting resource transfer information in some embodiments
  • Figure 3(a) is a schematic diagram of a resource transfer relationship diagram in some embodiments.
  • Fig. 3(b) is a schematic diagram of searching for a resource transfer path on a resource transfer relationship graph in some embodiments
  • Figure 3(c) is a schematic diagram of a resource transfer relationship diagram in some embodiments.
  • Fig. 4 is a schematic diagram of determining the net transfer-out resources between nodes and the time corresponding to the net transfer-out resources in some embodiments;
  • Fig. 5 is a schematic diagram of determining the net transfer-out resources between nodes and the time corresponding to the net transfer-out resources in some embodiments;
  • Figure 6(a) is a schematic diagram of determining the time corresponding to the net transfer-out resources between nodes in some embodiments
  • Figure 6(b) is a schematic diagram of determining the time corresponding to the net transfer-out resources between nodes in some embodiments
  • Fig. 7 is a unidirectional diagram of net transfer of resources between multiple nodes in some embodiments.
  • Fig. 8 is a schematic flowchart of a method for detecting resource transfer information in some embodiments.
  • Fig. 9 is a structural block diagram of an apparatus for detecting resource transfer information in some embodiments.
  • Figure 10 is a diagram of the internal structure of a computer device in some embodiments.
  • an embodiment means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least some of the embodiments of the present application.
  • the occurrences of this phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. It is understood explicitly and implicitly by those skilled in the art that the embodiments described in this application can be combined with other embodiments.
  • the method for detecting resource transfer information involves multiple resource transfer identifiers (hereinafter referred to as identifiers) with resource transfer relationships. Based on the resource source of one of the identifiers, the whereabouts of the resource corresponding to the identifier can be determined, and then the source can be determined. Unrecognized resources transfer resource transfer marks to form a transfer path, such as the transfer path formed by multiple accounts that transfer funds from unrecognized illegal funds or the transfer path formed by multiple accounts that transfer game equipment from unrecognized sources . In some scenarios, the source of the game equipment is not recognized, which can be understood as illegal game equipment that may not be officially generated by the game platform, but generated by the player without authorization by the game platform. When the resource is funds, the transfer path may be a path formed by multiple resource accounts that transform illegal funds into legitimate funds through a series of transfer operations.
  • resource transfer between identity a and identity b can be based on the server 104. For example, if identity a wants to transfer resources to identity b, then identity a can first send the number of resources to be transferred and identity b to the server 104. after the server 104 receives the amount of resources sent by the identifier a and the identifier information of the identifier b, it divides resources of the above-mentioned number of resources from the resources owned by the identifier a to the identifier b, and completes the resource transfer operation from the identifier a to the identifier b . The server 104 stores resource transfer records between resource transfer identifiers.
  • the resource transfer record can be obtained, based on The resource transfer record acquires the set of resource transfer identifiers to be detected maliciously, so as to execute the resource transfer information detection method provided by the embodiment of the present application to obtain the target resource transfer path, and the server 104 can continue to further confirm the target resource transfer path based on the target resource transfer path Whether it is a malicious resource transfer path, for example, based on information such as resource transfer behavior in the target resource transfer path and the pre-trained resource transfer path detection model to predict the probability that the path is a resource transfer path with an unauthenticated source.
  • the server may also send the detected target resource transfer path to the terminal 102, so that the user corresponding to the terminal 102 can manually confirm based on the target resource transfer path.
  • Identities include but are not limited to personal identities, merchant identities, and bank card identities.
  • Identities a and b can be owned by the same user, that is, the same user can own multiple identities. For example, Alice owns multiple personal identities at the same time, and For example, Alice has both a personal ID and a business ID.
  • Users can perform resource transfer operations through terminals, which can be personal computers, laptops, smart phones, tablets, and portable wearable devices; servers can be implemented by independent servers or server clusters composed of multiple servers.
  • a method for detecting resource transfer information is provided. Taking the method applied to the server in FIG. 1 as an example for illustration, the method includes the following steps:
  • Step S202 acquiring a set of resource transfer identifiers.
  • the resource transfer identifier represents the resource transfer participant of the resource transfer.
  • the resource transfer participant includes the resource transfer party and the resource transfer party.
  • the resource transfer identifier can include resource account, user ID, merchant ID, etc., and the resource account can be the Card account, third-party payment platform account, etc., the user ID can be an account used by individuals for resource transfer, the merchant ID can be the ID used by merchants for resource transfer, and the third-party payment platform account can be used to transfer resources through a third-party payment platform.
  • An identifier for resource transfer which may be a social account.
  • the resource transfer identifier set includes multiple resource transfer identifiers, and the types of identifiers included in the resource transfer identifier set can be at least one, that is, the types of identifiers included in the resource transfer identifier set are personal identifiers, business identifiers, and bank card identifiers. at least one of .
  • the same user can have multiple identities, and the types of the multiple identities can be the same or different.
  • the transfer of resources whose source is not authenticated may be a malicious or illegal resource transfer.
  • This application obtains a resource transfer identifier set, based on the resource transfer identifier set and the resource transfer relationship between the resource transfer identifiers, transfers from the resource A path consisting of identifiers whose source is not authenticated is detected in the identifier set, that is, a target resource transfer path including several identifiers.
  • the detection of unauthenticated resources such as illegal funds may be to detect the fund account path suspected of money laundering, and obtain a path formed by multiple identifiers pointing to in turn, and the multiple identifiers are a malicious group.
  • the server may obtain multiple resource transfer identifiers, and the multiple resource transfer identifiers form a resource transfer identifier set.
  • the server can obtain resource transfer records corresponding to resource transfer operations that occurred on the payment platform in the past period of time (such as past t hours, past t days, etc.), and each resource transfer record includes resource transferee, resource
  • the server can obtain a set of resource transfer identifiers based on the resource transfer-in party and resource transfer-out party in the resource transfer records that occurred in the past period of time.
  • the server may also obtain resource transfer records corresponding to resource transfer operations that occurred within a preset time period in the past, for example, the preset time period is from February 1, 2021 to July 10, 2021.
  • Step S204 acquiring the resource transfer identifier pair corresponding to the resource transfer identifier set, and determining the resource transfer direction corresponding to the resource transfer identifier pair.
  • Each resource transfer identifier pair is composed of two resource transfer identifiers that have a resource transfer relationship in the resource transfer identifier set, and the resource transfer relationship may include a resource transfer-out relationship and a resource transfer-in relationship. For example, if there is a resource transfer record between identity a and identity b, and the resource transfer record indicates that resources are transferred from identity a to identity b, or resources are transferred from identity a to identity b, then it is determined that there is a resource transfer between identity a and identity b In the resource transfer relationship, the identifier a and the identifier b can form a pair of resource identifiers.
  • the resource transfer direction refers to the resource transfer flow direction between the two identifiers that make up the resource transfer identifier pair.
  • the resource transfer direction can be the resource net transfer direction, and the resource net transfer direction can be the resource net transfer direction or the resource net transfer direction. in direction.
  • the total amount of resources transferred from identity a to identity b is 30,000
  • the total amount of resources transferred from identity b to identity a is 20,000.
  • the net transfer direction of resources adopts the net resource transfer direction
  • the resources transferred from identity a to identity b The net transfer-out amount is 10,000
  • the net transfer-out amount of resources transferred from identity b to identity a is -10,000.
  • the direction of resource net transfer adopts the direction of resource net transfer, then the net transfer of resources from label b to label a is -10,000, and the net resource transfer from label a to label b is 10,000.
  • the net resource transfer amount between the two identifiers is determined according to the resource transfer amount of multiple resource transfers that occurred between the two identifiers . For example, logo a transferred 5 resources to logo b with a total resource amount of 30,000, and logo b transferred 2 resources to logo a with a total resource amount of 20,000. If the resource net transfer direction adopts the resource net transfer-out direction, then according to the seven resource transfers that occurred between the identifier a and the identifier b, it can be determined that the net resource transfer from the identifier a to the identifier b is 10,000. The net transfer of resources from b to a is -10,000.
  • the direction of resource net transfer adopts the direction of resource net transfer, then according to the seven resource transfers that occurred between logo a and logo b, it can be determined that the net resource transfer amount of logo a from logo b is -10,000, and logo b The net transfer-in of resources from identification a is 10,000.
  • the server uses the resource net transfer-out direction or the resource net-in direction as the resource transfer direction, and after obtaining the resource transfer identifier set, determines resource transfer identifier pairs that have a resource transfer relationship according to the resource transfer records (each resource transfer identifier pair Including the first identifier and the second identifier), according to the resource transfer amount of resource transfer in or resource transfer out between the resource transfer identifier pair, determine the resource transfer identifier pair's net resource transfer amount for the above resource transfer direction.
  • the server after the server obtains the set of resource transfer identifiers, it determines the resource transfer identifier pairs that have a resource transfer relationship according to the resource transfer records, and determines the resource net value of the resource transfer identifier pairs according to the amount of resource transferred out between the resource transfer identifier pairs.
  • Transfer-out amount according to the relationship between the net transfer-out amount of resources and zero, determine the net transfer-out direction of resources between pairs of resource transfer IDs, that is, determine whether the net transfer-out direction of resources is from the first ID to the second ID or by the second ID The ID points to the first ID.
  • the server after the server obtains the set of resource transfer identifiers, it determines the resource transfer identifier pairs that have a resource transfer relationship according to the resource transfer records, and determines the resource net value of the resource transfer identifier pairs according to the resource transfer amount between the resource transfer identifier pairs.
  • Transfer-in amount according to the relationship between the net transfer-in amount of resources and zero, determine the net transfer-in direction of resources between pairs of resource transfer identifiers, that is, determine whether the net transfer-in direction of resources is from the first identifier to the second identifier or by the second identifier
  • the ID points to the first ID.
  • the server uses the net resource transfer direction as the resource transfer direction.
  • the server determines that there are 5 A resource transfer, the five resource transfers are: the amount of resources transferred from identifier b to identifier d is m v1 , the amount of resources transferred from identifier b to identifier d is m v2 , and the amount of resources transferred from identifier d to identifier b is m v3 , the amount of resources transferred from identity b to identity d is m v4 , and the amount of resources transferred from identity d to identity b is m v5 , and the net resource transfer amount between identity b and identity d is recorded as M(b,d) , the server adds up the offsets of the resource amounts (all greater than 0) of these 5 resource transfers, and can determine that the net resource transfer amount M(b,d) between the identifier
  • M(b,d) is equal to 0, it can be considered that the net transfer of resources between the two parties is 0.
  • M(b,d) greater than 0 shows that the resource transfer direction is from the identifier b to the identifier d.
  • the resource transfer records it is determined that there are 3 resource transfers between the identifier d and the identifier f. These 3 resource transfers are: the amount of resources transferred from the identifier d to the identifier f is m v6 The amount of resources transferred to identity d is m v7 , the amount of resources transferred from identity d to identity f is m v8 , and the net resource transfer amount between identity d and identity f is recorded as M(d,f), and the server records this
  • the offsetting addition of the resource amounts (all greater than 0) of the three resource transfers can determine the net resource transfer amount M(d,f) between the identifier d and the identifier f as m v6- m v7+ m v8 .
  • the server can determine that the resource transfer direction between the identifier d and f is from the identifier d to the identifier f, if M(d,f) is less than 0, then the resource transfer direction It is from the identification f to the identification d. If M(d, f) is equal to 0, it can be considered that the net transfer of resources between the two parties is 0. In FIG. 4 , taking M(d, f) greater than 0 as an example, it shows that the resource transfer direction is from the identifier d to the identifier f.
  • Step S206 using the resource transfer identifiers in the resource transfer identifier set as nodes in the resource transfer relationship graph, connecting the resource transfer identifiers with directed edges according to the resource transfer direction to obtain the resource transfer relationship graph.
  • the directed edge is a one-way edge
  • the resource transfer relationship graph formed correspondingly can be called a one-way graph of net resource transfer.
  • the one-way graph of resource net transfer is the one-way graph of resource net transfer out; in the case of resource net transfer direction, it is the resource net transfer
  • the one-way graph of net resource transfers is the one-way graph of net resource transfers.
  • the directed edge of the label a points to the label b, indicating that a net transfer of resources greater than 0 is transferred from the label a to the label b, and in the resource transfer relationship
  • the directed edge of the label a points to the label b, indicating that the net transfer of resources greater than 0 has been transferred from the label b to the label a.
  • the server determines the resource transfer direction between two identities that have a resource transfer relationship in the resource transfer id set, it can take each id as a node and perform a one-way edge connection to the nodes according to the resource transfer direction, for example, the id
  • the resource transfer direction between b and d is from b to d, then the two identities can be connected by a one-way edge whose direction is b to d. identities, one-way edge connections can also be performed in the above manner to obtain the resource transfer relationship diagram shown in Figure 3(a).
  • the resource transfer relationship graph as an example of a resource net transfer-out unidirectional graph. It can be understood that the one-way edge from node a to node b in the resource net-out unidirectional graph reflects that resources flow out from node a and flow to node b.
  • Step S208 in the process of searching the resource transfer path for the resource transfer relationship graph, determine the current search node in the current resource transfer path that is currently searched, use the node pointing to the current search node in the current resource transfer path as a reference node, and set The node pointed to by the current search node in the resource transfer relationship graph is used as a candidate node.
  • the server can perform path search on the resource transfer relationship graph, that is, graph traversal.
  • Graph traversal refers to starting from a certain node in the graph and searching all the nodes in the graph along the edges in a certain search method. Nodes are visited once and only once.
  • Breadth-first search is a search in which the breadth of the path is prioritized over the depth of the path.
  • Depth-first search is a search in which the depth of the path is prioritized over the breadth of the path.
  • the resource transfer path search may adopt a search manner in which path depth is prioritized over path breadth.
  • Depth-first search that is, in the search where the path depth is prior to the path breadth, refer to Figure 3(a), in the graph structure shown in Figure 3(a), starting from a certain node, if the currently searched node is a node f, the identification pointed to by the node f includes node c and node h, select a node from node c and node as the searched node; if the selected node is node c, then determine from the node pointed to by node c A node is used as the searched node, that is, node j is searched; then, a node is determined from the nodes pointed to by node j as the searched node, that is, node k is searched; in this search method, the current search The reached node f points to node c, and node c points to node j, then continue to determine the node k pointed to by node j until the end condition of path depth search is reached.
  • Breadth-first search that is, in the search where the breadth of the path is prior to the depth of the path, refer to Figure 3(a), in the graph structure shown in Figure 3(a), starting from a certain node, if the currently searched node is a node f, the nodes pointed to by node f include node c and node h, select a node from nodes c and h as the searched node; if the selected node is node c, then determine from the nodes pointed to by node c A node is used as the searched node, that is, node j is searched; then, another node h pointed to by node f is used as the searched node, and a node is determined from the nodes pointed to by node h as the searched node , that is, the node g is searched; in this search method, first determine the nodes pointed to by all the nodes of the same level, and then enter the next level, and determine the nodes pointed to by all the nodes of
  • the current resource transfer path is a path formed by nodes connected by one-way edges searched based on the path search method from the resource transfer relationship graph, and is the resource transfer path currently being searched.
  • a currently searched node may be referred to as a currently searched node.
  • the reference node is the node pointing to the current search node in the current resource transfer path; the candidate node is the node pointed to by the current search node in the resource transfer relationship diagram.
  • the server may search for a resource transfer path on the resource transfer relation graph in a path depth-first manner.
  • the currently searched resource transfer path is a->b->d
  • the current search node is node d
  • the current resource transfer path a->b->d can be pointed to
  • the node b of the current search node d is used as a reference node
  • the node f pointed to by the current search node d in the resource transfer relationship graph is used as a candidate node to determine whether the node f can be added to the current resource transfer path through subsequent steps .
  • Step S210 determining the first resource transfer time between the current search node and the reference node, and the second resource transfer time between the current search node and the candidate node.
  • the first resource transfer time is determined based on the occurrence time of multiple resource transfers between the current search node and the reference node, and is used to represent the transfer time corresponding to the net resource transfer amount between the current search node and the reference node.
  • the second resource transfer time is determined based on the occurrence time of multiple resource transfers between the current search node and the candidate node, and is used to represent the transfer time corresponding to the net resource transfer amount between the current search node and the candidate node.
  • the first resource transfer time may be an average value of occurrence times of multiple resource transfers between the current search node and the reference node.
  • the occurrence time may be a time stamp that increases sequentially according to the resource transfer time.
  • the amount of resources for marker d is m v1
  • the amount of resources transferred from marker b to marker d at time t v2 is m v2
  • the amount of resources transferred from marker d to marker b at time t v3 is m v3
  • the server can transfer t v1 , t v2 , t v3
  • the second resource transfer time may be determined in the manner described above, which will not be described in detail here.
  • Step S212 when the first resource transfer time and the second resource transfer time satisfy the time difference condition, adding the candidate node into the current resource transfer path to detect the target resource transfer path.
  • the difference between the two resource transfer times can be represented by the difference between the two resource transfer times, or by the ratio of the two resource transfer times.
  • the time difference condition is a time difference condition that the target resource flows from the reference node to the current search node and the candidate node in sequence; the target resource may be a resource whose source is not authenticated.
  • the target resource is more likely to flow from the reference node to the current search node and the candidate node in order of time, that is, the reference node may be the target resource source node of the current search node, and the candidate node may be the target resource destination node of the current search node.
  • the target resource transfer path is a path that is finally obtained when the resource transfer relationship graph is continuously searched based on the current resource transfer path.
  • the target resource transfer path is an identified path where malicious resource transfer may exist.
  • the server obtains the current search node After the first resource transfer time T(b,d) between the reference node and the second resource transfer time T(d,f) between the current search node and the candidate node, if the first resource transfer time T(b ,d) is earlier than the second resource transfer time T(d,f), it can be determined that the first resource transfer time and the second resource transfer time meet the time difference condition, and node f is added to the current resource transfer path a->b On ->d, update the current resource transfer path to a->b->d->f; then, the server can use the current resource transfer path as a->b->d->f, and use node f as the current search node , and take node d as the reference node of the current search node f and the node
  • a resource transfer relationship diagram is constructed based on the resource transfer relationship and resource transfer direction between resource transfer identifiers. Accurately identify the transfer path of unauthenticated resources in resource transfer, and improve the efficiency of path identification; in addition, in the process of resource transfer path search in the resource transfer relationship graph, the first node between the current search node and the reference node When the time difference condition is satisfied between the first resource transfer time and the second resource transfer time between the current search node and the candidate node, the candidate node is added to the current resource transfer path, indicating that the target resources are in chronological order, from If the reference node flows to the current node and the candidate node in turn, it can accurately reflect the flow relationship of the target resource. In this way, nodes are added sequentially, thereby accurately identifying the target resource transfer path of the target resource, and improving the accuracy of path identification.
  • the out-degree of each node in the resource transfer relationship graph can be determined, the out-degree is the number of edges starting from the node and pointing to other nodes, and the server can use the out-degree A node greater than 0 is used as the starting node of the path search.
  • the server may determine the nodes included in the target resource transfer path. , that is, if a node has multiple incoming edges, the sub-path starting from the node in the target resource transfer path is recorded as the attribute of the node, so that the next time the node is searched, the sub-path can be directly obtained. path to obtain another target resource transfer path including the sub-path, thereby saving search time and improving search efficiency.
  • the target resource transfer path a>b->d->f->c->j->k is searched, and there are two nodes pointing to node f: node d and node i
  • the server records the subpath f->c->j->k starting from node f, and searches for the path starting from node e next time, and finds candidate node f, that is, the current resource transfer path is e-
  • candidate node f that is, the current resource transfer path is e-
  • the candidate node when the first resource transfer time and the second resource transfer time meet the time difference condition, the candidate node is added to the current resource transfer path, including: when the first resource transfer time and the second resource transfer time When the time difference condition is satisfied, the path attribute identifier corresponding to the candidate node is obtained; based on the path attribute identifier, the subpath starting from the candidate node is obtained, and the subpath is spliced into the current resource transfer path to obtain the target resource transfer path.
  • the server will record the node every time a node is added to the current resource transfer path, that is, record the nodes (identifications) included in the current resource transfer path ), if the current search node already exists in the current resource transfer path, it means that the current search node has already been visited, and when a node ring formed by the nodes is encountered, the server will exit the visit and use the current resource transfer path as the The obtained target resource transfer path is searched, and the next path search is started. Referring to FIG. 3(c), nodes y3, y5 and y4 in FIG. 3(c) form a node ring.
  • node y4 is the current search node, and its corresponding candidate node is node y3, since the candidate node y3 already exists in the current resource transfer path , exit the access, and obtain the target resource transfer path as y1->y2->y3->y5->y4.
  • node y3 is the current search node, and its corresponding candidate node is node y5, since the candidate node y5 already exists with the current In the resource transfer path, exit the access, and obtain the target resource transfer path as y1->y2->y5->y4->y3. In this way, infinite loop access to nodes can be avoided, wasting computing resources.
  • the first resource transfer time between the current search node and the reference node can also be determined in the following manner: obtain the resource transfer record set between the current search node and the reference node; obtain the resources in each resource transfer record Transfer time and resource transfer value; determine the time weight corresponding to the resource transfer time based on the resource transfer value; the time weight is positively correlated with the resource transfer value; weight the resource transfer time in the resource transfer record set based on the time weight corresponding to the resource transfer time Calculate to obtain the first resource transfer time between the current search node and the reference node.
  • the resource transfer record set includes multiple resource transfer records; each resource transfer record corresponds to each resource transfer between the current search node and the reference node, and each resource transfer record can include the resource transfer value and resource transfer time of each resource transfer ;
  • the resource transfer value of each resource transfer refers to the amount of resource transfer;
  • the resource transfer time corresponding to each resource transfer refers to the occurrence time of each resource transfer, such as the occurrence of each resource transfer between the markers b and d Times t v1 , t v2 , t v3 , t v4 , and t v5 .
  • the weight assigned to the occurrence time of each resource transfer is positively correlated with the amount of resource transfer corresponding to each resource transfer, for example, for the occurrence time t v1 , t v2 , t v3 , t v4 , and t v5 , if the order of resource transfer amounts corresponding to each resource transfer from large to small is: m v1 , m v4 , m v3 , m v2 , m v5 , then based on the above positive correlation, The order of the weights given by the occurrence times t v1 , t v2 , t v3 , t v4 and t v5 of each resource transfer from large to small is w v1 , w v4 , w v3 , w v2 , w v5 .
  • the server can perform weighted calculation on the occurrence time of each resource transfer, that is, w v1 ⁇ t v1 + w v2 ⁇ t v2 + w v3 ⁇ t v3 +w v4 ⁇ t v4 +w v5 ⁇ t v5 , the weighted calculation result is used as the first resource transfer time between the current search node and the reference node.
  • the weight assigned to the occurrence time of each resource transfer is determined and weighted calculation is performed, so that the first resource transfer time It focuses more on reflecting the occurrence time of the larger resource transfer among the multiple resource transfers between the current search node and the reference node, and improves the search accuracy of the target resource transfer path.
  • determining the time weight corresponding to the resource transfer time based on the resource transfer value includes: calculating the sum of the resource transfer values in the resource transfer record set to obtain the resource transfer statistical value; calculating the resource transfer value in the resource transfer statistical value The proportion in , and the proportion is used as the time weight corresponding to the resource transfer time.
  • the resource statistics value refers to the sum of the resource transfer amounts corresponding to each resource transfer between the current search node and the reference node, which can also be called the total amount of resource transfer.
  • the resource transfer amounts corresponding to each resource transfer between the identifier b and the identifier d are m v1 , m v2 , m v3 .
  • the server can use m v1 +m v2 +m v3 +m v4 +m v5 as resource statistics. Then, the server can calculate the proportion of the resource transfer amount corresponding to each resource transfer in the resource statistics:
  • the proportion of the resource transfer amount of each resource transfer in the total resource transfer is used as the weight given to the occurrence time of each resource transfer, so that the first resource transfer time reflects the current search node to a greater extent
  • the occurrence time of a large amount of resource transfer among multiple resource transfers between the reference node and the reference node further improves the search accuracy of the target resource transfer path.
  • the above method of determining the first resource transfer time between the reference node and the current search node may be applicable to the second resource transfer time between the current search node and the candidate node.
  • the first resource transfer time is the first last resource transfer time from the reference node to the current search node
  • the second resource transfer time is the second first resource transfer time from the current search node to the candidate node.
  • the step of satisfying the time difference condition between the resource transfer time and the second resource transfer time includes: determining the time order between the first resource transfer time and the second resource transfer time; when the time order indicates that the first resource transfer time is earlier than the second resource transfer time When transferring time, it is determined that the first resource transfer time and the second resource transfer time meet the time difference condition; when the time sequence indicates that the first resource transfer time is later than the second resource transfer time, if the first resource transfer time and the second resource transfer time If the time difference is smaller than the preset time threshold, it is determined that the first resource transfer time and the second resource transfer time satisfy the time difference condition.
  • the first resource transfer time is the first and last resource transfer time from the reference node to the current search node. For example, if the current search node is d and the reference node is b, as shown in Figure 4, there are 5 transactions between node b and node d resource transfer, and there are 2 resource transfers from node b to node d among the 5 resource transfers, and the last resource transfer of these 2 resource transfers takes place at t v4 , at this time, t v4 can be used as the first resource transfer - resource transfer time.
  • the second resource transfer time is the second first resource transfer time from the current search node to the candidate node.
  • the current search node is d and the candidate node is f, as shown in Figure 5, there are 3 transactions between node d and node f Resource transfer, and among these 3 resource transfers, there are 2 resource transfers from node d to node f, and the first resource transfer in these 2 resource transfers occurs at t v6 , at this time, t v6 can be used as the second resource transfer time.
  • the time sequence is used to characterize the sequence of the first resource transfer time and the second resource transfer time. If the first resource transfer time is earlier than the second resource transfer time, the server may determine that the first resource transfer time and the second resource transfer time satisfy the time difference condition. When the first resource transfer time is later than the second resource transfer time, if the difference between the first resource transfer time and the second resource transfer time is less than the preset time threshold, that is, the difference between the first resource transfer time and the second resource transfer time If the absolute value of the difference is less than the preset time threshold, the server may determine that the first resource transfer time and the second resource transfer time satisfy the time difference condition.
  • the occurrence time of the last resource transfer among the multiple resource transfers transferred from the reference node to the current search node is taken as the first resource transfer time
  • the multiple resource transfers transferred from the current search node to the candidate node The time of occurrence of the first resource transfer in is used as the second resource transfer time, and the time difference between the two resource transfer times represents the difference between the occurrence time of multiple resource transfers between the reference node and the current search node and the current search node and the candidate node Whether there is an overlap in the occurrence time of multiple resource transfers between them, if there is no overlap, it is determined that there is a significant net resource transfer between the reference node and the current search node and the resource net transfer between the current search node and the candidate node.
  • the sequence of resources transferred from the reference node to the current search node and then to the candidate node is more likely to be an illegal resource, thereby improving the identification accuracy of the transfer path of the source of unauthenticated resources.
  • the step of determining that the first resource transfer time and the second resource transfer time satisfy the time difference condition includes: determining the time sequence between the first resource transfer time and the second resource transfer time; when the time sequence indicates When the first resource transfer time is later than the second resource transfer time, obtain the first time difference between the first resource transfer time and the second resource transfer time; obtain the first resource transfer between the reference node pointing to the current search node time, and obtain the second last resource transfer time of the current search node pointing to the candidate node; obtain the second time difference between the second last resource transfer time and the first first resource transfer time; calculate the first time difference and the second For the time ratio between the time differences, when the time ratio is less than or equal to the preset ratio threshold, it is determined that the first resource transfer time and the second resource transfer time meet the time difference condition.
  • the first resource transfer time is the occurrence time of the first resource transfer among the multiple resource transfers transferred from the reference node to the current search node
  • the second last resource transfer time is the multiple resource transfers transferred from the current search node to the candidate node The occurrence time of the last resource transfer in .
  • the above steps are introduced by taking the reference node b, the current search node d and the candidate node f as examples: Referring to Figure 6(a), it is the occurrence of multiple resource transfers from the reference node to the current search node Schematic diagram of time and the occurrence time of multiple resource transfers from the current search node to the candidate node, where the occurrence time of multiple resource transfers from the reference node b to the current search node d includes tv1, tv4, and the current search node d
  • the occurrence time of multiple resource transfers transferred to candidate node f includes tv6 and tv8, and the sequence is tv1, tv6, tv4, tv8, as shown in Figure 6(a).
  • the first resource transfer time is the number of times transferred from the reference node b to the current search node d
  • the occurrence time of the last resource transfer among the actual resource transfers is t v4
  • the first resource transfer time is the occurrence time of the first resource transfer among the multiple resource transfers transferred from the reference node b to the current search node d, namely t v1
  • the second resource transfer time is the occurrence time of the first resource transfer among multiple resource transfers transferred from the current search node d to the candidate node f, which is t v6
  • the second last resource transfer time is transferred from the current search node d to
  • the occurrence time of the last resource transfer among the multiple resource transfers to the candidate node f is t v8 ; referring to Figure 6(a), the first resource transfer time is later than the second resource transfer time, that is, t v4 >t
  • the server can use t v4 -t v6 as the first time difference; similarly, the server can use t v8 -t v1 as the second time difference to obtain the second time difference A time ratio (t v4 -t v6 )/(t v8 -t v1 ) of the first time difference and the second time difference.
  • the overlapping periods (ie t v6 to t v4 ) between the occurrence periods (ie t v6 to t v8 ) of multiple resource transfers transferred to candidate nodes account for the total occurrence period (ie t v1 to t v8 )
  • the smaller the ratio it also indicates that the chronological order of the resource net transfer from reference node b to current search node d and the resource net transfer from current search node d to candidate node f is higher.
  • the server can determine that the first resource transfer time and the second resource transfer time meet the time difference condition, and add candidate node f to the current resource transfer path a->b->d.
  • the step of determining that the first resource transfer time and the second resource transfer time satisfy the time difference condition includes: determining the time sequence between the first resource transfer time and the second resource transfer time; when the time sequence indicates When the first resource transfer time is earlier than the second resource transfer time, it is directly determined that the time difference condition is satisfied between the first resource transfer time and the second resource transfer time.
  • the above steps are introduced by taking the reference node b, the current search node d and the candidate node f as examples: Referring to Figure 6(b), it is the occurrence of multiple resource transfers from the reference node to the current search node Schematic diagram of time and the occurrence time of multiple resource transfers from the current search node to the candidate node, where the occurrence time of multiple resource transfers from the reference node b to the current search node d includes tv1, tv4, and the current search node d
  • the occurrence time of multiple resource transfers transferred to candidate node f includes tv6 and tv8, and the sequence is tv1, tv4, tv6 and tv8, as shown in Figure 6(b).
  • the first resource transfer time is the number of times transferred from the reference node b to the current search node d
  • the occurrence time of the last resource transfer among the actual resource transfers is t v4
  • the first resource transfer time is the occurrence time of the first resource transfer among the multiple resource transfers transferred from the reference node b to the current search node d, namely t v1
  • the second resource transfer time is the occurrence time of the first resource transfer among multiple resource transfers transferred from the current search node d to the candidate node f, which is t v6
  • the second last resource transfer time is transferred from the current search node d to
  • the occurrence time of the last resource transfer among multiple resource transfers to candidate node f is tv8 ; referring to Figure 6(b), the first resource transfer time is earlier than the second resource transfer time, that is, tv4 ⁇ tv6
  • t v4 When t v4 ⁇ t v6 , it represents the occurrence period of multiple resource transfers from the reference node b to the current search node d (ie tv1 to tv4) and the occurrence of multiple resource transfers from the current search node d to the candidate node f There is no overlapping period between periods (i.e. tv6 to tv8), which also characterizes the chronological order of the net transfer of resources from reference node b to current search node d and the net resource transfer from current search node d to candidate node f is higher, it can be determined that the first resource transfer time and the second resource transfer time satisfy the time difference condition, and the candidate node f is added to the current resource transfer path a->b->d.
  • adding the candidate node to the current resource transfer path to obtain the target resource transfer path includes: obtaining the reference node to the current resource transfer path The first transfer resource amount transferred by the search node, and the second transfer resource amount transferred from the current search node to the candidate node; when the first resource transfer time and the second resource transfer time meet the time difference condition, and determine the first transfer resource amount and When the resource difference between the second transferred resource amounts is smaller than the preset difference, the candidate node is added to the current resource transfer path to obtain the target resource transfer path.
  • the first transfer resource amount refers to the resource transfer amount transferred from the reference node to the current search node
  • the first transfer resource amount refers to the resource transfer amount transferred from the current search node to the candidate node.
  • the resource difference between the first transfer resource amount and the second transfer resource amount may reflect the relative size of the first transfer resource amount and the second transfer resource amount.
  • the first amount of transferred resources is M(b,d)
  • the second amount of transferred resources is M(d,f).
  • determining the resource difference between the first transferred resource amount and the second transferred resource amount includes: calculating a resource amount ratio between the first transferred resource amount and the second transferred resource amount; calculating the resource amount ratio As a resource variance amount. Further, when the server determines that the resource amount ratio is within the preset ratio range, such as greater than the first threshold and smaller than the second threshold, determine that the resource difference between the first transfer resource amount and the second transfer resource amount is smaller than the preset difference quantity.
  • the first threshold and the second threshold are used to measure whether the size of the first transfer resource amount and the second transfer resource amount are similar
  • the first threshold and the second threshold may be values adjacent to 1, for example, the first threshold is 1.1 and the second threshold is 1.3; the first threshold may be a value less than 1 and adjacent to 1, such as 0.8, and the second threshold may be a value greater than 1 and adjacent to 1, such as 1.1.
  • the first transfer resource amount is M(b,d), and the second transfer resource
  • the amount is M(d,f)
  • M(b,d)/M( d,f) is greater than 0.8 and less than 1.1
  • M(b,d) and M(d,f) are considered to be similar in size
  • the candidate node f can be added to the current resource transfer path a->b->d to obtain New current resource transfer path a->b->d->f.
  • the resource amount ratio is used as the similarity of the two resource transfer amounts, so that when the size is similar, the candidate node is added to the current resource transfer path to ensure that the candidate node is the resource destination node of the current search node, and the target resource is improved. Recognition accuracy of transfer path search.
  • determining the current search node in the currently searched current resource transfer path includes: determining the start node among the nodes included in the resource transfer relationship graph; If the resource transfer amount of the node is greater than or equal to the resource transfer amount threshold, the current resource transfer path is formed based on the start node and the node pointed to by the start node, and the node pointed to by the start node is used as the current search node.
  • the starting node in the resource transfer relationship graph should meet at least one of the following conditions:
  • the out-degree of the node is greater than 0 and the in-degree of the node is less than or equal to the preset threshold. If the preset threshold is 0, the in-degree is the number of edges pointing to the node. As shown in Figure 3(a), node a and node The in-degree of e is 0, which satisfies this condition and can be used as the starting node.
  • the ratio of the total amount of transferred-in resources of a node to the total amount of transferred-out resources of a node is less than the preset ratio;
  • the amount is the total amount of resources that the node transfers to all nodes pointed to by the node;
  • the ratio of the total amount of resources transferred in to the total amount of resources transferred out is less than the preset ratio, which means: the total amount of resources transferred in by the node and the total amount of resources transferred out by the node
  • the size of the total resource transfer-out is not similar and the total resource transfer-in is less than the total resource transfer-out, that is, the total resource transfer-in of this node is much smaller than the net resource transfer-out total, so this node can be used as the starting node.
  • the node when determining whether the total amount of resources transferred in by node o is much smaller than the total amount of resources transferred out by this node, since all the nodes pointing to this node o are q, n, r and m, the node can be The sum of the amount of resources transferred to node o by q, n, r, and m is taken as the total amount of resources transferred to node o, that is, M(q,o)+M(n,o)+M(r,o) +M(m,o); Since all the nodes pointed to by the node o are p and s, the sum of the resources transferred from node o to node p and node s can be used as the total amount of resources transferred from node o , which is M(o,p)+M(o,s); if the total amount of resources transferred is M(q,o)+M(n,o)+M(r,o)+M(m,o) is much smaller than the total amount
  • k can be any value from 0.1 to 0.3, then it can be determined that the total amount of resources transferred in is much smaller than the total amount of resources transferred out.
  • the in-degree of node e is 0, the node e only points to node i, and there is no in-edge, then the total amount of transferred-in resources corresponding to node e is 0, and the total amount of transferred-out resources transferred from node e to node i is M (e,i), if M(e,i) is much greater than 0, then node e satisfies the above condition (3), can be used as the starting node, and form the current resource transfer path e->i based on node e and node i, Take node i as the current search node, node e as the reference node, and node f pointed to by node i as the candidate node, according to the time sequence of the resource transfer time from node e to node i and the resource transfer time from node i to node f The order significance and the similarity between M(e,i) and M(i,f) determine whether to add node f to the current resource transfer path e->i.
  • the node that satisfies the preset condition is used as the starting node of the current path search in the resource transfer relationship diagram, and the current The resource transfer path and the current search node ensure the normal progress of the search for the transfer path of resources whose source is not authenticated.
  • the resource transfer identifier in this application embodiment is referred to as an identifier for short.
  • Step S802 obtaining an identification set
  • step S804 the identifier is used as a node, and the nodes with resource transfer relationship are connected through unidirectional edges to obtain a unidirectional graph of net transfer of resources.
  • the direction of the one-way edge represents the net resource transfer direction between the two nodes connected by the one-way edge, and the resource net transfer direction is determined based on multiple resource transfers between the two nodes; for example, node a 5 resources were transferred to node b with a total amount of 30,000 resources, and node b transferred 2 resources to node a with a total amount of 20,000 resources, then according to the 7 resource transfers between node a and node b, It can be determined that the resource net transfer direction between the two nodes is from node a to node b.
  • each unidirectional edge has two attributes, one attribute is the net resource transfer amount, and the other attribute is the time corresponding to the resource net transfer amount.
  • the time corresponding to the net resource transfer amount can be obtained by synthesizing the occurrence time of multiple resource transfers between nodes.
  • the specific synthesis method can be based on the weighted synthesis of the resource transfer amount of each resource transfer, for example, between node b and node d
  • the time T(b,d) corresponding to the net resource transfer amount during the period t v1 ⁇ mv1/(mv1+mv2+mv3+mv4+mv5)+t v2 ⁇ mv2/(mv1+mv2+mv3+mv4+mv5) +t v3 ⁇ mv3/(mv1+mv2+mv3+mv4+mv5)+t v4 ⁇ mv4/(mv1+mv2+mv3+mv4+mv5)+t v5 ⁇ mv5/(mv1+mv2+mv3+mv4+mv5 ), for details, please refer to the previous examples.
  • Step S806 among the nodes included in the resource net transfer-out unidirectional graph, use the node that satisfies the preset starting node condition as the starting node for the current path search;
  • Step S808 record the net resource transfer amount from the start node to the node pointed to by the start node as M, if M is greater than or equal to the resource transfer amount threshold M 0 , based on the start node and the node pointed to by the start node Nodes form the current resource transfer path, and the node pointed to by the starting node is used as the current search node;
  • Step S810 taking the starting node as a reference node, and taking the node pointed to by the current search node as a candidate node;
  • Step S812 taking the time corresponding to the net transfer-out amount of resources between the reference node and the current search node as the first resource transfer time, and taking the time corresponding to the net transfer-out amount of resources between the current search node and the candidate node as the second 2. Resource transfer time.
  • the first resource transfer time is recorded as T(i-1,i), and the second resource transfer time is recorded as T(i,i+1); wherein, i-1 represents the reference node pointing to the current search node, i Represents the current search node, i+1 represents the candidate node pointed to by the current search node;
  • Step S814 if the first resource transfer time is earlier than the second resource transfer time, obtain the net resource transfer amount between the reference node and the current search node and the resource net transfer amount between the current search node and the candidate node, if the resource If the net transfer amount and the resource net transfer amount are similar, the candidate node is added to the current resource transfer path, and the current search node is used as the reference node, the candidate node is used as the current node, and the node pointed to by the candidate node is used as the candidate node to continue Path search until the termination condition is satisfied, and the target resource transfer path is obtained.
  • the resources between the reference node and the current search node are obtained
  • the net transfer amount M(i-1,i) and the net resource transfer amount M(i,i+1) between the current search node and the candidate node if M(i-1,i) and M(i,i +1) are similar in size, then the candidate node is added to the current resource transfer path, and the current search node is used as the reference node, the candidate node is used as the current node, and the node pointed to by the candidate node is used as the candidate node to continue the path search until the termination is satisfied conditions to obtain the target resource transfer path;
  • the determination method of M(i-1,i) and M(i,i+1) is similar in size: when M(i-1,i)/M(i,i+1) ⁇ (1-p loss , 1+p loss ), it can be determined that M(i-1,i) and M(i,i+1) are similar in size; where, p loss ⁇ (0.1 ⁇ 0.2).
  • Termination conditions include any of the following:
  • Step S816 after completing the path search, store the sub-paths corresponding to the nodes with multiple incoming edges on the target resource transfer path as the path attributes of the corresponding nodes;
  • Step S818 determine the next node that satisfies the preset start node condition among the nodes included in the resource net transfer out unidirectional graph, and search for the resource transfer path according to steps S808 to S816, if one of the searched nodes has path attribute, directly read the path attribute and splice it into the current resource transfer path that is currently searched until the end of the path search;
  • Step S820 if there is still an unvisited start node in the resource net transfer-out unidirectional graph, return to step S808 to continue path search.
  • path search record the nodes (identities) included in the current resource transfer path. If the current search node already exists in the current resource transfer path, it means that the current search node has been visited, and the node is encountered at this time. If the node ring is formed, the server will exit the access, take the current resource transfer path as the target resource transfer path obtained by this search, and start the next path search. In this way, infinite loop access to nodes can be avoided, wasting computing resources.
  • a resource transfer relationship diagram is constructed based on the resource transfer relationship and resource transfer direction between resource transfer identifiers. Accurately identify the transfer path of resources whose sources are not authenticated, and improve the efficiency of path identification; in addition, in the process of resource transfer path search in the resource transfer relationship graph, the first resource between the current search node and the reference node When the time difference condition is satisfied between the transfer time and the second resource transfer time between the current search node and the candidate node, the candidate node is added to the current resource transfer path, indicating that the target resource is in chronological order, starting from the reference node The flow to the current node and the candidate node in turn can accurately reflect the flow relationship of the target resource. In this way, nodes are added in sequence, thereby accurately identifying the target resource transfer path of the target resource and improving the accuracy of path identification.
  • FIGS. 1 to 8 may include multiple steps or stages. These steps or stages are not necessarily executed at the same moment, but may be executed at different moments. The steps or stages The order of execution is not necessarily performed sequentially, but may be performed alternately or alternately with other steps or at least a part of steps or stages in other steps.
  • an apparatus for detecting resource transfer information including:
  • An identification set acquisition module 902 configured to acquire a resource transfer identification set to be maliciously detected; the resource transfer identification set includes a plurality of resource transfer identifications;
  • the transfer direction determining module 904 is configured to acquire resource transfer identifier pairs corresponding to the resource transfer identifier set, and determine the resource transfer direction corresponding to the resource transfer identifier pair; each resource transfer identifier pair is two resource transfer identifier pairs in the resource transfer identifier set Composed of resource transfer identifiers;
  • the relationship graph acquisition module 906 is configured to use the resource transfer identifiers in the resource transfer identifier set as nodes in the resource transfer relationship graph, and connect the corresponding nodes of the resource transfer identifiers with directed edges according to the resource transfer direction to obtain the resource transfer relationship picture;
  • the node determining module 908 is configured to determine the current search node in the current resource transfer path that is currently searched in the process of searching the resource transfer path for the resource transfer relationship graph, and use the node pointing to the current search node in the current resource transfer path as Reference node, using the node pointed to by the current search node in the resource transfer relationship graph as a candidate node;
  • a time determination module 910 configured to determine a first resource transfer time between the current search node and the reference node, and a second resource transfer time between the current search node and the candidate node;
  • the node addition module 912 is used to determine that when the first resource transfer time and the second resource transfer time meet the time difference condition, then add the candidate node to the current resource transfer path to obtain the target resource transfer path; the time difference condition is the target resource Time difference conditions that flow sequentially from the reference node to the current search node and candidate nodes.
  • the time determination module 910 is further configured to obtain a resource transfer record set between the current search node and the reference node; the resource transfer record set includes multiple resource transfer records; obtain each of the The resource transfer time and resource transfer value in the resource transfer record; determine the time weight corresponding to the resource transfer time based on the resource transfer value; the time weight is positively correlated with the resource transfer value; based on the resource transfer time The corresponding time weight performs weighted calculation on the resource transfer time in the resource transfer record set to obtain the first resource transfer time between the current search node and the reference node.
  • the time determining module 910 is further configured to: calculate the sum of the resource transfer values in the resource transfer record set to obtain the statistical value of resource transfer; calculate the proportion of the resource transfer value in the resource transfer statistical value, and The proportion is used as the time weight corresponding to the resource transfer time.
  • the first resource transfer time is the first last resource transfer time when the reference node points to the current search node
  • the second resource transfer time is when the current search node points to the candidate node
  • the second first resource transfer time; the node adding module 912 is also configured to: determine the time sequence between the first last resource transfer time and the second first resource transfer time; when the time sequence indicates the first resource transfer time When the last resource transfer time is earlier than the second first resource transfer time, it is determined that the first resource transfer time and the second resource transfer time satisfy a time difference condition.
  • the node adding module 912 is further configured to: when the time sequence indicates that the first last resource transfer time is later than the second first resource transfer time, acquire the first last resource transfer time and the first time difference between the second first resource transfer time; obtain the first first resource transfer time between the reference node pointing to the current search node, and obtain the current search node pointing to the candidate The second last resource transfer time of the node, obtaining the second time difference between the second last resource transfer time and the first first resource transfer time; calculating the first time difference and the second time difference A time ratio between differences, when the time ratio is smaller than a preset ratio threshold, it is determined that the first resource transfer time and the second resource transfer time satisfy a time difference condition.
  • the node addition module 912 is further configured to: obtain the first transfer resource amount transferred from the reference node to the current search node, and the second transfer resource transferred from the current search node to the candidate node Resource amount; when the first resource transfer time and the second resource transfer time satisfy a time difference condition, and it is determined that the resource difference between the first resource transfer amount and the second resource transfer amount is less than When the difference is preset, the candidate node is added to the current resource transfer path to detect the target resource transfer path.
  • the node adding module 912 is further configured to: obtain the first transfer resource amount transferred from the reference node to the current search node, and the second transfer resource amount transferred from the current search node to the candidate node; when the resource transfer time difference When the time difference condition is satisfied and it is determined that the resource amount between the first transfer resource amount and the second transfer resource amount is less than the difference amount, adding the candidate node to the current resource transfer path to obtain the target resource transfer path.
  • the node addition module 912 is further configured to: calculate the resource amount ratio between the first transferred resource amount and the second transferred resource amount; use the resource amount ratio as the resource difference amount ; When the resource amount ratio is greater than the first threshold and smaller than the second threshold, determine that the resource difference between the first transfer resource amount and the second transfer resource amount is less than a preset difference amount; the first The threshold is less than 1, and the second threshold is greater than 1.
  • the node adding module 912 is further configured to: acquire the path attribute identifier corresponding to the candidate node when the first resource transfer time and the second resource transfer time satisfy a time difference condition;
  • the path attribute identifier is added to the node with multiple incoming edges in the existing target resource transfer path, and the path attribute identifier is used to identify the departure from the node with multiple incoming edges in the existing target resource transfer path Obtained sub-paths: obtaining sub-paths starting from the candidate node based on the path attribute identifier, and splicing the sub-paths into the current resource transfer path to detect a target resource transfer path.
  • the node determination module 908 is configured to: among the nodes included in the resource transfer relationship graph, use a node that satisfies a preset starting node condition as the starting node of the current resource transfer path;
  • the preset starting node conditions include at least one of the following conditions: the out-degree of the node is greater than 0 and the in-degree of the node is less than or equal to a preset threshold; The ratio of the total amount of resources transferred out is less than the preset ratio.
  • the node determination module 908 is configured to: if the resource transfer amount from the starting node to the node pointed to by the starting node is greater than or equal to the resource transfer amount threshold, based on the starting node The current resource transfer path is formed with the node pointed to by the starting node, and the node pointed to by the starting node is used as the current search node.
  • Each module in the above resource transfer information detection device can be fully or partially realized by software, hardware and a combination thereof.
  • the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, and can also be stored in the memory of the computer device in the form of software, so that the processor can invoke and execute the corresponding operations of the above-mentioned modules.
  • a computer device is provided, and its internal structure diagram may be as shown in FIG. 10 .
  • the computer device may be server 104 in FIG. 1 .
  • the computer device includes a processor, memory and a network interface connected by a system bus. Wherein, the processor of the computer device is used to provide calculation and control capabilities.
  • the memory of the computer device includes a non-volatile computer-readable storage medium and an internal memory.
  • the non-volatile computer readable storage medium stores an operating system, computer programs and databases.
  • the internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium.
  • the database of the computer device is used to store resource transfer information detection data.
  • the network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a method for detecting resource transfer information is realized.
  • FIG. 10 is only a block diagram of a part of the structure related to the solution of this application, and does not constitute a limitation to the computer equipment on which the solution of this application is applied.
  • the specific computer equipment can be More or fewer components than shown in the figures may be included, or some components may be combined, or have a different arrangement of components.
  • a computer device includes a memory and a processor.
  • the memory stores computer-readable instructions.
  • the processor is made to execute the resource transfer information detection method of the present application.
  • a non-volatile computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the processor executes the resource transfer information detection method of the present application.
  • a computer program product or computer program comprising computer readable instructions stored on a computer readable storage medium.
  • the processor of the computer device reads the computer-readable instructions from the computer-readable storage medium, and the processor executes the computer-readable instructions, so that the computer device executes the resource transfer information detection method of the present application.
  • user information including but not limited to user equipment information, user personal information, etc.
  • data including but not limited to data used for analysis, stored data, displayed data, etc.
  • Non-volatile memory may include read-only memory (Read-Only Memory, ROM), magnetic tape, floppy disk, flash memory or optical memory, etc.
  • Volatile memory can include Random Access Memory (RAM) or external cache memory.
  • RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Theoretical Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Finance (AREA)
  • Software Systems (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Development Economics (AREA)
  • Economics (AREA)
  • Mathematical Physics (AREA)
  • Marketing (AREA)
  • Technology Law (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

一种资源转移信息检测方法，包括：对资源转移关系图进行资源转移路径搜索的过程中，确定当前搜索节点、当前资源转移路径中指向当前搜索节点的参考节点以及资源转移关系图中当前搜索节点所指向的候选节点；获取当前搜索节点与参考节点之间的第一资源转移时间，与当前搜索节点与候选节点之间的第二资源转移时间，当第一资源转移时间与第二资源转移时间满足时间差异条件时，将候选节点加入到当前资源转移路径中，以检测出目标资源转移路径。

Description

资源转移信息检测方法、装置、设备和存储介质
本申请要求于2021年10月20日提交中国专利局，申请号为202111221459.0，申请名称为“资源转移信息检测方法、装置、设备和存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域，特别是涉及一种资源转移信息检测方法、装置、计算机设备、存储介质和计算机程序产品。
背景技术
随着计算机技术与互联网技术的发展，出现了基于互联网形成的线上支付平台，用户可以在线上支付平台上进行资金转移，极大地提高了交易效率且降低了交易成本。
在很多情况下，需要对资源转移信息进行检测，例如检测来源未受认证的资源的转移操作。目前主要是依据人工进行检测，导致资源转移信息检测效率低。
发明内容
一种资源转移信息检测方法，所述方法包括：
获取资源转移标识集合；所述资源转移标识集合包括多个资源转移标识；
获取所述资源转移标识集合对应的资源转移标识对，确定所述资源转移标识对所对应的资源转移方向；每个所述资源转移标识对是所述资源转移标识集合中存在资源转移关系的两个资源转移标识组成的；
将所述资源转移标识集合中的资源转移标识作为资源转移关系图中的节点，根据所述资源转移方向对所述资源转移标识对所对应的节点进行有向边连接，得到所述资源转移关系图；
在对所述资源转移关系图进行资源转移路径搜索的过程中，确定当前搜索到的当前资源转移路径中的当前搜索节点，将所述当前资源转移路径中指向所述当前搜索节点的节点作为参考节点，将所述资源转移关系图中所述当前搜索节点所指向的节点作为候选节点；
确定所述当前搜索节点与所述参考节点之间的第一资源转移时间，以及所述当前搜索节点与所述候选节点之间的第二资源转移时间；
当所述第一资源转移时间与所述第二资源转移时间满足时间差异条件时，将所述候选节点加入到所述当前资源转移路径中，以检测出目标资源转移路径；所述时间差异条件为目标资源从所述参考节点依次流向所述当前搜索节点以及所述候选节点的时间差异条件。
一种资源转移信息检测装置，所述装置包括：
标识集合获取模块，用于获取资源转移标识集合；所述资源转移标识集合包括多个资源转移标识；
转移方向确定模块，用于获取所述资源转移标识集合对应的资源转移标识对，确定所述资源转移标识对所对应的资源转移方向；每个所述资源转移标识对是所述资源转移标识 集合中存在资源转移关系的两个资源转移标识组成的；
关系图获取模块，用于将所述资源转移标识集合中的资源转移标识作为资源转移关系图中的节点，根据所述资源转移方向对所述资源转移标识对所对应的节点进行有向边连接，得到所述资源转移关系图；
节点确定模块，用于在对所述资源转移关系图进行资源转移路径搜索的过程中，确定当前搜索到的当前资源转移路径中的当前搜索节点，将所述当前资源转移路径中指向所述当前搜索节点的节点作为参考节点，将所述资源转移关系图中所述当前搜索节点所指向的节点作为候选节点；
时间确定模块，用于确定所述当前搜索节点与所述参考节点之间的第一资源转移时间，以及所述当前搜索节点与所述候选节点之间的第二资源转移时间；
节点添加模块，用于当所述第一资源转移时间与所述第二资源转移时间满足时间差异条件时，将所述候选节点加入到所述当前资源转移路径中，以检测出目标资源转移路径；所述时间差异条件为目标资源从所述参考节点依次流向所述当前搜索节点以及所述候选节点的时间差异条件。
一种计算机设备，包括存储器和处理器，存储器存储有计算机可读指令，计算机可读指令被处理器执行时，使得处理器执行本申请的资源转移信息检测方法。
一种非易失性的计算机可读存储介质，该计算机可读存储介质存储有计算机可读指令，该计算机可读指令被处理器执行时使该处理器执行本申请的资源转移信息检测方法。
一种计算机程序产品或计算机程序，该计算机程序产品或计算机程序包括计算机可读指令，该计算机可读指令存储在计算机可读存储介质中，计算机设备的处理器从计算机可读存储介质读取该计算机可读指令，处理器执行该计算机可读指令，使得该计算机设备执行本申请的资源转移信息检测方法。
附图说明
图1为一些实施例中资源转移信息检测方法的应用环境图；
图2为一些实施例中资源转移信息检测方法的流程示意图；
图3(a)为一些实施例中资源转移关系图的示意图；
图3(b)为一些实施例中对资源转移关系图进行资源转移路径搜索的示意图；
图3(c)为一些实施例中资源转移关系图的示意图；
图4为一些实施例中确定节点间的净转出资源和与净转出资源对应的时间的示意图；
图5为一些实施例中确定节点间的净转出资源和与净转出资源对应的时间的示意图；
图6(a)为一些实施例中确定节点间的净转出资源对应的时间早晚示意图；
图6(b)为一些实施例中确定节点间的净转出资源对应的时间早晚示意图；
图7为一些实施例中多个节点间的资源净转出单向图；
图8为一些实施例中资源转移信息检测方法的流程示意图；
图9为一些实施例中资源转移信息检测装置的结构框图；
图10为一些实施例中计算机设备的内部结构图。
具体实施方式
为了使本申请的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
在本申请中提及“实施例”意味着，结合实施例描述的特定特征、结构或特性可以包含在本申请的至少一些实施例中。在说明书中的各个位置出现该短语并不一定均是指相同的实施例，也不是与其它实施例互斥的独立的或备选的实施例。本领域技术人员显式地和隐式地理解的是，本申请所描述的实施例可以与其它实施例相结合。
本申请提供的资源转移信息检测方法，涉及具有资源转移关系的多个资源转移标识(以下可以简称为标识)，可以基于其中一个标识的资源来源，确定该标识对应的资源去向，进而确定对来源未受到认可的资源进行资源转移的资源转移标识形成转移路径，如转移资金来源未受认可的非法资金的多个账户形成的转移路径或者转移游戏装备来源未受认可的多个账户形成的转移路径。在一些场景中，游戏装备来源未受认可，可以理解为可能不是由游戏平台官方生成的，而是由玩家私自生成的未受到游戏平台认证的非法游戏装备。当资源是资金时，则转移路径可以是通过多个资源账户将非法的资金，通过一系列的转移操作，变成合法的资金的该多个资源账户形成的路径。
如图1所示，标识a和标识b之间可以基于服务器104进行资源转移，例如，如果标识a要向标识b转移资源，那么标识a可以先向服务器104发送欲转移的资源数量以及标识b的标识信息；服务器104接收到标识a发送的资源量和标识b的标识信息后，从标识a所拥有的资源中划分上述资源数量的资源给标识b，完成标识a向标识b的资源转移操作。服务器104中存储有各个资源转移标识之间的资源转移记录，当需要进行资源转移的恶意检测时，例如检测来源未受认证的较大数额的资源的转移路径时，可以获取资源转移记录，基于资源转移记录获取待进行恶意检测的资源转移标识集合，以执行本申请实施例提供的资源转移信息检测方法，得到目标资源转移路径，服务器104可以继续基于目标资源转移路径进一步确认该目标资源转移路径是否是恶意的资源转移路径，例如基于目标资源转移路径中的资源转移行为等信息以及预先训练得到的资源转移路径检测模型预测该路径是来源未受认证的资源的转移路径的概率。服务器还可以向终端102发送检测得到的目标资源转移路径，以使得终端102对应的用户可以基于目标资源转移路径进行人工确认。
标识包括但不限于是个人标识、商家标识和银行卡标识等，标识a和标识b可以是被同一用户拥有，也即，同一用户可以拥有多个标识，例如Alice同时拥有多个个人标识，又例如Alice同时拥有个人标识和商家标识等。用户可以通过终端进行资源转移操作，终端可以是个人计算机、笔记本电脑、智能手机、平板电脑和便携式可穿戴设备；服务器可以用独立的服务器或者是多个服务器组成的服务器集群来实现。
在一些实施例中，如图2所示，提供了一种资源转移信息检测方法，以该方法应用于图1中的服务器为例进行说明，包括以下步骤：
步骤S202，获取资源转移标识集合。
其中，资源转移标识表征资源转移的资源转移参与方，资源转移参与方包括资源转入方与资源转出方，资源转移标识可以包括资源账户、用户标识、商户标识等等，资源账户可以是银行卡账户、第三方支付平台账户等等，用户标识可以是个人用于资源转移的账户，商户标识可以是商户用于资源转移的标识，第三方支付平台账户可以是用于通过第三方支付平台进行资源转移的标识，该标识可以是社交账号。资源转移标识集合包括多个资源转移标识，资源转移标识集合所包括的标识的种类可以为至少一种，也即资源转移标识集合所包括的标识的种类为个人标识、商家标识和银行卡标识中的至少一种。同一个用户可以拥有多个标识，该多个标识的种类可以相同或不同。
来源未受认证的资源的转移，可能是一种恶意或非法的资源转移，本申请通过获取资源转移标识集合，基于该资源转移标识集合以及资源转移标识之间的资源转移关系，从该资源转移标识集合中检测出对来源未受认证的资源进行转移的标识构成的路径，即包括若干个标识的目标资源转移路径。例如，来源未受认证的资源如非法资金等，检测例如可以是对涉嫌洗钱的资金账户路径进行检测，得到由多个标识依次指向形成的路径，该多个标识即为一个恶意团伙。
具体地，服务器可以获取到多个资源转移标识，该多个资源转移标识形成资源转移标识集合。在一个实施例中，服务器可以获取支付平台上过去一段时间内(如过去t小时、过去t天等)发生的资源转移操作对应的资源转移记录，每条资源转移记录包括资源转入方、资源转出方、资源转移量和资源转移时间等信息，服务器可以根据过去一段时间内发生的资源转移记录中的资源转入方与资源转出方，获得资源转移标识集合。在另一些实施例中，服务器也可以获取过去预设时间段内发生的资源转移操作对应的资源转移记录，例如，预设时间段是2021年2月1号至2021年7月10号。
步骤S204，获取资源转移标识集合对应的资源转移标识对，确定资源转移标识对所对应的资源转移方向。
其中，每个资源转移标识对是资源转移标识集合中存在资源转移关系的两个资源转移标识组成的，该资源转移关系可以包括资源转出关系、资源转入关系。例如，标识a与标识b之间存在资源转移记录，该资源转移记录表示从标识a转出资源到标识b，或从标识a向标识b转入资源，则确定标识a和标识b之间存在资源转移关系，标识a和标识b可以组成一对资源标识对。
资源转移方向是指组成资源转移标识对的两个标识之间资源转移的流向，资源转移方向可以是资源净转移方向，该资源净转移方向可以采用资源净转出方向，也可以采用资源净转入方向。例如，标识a转给标识b的资源总额为3万，标识b转给标识a的资源总额为2万，若资源净转移方向采用资源净转出方向，则标识a转出到标识b的资源净转出 量为1万，标识b转出到标识a的资源净转出量为-1万。若资源净转移方向采用资源净转入方向，则从标识b向标识a转入的资源净转入量为-1万，从标识a向标识b转入的资源净转入量为1万。
当资源转移标识对的两个标识之间发生多笔资源转移时，该两个标识之间的资源净转移量是根据发生于该两个标识之间的多次资源转移的资源转移量确定的。例如，标识a向标识b转过5笔资源且资源量共计3万，标识b向标识a转过2笔资源且资源量共计2万。若资源净转移方向采用资源净转出方向，那么根据发生于标识a和标识b之间的这7笔资源转移，可以确定从标识a到标识b的资源净转出量为1万，从标识b到标识a的资源净转出量为-1万。若资源净转移方向采用资源净转入方向，则根据发生于标识a和标识b之间的这7笔资源转移，可以确定标识a来自标识b的资源净转入量为-1万，标识b来自标识a的资源净转入量为1万。
具体地，服务器采用资源净转出方向或资源净转入方向作为资源转移方向，在获取资源转移标识集合之后，根据资源转移记录确定存在资源转移关系的资源转移标识对(每个资源转移标识对包括第一标识与第二标识)，根据资源转移标识对之间资源转入或资源转出的资源转移量，确定资源转移标识对对于上述资源转移方向的资源净转移量。
在一个实施例中，服务器获取资源转移标识集合之后，根据资源转移记录确定存在资源转移关系的资源转移标识对，根据资源转移标识对之间的资源转出量，确定资源转移标识对的资源净转出量，根据资源净转出量与零的大小关系，确定资源转移标识对之间的资源净转出方向，即确定资源净转出方向是由第一标识指向第二标识或由第二标识指向第一标识。
在一个实施例中，服务器获取资源转移标识集合之后，根据资源转移记录确定存在资源转移关系的资源转移标识对，根据资源转移标识对之间的资源转入量，确定资源转移标识对的资源净转入量，根据资源净转入量与零的大小关系，确定资源转移标识对之间的资源净转入方向，即确定资源净转入方向是由第一标识指向第二标识或由第二标识指向第一标识。
以资源净转移方向为资源净转出方向、资源转移量为资源净转出量为例进行说明。
例如，如图4所示，服务器采用资源净转出方向作为资源转移方向，服务器获取由标识a至标识k构成的资源转移标识集合后，根据资源转移记录确定标识b和标识d之间存在5笔资源转移，这5笔资源转移分别是：标识b转给标识d的资源量为m v1、标识b转给标识d的资源量为m v2、标识d转给标识b的资源量为m v3、标识b转给标识d的资源量为m v4、以及标识d转给标识b的资源量为m v5，将标识b和标识d之间的资源净转出量记为M(b,d)，服务器将这5笔资源转移的资源量(均大于0)的抵消相加，可以确定标识b和标识d之间的资源净转出量M(b,d)为m v1+m v2-m v3+m v4-m v5，进一步若服务器确定M(b,d)的值大于0，则资源转移方向是从标识b指向标识d，若M(b,d)小于0，则资源转移方向是从标识d指向标识b，若M(b,d)等于0，则可以认为双方之间资源净转出量为 0。图4中，以M(b,d)大于0为例，显示资源转移方向是从标识b指向标识d。
同样地，如图5所示，根据资源转移记录确定标识d和标识f之间存在3笔资源转移，这3笔资源转移分别是：标识d转给标识f的资源量为m v6、标识f转给标识d的资源量为m v7、标识d转给标识f的资源量为m v8，将标识d和标识f之间的资源净转出量记为M(d,f)，服务器将这3笔资源转移的资源量(均大于0)的抵消相加，可以确定标识d和标识f之间的资源净转出量M(d,f)为m v6-m v7+m v8。进一步服务器确定M(d,f)的值大于0，则服务器可以确定标识d和f之间的资源转移方向是从标识d指向标识f，若M(d,f)小于0，则资源转移方向是从标识f指向标识d，若M(d,f)等于0，则可以认为双方之间资源净转出量为0。图4中，以M(d,f)大于0为例，显示资源转移方向是从标识d指向标识f。
步骤S206，将资源转移标识集合中的资源转移标识作为资源转移关系图中的节点，根据资源转移方向对资源转移标识对所对应的节点进行有向边连接，得到资源转移关系图。
其中，有向边是单向边，对应形成的资源转移关系图可以称为资源净转移单向图。在资源净转移方向为资源净转出方向、资源转移量为资源净转出量的情况下，资源净转移单向图为资源净转出单向图；在资源净转移方向为资源净转入方向、资源转移量为资源净转入量的情况下，资源净转移单向图为资源净转入单向图。在资源转移关系图采用资源净转出单向图的情况下，标识a指向标识b的有向边，表示从标识a转出了大于0的净转出资源量到标识b，在资源转移关系图采用资源净转入单向图的情况下，标识a指向标识b的有向边，表示从标识b转出了大于0的净转入资源量到标识a。
本步骤中，服务器确定资源转移标识集合中存在资源转移关系的两个标识之间的资源转移方向后，可以以每个标识为节点，根据资源转移方向对节点进行单向边连接，例如，标识b和标识d之间的资源转移方向是从标识b指向标识d，那么可以用指向方向为标识b指向标识d的单向边连接这两个标识，同样地，针对其他存在资源转移关系的两个标识，也可以按照上述方式进行单向边连接，得到图3(a)所示的资源转移关系图。
后续的实施例将以资源转移关系图为资源净转出单向图为例进行说明。可以理解的是，资源净转出单向图中的从节点a指向节点b的单向边，反应了资源从节点a流出、且流向了节点b。
步骤S208，在对资源转移关系图进行资源转移路径搜索的过程中，确定当前搜索到的当前资源转移路径中的当前搜索节点，将当前资源转移路径中指向当前搜索节点的节点作为参考节点，将资源转移关系图中当前搜索节点所指向的节点作为候选节点。
具体地，服务器可以通过对资源转移关系图进行路径搜索，也即图遍历，图的遍历是指从图中的某一节点出发，按照某种搜索方式沿着图中的边对图中的所有节点访问一次且仅访问一次。遍历图的方式分为两种：广度优先搜索和深度优先搜索，广度优先搜索即路径广度优先于路径深度的搜索，深度优先搜索即路径深度优先于路径广度的搜索。本申请实施例中，该资源转移路径搜索可以采用路径深度优先于路径广度的搜索方式。
结合图3(a)介绍路径深度优先于路径广度的搜索：
深度优先搜索，即在路径深度优先于路径广度的搜索中，参照图3(a)，在图3(a)所示的图结构中，从某个节点出发，若当前搜索到的节点是节点f，该节点f所指向的标识包括节点c和节点h，从节点c和节点中选择一个节点作为搜索到的节点；若所选择的节点是节点c，那么从节点c所指向的节点中确定一个节点作为搜索到的节点，也即搜索到节点j；再接着，从节点j所指向的节点中确定一个节点作为搜索到的节点，也即搜索到节点k；此种搜索方式中，当前搜索到的节点f指向节点c，且节点c有指向的节点j，则继续确定该节点j指向的节点k，直至达到路径深度搜索的结束条件，可以看出，依次从节点f的未被访问的邻接节点出发，对图进行深度优先遍历，直至图中和节点f有路径相通的顶点都被访问，在达到该结束条件之前，搜索到的节点所处的层级深度呈现递增趋势，该路径搜索可以称为路径深度优先于路径广度的搜索。
结合图3(a)介绍路径广度优先于路径深度的搜索：
广度优先搜索，即在路径广度优先于路径深度的搜索中，参照图3(a)，在图3(a)所示的图结构中，从某个节点出发，若当前搜索到的节点是节点f，该节点f所指向的节点包括节点c和节点h，从节点c和h中选择一个节点作为搜索到的节点；若所选择的节点是节点c，那么从节点c所指向的节点中确定一个节点作为搜索到的节点，也即搜索到节点j；再接着，将节点f指向的另一个节点h作为搜索到的节点，并从节点h所指向的节点中确定一个节点作为搜索到的节点，也即搜索到节点g；此种搜索方式中，先确定同一层级的所有节点所指向的节点后，再进入下一层级，并确定下一层级的所有节点所指向的节点，以路径广度为主，该路径搜索称为路径广度优先于路径深度的搜索，可见广度优先搜索是一种分层的查找过程。
其中，当前资源转移路径是从资源转移关系图中后基于路径搜索方式，搜索到的通过单向边连接的节点形成的路径，是当前正在搜索的资源转移路径。当前搜索到的节点可以称为当前搜索节点。参考节点是当前资源转移路径中，指向当前搜索节点的节点；候选节点是资源转移关系图中，当前搜索节点所指向的节点。
示例性地，服务器获取到图3(a)所示的资源转移关系图后，可以按照路径深度优先方式，对资源转移关系图进行资源转移路径搜索。如图3(b)所示，若当前搜索到的资源转移路径是a->b->d，则当前搜索节点是节点d，那么可以将当前资源转移路径a->b->d上指向当前搜索节点d的节点b作为参考节点，并将该资源转移关系图中当前搜索节点d所指向的节点f作为候选节点，以通过后续的步骤确定该节点f是否可以添加至当前资源转移路径中。
步骤S210，确定当前搜索节点与参考节点之间的第一资源转移时间，以及当前搜索节点与候选节点之间的第二资源转移时间。
其中，第一资源转移时间是综合当前搜索节点和参考节点之间的多笔资源转移的发生时间确定的，用于表征在当前搜索节点和参考节点之间的资源净转移量对应的转移时 间。第二资源转移时间是综合当前搜索节点和候选节点之间的多笔资源转移的发生时间确定的，用于表征与当前搜索节点和候选节点之间的资源净转移量对应的转移时间。
以确定第一资源转移时间为例介绍一些可能的实施方式：
第一资源转移时间，可以是当前搜索节点和参考节点之间的多笔资源转移的发生时间的平均值。发生时间可以是按资源转移时间依次增大的时间戳。如图4所示，若当前搜索节点是标识d，参考节点是标识b，在标识b和标识d之间存在5笔资源转移，这5笔资源转移分别是：在t v1时刻下标识b转给标识d的资源量为m v1、在t v2时刻下标识b转给标识d的资源量为m v2、在t v3时刻下标识d转给标识b的资源量为m v3、在t v4时刻下标识b转给标识d的资源量为m v4、以及在t v5时刻下标识d转给标识b的资源量为m v5，服务器可以将t v1、t v2、t v3、t v4和t v5的平均值作为第一资源转移时间，该第一资源转移之间可以记为T(b,d)。
同样地，可以按照上述方式确定第二资源转移时间，这里不赘述。
步骤S212，当第一资源转移时间与第二资源转移时间满足时间差异条件时，将候选节点加入到当前资源转移路径中，以检测出目标资源转移路径。
其中，两个资源转移时间之间的差异，可以通过两个资源转移时间的差值表征，也可以通过两个资源转移时间的比值表征。时间差异条件为目标资源从参考节点依次流向当前搜索节点以及候选节点的时间差异条件；该目标资源可以是来源未受认证的资源。第一资源转移时间与第二资源转移时间的时间差异越大，表征在当前搜索节点和参考节点之间的资源转移，与当前搜索节点和候选节点之间的资源转移的时间先后顺序越明显，目标资源在时间先后顺序上更可能是从参考节点依次流向当前搜索节点和候选节点，也即参考节点可能是当前搜索节点的目标资源来源节点，候选节点可能是当前搜索节点的目标资源去向节点。可以理解，目标资源转移路径可以有多条，目标资源转移路径是基于当前资源转移路径不断地对资源转移关系图进行搜索，在搜索结束时最终得到的路径。目标资源转移路径是被识别出的可能存在恶意资源转移的路径。通过执行本申请实施例的方法，可以从资源转移关系图中得到一条或者多条目标资源转移路径。
示例性地，参照图3(b)，若当前资源转移路径为a->b->d，当前搜索节点为节点d、参考节点为节点b和候选节点为节点f，服务器在获取当前搜索节点和参考节点之间的第一资源转移时间T(b,d)，以及当前搜索节点和候选节点之间的第二资源转移时间T(d,f)后，若第一资源转移时间T(b,d)早于第二资源转移时间T(d,f)，则可以确定第一资源转移时间和第二资源转移时间满足时间差异条件，并将节点f加入到当前资源转移路径a->b->d上，更新当前资源转移路径为a->b->d->f；接着，服务器可以以当前资源转移路径为a->b->d->f，将节点f作为当前搜索节点，并将节点d作为当前搜索节点f的参考节点以及将该资源转移关系图中当前搜索节点f指向的节点c或节点h作为候选节点，执行步骤S210至步骤S212，确定是否将节点f指向的节点c或h加入当前资源转移路径a->b->d->f中，更新当前资源转移路径为a->b->d->f->c或a->b->d->f->h；其中，上述的路径深度优先的搜索可 以持续进行，当满足以下任一项终止条件时，可以停止该条路径的深度优先搜索：
①当前搜索得到的资源转移路径的长度达到预设的最大长度；
②当前搜索节点的出度等于0，即当前搜索节点不存在相应的候选节点；
③当前搜索节点所指向的候选节点中，不存在满足可添加至当前资源转移路径的条件的节点。
上述资源转移信息检测方法中，基于资源转移标识间的资源转移关系与资源转移方向构建资源转移关系图，该资源转移关系图能够准确反映资源转移标识之间的资源转移情况，有利于从海量的资源转移中准确识别出来源未受认证的资源的转移路径，提升路径识别效率；另外，在对资源转移关系图中进行资源转移路径搜索的过程中，在当前搜索节点与参考节点之间的第一资源转移时间和当前搜索节点与候选节点之间的第二资源转移时间之间满足时间差异条件的情况下，将候选节点添加至当前资源转移路径中，表明目标资源是按照时间先后顺序，从参考节点依次流向当前节点和候选节点的，能准确反应目标资源的流向关系，依照这样的方式，依次添加节点，从而准确识别出目标资源的目标资源转移路径，提升了路径识别准确率。
在一些实施例中，进行资源转移路径搜索的过程中，可以确定资源转移关系图中每个节点的出度，出度即为从该节点出发指向其它节点的边的数量，服务器可以将出度大于0的节点，作为路径搜索的起始节点。
在一些实施例中，服务器从起始节点出发进行路径搜索得到一条目标资源转移路径后，可以确定该目标资源转移路径包括的节点，若该目标资源转移路径中某个节点存在多个指向该节点的节点，即某个节点存在多条入边，则将目标资源转移路径中从该节点出发的子路径，记为该节点的属性，以便于下次搜索到该节点时，可以直接获取该子路径，得到包括该子路径的另一目标资源转移路径，从而节省搜索时间、提高搜索效率。例如，参照图3(b)，从节点a出发，搜索到目标资源转移路径a>b->d->f->c->j->k，其中指向节点f的节点包括两个：节点d和节点i，服务器便记录从节点f出发的子路径f->c->j->k，在下次从节点e出发进行路径搜索，搜索到候选节点f，即当前资源转移路径为e->i时，可以直接获取候选节点f对应的子路径f->c->j->k，将该子路径拼接到当前资源转移路径的后面，得到另一目标资源转移路径e->i->f->c->j->k，无需往下遍历，直接读取候选节点的属性拼接相应的子路径即可，提高路径搜索效率。
在一些实施例中，当第一资源转移时间与第二资源转移时间满足时间差异条件时，则将候选节点加入到当前资源转移路径中，包括：当第一资源转移时间与第二资源转移时间满足时间差异条件时，获取候选节点对应的路径属性标识；基于路径属性标识获取从候选节点出发的子路径，将子路径拼接至当前资源转移路径中，以得到目标资源转移路径。
在一些实施例中，服务器从起始节点出发进行路径搜索的过程中，每添加一个节点到当前资源转移路径中，会记录下该节点，也就是记录当前该资源转移路径所包括的节点(标识)，若当前搜索节点已存在于当前资源转移路径中，则说明当前搜索节点已经被访问过， 此时遇到了节点形成的节点环，那么服务器将会退出访问，以当前资源转移路径作为本次搜索得到的目标资源转移路径，并开始下一次路径搜索。参照图3(c)，图3(c)中的节点y3、y5和y4形成了一个节点环。当访问得到当前资源转移路径为y1->y2->y3->y5->y4时，节点y4为当前搜索节点，其对应的候选节点为节点y3，由于候选节点y3已经存在于当前资源转移路径中，则退出访问，得到目标资源转移路径为y1->y2->y3->y5->y4。类似地，当访问得到当前资源转移路径为y1->y2->y5->y4->y3时，节点y3为当前搜索节点，其对应的候选节点为节点y5，由于候选节点y5已经存在与当前资源转移路径中，则退出访问，得到目标资源转移路径为y1->y2->y5->y4->y3。通过这样的方式，可以避免无限循环访问节点，浪费计算资源。
在一些实施例中，还可以通过如下方式确定当前搜索节点与参考节点之间的第一资源转移时间：获取当前搜索节点与参考节点之间的资源转移记录集合；获取各个资源转移记录中的资源转移时间以及资源转移数值；基于资源转移数值确定资源转移时间对应的时间权重；时间权重与资源转移数值成正相关关系；基于资源转移时间对应的时间权重对资源转移记录集合中的资源转移时间进行加权计算，得到当前搜索节点与参考节点之间的第一资源转移时间。
其中，资源转移记录集合包括多个资源转移记录；各个资源转移记录对应当前搜索节点和参考节点之间的各笔资源转移，各个资源转移记录可以包括各笔资源转移的资源转移数值和资源转移时间；其中，各笔资源转移的资源转移数值是指资源转移量；各笔资源转移对应的资源转移时间是指各笔资源转移的发生时间，如标识b和d之间的各笔资源转移的发生时间t v1、t v2、t v3、t v4和t v5。
为各笔资源转移的发生时间赋予的权重，与各笔资源转移对应的资源转移量成正相关关系，例如，针对标识b和标识d之间的各笔资源转移的发生时间t v1、t v2、t v3、t v4和t v5，若各笔资源转移对应的资源转移量从大到小的排序是：m v1、m v4、m v3、m v2、m v5，那么基于上述正相关关系，为各笔资源转移的发生时间t v1、t v2、t v3、t v4和t v5赋予的权重从大到小的排序是w v1、w v4、w v3、w v2、w v5。
具体地，服务器在得到各笔资源转移的发生时间对应的权重后，可以对各笔资源转移的发生时间进行加权计算，也即w v1×t v1+w v2×t v2+w v3×t v3+w v4×t v4+w v5×t v5，将加权计算得到的结果作为当前搜索节点与参考节点之间的第一资源转移时间。
上述方式中，基于各笔资源转移的资源转移数值与各资源转移的发生时间之间的正相关关系，确定为各笔资源转移的发生时间赋予的权重并进行加权计算，使得第一资源转移时间更侧重于反映当前搜索节点和参考节点之间的多笔资源转移中的较大额资源转移的发生时间，提升目标资源转移路径的搜索准确性。
在一些实施例中，基于资源转移数值确定资源转移时间对应的时间权重，包括：对资源转移记录集合中的资源转移数值求和计算，得到资源转移统计值；计算资源转移数值在资源转移统计值中的占比，将占比作为资源转移时间对应的时间权重。
资源统计值是指当前搜索节点和参考节点之间各笔资源转移对应的资源转移量的和值，也可以称为资源转移总量。
仍以当前搜索节点为d和参考节点为b介绍上述实施例：如图4所示，标识b和标识d之间的各笔资源转移对应的资源转移量是m v1、m v2、m v3、m v4、m v5，服务器可以将m v1+m v2+m v3+m v4+m v5作为资源统计值。接着，服务器可以计算各笔资源转移对应的资源转移量在资源统计值中的占比：
m v1/(m v1+m v2+m v3+m v4+m v5)、m v2/(m v1+m v2+m v3+m v4+m v5)
m v3/(m v1+m v2+m v3+m v4+m v5)、m v4/(m v1+m v2+m v3+m v4+m v5)
m v5/(m v1+m v2+m v3+m v4+m v5)；并将这些占比依次作为赋予给t v1、t v2、t v3、t v4和t v5的权重w v1、w v2、w v3、w v4、w v5。
上述方式中，将各笔资源转移的资源转移量在资源转移总量中的占比作为赋予给各笔资源转移的发生时间的权重，使得第一资源转移时间更大程度反映的是当前搜索节点和参考节点之间的多笔资源转移中的较大额资源转移的发生时间，进一步提升目标资源转移路径的搜索准确性。
需要说明的是，上述参考节点与当前搜索节点之间的第一资源转移时间的确定方式，可以适用于当前搜索节点和候选节点之间的第二资源转移时间的。
在一些实施例中，第一资源转移时间为参考节点指向当前搜索节点的第一末次资源转移时间，第二资源转移时间为当前搜索节点指向候选节点的第二首次资源转移时间，上述确定第一资源转移时间与第二资源转移时间满足时间差异条件的步骤，包括：确定第一资源转移时间与第二资源转移时间之间的时间顺序；当时间顺序指示第一资源转移时间早于第二资源转移时间时，确定第一资源转移时间与第二资源转移时间满足时间差异条件；当时间顺序指示第一资源转移时间晚于第二资源转移时间时，若第一资源转移时间与第二资源转移时间之间的差异小于预设时间阈值，则确定第一资源转移时间与第二资源转移时间满足时间差异条件。
第一资源转移时间是参考节点指向当前搜索节点的第一末次资源转移时间，例如，若当前搜索节点为d和参考节点为b，如图4所示，节点b和节点d之间发生5笔资源转移，且这5笔资源转移中由节点b转给节点d的资源转移有2笔，这2笔中的最后一笔资源转移的发生时间为t v4，此时，可以将t v4作为第一资源转移时间。
第二资源转移时间为当前搜索节点指向候选节点的第二首次资源转移时间，例如，若当前搜索节点为d和候选节点为f，如图5所示，节点d和节点f之间发生3笔资源转移，且这3笔资源转移中由节点d转给节点f的资源转移有2笔，这2笔中的首次资源转移的发生时间为t v6，此时，可以将t v6作为第二资源转移时间。
时间顺序用于表征第一资源转移时间和第二资源转移时间的早晚顺序。第一资源转移时间早于第二资源转移时间情况下，服务器就可以确定第一资源转移时间与第二资源转移时间满足时间差异条件。第一资源转移时间晚于第二资源转移时间情况下，若第一资源转 移时间与第二资源转移时间之间的差异小于预设时间阈值，即第一资源转移时间与第二资源转移时间之差的绝对值小于预设时间阈值的情况下，服务器就可以确定第一资源转移时间与第二资源转移时间满足时间差异条件。
上述方式中，将从参考节点转给当前搜索节点的多笔资源转移中的最后一笔资源转移的发生时间作为第一资源转移时间，将从当前搜索节点转给候选节点的多笔资源转移中的首笔资源转移的发生时间作为第二资源转移时间，该两个资源转移时间之间的时间差异表征参考节点和当前搜索节点之间的多笔资源转移的发生时间与当前搜索节点和候选节点之间的多笔资源转移的发生时间是否存在交叠，若不存在交叠，则确定参考节点和当前搜索节点之间的资源净转移与当前搜索节点和候选节点之间的资源净转移存在明显的先后顺序，从参考节点到当前搜索节点再到候选节点进行的连续资源转移所转移的资源是非法资源的可能性越大，从而提升来源未受认证的资源的转移路径的识别准确率。
在一些实施例中，上述确定第一资源转移时间与第二资源转移时间满足时间差异条件的步骤，包括：确定第一资源转移时间与第二资源转移时间之间的时间顺序；当时间顺序指示第一资源转移时间晚于第二资源转移时间时，获取第一资源转移时间与第二资源转移时间之间的第一时间差值；获取参考节点指向当前搜索节点之间的第一首次资源转移时间，以及获取当前搜索节点指向候选节点的第二末次资源转移时间；获取第二末次资源转移时间与第一首次资源转移时间之间的第二时间差值；计算第一时间差值与第二时间差值之间的时间比例，当时间比例小于或者等于预设比例阈值时，确定第一资源转移时间与第二资源转移时间满足时间差异条件。
第一首次资源转移时间是由参考节点转给当前搜索节点的多笔资源转移中的首笔资源转移的发生时间，第二末次资源转移时间是由当前搜索节点转给候选节点的多笔资源转移中的最后一笔资源转移的发生时间。
结合图4、图5，以参考节点b、当前搜索节点为d和候选节点为f为例介绍上述步骤：参照图6(a)，为参考节点转给当前搜索节点的多笔资源转移的发生时间、当前搜索节点转给候选节点的多笔资源转移的发生时间的早晚顺序示意图，其中，参考节点b转给当前搜索节点d的多笔资源转移的发生时间包括tv1、tv4，当前搜索节点d转给候选节点f的多笔资源转移的发生时间包括tv6、tv8，其先后顺序为tv1、tv6、tv4、tv8，如图6(a)所示。
参照图6(a)，以及对前文第一资源转移时间、第一首次资源转移时间的定义，可以明确各符号的含义：第一资源转移时间为从参考节点b转给当前搜索节点d的多笔实际资源转移中的最后一笔资源转移的发生时间即t v4，第一首次资源转移时间是由参考节点b转给当前搜索节点d的多笔资源转移中的首笔资源转移的发生时间即t v1，第二资源转移时间为从当前搜索节点d转给候选节点f的多笔资源转移中的首笔资源转移的发生时间即t v6，第二末次资源转移时间是由当前搜索节点d转给候选节点f的多笔资源转移中的最后一笔资源转移的发生时间即t v8；参照图6(a)，是第一资源转移时间晚于第二资源转移时 间即t v4>t v6的情况。倘若是第一资源转移时间晚于第二资源转移时间，服务器可以将t v4-t v6作为第一时间差值；类似地，服务器可以将t v8-t v1作为第二时间差值，得到第一时间差值和第二时间差值的时间比例(t v4-t v6)/(t v8-t v1)。
如图6(a)所示，时间比例(t v4-t v6)/(t v8-t v1)越大，表征：参考节点b转给当前搜索节点d的多笔资源转移的发生时段(即t v1至t v4)与当前搜索节点d转给候选节点f的多笔资源转移的发生时段(即t v6至t v8)之间的交叠时段(即t v6至t v4)，在总发生时段(即t v1至t v8)中的占比越大，也表征：参考节点b向当前搜索节点d的资源净转移和当前搜索节点d向候选节点f的资源净转移的时间先后顺序的明显度越低。时间比例(t v4-t v6)/(t v8-t v1)越小，表征：参考节点转给当前搜索节点的多笔资源转移的发生时段(即t v1至t v4)与当前搜索节点f转给候选节点的多笔资源转移的发生时段(即t v6至t v8)之间的交叠时段(即t v6至t v4)，在总发生时段(即t v1至t v8)中的占比越小，也表征：参考节点b向当前搜索节点d的资源净转移和当前搜索节点d向候选节点f的资源净转移的时间先后顺序的明显度越高。若预设比例阈值是0.5，则当时间比例(t v4-t v6)/(t v8-t v1)小于或等于0.5时，服务器则可以确定第一资源转移时间与第二资源转移时间满足时间差异条件，并将候选节点f添加至当前资源转移路径a->b->d中。
上述方式中，在参考节点向当前搜索节点的多笔资源转移中的末次资源转移的发生时间晚于当前搜索节点向候选节点的多笔资源转移中的首次资源转移的发生时间的情况下，基于交叠时段在总发生时段中的占比的大小，确定节点对之间的资源净转移的时间先后顺序的明显度高低，作为添加候选节点到目标资源路径需要满足条件，提高了目标资源路径搜索的识别准确率。
在一些实施例中，上述确定第一资源转移时间与第二资源转移时间满足时间差异条件的步骤，包括：确定第一资源转移时间与第二资源转移时间之间的时间顺序；当时间顺序指示第一资源转移时间早于第二资源转移时间时，直接确定第一资源转移时间与第二资源转移时间之间满足时间差异条件。
结合图4、图5，以参考节点b、当前搜索节点为d和候选节点为f为例介绍上述步骤：参照图6(b)，为参考节点转给当前搜索节点的多笔资源转移的发生时间、当前搜索节点转给候选节点的多笔资源转移的发生时间的早晚顺序示意图，其中，参考节点b转给当前搜索节点d的多笔资源转移的发生时间包括tv1、tv4，当前搜索节点d转给候选节点f的多笔资源转移的发生时间包括tv6、tv8，其先后顺序为tv1、tv4、tv6、tv8，如图6(b)所示。
参照图6(b)，以及对前文第一资源转移时间、第一首次资源转移时间的定义，可以明确各符号的含义：第一资源转移时间为从参考节点b转给当前搜索节点d的多笔实际资源转移中的最后一笔资源转移的发生时间即t v4，第一首次资源转移时间是由参考节点b转给当前搜索节点d的多笔资源转移中的首笔资源转移的发生时间即t v1，第二资源转移时间为从当前搜索节点d转给候选节点f的多笔资源转移中的首笔资源转移的发生时间即 t v6，第二末次资源转移时间是由当前搜索节点d转给候选节点f的多笔资源转移中的最后一笔资源转移的发生时间即t v8；参照图6(b)，是第一资源转移时间早于第二资源转移时间即t v4＜t v6的情况。
当t v4<t v6时，表征，参考节点b转给当前搜索节点d的多笔资源转移的发生时段(即tv1至tv4)与当前搜索节点d转给候选节点f的多笔资源转移的发生时段(即tv6至tv8)之间不存在交叠时段，也表征：参考节点b向当前搜索节点d的资源净转移和当前搜索节点d向候选节点f的资源净转移的时间先后顺序的明显度越高，可以确定第一资源转移时间与第二资源转移时间满足时间差异条件，并将候选节点f添加至当前资源转移路径a->b->d中。
上述方式中，在参考节点向当前搜索节点的多笔资源转移中的末次资源转移的发生时间早于当前搜索节点向候选节点的多笔资源转移中的首次资源转移的发生时间的情况下，则确定节点对之间的资源净转移的时间先后顺序的明显度高，提高来源未受认证的资源的转移路径搜索的识别准确率。
在一些实施例中，当第一资源转移时间与第二资源转移时间满足时间差异条件时，则将候选节点加入到当前资源转移路径中，以得到目标资源转移路径，包括：获取参考节点向当前搜索节点转移的第一转移资源量，以及当前搜索节点向候选节点转移的第二转移资源量；当第一资源转移时间与第二资源转移时间满足时间差异条件，且确定第一转移资源量与第二转移资源量之间的资源差异量小于预设差异量时，将候选节点加入到当前资源转移路径中，以得到目标资源转移路径。
其中，第一转移资源量是指参考节点转给当前搜索节点的资源转移量，第一转移资源量是指当前搜索节点转给候选节点的资源转移量。第一转移资源量和第二转移资源量之间的资源差异量可以反映第一转移资源量与第二转移资源量的相对大小。
以参考节点为b、当前搜索节点为d和候选节点为f介绍上述步骤：第一转移资源量为M(b,d)，第二转移资源量为M(d,f)，在利用其它实施例介绍的任一方法确定第一资源转移时间与第二资源转移时间满足时间差异条件时，如果M(b,d)和M(d,f)的资源差异量小于预设差异量，即M(b,d)和M(d,f)的大小相近，服务器就可以将候选节点f添加至当前资源转移路径a->b->d中，得到新的当前资源转移路径a->b->d->f。
上述方式中，结合资源转移时间差异以及资源差异量的大小，判断是否将候选节点添加至当前资源转移路径中，保证候选节点是当前搜索节点的资源去向节点，从而提升目标资源转移路径搜索的识别准确率。
在一些实施例中，确定第一转移资源量与第二转移资源量之间的资源差异量，包括：计算第一转移资源量与第二转移资源量之间的资源量比例；将资源量比例作为资源差异量。进一步地，当服务器确定资源量比例处于预设比例范围内，如大于第一阈值且小于第二阈值时，确定第一转移资源量与第二转移资源量之间的资源差异量小于预设差异量。
其中，第一阈值和第二阈值是用于衡量第一转移资源量和第二转移资源量的大小是否 相近的，第一阈值和第二阈值可以是与1邻近的数值，例如第一阈值为1.1以及第二阈值为1.3；第一阈值可以是小于1且与1邻近的数值，例如0.8，第二阈值可以是大于1且与1邻近的数值，例如1.1。
以参考节点为b、当前搜索节点为d和候选节点为f，以及第一阈值为0.8和第二阈值为1.1介绍上述步骤：第一转移资源量为M(b,d)，第二转移资源量为M(d,f)，在利用其它实施例介绍的任一方法确定第一资源转移时间与第二资源转移时间满足时间差异条件时，如果资源量比例M(b,d)/M(d,f)大于0.8且小于1.1，则认为M(b,d)和M(d,f)的大小相近，可以将候选节点f添加至当前资源转移路径a->b->d中，得到新的当前资源转移路径a->b->d->f。
上述方式中，将资源量比例作为两个资源转移量的大小相近程度，从而在大小相近时将候选节点添加至当前资源转移路径中，保证候选节点是当前搜索节点的资源去向节点，提升目标资源转移路径搜索的识别准确率。
在一些实施例中，确定当前搜索到的当前资源转移路径中的当前搜索节点，包括：在资源转移关系图所包括的节点中，确定起始节点；若从起始节点至起始节点所指向的节点的资源转移量大于或等于资源转移量阈值，则基于起始节点和起始节点所指向的节点形成当前资源转移路径，并将起始节点所指向的节点作为当前搜索节点。
其中，资源转移关系图中的起始节点应当满足以下条件的至少一个：
(1)节点的出度大于0且节点的入度小于或等于预设阈值，预设阈值如0，入度即为指向该节点的边的数量如图3(a)中，节点a和节点e的入度均为0，满足该条件，可以作为起始节点。
(2)节点的转入资源总量与节点的转出资源总量的比值小于预设比值；转入资源总量是指向该节点的全部节点转给该节点的资源总量；转出资源总量是该节点转给该节点所指向的全部节点的资源总量；转入资源总量与转出资源总量的比值小于预设比值，表征：该节点的资源转入总量和该节点的资源转出总量的大小不相近且资源转入总量小于资源转出总量，也即该节点的资源转入总量远小于资源净转出总量，可以将该节点作为起始节点。如图7所示，在确定节点o的资源转入总量是否远小于该节点的资源转出总量时，由于指向该节点o的全部节点为q、n、r和m，因此可以将节点q、n、r和m各自转给节点o的资源量的和值作为节点o的资源转入总量，即为M(q,o)+M(n,o)+M(r,o)+M(m,o)；由于该节点o指向的全部节点为p和s，因此可以将节点o转给节点p和节点s的资源转出量的和值作为节点o的资源转出总量，即为M(o,p)+M(o,s)；如果资源转入总量M(q,o)+M(n,o)+M(r,o)+M(m,o)远小于资源转出总量M(o,p)+M(o,s)，即比值小于预设比值，则可以将节点o作为资源转移关系图中用于路径搜索的起始节点。更具体地，如果M(q,o)+M(n,o)+M(r,o)+M(m,o)<k×[M(o,p)+M(o,s)]，k可以是0.1至0.3的任一个数值，那么可以确定资源转入总量远小于资源转出总量。
具体地，如图3(a)所示，以节点e为例介绍上述步骤：
若节点e的入度为0，该节点e仅指向节点i，不存在入边，则节点e对应的转入资源总量为0，节点e转给节点i的转出资源总量即为M(e,i)，倘若M(e,i)远大于0，则节点e满足上述条件(3)，可作为起始节点，并基于节点e和节点i形成当前资源转移路径e->i，并将节点i作为当前搜索节点，将节点e作为参考节点，将节点i指向的节点f作为候选节点，根据节点e向节点i的资源转移时间和节点i向节点f的资源转移时间的时间先后顺序明显度，以及M(e,i)和M(i,f)的大小相近程度，确定是否将节点f添加至当前资源转移路径e->i中。
上述方式中，在资源转移关系图中将满足预设条件的节点作为当前路径搜索的起始节点，并根据起始节点至起始节点所指向的节点的资源转出量的相对大小，得到当前资源转移路径和当前搜索节点，保证来源未受认证的资源的转移路径搜索的正常进行。
为了更好地理解上述方法，以下结合图8详细阐述一个本申请资源转移信息检测方法的应用实例，本应用实施例中资源转移标识简称为标识。
步骤S802，获取标识集合；
步骤S804，将标识作为节点，并通过单向边连接存在资源转移关系的节点，得到资源净转出单向图。
其中，单向边的指向表征单向边所连接的两个节点间的资源净转出方向，该资源净转出方向是根据这两个节点间的多笔资源转移确定的；例如，节点a向节点b转过5笔资源且资源量共计3万，节点b向节点a转过2笔资源且资源量共计2万，那么根据发生于节点a和节点b之间的这7笔资源转移，可以确定这两个节点之间的资源净转出方向是从节点a指向节点b。
其中，每一单向边具有两个属性，一个属性是资源净转移量，另一个属性是资源净转移量对应的时间。其中，资源净转移量可以根据节点间的多笔资源转移的资源转移量进行抵消相加得到的，例如M(b,d)＝(+m v1)+(-m v2)+(-m v3)+(+m v4)+(-m v5)，其中+表示从节点d转出到节点d，-表示从节点d转出到节点b。资源净转移量对应的时间可以是对节点间的多笔资源转移的发生时间进行综合得到的，具体综合方式可以是基于各笔资源转移的资源转移量的加权综合，例如节点b和节点d之间的与资源净转移量对应的时间T(b,d)＝t v1×mv1/(mv1+mv2+mv3+mv4+mv5)+t v2×mv2/(mv1+mv2+mv3+mv4+mv5)+t v3×mv3/(mv1+mv2+mv3+mv4+mv5)+t v4×mv4/(mv1+mv2+mv3+mv4+mv5)+t v5×mv5/(mv1+mv2+mv3+mv4+mv5)，具体可以参见前文实施例。
步骤S806，在资源净转出单向图所包括的节点中，将满足预设起始节点条件的节点作为当前进行路径搜索的起始节点；
步骤S808，将从起始节点至起始节点所指向的节点的资源净转出量记为M，若M大于或等于资源转移量阈值M 0，则基于起始节点和起始节点所指向的节点形成当前资源转移路径，并将起始节点所指向的节点作为当前搜索节点；
步骤S810，将起始节点作为参考节点，将当前搜索节点指向的节点作为候选节点；
步骤S812，将参考节点和当前搜索节点之间的与资源净转出量对应的时间作为第一资源转移时间，将当前搜索节点与候选节点之间的与资源净转出量对应的时间作为第二资源转移时间。
将第一资源转移时间记为T(i-1,i)，并将第二资源转移时间记为T(i,i+1)；其中，i-1表征指向当前搜索节点的参考节点，i表征当前搜索节点，i+1表征当前搜索节点指向的候选节点；
步骤S814，若第一资源转移时间早于第二资源转移时间，则获取参考节点和当前搜索节点之间的资源净转移量以及当前搜索节点和候选节点之间的资源净转出量，若资源净转移量以及资源净转出量的大小相近，则将候选节点加入到当前资源转移路径中，并将当前搜索节点作为参考节点，候选节点作为当前节点，候选节点指向的节点作为候选节点继续进行路径搜索，直至满足终止条件，得到目标资源转移路径。
也即是，若第一资源转移时间早于第二资源转移时间，也即T(i-1,i)≤T(i,i+1)，则获取参考节点和当前搜索节点之间的资源净转移量M(i-1,i)以及当前搜索节点和候选节点之间的资源净转出量M(i,i+1)，若M(i-1,i)与M(i,i+1)的大小相近，则将候选节点加入到当前资源转移路径中，并将当前搜索节点作为参考节点，候选节点作为当前节点，候选节点指向的节点作为候选节点继续进行路径搜索，直至满足终止条件，得到目标资源转移路径；
其中，M(i-1,i)与M(i,i+1)的大小相近的确定方式为：当M(i-1,i)/M(i,i+1)∈(1-p loss，1+p loss)时，可以确定M(i-1,i)与M(i,i+1)的大小相近；其中，p loss∈(0.1～0.2)。
终止条件包括以下任一项：
①当前搜索得到的资源转移路径的长度达到预设的最大长度；
②当前搜索节点的出度等于0，即当前搜索节点不存在相应的候选节点；
③当前搜索节点所指向的候选节点中，不存在满足可添加至当前资源转移路径的条件的节点。
步骤S816，在完成此次路径搜索后，将目标资源转移路径上存在多条入边的各节点对应的子路径，作为相应节点的路径属性进行存储；
步骤S818，确定资源净转出单向图所包括的节点中满足预设起始节点条件的下一节点，并按照步骤S808至S816的方式进行资源转移路径搜索，若搜索到的其中一个节点有路径属性，则直接读取该路径属性并拼接至当前搜索到的当前资源转移路径中，直至路径搜索结束；
步骤S820，若资源净转出单向图中仍存在起始节点未被访问，则返回步骤S808继续进行路径搜索。
在进行路径搜索的过程中，记录当前该资源转移路径所包括的节点(标识)，若当前搜索节点已存在于当前资源转移路径中，则说明当前搜索节点已经被访问过，此时遇到了节点形成的节点环，那么服务器将会退出访问，以当前资源转移路径作为本次搜索得到的 目标资源转移路径，并开始下一次路径搜索。通过这样的方式，可以避免无限循环访问节点，浪费计算资源。
本应用实施例中，基于资源转移标识间的资源转移关系与资源转移方向构建资源转移关系图，该资源转移关系图能够准确反映资源转移标识之间的资源转移情况，有利于从海量的资源转移中准确识别出来源未受认证的资源的转移路径，提升路径识别效率；另外，在对资源转移关系图中进行资源转移路径搜索的过程中，在当前搜索节点与参考节点之间的第一资源转移时间和当前搜索节点与候选节点之间的第二资源转移时间之间满足时间差异条件的情况下，将候选节点添加至当前资源转移路径中，表明目标资源是按照时间先后顺序，从参考节点依次流向当前节点和候选节点的，能准确反应目标资源的流向关系，依照这样的方式，依次添加节点，从而准确识别出目标资源的目标资源转移路径，提升了路径识别准确率。
应该理解的是，虽然图1至图8的流程图中的各个步骤按照箭头的指示依次显示，但是这些步骤并不是必然按照箭头指示的顺序依次执行。除非本文中有明确的说明，这些步骤的执行并没有严格的顺序限制，这些步骤可以以其它的顺序执行。而且，图1至图8中的至少一部分步骤可以包括多个步骤或者多个阶段，这些步骤或者阶段并不必然是在同一时刻执行完成，而是可以在不同的时刻执行，这些步骤或者阶段的执行顺序也不必然是依次进行，而是可以与其它步骤或者其它步骤中的步骤或者阶段的至少一部分轮流或者交替地执行。
在一些实施例中，如图9所示，提供了一种资源转移信息检测装置，包括：
标识集合获取模块902，用于获取待进行恶意检测的资源转移标识集合；资源转移标识集合包括多个资源转移标识；
转移方向确定模块904，用于获取资源转移标识集合对应的资源转移标识对，确定资源转移标识对所对应的资源转移方向；每个资源转移标识对是资源转移标识集合中存在资源转移关系的两个资源转移标识组成的；
关系图获取模块906，用于将资源转移标识集合中的资源转移标识作为资源转移关系图中的节点，根据资源转移方向对资源转移标识对所对应的节点进行有向边连接，得到资源转移关系图；
节点确定模块908，用于在对资源转移关系图进行资源转移路径搜索的过程中，确定当前搜索到的当前资源转移路径中的当前搜索节点，将当前资源转移路径中指向当前搜索节点的节点作为参考节点，将资源转移关系图中当前搜索节点所指向的节点作为候选节点；
时间确定模块910，用于确定当前搜索节点与参考节点之间的第一资源转移时间，以及当前搜索节点与候选节点之间的第二资源转移时间；
节点添加模块912，用于确定第一资源转移时间与第二资源转移时间满足时间差异条件时，则将候选节点加入到当前资源转移路径中，以得到目标资源转移路径；时间差异条 件为目标资源从参考节点依次流向当前搜索节点以及候选节点的时间差异条件。
在一些实施例中，时间确定模块910，还用于获取所述当前搜索节点与所述参考节点之间的资源转移记录集合；所述资源转移记录集合包括多个资源转移记录；获取各个所述资源转移记录中的资源转移时间以及资源转移数值；基于所述资源转移数值确定所述资源转移时间对应的时间权重；所述时间权重与所述资源转移数值成正相关关系；基于所述资源转移时间对应的时间权重对所述资源转移记录集合中的资源转移时间进行加权计算，得到所述当前搜索节点与所述参考节点之间的第一资源转移时间。
在一些实施例中，时间确定模块910，还用于：对资源转移记录集合中的资源转移数值求和计算，得到资源转移统计值；计算资源转移数值在资源转移统计值中的占比，将占比作为资源转移时间对应的时间权重。
在一些实施例中，所述第一资源转移时间为所述参考节点指向所述当前搜索节点的第一末次资源转移时间，所述第二资源转移时间为所述当前搜索节点指向所述候选节点的第二首次资源转移时间；节点添加模块912，还用于：确定所述第一末次资源转移时间与所述第二首次资源转移时间之间的时间顺序；当所述时间顺序指示所述第一末次资源转移时间早于所述第二首次资源转移时间时，确定所述第一资源转移时间与所述第二资源转移时间满足时间差异条件。
在一些实施例中，节点添加模块912，还用于：当所述时间顺序指示所述第一末次资源转移时间晚于所述第二首次资源转移时间时，获取所述第一末次资源转移时间与所述第二首次资源转移时间之间的第一时间差值；获取所述参考节点指向所述当前搜索节点之间的第一首次资源转移时间，以及获取所述当前搜索节点指向所述候选节点的第二末次资源转移时间，获取所述第二末次资源转移时间与所述第一首次资源转移时间之间的第二时间差值；计算所述第一时间差值与所述第二时间差值之间的时间比例，当所述时间比例小于预设比例阈值时，确定所述第一资源转移时间与所述第二资源转移时间满足时间差异条件。
在一些实施例中，节点添加模块912，还用于：获取所述参考节点向所述当前搜索节点转移的第一转移资源量，以及所述当前搜索节点向所述候选节点转移的第二转移资源量；当所述所述第一资源转移时间与所述第二资源转移时间满足时间差异条件，且确定所述第一转移资源量与所述第二转移资源量之间的资源差异量小于预设差异量时，将所述候选节点加入到所述当前资源转移路径中，以检测出目标资源转移路径。
在一些实施例中，节点添加模块912，还用于：获取参考节点向当前搜索节点转移的第一转移资源量，以及当前搜索节点向候选节点转移的第二转移资源量；当资源转移时间差异满足时间差异条件，且确定第一转移资源量与第二转移资源量之间的资源量小于差异量时，将候选节点加入到当前资源转移路径中，以得到目标资源转移路径。
在一些实施例中，节点添加模块912，还用于：计算所述第一转移资源量与所述第二转移资源量之间的资源量比例；将所述资源量比例作为所述资源差异量；当所述资源量比 例大于第一阈值且小于第二阈值时，确定所述第一转移资源量与所述第二转移资源量之间的资源差异量小于预设差异量；所述第一阈值小于1，所述第二阈值大于1。
在一些实施例中，节点添加模块912，还用于：当所述第一资源转移时间与所述第二资源转移时间满足时间差异条件时，获取所述候选节点对应的路径属性标识；所述路径属性标识是对已有目标资源转移路径中存在多条入边的节点添加的，所述路径属性标识用于标识所述已有目标资源转移路径中从所述存在多条入边的节点出发得到的子路径；基于所述路径属性标识获取从所述候选节点出发的子路径，将所述子路径拼接至所述当前资源转移路径中，以检测出目标资源转移路径。
在一些实施例中，节点确定模块908，用于：在所述资源转移关系图所包括的节点中，将满足预设起始节点条件的节点作为所述当前资源转移路径的起始节点；所述预设起始节点条件包括以下条件的至少一个：所述节点的出度大于0且所述节点的入度小于或等于预设阈值；所述节点的转入资源总量与所述节点的转出资源总量的比值小于预设比值。
在一些实施例中，节点确定模块908，用于：若从所述起始节点至所述起始节点所指向的节点的资源转移量大于或等于资源转移量阈值，则基于所述起始节点和所述起始节点所指向的节点形成所述当前资源转移路径，并将所述起始节点所指向的节点作为当前搜索节点。
关于资源转移信息检测装置的具体限定可以参见上文中对于资源转移信息检测方法的限定，在此不再赘述。上述资源转移信息检测装置中的各个模块可全部或部分通过软件、硬件及其组合来实现。上述各模块可以硬件形式内嵌于或独立于计算机设备中的处理器中，也可以以软件形式存储于计算机设备中的存储器中，以便于处理器调用执行以上各个模块对应的操作。
在一些实施例中，提供了一种计算机设备，其内部结构图可以如图10所示。该计算机设备可以是图1中的服务器104。该计算机设备包括通过系统总线连接的处理器、存储器和网络接口。其中，该计算机设备的处理器用于提供计算和控制能力。该计算机设备的存储器包括非易失性计算机可读存储介质、内存储器。该非易失性计算机可读存储介质存储有操作系统、计算机程序和数据库。该内存储器为非易失性存储介质中的操作系统和计算机程序的运行提供环境。该计算机设备的数据库用于存储资源转移信息检测数据。该计算机设备的网络接口用于与外部的终端通过网络连接通信。该计算机程序被处理器执行时以实现一种资源转移信息检测方法。
本领域技术人员可以理解，图10中示出的结构，仅仅是与本申请方案相关的部分结构的框图，并不构成对本申请方案所应用于其上的计算机设备的限定，具体的计算机设备可以包括比图中所示更多或更少的部件，或者组合某些部件，或者具有不同的部件布置。
一种计算机设备，包括存储器和处理器，存储器存储有计算机可读指令，计算机可读指令被处理器执行时，使得处理器执行本申请资源转移信息检测方法。
一种非易失性的计算机可读存储介质，该计算机可读存储介质存储有计算机可读指 令，该计算机可读指令被处理器执行时使该处理器执行本申请资源转移信息检测方法。
一种计算机程序产品或计算机程序，该计算机程序产品或计算机程序包括计算机可读指令，该计算机可读指令存储在计算机可读存储介质中。计算机设备的处理器从计算机可读存储介质读取该计算机可读指令，处理器执行该计算机可读指令，使得该计算机设备执行本申请资源转移信息检测方法。
需要说明的是，本申请所涉及的用户信息(包括但不限于用户设备信息、用户个人信息等)和数据(包括但不限于用于分析的数据、存储的数据、展示的数据等)，均为经用户授权或者经过各方充分授权的信息和数据。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机可读指令来指令相关的硬件来完成，上述的计算机可读指令可存储于一非易失性计算机可读取存储介质中，该计算机可读指令在执行时，可包括如上述各方法的实施例的流程。其中，本申请所提供的各实施例中所使用的对存储器、存储、数据库或其它介质的任何引用，均可包括非易失性和易失性存储器中的至少一种。非易失性存储器可包括只读存储器(Read-Only Memory，ROM)、磁带、软盘、闪存或光存储器等。易失性存储器可包括随机存取存储器(Random Access Memory，RAM)或外部高速缓冲存储器。作为说明而非局限，RAM可以是多种形式，比如静态随机存取存储器(Static Random Access Memory，SRAM)或动态随机存取存储器(Dynamic Random Access Memory，DRAM)等。
以上实施例的各技术特征可以进行任意的组合，为使描述简洁，未对上述实施例中的各个技术特征所有可能的组合都进行描述，然而，只要这些技术特征的组合不存在矛盾，都应当认为是本说明书记载的范围。
以上的实施例仅表达了本申请的几种实施方式，其描述较为具体和详细，但并不能因此而理解为对发明专利范围的限制。应当指出的是，对于本领域的普通技术人员来说，在不脱离本申请构思的前提下，还可以做出若干变形和改进，这些都属于本申请的保护范围。因此，本申请专利的保护范围应以所附权利要求为准。

Claims (20)

  1. 一种资源转移信息检测方法，由计算机设备执行，所述方法包括：
    获取资源转移标识集合；所述资源转移标识集合包括多个资源转移标识；
    获取所述资源转移标识集合对应的资源转移标识对，确定所述资源转移标识对所对应的资源转移方向；每个所述资源转移标识对是所述资源转移标识集合中存在资源转移关系的两个资源转移标识组成的；
    将所述资源转移标识集合中的资源转移标识作为资源转移关系图中的节点，根据所述资源转移方向对所述资源转移标识对所对应的节点进行有向边连接，得到所述资源转移关系图；
    在对所述资源转移关系图进行资源转移路径搜索的过程中，确定当前搜索到的当前资源转移路径中的当前搜索节点，将所述当前资源转移路径中指向所述当前搜索节点的节点作为参考节点，将所述资源转移关系图中所述当前搜索节点所指向的节点作为候选节点；
    确定所述当前搜索节点与所述参考节点之间的第一资源转移时间，以及所述当前搜索节点与所述候选节点之间的第二资源转移时间；
    当所述第一资源转移时间与所述第二资源转移时间满足时间差异条件时，将所述候选节点加入到所述当前资源转移路径中，以检测出目标资源转移路径；所述时间差异条件为目标资源从所述参考节点依次流向所述当前搜索节点以及所述候选节点的时间差异条件。
  2. 根据权利要求1所述的方法，其特征在于，所述确定所述当前搜索节点与所述参考节点之间的第一资源转移时间，包括：
    获取所述当前搜索节点与所述参考节点之间的资源转移记录集合；所述资源转移记录集合包括多个资源转移记录；
    获取各个所述资源转移记录中的资源转移时间以及资源转移数值；
    基于所述资源转移数值确定所述资源转移时间对应的时间权重；所述时间权重与所述资源转移数值成正相关关系；
    基于所述资源转移时间对应的时间权重对所述资源转移记录集合中的资源转移时间进行加权计算，得到所述当前搜索节点与所述参考节点之间的第一资源转移时间。
  3. 根据权利要求2所述的方法，其特征在于，所述基于所述资源转移数值确定所述资源转移时间对应的时间权重，包括：
    对所述资源转移记录集合中的资源转移数值求和，得到资源转移统计值；
    计算所述资源转移数值在所述资源转移统计值中的占比，将所述占比作为资源转移时间对应的时间权重。
  4. 根据权利要求1所述的方法，其特征在于，所述第一资源转移时间为所述参考节点指向所述当前搜索节点的第一末次资源转移时间，所述第二资源转移时间为所述当前搜索 节点指向所述候选节点的第二首次资源转移时间；确定所述第一资源转移时间与所述第二资源转移时间满足时间差异条件的步骤，包括：
    确定所述第一末次资源转移时间与所述第二首次资源转移时间之间的时间顺序；
    当所述时间顺序指示所述第一末次资源转移时间早于所述第二首次资源转移时间时，确定所述第一资源转移时间与所述第二资源转移时间满足时间差异条件。
  5. 根据权利要求4所述的方法，其特征在于，所述方法还包括：
    当所述时间顺序指示所述第一末次资源转移时间晚于所述第二首次资源转移时间时，获取所述第一末次资源转移时间与所述第二首次资源转移时间之间的第一时间差值；
    获取所述参考节点指向所述当前搜索节点之间的第一首次资源转移时间，以及获取所述当前搜索节点指向所述候选节点的第二末次资源转移时间，获取所述第二末次资源转移时间与所述第一首次资源转移时间之间的第二时间差值；计算所述第一时间差值与所述第二时间差值之间的时间比例，当所述时间比例小于预设比例阈值时，确定所述第一资源转移时间与所述第二资源转移时间满足时间差异条件。
  6. 根据权利要求1所述的方法，其特征在于，所述当所述第一资源转移时间与所述第二资源转移时间满足时间差异条件时，将所述候选节点加入到所述当前资源转移路径中，以检测出目标资源转移路径，包括：
    获取所述参考节点向所述当前搜索节点转移的第一转移资源量，以及所述当前搜索节点向所述候选节点转移的第二转移资源量；
    当所述所述第一资源转移时间与所述第二资源转移时间满足时间差异条件，且确定所述第一转移资源量与所述第二转移资源量之间的资源差异量小于预设差异量时，将所述候选节点加入到所述当前资源转移路径中，以检测出目标资源转移路径。
  7. 根据权利要求6所述的方法，其特征在于，确定所述第一转移资源量与所述第二转移资源量之间的资源差异量，包括：
    计算所述第一转移资源量与所述第二转移资源量之间的资源量比例；
    将所述资源量比例作为所述资源差异量；
    所述确定所述第一转移资源量与所述第二转移资源量之间的资源差异量小于预设差异量，包括：当所述资源量比例大于第一阈值且小于第二阈值时，确定所述第一转移资源量与所述第二转移资源量之间的资源差异量小于预设差异量；所述第一阈值小于1，所述第二阈值大于1。
  8. 根据权利要求1所述的方法，其特征在于，所述当所述第一资源转移时间与所述第二资源转移时间满足时间差异条件满足时间差异条件时，将所述候选节点加入到所述当前资源转移路径中，包括：
    当所述第一资源转移时间与所述第二资源转移时间满足时间差异条件时，获取所述候选节点对应的路径属性标识；所述路径属性标识是对已有目标资源转移路径中存在多条入边的节点添加的，所述路径属性标识用于标识所述已有目标资源转移路径中从所述存在 多条入边的节点出发得到的子路径；
    基于所述路径属性标识获取从所述候选节点出发的子路径，将所述子路径拼接至所述当前资源转移路径中，以检测出目标资源转移路径。
  9. 根据权利要求1至8任一项所述的方法，其特征在于，所述方法还包括：
    在所述资源转移关系图所包括的节点中，将满足预设起始节点条件的节点作为所述当前资源转移路径的起始节点；所述预设起始节点条件包括以下条件的至少一个：
    所述节点的出度大于0且所述节点的入度小于或等于预设阈值；
    所述节点的转入资源总量与所述节点的转出资源总量的比值小于预设比值。
  10. 根据权利要求9所述的方法，其特征在于，所述确定当前搜索到的当前资源转移路径中的当前搜索节点，包括：
    若从所述起始节点至所述起始节点所指向的节点的资源转移量大于或等于资源转移量阈值，则基于所述起始节点和所述起始节点所指向的节点形成所述当前资源转移路径，并将所述起始节点所指向的节点作为当前搜索节点。
  11. 一种资源转移信息检测装置，所述装置包括：
    标识集合获取模块，用于获取资源转移标识集合；所述资源转移标识集合包括多个资源转移标识；
    转移方向确定模块，用于获取所述资源转移标识集合对应的资源转移标识对，确定所述资源转移标识对所对应的资源转移方向；每个所述资源转移标识对是所述资源转移标识集合中存在资源转移关系的两个资源转移标识组成的；
    关系图获取模块，用于将所述资源转移标识集合中的资源转移标识作为资源转移关系图中的节点，根据所述资源转移方向对所述资源转移标识对所对应的节点进行有向边连接，得到所述资源转移关系图；
    节点确定模块，用于在对所述资源转移关系图进行资源转移路径搜索的过程中，确定当前搜索到的当前资源转移路径中的当前搜索节点，将所述当前资源转移路径中指向所述当前搜索节点的节点作为参考节点，将所述资源转移关系图中所述当前搜索节点所指向的节点作为候选节点；
    时间确定模块，用于确定所述当前搜索节点与所述参考节点之间的第一资源转移时间，以及所述当前搜索节点与所述候选节点之间的第二资源转移时间；
    节点添加模块，用于当所述第一资源转移时间与所述第二资源转移时间满足时间差异条件时，将所述候选节点加入到所述当前资源转移路径中，以检测出目标资源转移路径；所述时间差异条件为目标资源从所述参考节点依次流向所述当前搜索节点以及所述候选节点的时间差异条件。
  12. 根据权利要求11所述的装置，其特征在于，所述时间确定模块，还用于：
    获取所述当前搜索节点与所述参考节点之间的资源转移记录集合；所述资源转移记录集合包括多个资源转移记录；
    获取各个所述资源转移记录中的资源转移时间以及资源转移数值；
    基于所述资源转移数值确定所述资源转移时间对应的时间权重；所述时间权重与所述资源转移数值成正相关关系；
    基于所述资源转移时间对应的时间权重对所述资源转移记录集合中的资源转移时间进行加权计算，得到所述当前搜索节点与所述参考节点之间的第一资源转移时间。
  13. 根据权利要求11所述的装置，其特征在于，所述时间确定模块，还用于对所述资源转移记录集合中的资源转移数值求和，得到资源转移统计值；计算所述资源转移数值在所述资源转移统计值中的占比，将所述占比作为资源转移时间对应的时间权重。
  14. 根据权利要求11所述的装置，其特征在于，所述第一资源转移时间为所述参考节点指向所述当前搜索节点的第一末次资源转移时间，所述第二资源转移时间为所述当前搜索节点指向所述候选节点的第二首次资源转移时间；所述节点添加模块，还用于确定所述第一末次资源转移时间与所述第二首次资源转移时间之间的时间顺序；当所述时间顺序指示所述第一末次资源转移时间早于所述第二首次资源转移时间时，确定所述第一资源转移时间与所述第二资源转移时间满足时间差异条件。
  15. 根据权利要求14所述的装置，其特征在于，所述节点添加模块，还用于当所述时间顺序指示所述第一末次资源转移时间晚于所述第二首次资源转移时间时，获取所述第一末次资源转移时间与所述第二首次资源转移时间之间的第一时间差值；获取所述参考节点指向所述当前搜索节点之间的第一首次资源转移时间，以及获取所述当前搜索节点指向所述候选节点的第二末次资源转移时间，获取所述第二末次资源转移时间与所述第一首次资源转移时间之间的第二时间差值；计算所述第一时间差值与所述第二时间差值之间的时间比例，当所述时间比例小于预设比例阈值时，确定所述第一资源转移时间与所述第二资源转移时间满足时间差异条件。
  16. 根据权利要求11所述的装置，其特征在于，所述节点添加模块，还用于获取所述参考节点向所述当前搜索节点转移的第一转移资源量，以及所述当前搜索节点向所述候选节点转移的第二转移资源量；当所述所述第一资源转移时间与所述第二资源转移时间满足时间差异条件，且确定所述第一转移资源量与所述第二转移资源量之间的资源差异量小于预设差异量时，将所述候选节点加入到所述当前资源转移路径中，以检测出目标资源转移路径。
  17. 根据权利要求11至16任一项所述的装置，其特征在于，所述节点确定模块还用于在所述资源转移关系图所包括的节点中，将满足预设起始节点条件的节点作为所述当前资源转移路径的起始节点；所述预设起始节点条件包括以下条件的至少一个：
    所述节点的出度大于0且所述节点的入度小于或等于预设阈值；
    所述节点的转入资源总量与所述节点的转出资源总量的比值小于预设比值。
  18. 一种计算机设备，包括存储器和处理器，所述存储器存储有计算机可读指令，所述计算机可读指令被处理器执行时，使得所述处理器实现权利要求1至10中任一项所述 的方法。
  19. 一种非易失性的计算机可读存储介质，所述计算机可读存储介质存储有计算机可读指令，所述计算机可读指令被处理器执行时使所述处理器实现权利要求1至10中任一项所述的方法。
  20. 一种计算机程序产品，包括计算机可读指令，其特征在于，所述计算机可读指令被处理器执行时实现权利要求1至10任一项所述的方法。
PCT/CN2022/117568 2021-10-20 2022-09-07 资源转移信息检测方法、装置、设备和存储介质 WO2023065870A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/326,652 US20230315538A1 (en) 2021-10-20 2023-05-31 Resource transfer information detection method and apparatus, device, and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111221459.0 2021-10-20
CN202111221459.0A CN115994761A (zh) 2021-10-20 2021-10-20 资源转移信息检测方法、装置、设备和存储介质

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/326,652 Continuation US20230315538A1 (en) 2021-10-20 2023-05-31 Resource transfer information detection method and apparatus, device, and storage medium

Publications (1)

Publication Number Publication Date
WO2023065870A1 true WO2023065870A1 (zh) 2023-04-27

Family

ID=85994152

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/117568 WO2023065870A1 (zh) 2021-10-20 2022-09-07 资源转移信息检测方法、装置、设备和存储介质

Country Status (3)

Country Link
US (1) US20230315538A1 (zh)
CN (1) CN115994761A (zh)
WO (1) WO2023065870A1 (zh)

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150178853A1 (en) * 2013-12-19 2015-06-25 International Business Machines Corporation Modeling Asset Transfer Flow Relationships Discovered in Unstructured Data
JP2019057160A (ja) * 2017-09-21 2019-04-11 国立大学法人 東京大学 口座管理装置、口座管理方法及び口座管理用プログラム
US20190179682A1 (en) * 2017-12-12 2019-06-13 Atalaya Capital Management LP Systems and methods for providing an interactive map of an event driven funding path for affecting a directed event
CN111126828A (zh) * 2019-12-19 2020-05-08 浙江邦盛科技有限公司 一种基于知识图谱的多层资金异常流向监控方法
CN111695981A (zh) * 2019-03-13 2020-09-22 北京三快在线科技有限公司 资源转移方法、装置及存储介质
CN112598510A (zh) * 2021-01-06 2021-04-02 中国工商银行股份有限公司 资源数据处理方法和装置
CN113159937A (zh) * 2021-05-27 2021-07-23 中国工商银行股份有限公司 识别风险的方法、装置和电子设备

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150178853A1 (en) * 2013-12-19 2015-06-25 International Business Machines Corporation Modeling Asset Transfer Flow Relationships Discovered in Unstructured Data
JP2019057160A (ja) * 2017-09-21 2019-04-11 国立大学法人 東京大学 口座管理装置、口座管理方法及び口座管理用プログラム
US20190179682A1 (en) * 2017-12-12 2019-06-13 Atalaya Capital Management LP Systems and methods for providing an interactive map of an event driven funding path for affecting a directed event
CN111695981A (zh) * 2019-03-13 2020-09-22 北京三快在线科技有限公司 资源转移方法、装置及存储介质
CN111126828A (zh) * 2019-12-19 2020-05-08 浙江邦盛科技有限公司 一种基于知识图谱的多层资金异常流向监控方法
CN112598510A (zh) * 2021-01-06 2021-04-02 中国工商银行股份有限公司 资源数据处理方法和装置
CN113159937A (zh) * 2021-05-27 2021-07-23 中国工商银行股份有限公司 识别风险的方法、装置和电子设备

Also Published As

Publication number Publication date
CN115994761A (zh) 2023-04-21
US20230315538A1 (en) 2023-10-05

Similar Documents

Publication Publication Date Title
US9336281B2 (en) Systems and methods for identifying and analyzing internet users
US7865592B2 (en) Using semantic networks to develop a social network
WO2019165868A1 (zh) 一种确定营销方案的方法、装置及电子设备
US10735401B2 (en) Online identity reputation
JP2014519097A (ja) アイテムを推薦する方法およびシステム
CN110738558B (zh) 信息修复方法、装置、电子设备及计算机可读介质
CN108154425B (zh) 一种结合社会网络和位置的线下商户推荐方法
US9122910B2 (en) Method, apparatus, and system for friend recommendations
TW201926170A (zh) 目標用戶群體的確定方法及裝置
WO2016145993A1 (zh) 一种用户设备识别方法及系统
KR102086936B1 (ko) 사용자 데이터 공유 방법 및 디바이스
CN106102059B (zh) 用于确定无线热点的所有者的方法与设备
WO2023065870A1 (zh) 资源转移信息检测方法、装置、设备和存储介质
WO2021189925A1 (zh) 保护用户隐私的风险检测方法和装置
WO2018177303A1 (zh) 媒体内容推荐方法、装置及存储介质
Wang et al. Privacy preserving for continuous query in location based services
US10318560B2 (en) Identifying entries in a location store associated with a common physical location
CN114781517A (zh) 风险识别的方法、装置及终端设备
CN110458099B (zh) 用于输出信息的方法和装置
CN112214387B (zh) 基于知识图谱的用户操作行为预测方法及装置
CN105824871A (zh) 一种图片检测方法与设备
KR102501227B1 (ko) 인터넷 주소 검색량에 기반한 금융 사기 탐지 시스템 및 방법
CN115018280B (zh) 风险图模式的挖掘方法、风险识别方法及对应装置
Chen et al. A Multidimensional Data Utility Evaluation and Pricing Scheme in the Big Data Market
CN116915831A (zh) 样本数据生成、模型训练以及确定设备关联关系的方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22882485

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE