Method and apparatus of identifying a transaction risk
A method and an apparatus for identifying a transaction risk are disclosed. The method includes obtaining risk identification information of a sub-network to which a node relating to a transaction to be identified belongs; and identifying a risk of the transaction to be identified based on the risk identification information of the sub-network to which the node relating to the transaction to be identified belongs, wherein the sub-network is a network acquired by partitioning a relationship network based on connectivity, the relationship network is a network built up with entities and activities relating to a plurality of transactions. Embodiments of the present disclosure build up entities and activities relating to a transaction to be identified into a relationship network, and identify whether a risk exists in the transaction to be identified using risk identification information of the network which is difficult to be found or changed, and thus are able to identify a transaction risk in a more effective manner.
1. A method implemented by one or more computing devices, the method comprising:
generating a relationship network, nodes and edges of the relationship network representing entities and activities associated with a plurality of transactions, respectively; and
partitioning the relationship network into a plurality of sub-networks based at least in part on connectivity between the nodes;
monitoring changes related to the nodes based at least in part on real-time activities associated with the corresponding entities;
re-partitioning the relationship network based at least in part on the changes related to the nodes;
obtaining a target sub-network comprising a target node associated with a target transaction, the target transaction being one of the plurality of transactions;
determining a risk of the target transaction based at least in part on a static property of the target sub-network or dynamic change information of the target sub-network that is caused by the target transaction; and
labeling the target node associated with a target transaction as a risk node based on the determined risk of the target transaction.
2. The method of claim 1 , wherein:
the plurality of sub-networks are unconnected; and
partitioning the relationship network into a plurality of sub-networks based at least in part on connectivity between the nodes further comprises:
grouping nodes that are connected directly or indirectly into a sub-network; and
assigning a serial number that is unique in the relationship network to the sub-network, the serial number being steady if a dynamic change occurs in the sub-network.
3. The method of claim 2 , wherein:
partitioning the relationship network into a plurality of sub-networks is performed in a preset time period or in real-time based on the real-time activities associated with the entities.
4. The method of claim 2 , further comprising:
querying the relationship network according to the serial numbers assigned to the plurality of sub-networks to obtain one or more nodes that are within a first distance threshold to the risk node;
obtaining historical risk nodes associated with the relationship network from a data storage;
for each node of the one or more nodes that are within a first determined distance to the risk node,
determining shortest paths from each node to the historical risk nodes;
selecting one or more shortest paths with a count of edges less than a second threshold; and
determining each node to be a new risk node when a number of the selected one or more shortest paths reaches a third threshold; and
updating the historical risk nodes associated with the relationship network in the data storage.
5. The method of claim 1 , wherein:
re-partitioning the relationship network based at least in part on the changes related to the nodes further comprises:
comparing current node information with prior node information, the current node information and the prior node information indicating the activities associated with the entities at a current time and a prior time, respectively;
determining node change information based on the comparison;
labeling one or more nodes and one or more edges based on different changes associated therewith; and
processing at least one of deleting nodes and edges, or adding nodes and edges, splitting a sub-network, or merging sub-networks based on the labeling.
6. The method of claim 1 , further comprising:
determining the risk of the target transaction based on the static property of the target sub-network including:
determining a ratio between a number of events and a number of nodes in the target sub-network; and
determining that a risk exists in the target transaction when the ratio between the number of events and the number of nodes in the target sub-network exceeds a set ratio range,
wherein the events indicate historical risking transactions occurred in the target sub-network.
7. The method of claim 1 , further comprising:
determining the risk of the target transaction based on the static property of the target sub-network including:
determining a density of the target sub-network; and
determining that a risk exists in the target transaction when the density of the target sub-network exceeds a set density range.
8. The method of claim 1 , further comprising:
determining the risk of the target transaction based on the dynamic change information of the target sub-network including at least one of:
determining that a risk exists in the target transaction when the target transaction introduces a pre-labeled risk node into the target sub-network; or
determining that a risk exists in the target transaction when the target transaction causes merging with a risk sub-network.
9. The method of claim 1 , wherein:
the entities associated with the plurality of transactions comprise one or more of a user identifier (ID), a delivery address, a phone number, a bank card used in a particular transaction, a Unique Material Identifier (UMID) or a Media Access Control (MAC) address.
10. An apparatus comprising:
one or more processors; and
memory coupled to the one or more processors, the memory storing a plurality of modules executable by the one or more processors, that when executed by the one or more processors, cause the one or more processors to perform operations comprising:
generating a relationship network, nodes and edges of the relationship network representing entities and activities associated with a plurality of transactions, respectively; and
partitioning the relationship network into a plurality of sub-networks based at least in part on connectivity between the nodes;
monitoring changes related to the nodes based at least in part on real-time activities associated with the corresponding entities;
re-partitioning the relationship network based at least in part on the changes related to the nodes;
obtaining a target sub-network comprising a target node associated with a target transaction, the target transaction being one of the plurality of transactions;
determining a risk of the target transaction based at least in part on a static property of the target sub-network or dynamic change information of the target sub-network that is caused by the target transaction; and
labeling the target node associated with a target transaction as a risk node based on the determined risk of the target transaction.
11. The apparatus of claim 10 , wherein
the plurality of sub-networks are unconnected; and
partitioning the relationship network into a plurality of sub-networks based at least in part on connectivity between the nodes further comprises:
grouping nodes that are connected directly or indirectly into a sub-network; and
assigning a serial number that is unique in the relationship network to the sub-network, the serial number being steady if a dynamic change occurs in the sub-network.
12. The apparatus of claim 11 , wherein:
partitioning the relationship network into a plurality of sub-networks is performed in a preset time period or in real-time based on the real-time activities associated with the entities.
13. The apparatus of claim 11 , further comprising:
querying the relationship network according to the serial numbers assigned to the plurality of sub-networks to obtain one or more nodes that are within a first distance threshold to the risk node;
obtaining historical risk nodes associated with the relationship network from a data storage;
for each node of the one or more nodes that are within a first determined distance to the risk node,
determining shortest paths from each node to the historical risk nodes;
selecting one or more shortest paths with a count of edges less than a second threshold; and
determining each node to be a new risk node when a number of the selected one or more shortest paths reaches a third threshold; and
updating the historical risk nodes associated with the relationship network in the data storage.
14. The apparatus of claim 10 , wherein:
re-partitioning the relationship network based at least in part on the changes related to the nodes further comprises:
comparing current node information with prior node information, the current node information and the prior node information indicating the activities associated with the entities at a current time and a prior time, respectively;
determining node change information based on the comparison;
labeling one or more nodes and one or more edges based on different changes associated therewith; and
processing at least one of deleting nodes and edges, or adding nodes and edges, splitting a sub-network, or merging sub-networks based on the labeling.
15. The apparatus of claim 10 , further comprising:
determining the risk of the target transaction based on the static property of the target sub-network including:
determining a ratio between a number of events and a number of nodes in the target sub-network; and
determining that a risk exists in the target transaction when the ratio between the number of events and the number of nodes in the target sub-network exceeds a set ratio range,
wherein the events indicate historical risking transactions occurred in the target sub-network.
16. The apparatus of claim 10 , further comprising:
determining the risk of the target transaction based on the static property of the target sub-network including:
determining a density of the target sub-network; and
determining that a risk exists in the target transaction when the density of the target sub-network exceeds a set density range.
17. The apparatus of claim 10 , further comprising:
determining the risk of the target transaction based on the dynamic change information of the target sub-network including at least one of:
determining that a risk exists in the target transaction when the target transaction introduces a pre-labeled risk node into the target sub-network; or
determining that a risk exists in the target transaction when the target transaction causes merging with a risk sub-network.
18. A computer-readable medium storing instructions executable by one or more processors, that when executed by the one or more processors, cause the one or more processors to perform operations comprising:
generating a relationship network, nodes and edges of the relationship network representing entities and activities associated with a plurality of transactions, respectively; and
partitioning the relationship network into a plurality of sub-networks based at least in part on connectivity between the nodes;
monitoring changes related to the nodes based at least in part on real-time activities associated with the corresponding entities;
re-partitioning the relationship network based at least in part on the changes related to the nodes;
obtaining a target sub-network comprising a target node associated with a target transaction, the target transaction being one of the plurality of transactions;
determining a risk of the target transaction based at least in part on a static property of the target sub-network or dynamic change information of the target sub-network that is caused by the target transaction; and
labeling the target node associated with a target transaction as a risk node based on the determined risk of the target transaction.
19. The computer-readable medium of claim 18 , wherein when the instructions executed by the one or more processors, cause the one or more processors to perform further operations comprising:
querying the relationship network according to serial numbers assigned to the plurality of sub-networks to obtain one or more nodes that are within a first distance threshold to the risk node;
obtaining historical risk nodes associated with the relationship network from a data storage;
for each node of the one or more nodes that are within a first determined distance to the risk node,
determining shortest paths from each node to the historical risk nodes;
selecting one or more shortest paths with a count of edges less than a second threshold; and
determining each node to be a new risk node when a number of the selected one or more shortest paths reaches a third threshold; and
updating the historical risk nodes associated with the relationship network in the data storage.
20. The computer-readable medium of claim 18 , wherein when the instructions executed by the one or more processors, cause the one or more processors to perform further operations comprising:
determining the risk of the target transaction based on the static property of the target sub-network including:
determining a ratio between a number of events and a number of nodes in the target sub-network; and
determining that a risk exists in the target transaction when the ratio between the number of events and the number of nodes in the target sub-network exceeds a set ratio range,
wherein the events indicate historical risking transactions occurred in the target sub-network.