CN115048535A

CN115048535A - Method and device for recognizing abnormity

Info

Publication number: CN115048535A
Application number: CN202210768073.XA
Authority: CN
Inventors: 舒慧珍; 张天翼; 刘丹丹; 黄超敏; 曹琳
Original assignee: Alipay Hangzhou Information Technology Co Ltd
Current assignee: Alipay Hangzhou Information Technology Co Ltd
Priority date: 2022-06-30
Filing date: 2022-06-30
Publication date: 2022-09-13

Abstract

One aspect of the present disclosure relates to a method of anomaly identification, including collecting information of a user; organizing the information of the user into knowledge, wherein the knowledge comprises the relation between the user and the information or between the information and the information; constructing a knowledge-graph based on the organized knowledge, the knowledge-graph comprising information nodes corresponding to the user and each item of information, and comprising edges corresponding to respective relationships; modeling the knowledge graph with a spatial domain based graph convolution network to obtain a model; and training the model to determine whether the user is abnormal based on a graph convolution calculation of the knowledge-graph. The present disclosure also relates to other related aspects.

Description

Method and device for recognizing abnormity

Technical Field

The present application relates generally to anomaly identification and more particularly to knowledge-graph based anomaly identification.

Background

In the countermeasure of abnormality identification and management, information collected passively is often used to judge the black and white of a user (i.e., whether the user is abnormal).

For example, when Enhanced Due Diligence (EDD), or enhanced due diligence, a deeper due diligence may be performed for high-risk customers to collect more information and understand customer activities deeply, thereby reducing risk.

There are two main ways to identify anomalies in similar scenarios, namely, using some rules to identify whether there is a contradiction between the collected user information and the existing user information, and using some mathematical models to model these data. However, such solutions are either too labor-intensive or of a quality that is difficult to handle.

Accordingly, there is a need in the art for improved approaches to anomaly identification.

Disclosure of Invention

One aspect of the present disclosure relates to a method of anomaly identification, including collecting information of a user; organizing the information of the user into knowledge, wherein the knowledge comprises the relation between the user and the information or between the information and the information; constructing a knowledge-graph based on the organized knowledge, the knowledge-graph comprising user nodes corresponding to the users and information nodes corresponding to each item of information, and comprising edges corresponding to respective relationships; modeling the knowledge graph with a spatial domain based graph convolution network to obtain a model; and training the model to identify whether the user is abnormal based on a graph convolution calculation of the knowledge-graph.

According to some exemplary embodiments, the knowledge comprises subject, predicate and object SPO triples.

According to some exemplary embodiments, the knowledge-graph comprises knowledge hosted by the user and information hosted by the user, or knowledge hosted by information and hosted by further information related to the information.

According to some of the example embodiments, the knowledge that is subject to the user and that is subject to information corresponds to neighbor nodes in the model that have a one-hop distance from the user node, and the knowledge that is subject to information and that is subject to further information related to the information corresponds to nodes in the model that have a distance of more than one hop from the user node.

According to some exemplary embodiments, training the model comprises training the model by using a user with an existing label as a group route of the model, so that the weight of the edge in the knowledge graph after training reflects the importance of the corresponding relation in the abnormal recognition.

According to some exemplary embodiments, the information includes domain information of a group to which the user belongs and known individual information of individuals of the user.

According to some exemplary embodiments, the domain information of the group to which the user belongs includes transaction characteristics of categories such as industry or occupation to which the user belongs; and the known individual information personal to the user comprises personal transaction behavior characteristics of the user.

According to some exemplary embodiments, the information further comprises newly obtained supplementary information of the user.

According to some example embodiments, each node in the knowledge-graph carries its own feature value or feature vector.

According to some example embodiments, the graph convolution calculation for the knowledge-graph is based on the feature values or feature vectors of the user nodes and a subset of information nodes, wherein the subset of information nodes is determined based on a hop count threshold.

Other aspects of the disclosure also include corresponding apparatus, devices, and computer-readable media, among others.

Drawings

FIG. 1 illustrates a schematic diagram of a portion of an exemplary user knowledge-graph in accordance with an aspect of the present disclosure.

FIG. 2 illustrates a schematic diagram of a portion of an example user knowledge graph model in accordance with an aspect of the present disclosure.

Fig. 3 illustrates a schematic diagram of a neural network model of a generalized example user knowledge graph model in accordance with an aspect of the present disclosure.

Fig. 4 illustrates a flow diagram of a method 400 of anomaly identification in accordance with an aspect of the present disclosure.

Detailed Description

A graph (graph) is a graph composed of a plurality of nodes (nodes) and edges (edges) connecting two nodes, and is used for depicting the relationship between different nodes. The graph (graph) is different from a general image (image), the image belongs to an Euclidean space, the number of neighbors of the node is fixed, the graph belongs to a non-Euclidean space, and the number of neighbors of the node is not fixed. A knowledge graph is a type of graph.

Essentially, a knowledge graph is a semantic network that exposes relationships between entities. The knowledge graph is composed of a piece of knowledge, each piece of knowledge can be represented as an SPO triple (Subject-predict-Object), wherein the Subject (Subject) and the Object (Object) are nodes in the graph, and the Predicate (predict) is a directed edge between the Subject (Subject) node and the Object (Object). The domain knowledge graph refers to a semantic network for a specific domain.

The construction of the knowledge graph relates to data collection, data combing and knowledge graph construction. For example, in the area of anomaly recognition by a user, a user's knowledge graph may include multiple portions of data.

According to an exemplary embodiment, a portion of data of a user's knowledge graph may include domain knowledge, with specific meaning being domain knowledge of a user population to which the user belongs, such as transaction characteristics of a category, such as industry or profession, to which the user belongs. For example, if the user engages in a mobile phone recharging service, the general transaction amount in the mobile phone recharging industry is an integer of 50 or 100. For another example, the general industry and profession do not have morning trading behavior, and the like. These are the group characteristics in the domain that form domain knowledge about the transaction characteristics of the user. The domain knowledge may not be dependent on the user individuals, but rather reflect commonalities with the user population in the domain. The domain knowledge may be collected, for example, by statistical or empirical means.

According to an exemplary embodiment, another portion of the user's knowledge-graph may include knowledge of the user's individual, including, for example, knowledge of the user's individual's user behavior, which may include, for example, some of the user's personal characteristics that may be relevant to the transaction behavior, such as age, income, preferences, and the like.

According to an exemplary embodiment, the further portion of the user's knowledge-graph may further include supplemental knowledge that includes information collected by actively communicating with the user and that may be supplemental to the user's knowledge of transaction activities.

After one or more portions of data are collected, the collected data may be groomed. According to an exemplary embodiment, combing may include, for example, sorting, associating, etc., data to organize it into knowledge. For example, each piece of knowledge may be represented as an SPO triple (Subject-Predicate-Object), where the relationship of Subject (Subject) and Object (Object) is expressed by a Predicate (Predicate).

After the combing of the data is completed, a knowledge-graph can be constructed based on the organized knowledge. According to an exemplary embodiment, the Subject (Subject) and the Object (Object) in each piece of knowledge may be respectively used as nodes in the knowledge graph, and the Predicate (Predicate) in each piece of knowledge may be used as a directed edge between the node representing the Subject (Subject) and the node being the Object (Object).

For a single user, the user knowledge graph may be spread out centered around the user node. According to an example embodiment, one or more users may be included in the knowledge-graph, and nodes associated with different users may have relationships between them and be represented by directed edges.

Fig. 1 illustrates a schematic diagram of a portion of an example user knowledge graph 100 in accordance with an aspect of the present disclosure. As can be seen, the portion of the example user knowledge graph 100 of fig. 1 is centered around user nodes and includes domain knowledge nodes, user transaction behavior knowledge nodes, and/or supplemental knowledge nodes, among others. Although only one user node is shown in the example user knowledgegraph 100 in fig. 1, according to other example embodiments, one or more user nodes and their respective domain knowledge nodes, user transaction behavior knowledge nodes, and/or supplemental knowledge nodes, etc. may be included in the example user knowledgegraph 100.

In the exemplary user knowledge graph 100 of FIG. 1, the user nodes may have associated domain knowledge nodes, including but not limited to, for example, industry, profession … …, and knowledge of their relationship to the user nodes may be, for example, (user, belonging, industry) and (user, having, profession), respectively, and so forth.

According to an exemplary embodiment, an industry node may have one or more associated industry transaction characteristic nodes, and knowledge of their relationship to the industry node may include, for example, (industry, having, industry transaction characteristic 1), (industry, having, industry transaction characteristic 2) … ….

According to an example embodiment, professional nodes may have one or more associated professional trading features, and knowledge of their relationship to professional nodes may include, for example, (professional, have, professional trading feature 1), (professional, have, professional trading feature 2) … ….

In the exemplary user knowledge graph 100 of fig. 1, the user node may also have associated user trading behavior knowledge nodes including, but not limited to, for example, income, age … …, and knowledge of their relationship to the user node may include, for example, (user, has, income) and (user, yes, age), respectively, and so forth.

In the exemplary user knowledge-graph 100 of FIG. 1, the user node may also have associated supplemental knowledge nodes, including but not limited to a gather information node, etc., whose relationship to the user node may include, for example, (user, has, gathers information).

According to an example embodiment, a collecting information node may have one or more associated specific supplemental information knowledge nodes, including but not limited to, for example, job position, revenue source … …, whose relationships to the collecting information node may include, for example, (collecting information, is job position), and (collecting information, is revenue source), respectively.

According to an exemplary embodiment, each node may have its own eigenvalue or eigenvector. For example, the characteristic values of the revenue nodes may include revenue values or revenue binning values, etc., and the characteristic values of the job nodes may include coded values or embedded vectors of different jobs, etc.

The exemplary user knowledgegraph 100 of FIG. 1 may be obtained, for example, based on gathering data as previously described, combing the gathered data (including, for example, sorting, collating, correlating, etc. the data to organize it into knowledge), and constructing a user knowledgegraph based on the combing of the data.

After obtaining a user knowledge graph, such as fig. 1, aspects of the present disclosure may include modeling the user knowledge graph. The goal of modeling the user knowledge graph may include categorical forecasting of an entire built user knowledge graph.

According to an exemplary embodiment, since the knowledge-graph of each user is not certain to consist of several nodes, a spatial domain based graph volume network, such as GAT or GraphSAGE, may be employed to fully utilize all nodes around the user.

According to an exemplary embodiment, modeling may include modeling based on a carded constructed user knowledge graph such as described above in connection with FIG. 1. For example, a user node in a user's knowledge-graph, along with nodes directly or indirectly associated therewith, may be considered a node in a model of the user's knowledge-graph. The established model may calculate a graph volume of the user node based on a graph volume algorithm to determine whether the corresponding user node is abnormal.

There are various ways to compute the graph convolution for a user node. A more common way of calculating the graph convolution of a user node may include constructing an eigen matrix according to eigenvalues or eigenvectors of the user node and neighboring nodes, and constructing an adjacency matrix and a degree matrix according to the connection relationship between the nodes and the number of hops between the nodes and the user node, thereby calculating the graph convolution of the user node based on these matrices.

According to an exemplary embodiment, the model of the user's knowledge graph may be trained on the basis of a group channel that has a labeled user as a model to train the weights (also referred to as "attention") of the edges between the nodes. To some extent, the weight of each edge after training reflects the importance of the corresponding relationship (i.e., the neighbor node to the user node).

Fig. 2 illustrates a schematic diagram of a portion of an example user knowledge graph model 200 in accordance with an aspect of the present disclosure. As shown in the portion of the exemplary user knowledge graph model 200 of FIG. 2, h ₁ The node may correspond to a user node and each with an associated neighbor node h ₂ 、h ₃ 、h ₄ 、h ₅ Etc. are connected via directed edges. According to some exemplary embodiments, h ₁ The nodes may also be via directed edge a ₁₁ To connect with itself to form a ring. An exemplary user knowledge graph model 200, as shown in FIG. 2, may be derived by mapping from a user knowledge graph.

According to an exemplary embodiment, with user node h ₁ Associated neighbor node h ₂ 、h ₃ 、h ₄ 、h ₅ Etc. may correspond, for example, to a domain knowledge node, a user transaction behavior knowledge node, and/or a supplemental knowledge node, etc., respectively, as described above, for example, in connection with the example of fig. 1. E.g. with user node h ₁ Associated neighbor node h ₂ 、h ₃ 、h ₄ 、h ₅ Etc. may include, for example, the aforementioned industry nodes, profession nodes, income nodes, age nodes, collection information nodes … …, respectively.

Although only one-hop networks are shown in the exemplary user knowledge graph model 200 of fig. 2 for simplicity, the present disclosure is not so limited, but may include multi-hop networks. E.g. with user node h ₁ Associated neighbor node h ₂ 、h ₃ 、h ₄ 、h ₅ Etc. may further include respective neighbor nodes.

In an initial state, the attention coefficient a of the directed edge of the exemplary user knowledge graph model 200 of FIG. 2 ₁₁ 、a ₁₂ 、a ₁₃ 、a ₁₄ 、a ₁₅ Etc. may be assigned an initial value (e.g., a random value) and may be generated by utilizing user node h ₁ Is trained with a group treth tag (e.g., classified as abnormal or normal).

According to an exemplary embodiment, this may be accomplished by targeting user node h ₁ Calculate the similarity coefficient between its neighboring node and itself (e.g., based on the eigenvalues or eigenvectors of the neighboring node and the user node itself), and then normalize the result to obtain the attention coefficient a of the directed edge ₁₁ 、a ₁₂ 、a ₁₃ 、a ₁₄ 、a ₁₅ And the like.

In particular, a more common way of calculating the attention coefficient may include, for example, calculating node h according to equation (1) below _i Of neighbors

And the node h _i Similarity coefficient between themselves:

wherein W is a sharing parameter for the pair of nodes h _i The dimension of the feature of (2) is increased. "| |" indicates the characteristic Wh after dimensionality increase _i And Wh _j And splicing, and finally mapping the spliced changed characteristics to real numbers by a ().

Subsequently, the attention coefficient may be calculated for the following equation (2):

then, the eigenvalue or eigenvector of each neighbor node can be weighted and summed according to the calculated directed edge attention coefficient to obtain the user node h ₁ New feature of output h' ₁ (i.e., input to the next layer of neurons in the model).

Where σ () is the activation function.

Although equations (1) - (3) above show some specific ways of calculating the similarity coefficient, the attention coefficient, and the new feature, the present disclosure is not limited thereto, and other variations or similar functions, etc. may be employed to achieve similar purposes and/or similar effects.

In general, since a layer of neurons can complete the computation of the node relationships within one hop, when a user node in the exemplary user knowledge graph model 200 includes more than one layer of neighbor nodes, the model needs to train corresponding layers of neurons to complete the computation of the relationships with all associated nodes. According to an exemplary embodiment, a suitable hop count threshold may be set.

Finally, the output of the last layer of neurons can be connected to a classifier and trained to determine if the user node is abnormal based on a ground route. For example, when the hop count threshold is 1 (i.e., only neighbor nodes within one hop of distance from the user node are considered), the new feature h 'may be used' ₁ And directly connecting to a classifier to judge whether the user node is abnormal or not.

Fig. 3 illustrates a schematic diagram of a neural network model 300 of a generalized example user knowledge graph model in accordance with an aspect of the present disclosure.

As shown in fig. 3, a neural network model 300 of an exemplary user knowledge graph model may include an input layer 302, two or more intermediate layers 304, and a classifier 306.

According to an exemplary embodiment, the input layer 302 may include a node h such as described above in connection with FIG. 2 ₂ 、h ₃ 、h ₄ 、h ₅ And the like.

According to an exemplary embodiment, the two or more middle tiers 304 may include, for example, a user node tier h ₁ And a user node layer h' ₁ Etc., wherein the user node level h ₁ May correspond to a neighboring node (e.g., h) in the input layer 302 ₂ 、h ₃ 、h ₄ 、h ₅ ) Etc. and user node layer h' ₁ Can be connected with the previous user node layer h ₁ The outputs of (a) are directly connected.

According to an exemplary embodiment, the two or more intermediate layers 304 may also include more intermediate layers. The number of intermediate layers depends on the set hop count threshold.

According to an exemplary embodiment, the final output of the middle tier may be connected to a classifier 306. The classifier 306 performs classification based on the output of the middle layer 304 to determine whether the corresponding user node is abnormal.

According to an exemplary embodiment, the classifier 306 may be a hard classifier to directly output whether the corresponding user node is abnormal or non-abnormal. According to other exemplary embodiments, the classifier 306 may also be a soft classifier to, for example, output a probability that the corresponding user node is abnormal.

Fig. 4 illustrates a flow diagram of a method 400 of anomaly identification in accordance with an aspect of the present disclosure. The method 400 may include user knowledge graph construction at block 402.

According to an exemplary embodiment, user knowledge graph construction at block 402 may include data collection at sub-box 402-1.

According to an exemplary embodiment, data collection may include, but is not limited to, for example, domain knowledge, user transaction behavior knowledge, and supplemental knowledge.

The domain knowledge may include, but is not limited to, transactional features of the categories, such as industry or profession, to which the user belongs, i.e., group features in the domain form domain knowledge about the transactional features of the user. The domain knowledge may not be dependent on the user individuals, but rather reflect commonalities with the user population in the domain. The domain knowledge may be collected, for example, statistically or empirically.

The user's knowledge of transaction behavior may include, but is not limited to, some characteristics of the user's individual that are relevant to the transaction behavior. The supplemental knowledge may include, but is not limited to, information collected by actively communicating with the user and may be supplemental to the user's knowledge of transaction activities.

After collecting the data, the user's knowledge-graph construction of block 402 may include data combing in sub-block 402-2, also while collecting the data.

Data combing may include combing the collected data. According to an exemplary embodiment, combing may include, for example, sorting, associating, etc., data to organize it into knowledge. For example, according to some example embodiments, each piece of knowledge may be represented as an SPO triple (Subject-Predicate-Object), where the relationship of Subject (Subject) and Object (Object) is expressed by a Predicate (Predicate).

After completion of the combing of the data, user knowledge graph construction at block 402 may include constructing a user knowledge graph based on the combed data at sub-box 402-3. According to an exemplary embodiment, the Subject (Subject) and the Object (Object) in each piece of knowledge may be respectively used as nodes in the knowledge graph, and the Predicate (Predicate) in each piece of knowledge may be used as a directed edge between the node representing the Subject (Subject) and the node being the Object (Object).

The method 400 may further include modeling the user knowledge graph at block 404. The goal of modeling the user knowledge graph may include categorical forecasting of an entire built user knowledge graph.

Modeling the user knowledge graph at block 404 may include mapping the constructed user knowledge graph into a spatial domain-based graph convolution network at sub-box 404-1. According to an exemplary embodiment, since the knowledge-graph of each user is not certain to consist of several nodes, a spatial domain based graph volume network, such as GAT or GraphSAGE, may be employed to fully utilize all nodes around the user.

Modeling the user knowledge graph at block 404 may further include training the model of the user knowledge graph at sub-box 404-2. Training may include training the model of the user's knowledge graph on the basis of a ground route that has labeled data as a model to train out the weights (also referred to as "attention") of the edges between the nodes. To some extent, the weight of each edge after training reflects the importance of the corresponding relationship (i.e., the neighbor node to the user node).

In particular, according to an exemplary embodiment, this may be achieved by targeting user node h ₁ Similarity coefficients between its neighboring nodes and itself are computed (e.g., based on the eigenvalues or eigenvectors of the neighboring nodes and the user node itself), and the results are then normalized to get the attention coefficients of the directed edges.

The eigenvalues or eigenvectors of each neighbor node may then be weighted and summed according to the computed directional edge attention coefficients to obtain new features of the user node output (i.e., input to the next layer of neurons in the model).

In general, since a layer of neurons can complete the computation of the node relationships within one hop, when a user node in the exemplary user knowledge graph model includes more than one layer of neighbor nodes, the model needs to train corresponding multiple layers of neurons to complete the computation of the relationships with all associated nodes. According to an exemplary embodiment, a suitable hop count threshold may be set.

In this way, the output of the last layer of neurons can be connected to a classifier and trained to determine whether the user node is abnormal based on the ground route. For example, when the hop count threshold is 1 (i.e., only neighbor nodes within one hop of distance from the user node are considered), the new feature h 'may be used' ₁ And directly connecting to a classifier to judge whether the user node is abnormal.

Modeling the user knowledge graph at block 404 may further include using the trained model to classify with the model of the user knowledge graph, i.e., determine whether the corresponding user node is abnormal, at sub-block 404-3.

The present disclosure innovatively proposes a solution for user anomaly identification based on knowledge-graph and graph convolution. By applying the knowledge graph and the graph volume model to the user abnormity identification, not only all known information and newly researched information of the user can be utilized, but also the group characteristics of the group where the user is located can be fully utilized.

Due to the fact that the complete user map is introduced, the scheme of the method and the device can make full use of previous information and currently acquired information of the user when judging whether the user is abnormal or not, and more importantly, can make use of group characteristics of the category of the user. By using the labeled data as the ground route of the model and training the model on the basis, whether the unlabeled user has abnormality can be predicted.

The knowledge graph is applied to user anomaly identification, and not only all known information and newly researched supplementary information of a user can be utilized, but also the group characteristics of the group where the user is located can be utilized. And the adoption of the graph volume model can ensure that the information of the user graph is fully utilized.

What has been described above is merely exemplary embodiments of the present invention. The scope of the invention is not limited thereto. Any changes or substitutions that may be easily made by those skilled in the art within the technical scope of the present disclosure are intended to be included within the scope of the present disclosure.

The various illustrative logical blocks, modules, and circuits described in connection with the disclosure may be implemented or performed with a general purpose processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other Programmable Logic Device (PLD), discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general-purpose processor may be a microprocessor, but in the alternative, the processor may be any commercially available processor, controller, microcontroller or state machine. A processor may also be implemented as a combination of computing devices, e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration.

The steps of a method or algorithm described in connection with the disclosure may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. The software modules may reside in any form of storage medium known in the art. Some examples of storage media that may be used include Random Access Memory (RAM), Read Only Memory (ROM), flash memory, EPROM memory, EEPROM memory, registers, a hard disk, a removable disk, a CD-ROM, and so forth. A software module may comprise a single instruction, or many instructions, and may be distributed over several different code segments, among different programs, and across multiple storage media. A storage medium may be coupled to the processor such that the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor.

The methods disclosed herein comprise one or more steps or actions for achieving the described method. The method steps and/or actions may be interchanged with one another without departing from the scope of the claims. In other words, unless a specific order of steps or actions is specified, the order and/or use of specific steps and/or actions may be modified without departing from the scope of the claims.

The processor may execute software stored on a machine-readable medium. A processor may be implemented with one or more general and/or special purpose processors. Examples include microprocessors, microcontrollers, DSP processors, and other circuitry capable of executing software. Software should be construed broadly to mean instructions, data, or any combination thereof, whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise. By way of example, a machine-readable medium may include RAM (random access memory), flash memory, ROM (read only memory), PROM (programmable read only memory), EPROM (erasable programmable read only memory), EEPROM (electrically erasable programmable read only memory), registers, a magnetic disk, an optical disk, a hard drive, or any other suitable storage medium, or any combination thereof. The machine-readable medium may be embodied in a computer program product. The computer program product may include packaging material.

In a hardware implementation, the machine-readable medium may be a part of the processing system that is separate from the processor. However, as those skilled in the art will readily appreciate, the machine-readable medium, or any portion thereof, may be external to the processing system. By way of example, a machine-readable medium may include a transmission line, a carrier wave modulated by data, and/or a computer product separate from the wireless node, all of which may be accessed by a processor through a bus interface. Alternatively or additionally, the machine-readable medium or any portion thereof may be integrated into a processor, such as a cache and/or a general register file, as may be the case.

The processing system may be configured as a general purpose processing system having one or more microprocessors that provide processor functionality, and an external memory that provides at least a portion of the machine readable medium, all linked together with other supporting circuitry through an external bus architecture. Alternatively, the processing system may be implemented with an ASIC (application specific integrated circuit) having a processor, a bus interface, a user interface (in the case of an access terminal), support circuitry, and at least a portion of a machine readable medium integrated in a single chip, or with one or more FPGAs (field programmable gate arrays), PLDs (programmable logic devices), controllers, state machines, gated logic, discrete hardware components, or any other suitable circuitry, or any combination of circuitry that is capable of performing the various functionalities described throughout this disclosure. Depending on the particular application and the overall design constraints imposed on the overall system, those skilled in the art will recognize how to implement the functionality described with respect to the processing system.

The machine-readable medium may include several software modules. These software modules include instructions that, when executed by a device, such as a processor, cause the processing system to perform various functions. These software modules may include a transmitting module and a receiving module. Each software module may reside in a single storage device or be distributed across multiple storage devices. As an example, a software module may be loaded into RAM from a hard drive when a triggering event occurs. During execution of the software module, the processor may load some instructions into the cache to increase access speed. One or more cache lines may then be loaded into a general purpose register file for execution by the processor. When referring to the functionality of a software module below, it will be understood that such functionality is implemented by the processor when executing instructions from the software module.

If implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. A storage media may be any available media that can be accessed by a computer. By way of example, and not limitation, such computer-readable media can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer. Any connection is properly termed a computer-readable medium. For example, if the software is transmitted from a web site, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, Digital Subscriber Line (DSL), or wireless technologies such as Infrared (IR), radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of medium. Disk (disk) and disc (disc), as used herein, includes Compact Disc (CD), laser disc, optical disc, Digital Versatile Disc (DVD), floppy disk, and blu-ray disc where disks (disks) usually reproduce data magnetically, while discs (discs) reproduce data optically with lasers. Thus, in some aspects, computer readable media may comprise non-transitory computer readable media (e.g., tangible media). Additionally, for other aspects, the computer-readable medium may comprise a transitory computer-readable medium (e.g., a signal). Combinations of the above should also be included within the scope of computer-readable media.

Accordingly, certain aspects may comprise a computer program product for performing the operations presented herein. For example, such a computer program product may include a computer-readable medium having instructions stored (and/or encoded) thereon, the instructions being executable by one or more processors to perform the operations described herein. In certain aspects, a computer program product may include packaging materials.

It is to be understood that the claims are not limited to the precise configuration and components illustrated above. Various changes, substitutions and alterations in the arrangement, operation and details of the method and apparatus described above may be made without departing from the scope of the claims.

Claims

1. A method of anomaly identification, comprising:

collecting information of a user;

organizing the information of the user into knowledge, wherein the knowledge comprises the relation between the user and the information or between the information and the information;

constructing a knowledge-graph based on the organized knowledge, the knowledge-graph comprising information nodes corresponding to the user and each item of information, and comprising edges corresponding to respective relationships;

modeling the knowledge graph with a spatial domain based graph convolution network to obtain a model; and

training the model to determine whether the user is abnormal based on a graph convolution calculation of the knowledge-graph.

2. The method of claim 1, wherein the knowledge comprises subject, predicate and object SPO triples.

3. The method of claim 2, wherein the knowledge-graph comprises knowledge hosted by the user and information targeted, or knowledge hosted by information and targeted to further information related to the information.

4. The method of claim 3, wherein the knowledge that is hosted by the user and that is targeted at information corresponds to neighboring nodes in the model that have a one-hop distance from the node corresponding to the user, and the knowledge that is hosted by information and that is targeted at further information related to the information corresponds to nodes in the model that have a distance greater than one hop from the node corresponding to the user.

5. The method of claim 1, wherein training the model comprises training the model by using a labeled user as a ground route of the model so that the weights of the edges in the knowledge-graph after training reflect the importance of the corresponding relation in the anomaly recognition.

6. The method of claim 1, wherein the information comprises domain information of a group to which the user belongs and known individual information of individuals of the user.

7. The method of claim 6, wherein the domain information of the group to which the user belongs comprises transaction characteristics of categories such as industry or occupation to which the user belongs; and the known individual information personal to the user comprises personal transaction behavior characteristics of the user.

8. The method of claim 6, wherein the information further comprises newly obtained supplemental information for the user.

9. The method of claim 1, wherein each node in the knowledge-graph carries its own eigenvalue or eigenvector, wherein the graph-volume computation of the knowledge-graph is based on the eigenvalues or eigenvectors of the user nodes and a subset of information nodes.

10. The method of claim 9, wherein the subset of information nodes is determined based on a hop count threshold.

11. An apparatus for anomaly identification, comprising:

means for collecting information of a user;

means for organizing the user's information into knowledge, the knowledge comprising relationships between the user and information, or information and information;

means for constructing a knowledge-graph based on the organized knowledge, the knowledge-graph comprising information nodes corresponding to the user and each item of information, and comprising edges corresponding to respective relationships;

means for modeling the knowledge-graph with a spatial domain based graph convolution network to obtain a model; and

means for training the model to determine whether the user is abnormal based on a atlas computation of the knowledge-graph.

12. The apparatus of claim 11, wherein the knowledge comprises a subject, predicate and object SPO triplet.

13. The apparatus of claim 12, wherein the knowledge-graph comprises knowledge hosted by the user and targeted at information, or knowledge hosted by information and targeted at further information related to the information.

14. The apparatus of claim 13, wherein the knowledge that is hosted by the user and that is targeted at information corresponds to neighboring nodes in the model that have a one-hop distance from the node corresponding to the user, and the knowledge that is hosted by information and that is targeted at further information related to the information corresponds to nodes in the model that have a distance greater than one hop from the node corresponding to the user.

15. The apparatus of claim 11, wherein training the model comprises a user with an existing label as a ground trouth of the model to train the model such that weights of edges in the knowledge-graph after training reflect importance of correspondence in the anomaly recognition.

16. The apparatus of claim 11, wherein the information includes domain information of a group to which the user belongs and known individual information of individuals of the user.

17. The apparatus of claim 16, wherein the domain information of the group to which the user belongs includes transaction characteristics of categories such as industry or occupation to which the user belongs; and the known individual information personal to the user comprises personal transaction behavior characteristics of the user.

18. The apparatus of claim 16, wherein the information further comprises newly obtained supplemental information for the user.

19. The apparatus of claim 11, wherein each node in the knowledge-graph carries its own feature values or feature vectors, wherein the graph convolution computation on the knowledge-graph is based on the feature values or feature vectors of the user nodes and a subset of information nodes.

20. The apparatus of claim 19, wherein the subset of information nodes is determined based on a hop count threshold.

21. An apparatus for anomaly identification, comprising:

a memory; and

a processor coupled to the memory and configured to:

collecting information of a user;

22. A computer-readable storage medium having stored thereon processor-executable instructions that, when executed by a processor, are operable to cause the processor to perform an exception identification operation comprising:

collecting information of a user;