Abnormal group detection method based on unsupervised algorithm

Abstract

The invention discloses an abnormal group detection method based on an unsupervised algorithm. The method comprises the following steps: S1, carrying out data preprocessing and feature screening; S2, calculating user similarity; S3, clustering by using an unsupervised algorithm according to the user similarity to form a group; S4, using a frequent set mining algorithm to analyze a group aggregation reason and an aggregation degree; and S5, scoring groups formed by clustering, and selecting risk groups. According to the method, a large number of labeled samples are not needed before modeling, and only a small number of labeled samples or basic service experience are needed. Label samples often need a large amount of manual labeling work, even more label samples cannot be obtained in some service scenes, and the service scenes suitable for a model are enriched while the manual labeling cost is saved.

Description

technical field [0001] The invention relates to the technical field of electronic information, in particular to an abnormal group detection method based on an unsupervised algorithm. Background technique [0002] With the rapid development of society, the Internet has penetrated into all walks of life and affects everyone. As the saying goes, where there is sunshine, there are shadows. While enjoying the comfortable and convenient life brought by the Internet, people are also facing various risks. Risks are particularly prominent in industries with rapid Internet development such as e-commerce, finance, and payment. Words such as arbitrage, order swiping, money laundering, and false registration are no longer unfamiliar to the public. The diversification of black industry attack methods has brought difficulties to risk identification. Traditional black industry countermeasures are mainly divided into three types: expert rules, supervised models, and black and white list m...

AI Technical Summary

Problems solved by technology

Expert rules have the advantages of high accuracy, flexible rule changes, and significant detection effects, but require business personnel to have strong business experience, and the coverage is limited. The rules are basically based on the summary and induction of historical risk events, which cannot be done. Early perception of new risk types

The supervised model is widely used, but it is also unable to cope with the ever-changing hacking methods, and can only passively deal with fraud, and requires a large number of accurate sample labels, and the results lack interpretability

Images