Network illegal transaction relation prediction method and system based on association rules

Abstract

The invention discloses a network illegal transaction relation prediction method and system based on association rules, and relates to the technical field of information text analysis, and the method comprises the steps: collecting the related information information of a network illegal transaction suspect, carrying out the text preprocessing, and making a data set; based on the data set, calculating an association degree between words and marked vocabularies in the data set, and obtaining a latent language in a communication process of the two transaction parties; and based on the obtained latent language, performing semantic similarity calculation to judge a potential suspect, judging whether the suspect is a potential core person or not according to the communication active degree, and determining a character relationship network. According to the method, the latent language used in the transaction process can be effectively recognized, the recognition difficulty caused by the use of the latent language in illegal transactions can be overcome, and the efficiency and accuracy of discovering and fighting against network illegal transactions by law enforcement departments are remarkably improved. Adjustment and optimization are carried out according to different types of illegal transactions, and the method has important practical significance in maintaining network space order, fighting against network crimes and protecting public benefits.

Description

Technical Field

[0001] The present invention relates to the technical field of information text analysis, and in particular to a method and system for predicting illegal online transaction relationships based on association rules. Background Art

[0002] With the increasing popularity of the Internet and online chat tools, a large number of illegal items and services have emerged on the Internet. Unlike traditional offline illegal transactions, online illegal transactions are more covert in their means and channels, involving more people and covering a wider geographical area. Related illegal trading activities have undergone tremendous changes in transaction methods, payment methods, and transportation methods.

[0003] When conducting illegal transactions on the Internet, illegal traders use real-time communication tools such as WeChat and QQ, or email and other communication software to complete transactions. In order to prevent online chat records from being suspected, illegal merchants and their traders often use cryptic language to refer to sensitive words in transactions. In order to more accurately identify whether illegal transactions are being conducted, potential cryptic language can be identified through correlation rule calculation. By calculating the similarity of the text content of the suspect and his chat records on various chat software, potential traders who may conduct illegal transactions with the suspect can be identified. Summary of the invention

[0004] In view of the problems existing in the existing network illegal transaction relationship prediction method based on association rules, the present invention is proposed.

[0005] Therefore, the problem to be solved by the present invention is that illegal traders use cryptic language when conducting illegal transactions using network communication software, which makes the chat records of the transactions secret and difficult to quickly identify.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In the first aspect, an embodiment of the present invention provides a method for predicting the relationship of illegal online transactions based on association rules, which includes collecting relevant intelligence information of suspects of illegal online transactions for text preprocessing to form a data set; based on the data set, calculating the degree of association between words and marker words in the data set to obtain the cryptic language of the communication process between the two parties to the transaction; based on the obtained cryptic language, performing semantic similarity calculation to judge potential suspects, and judging whether they are potential core personnel based on the degree of communication activity, and determining the character relationship network.

[0008] As a preferred solution of the network illegal transaction relationship prediction method based on association rules of the present invention, the preprocessing includes: data cleaning: including removing stop words and performing Chinese word segmentation; feature extraction: preparing relevant dictionaries for the current illegal transaction field, retaining and extracting special words and proper nouns; separately counting the chat records between the suspect and the contact according to the communication time, treating the communication records with a difference interval not exceeding a certain limit as one communication, and counting the relevant words and their word frequencies appearing in each communication; dividing the communication information of each contact into a separate data group, including the vocabulary c i 、Word frequency f i , AC frequency t m , average time interval x m ; Based on the suspect's vocabulary, combined with the illegal transaction field dictionary, another data set is constructed, which includes vocabulary a i 、word frequency f i '; The obtained multiple data groups g k and data set g k 'Build datasets G and G respectively'.

[0009] As a preferred solution of the network illegal transaction relationship prediction method based on association rules of the present invention, wherein: the data set g k It is expressed as:

[0010] g k ={(c1,f1)...(c i ,f i )...(c j ,f j ), t m ,x m}

[0011] Among them, j,m∈N, N is a set of natural numbers, c i Indicates the contact vocabulary, f i Indicates c i The word frequency, t m Indicates the frequency of contact communication, x m It represents the average time interval between two exchanges; g k The data set G is made and expressed as:

[0012] G={g1,...g k ,...g n}

[0013] Where n represents the number of contacts of the suspect.

[0014] As a preferred solution of the network illegal transaction relationship prediction method based on association rules of the present invention, wherein: the data set g'k It is expressed as:

[0015] g' k ={(a1,f'1)...(a i ,f i ')...(a j ,f j '), t' m ,x m}

[0016] Among them, a i Indicates suspect vocabulary, f' i Indicates a i The word frequency of t' m Indicates the frequency of the suspect's communication; g' k The data set G' is made into:

[0018] G'={g' k1 ,...g' kn}

[0019] Furthermore, a i Includes contact vocabulary c i and the word b in the corresponding domain dictionary, if there is a word c∈a i But not ∈c i , corresponding to the vocabulary f i According to the remaining c i The average value is calculated for the first p% of the maximum word frequency.

[0020] As a preferred solution of the network illegal transaction relationship prediction method based on association rules of the present invention, the following is described: based on the data set G, the lingo of the communication process is obtained, and the degree of association between the words in the data set G and the words in the suspect vocabulary set G' is calculated using the apriori algorithm, and the lingo is discovered according to the calculation results, and a new illegal vocabulary dictionary is updated and sorted out; the lingo is determined by the lifting degree, and the formula is expressed as follows:

[0021]

[0022]

[0023] The mined cryptanalysts are scored according to the different degrees of lift, and the numerical distribution of the word frequency, support, and confidence calculation results are comprehensively considered. The appropriate minimum value θ is selected based on practical application experience. If the score w of the cryptanalyst vocabulary is i ≤θ, the words with scores below the threshold are deleted, and the data subset g to which the person belongs is k Update to g i ={(c1,f1,w1)...(ci ,f i ,w i )...(c j ,f j ,w j ), t m ,x m}, update g' k is: g' k ={(a1,f'1,w1)...(a i ,f' i ,w i )...(a j ,f j ',w j ), t' m ,x m}.

[0024] As a preferred solution of the network illegal transaction relationship prediction method based on association rules of the present invention, wherein: similarity judgment is performed based on the cryptic words, the data is normalized, and the As one of the vector components, is the average value of f in all user data g corresponding to the vocabulary; then the calculation of content similarity is expressed as:

[0025]

[0026] Among them, f represents the word frequency f of all vocabulary c, g includes g' k and g k .

[0027] As a preferred solution of the network illegal transaction relationship prediction method based on association rules described in the present invention, wherein: based on the calculation of content similarity, a similarity matrix is ​​obtained, which is expressed as:

[0028]

[0029] According to the numerical values ​​in the similarity matrix, select the maximum inter-class variance method, the adaptive threshold method and the histogram analysis method, and select and calculate the appropriate standard minimum threshold λ and the maximum threshold μ. If they exist:

[0030]

[0031] Then there exists g j 'with g k 'The topics are different, otherwise, the two topics are determined to be the same; then the corresponding data is divided into three parts, including: topics related to illegal transactions, topics unrelated to illegal transactions, and topics that cannot be determined; if there is g i and g' ibelong to the same category, then it is determined that the suspect and the dialogue object have conducted a dialogue behavior related to the illegal criminal transaction; according to the s obtained in the previous step i,j Further calculate the activity level of illegal transactions between the two i , expressed as:

[0032]

[0033] Based on the transaction activity of the suspect and his contacts, i And whether there is a lower-level buyer factor to judge whether it is an intermediary, set the activity evaluation standard to β, expressed as:

[0034]

[0035] If i,j <λ,p i >β, then it is judged to have a high topic activity and may be a middleman; if s i,j <λ,p i ≤β, then the topic relevance is high, but the activity level is low, which may be the end buyer; if s i,j ≥λ,p i >β, then the topic relevance is low but the activity is high, and they may be relatives or friends of the suspect.

[0036] In the second aspect, an embodiment of the present invention provides a network illegal transaction relationship prediction system based on association rules, which includes: a collection module, which is used to collect relevant intelligence information of suspects of network illegal transactions for text preprocessing to form a data set; a calculation module, which is used to calculate the degree of association between words and marker words in the data set based on the data set, and obtain the lingo in the communication process between the two parties to the transaction; a judgment module, which is used to perform semantic similarity calculation based on the obtained lingo to judge potential suspects, and judge whether they are potential core personnel based on the degree of communication activity, and determine the character relationship network.

[0037] In a third aspect, an embodiment of the present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, wherein: when the processor executes the computer program, it implements any step of the above-mentioned method for predicting network illegal transaction relationships based on association rules.

[0038] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, any step of the above-mentioned method for predicting illegal online transaction relationships based on association rules is implemented.

[0039] The beneficial effect of the present invention is that the present invention can effectively identify the lingo used in the transaction process, which can not only overcome the difficulty of identification caused by the use of lingo in illegal transactions, but also objectively quantify the closeness of the transaction relationship through mathematical models. It significantly improves the efficiency and accuracy of law enforcement agencies in discovering and combating illegal online transactions, and provides strong technical support for network security supervision. In addition, it also has strong adaptability and scalability, and can be adjusted and optimized according to different types of illegal transactions, which has important practical significance and application value for maintaining the order of cyberspace, combating cybercrime, and protecting the public interest. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0041] Figure 1 is a flow chart of the present invention;

[0042] Figure 2 This is a logical diagram for constructing an illegal transaction relationship network. DETAILED DESCRIPTION

[0043] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0044] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0045] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0046] Example 1

[0047] Reference Figure 1 and Figure 2, which is the first embodiment of the present invention, provides a method for predicting illegal online transaction relationships based on association rules, including:

[0048] S1: Collect intelligence information related to suspects of illegal online transactions, perform text preprocessing, and generate data.

[0049] Preprocessing includes:

[0050] Data cleaning: including removing stop words and performing Chinese word segmentation;

[0051] Feature extraction: prepare relevant dictionaries for the current illegal transaction field, retain and extract special words and proper nouns;

[0052] The chat records between the suspect and the contact are separated and counted according to the communication time, and the communication records with a time difference not exceeding a certain limit are regarded as one communication, and the relevant words and their frequency in each communication are counted;

[0053] Divide the communication information of each contact into a separate data group, including vocabulary c i 、word frequency f i , AC frequency t m , average time interval x m ;

[0054] Based on the suspect's vocabulary, combined with the illegal transaction field dictionary, another data set is constructed, which includes vocabulary a i 、word frequency f i ';

[0055] The obtained multiple data sets g k and data set g k 'Build datasets G and G respectively'.

[0056] S2: Based on the data set, the correlation between the words in the data set and the marked words is calculated to obtain the lingo of the communication process between the transaction parties.

[0057] Data Group g k It is expressed as:

[0058] g k ={(c1,f1)...(c i ,f i )...(c j ,f j ), t m ,x m}

[0059] Among them, j,m∈N, N is a set of natural numbers, c i Indicates the contact vocabulary, f i Indicates c iThe word frequency, t m Indicates the frequency of contact communication, x m It represents the average time interval between two exchanges;

[0060] G k The data set G is made and expressed as:

[0061] G={g1,...g k ,...g n}

[0062] Where n represents the number of contacts of the suspect.

[0063] Data set g' k It is expressed as:

[0064] g' k ={(a1,f'1)...(a i ,f i ')...(a j ,f j '), t' m ,x m}

[0065] Among them, a i Indicates the suspect word, f i ' means a i The word frequency of t' m Indicates the frequency of suspect communication;

[0066] Will g' k The data set G' is made into:

[0068] G'={g' k1 ,...g' kn}

[0069] Furthermore, a i Includes contact vocabulary c i and the word b in the corresponding domain dictionary, if there is a word c∈a i But not ∈c i , corresponding to the vocabulary f i According to the remaining c i The average value is calculated for the first p% of the maximum word frequency.

[0070] S3: Based on the acquired codewords, similarity calculation is performed to identify potential suspects, and at the same time, the communication frequency is used to identify key core personnel.

[0071] The codewords in the communication process are obtained based on the data set G. The apriori algorithm is used to calculate the degree of association between the words in the data set G and the words in the suspect vocabulary set G', and the codewords are discovered according to the calculation results, and a new illegal vocabulary dictionary is updated and sorted out; the codewords are determined by the lifting degree, and the formula is expressed as follows:

[0072]

[0073]

[0074] Score the discovered secret words according to the different degrees of improvement, and select the appropriate minimum value θ based on the calculation results.

[0075] If the score of the codeword is w i ≤θ, the words with scores below the threshold are deleted, and the data subset g to which the person belongs is k Update to: g i ={(c1,f1,w1)...(c i ,f i ,w i )...(c j ,f j ,w j ), t m ,x m}, update g' k is: g' k ={(a1,f'1,w1)...(a i ,f' i ,w i )...(a j ,f j ',w j ), t' m ,x m}.

[0076] Determine whether there is a correlation between two things, including:

[0077] The support is judged to be greater than the minimum support threshold;

[0078] Find all frequent item sets, generate association rules, calculate confidence, and exclude rules that are less than the minimum confidence threshold.

[0079] In short, support refers to the probability of thing a and thing b appearing at the same time; confidence refers to the probability of thing b appearing under the premise of thing a appearing, and lift is their ratio.

[0080] The purpose here is to extract words related to illegal transactions in this field from the disorganized original data by comparing it with a part of known illegal transaction words in this field. The words are called "code words".

[0081] The core of the apriori algorithm is what is shown in the above three expressions. The disadvantage of this algorithm is that the data is mixed and the iterative process has a large amount of computational redundancy. It adopts certain grouping, data screening and matching methods to reduce the complexity of the iterative process.

[0082] Based on the codeword, similarity judgment is performed, because f i The corresponding numerical part is greater than w i The corresponding value is then normalized and the data is used As one of the vector components, is the average value of f in all user data g corresponding to the vocabulary;

[0083]

[0084] Among them, f represents the word frequency f of all vocabulary c, g includes g' k and g k .

[0085] S4: Create a core data set based on the intelligence information of key core personnel, determine whether the transaction is an entity based on the core data set, extract relevant information appearing in the core data set to predict and intercept the transaction.

[0086] The core data set includes: types and characteristics of illegal online transactions, as well as address information contained in related intelligence.

[0087] Based on the calculation of content similarity, the similarity matrix is ​​obtained, which is expressed as:

[0088]

[0089] Select the appropriate standard minimum threshold λ and maximum threshold μ according to the values ​​in the matrix, if they exist:

[0090]

[0091] Then there exists g j 'with g k 'The topics are different, otherwise, the two topics are judged to be the same.

[0092] The corresponding data are then divided into three parts, including: topics related to illegal transactions, topics unrelated to illegal transactions, and topics where the subject cannot be determined;

[0093] If there is g i as well as' iIf they belong to the same category, it is determined that the suspect and the conversation partner had a conversation related to the illegal criminal transaction;

[0094] According to the s obtained in the previous step i,j Further calculate the activity level of illegal transactions between the two i , expressed as:

[0095]

[0096] According to the transaction activity of both parties p i And whether there is a lower-level buyer factor to judge whether it is an intermediary, set the activity evaluation standard to β, expressed as:

[0097]

[0098] If i,j <λ,p i >β, then it is judged to have a high topic activity and may be a middleman;

[0099] If i,j <λ,p i ≤β, then the topic relevance is high, but the activity level is low, which may be the end buyer;

[0100] If i,j ≥λ,p i >β, then the topic relevance is low but the activity is high, and they may be relatives or friends of the suspect.

[0101] The middleman is the core point of the next calculation, the new suspect, the axis of the transaction network, and also a member of the key core personnel. The key core personnel include a large number of end traders, upper or lower transaction agents, and are judged by the frequency of contact between the two and whether there are upper and lower traders.

[0102] In summary, the present invention can effectively identify the lingo used in the transaction process, which can not only overcome the difficulty of identification caused by the use of lingo in illegal transactions, but also objectively quantify the closeness of the transaction relationship through mathematical models. It significantly improves the efficiency and accuracy of law enforcement agencies in discovering and combating illegal online transactions, and provides strong technical support for network security supervision. In addition, it also has strong adaptability and scalability, and can be adjusted and optimized according to different types of illegal transactions. It has important practical significance and application value for maintaining the order of cyberspace, combating cybercrime, and protecting the public interest.

[0103] Example 2

[0104] Reference Figure 1Based on the first embodiment, this embodiment further provides a network illegal transaction relationship prediction system based on association rules, including:

[0105] The collection module is used to collect intelligence information related to suspects of illegal online transactions, perform text preprocessing, and generate a data set;

[0106] A calculation module, used to calculate the degree of association between words in the data set and the marked words based on the data set, and obtain the lingo in the communication process between the transaction parties;

[0107] The judgment module is used to perform semantic similarity calculation based on the acquired code words to judge potential suspects, and to determine whether they are potential core personnel based on the degree of communication activity and determine the character relationship network.

[0108] This embodiment also provides a computer device, which is suitable for the network illegal transaction relationship prediction method based on association rules, including a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the network illegal transaction relationship prediction method based on association rules as proposed in the above embodiment.

[0109] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0110] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the method for predicting illegal online transaction relationships based on association rules as proposed in the above embodiment is implemented.

[0111] The storage medium proposed in this embodiment and the data storage method proposed in the above embodiment belong to the same inventive concept. The technical details not fully described in this embodiment can be found in the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0112] Example 3

[0113] On the basis of the previous two embodiments, this embodiment provides a method for predicting illegal online transaction relationships based on association rules. In order to verify the beneficial effects of the present invention, a scientific demonstration is carried out through simulation experiments.

[0114] In order to fully verify the effectiveness of the method of the present invention, a series of in-depth simulation experiments were carried out, and a multi-dimensional comparison was made with three existing methods, including the traditional keyword matching method, the text classification method based on machine learning (SVM), and the LSTM (Long Short-Term Memory) network method based on deep learning.

[0115] The experimental data is 1,000 sets of real network communication record samples obtained by a law enforcement agency, including 200 sets of confirmed illegal transactions and 800 sets of ordinary transactions. These samples have been anonymized to protect privacy information.

[0116] The experimental setup includes:

[0117] Traditional keyword matching method: using a pre-defined list of illegal transaction keywords for matching.

[0118] Machine learning-based text classification: Use the support vector machine (SVM) algorithm to train and classify with TF-IDF features.

[0119] Deep learning based LSTM network method: Use pre-trained word embedding model and LSTM network for sequence classification.

[0120] Evaluation metrics include:

[0121] Accuracy

[0122] Precision

[0123] Recall

[0124] F1 score;

[0125] AUC-ROC (Area Under the Curve-Receiver Operating Characteristic);

[0126] Code language recognition rate;

[0127] Accuracy of constructing character relationship network.

[0128] The experimental results are shown in Table 1:

[0129] Table 1 Comparative experimental results data table

[0130]

[0131] As shown in Table 1, the method of the present invention is significantly superior to other methods in terms of accuracy, precision, recall and F1 score, especially in dealing with complex illegal transaction samples. The AUC-ROC value of the method reaches 0.968, which is close to perfect classification, indicating that it can maintain excellent classification performance under different thresholds.

[0132] When dealing with new lingo, this method showed strong adaptability. 20 groups of samples using new lingo were deliberately added to the test set. This method successfully identified 17 groups, while other methods could only identify 12 groups at most.

[0133] The advantages of this method are more obvious when constructing large-scale personal relationship networks. By simulating a large illegal transaction network containing 100 nodes, this method successfully restored 88% of the network structure, while other methods only reached a maximum of 80%.

[0134] Through this comprehensive simulation experiment, we can clearly see that the method of the present invention is significantly superior to the existing technology in multiple key indicators. It not only improves the accuracy and comprehensiveness of illegal transaction identification, but also demonstrates strong capabilities in cryptanalysis recognition and character relationship network construction. These results fully demonstrate the great potential of the method of the present invention in practical applications, and are of great significance to improving the supervision and crackdown capabilities of illegal online transactions.

[0135] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for predicting illegal online transaction relationships based on association rules, characterized by: include, Collect intelligence information related to suspects of illegal online transactions, perform text preprocessing, and create a data set; Based on the data set, the correlation between the words in the data set and the marked words is calculated to obtain the lingo of the communication process between the transaction parties; Based on the acquired code words, semantic similarity calculation is performed to identify potential suspects, and based on the level of communication activity, it is determined whether they are potential core personnel and the relationship network of the characters is determined.

2. The method for predicting illegal online transaction relationships based on association rules as claimed in claim 1, characterized in that: The pretreatment includes: Data cleaning: including removing stop words and performing Chinese word segmentation; Feature extraction: prepare relevant dictionaries for the current illegal transaction field, retain and extract special words and proper nouns; The chat records between the suspect and the contact are separated and counted according to the communication time, and the communication records with a time difference not exceeding a certain limit are regarded as one communication, and the relevant words and their frequency in each communication are counted; Divide the communication information of each contact into a separate data group, including vocabulary c i 、Word frequency f i , AC frequency t m , average time interval x m ; Based on the suspect's vocabulary, combined with the illegal transaction field dictionary, another data set is constructed, which includes vocabulary a i 、Word frequency f i '; The obtained multiple data sets g k and data set g k 'Build datasets G and G respectively'.

3. The method for predicting illegal online transaction relationships based on association rules as claimed in claim 2, characterized in that: The data set g k It is expressed as: g k ={(c1,f1)...(c i ,f i )...(c j ,f j ),t m ,x m } Among them, j,m∈N, N is a set of natural numbers, c i Indicates the contact vocabulary, f i Indicates c i The word frequency, t m Indicates the frequency of contact communication, x m It represents the average time interval between two exchanges; G k The data set G is made into: G={g1,...g k ,...g n } Where n represents the number of contacts of the suspect.

4. The method for predicting illegal online transaction relationships based on association rules as claimed in claim 3, characterized in that: The data set g' k It is expressed as: to k ={(a1,f'1)...(a i ,f i ')...(a j ,f j '),t' m ,x m } Among them, a i Indicates suspect vocabulary, f' i Indicates a i The word frequency of t' m Indicates the frequency of suspect communication; Will g' k The data set G' is made into: G'={g' k1 ,...g' kn } Furthermore, a i Includes contact vocabulary c i and the word b in the corresponding domain dictionary, if there is a word c∈a i But not ∈c i , corresponding to the vocabulary f i According to the remaining c i The average value is calculated for the first p% of the maximum word frequency.

5. The method for predicting illegal online transaction relationships based on association rules as claimed in claim 4, characterized in that: The codewords in the communication process are obtained based on the data set G. The apriori algorithm is used to calculate the degree of association between the words in the data set G and the words in the suspect vocabulary set G', and the codewords are discovered according to the calculation results, and a new illegal vocabulary dictionary is updated and sorted out; the codewords are determined by the lifting degree, and the formula is expressed as follows: The mined cryptanalysts are scored according to the different degrees of lift, and the numerical distribution of the word frequency, support, and confidence calculation results are comprehensively considered. The appropriate minimum value θ is selected in combination with practical application experience. If the score of the codeword is w i ≤θ, the words with scores below the threshold are deleted, and the data subset g to which the person belongs is k Update to g i ={(c1,f1,w1)...(c i ,f i ,w i )...(c j ,f j ,w j ), t m ,x m }, Update g' k is: g' k ={(a1,f'1,w1)...(a i ,f' i ,w i )...(a j ,f j ',w j ), t' m ,x m }.

6. The method for predicting illegal online transaction relationships based on association rules as claimed in claim 5, characterized in that: Based on the codeword, similarity is judged and the data is normalized. As one of the vector components, is the average value of f in all user data g corresponding to the vocabulary; then the calculation of content similarity is expressed as: Among them, f represents the word frequency f of all vocabulary c, g includes g' k and g k .

7. The method for predicting illegal online transaction relationships based on association rules as claimed in claim 6, characterized in that: Based on the calculation of content similarity, the similarity matrix is ​​obtained, which is expressed as: According to the numerical values ​​in the similarity matrix, select the maximum inter-class variance method, the adaptive threshold method and the histogram analysis method, and select and calculate the appropriate standard minimum threshold λ and the maximum threshold μ. If they exist: Then there exists g j 'with g k 'The topics are different, otherwise, the two topics are considered to be the same; The corresponding data are then divided into three parts, including: topics related to illegal transactions, topics unrelated to illegal transactions, and topics where the subject cannot be determined; If there is g i and g' i If they belong to the same category, it is determined that the suspect and the conversation partner had a conversation related to the illegal criminal transaction; According to the s obtained in the previous step i,j Further calculate the activity level of illegal transactions between the two i , expressed as: Based on the transaction activity of the suspect and his contacts, i And whether there is a lower-level buyer factor to judge whether it is an intermediary, set the activity evaluation standard to β, expressed as: If i,j <λ,p i >β, then it is judged to have a high topic activity and may be a middleman; If i,j <λ,p i ≤β, then the topic relevance is high, but the activity level is low, which may be the end buyer; If i,j ≥λ,p i >β, then the topic relevance is low but the activity is high, and they may be relatives or friends of the suspect.

8. A network illegal transaction relationship prediction system based on association rules, based on the network illegal transaction relationship prediction method based on association rules according to any one of claims 1 to 7, characterized in that: include, The collection module is used to collect intelligence information related to suspects of illegal online transactions, perform text preprocessing, and generate a data set; A calculation module, used to calculate the degree of association between words in the data set and the marked words based on the data set, and obtain the lingo in the communication process between the transaction parties; The judgment module is used to perform semantic similarity calculation based on the acquired code words to judge potential suspects, and to determine whether they are potential core personnel based on the degree of communication activity and determine the character relationship network.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method for predicting illegal online transaction relationships based on association rules described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for predicting illegal online transaction relationships based on association rules described in any one of claims 1 to 7 are implemented.

Images