Case series-parallel analysis method and device based on multi-dimensional features and computer equipment

Abstract

The invention relates to a multi-dimensional feature-based case series-parallel analysis method and device, computer equipment and a storage medium. The method comprises the following steps: performing feature extraction processing on denoised sample data of each case sample to obtain a case feature set of the corresponding case sample; performing vector construction processing according to the case feature set of each case sample to obtain a multi-dimensional feature vector of the corresponding case sample, and performing calculation according to the multi-dimensional feature vector of each case sample to obtain a reference multi-dimensional feature vector; performing similarity analysis according to the multi-dimensional feature vector of each case sample and the reference multi-dimensional feature vector to obtain case similarity of each case sample; wherein the case similarity is the similarity between the multi-dimensional feature vector of the corresponding case sample and the reference multi-dimensional feature vector; in response to the existence of the target case similarity, recording a case identity identification number of a case sample corresponding to the target case similarity to a case string, and analyzing a statistical result; by adopting the method, the efficiency and the accuracy can be improved.

Description

Technical Field

[0001] The present application relates to the field of criminal investigation technologies, and particularly to a method, device, computer device, and storage medium for case linking and analysis based on multi-dimensional features. Background Art

[0002] With the development of society, cybercrime activities have increased day by day, and criminal means have become more concealed and complex. Case linking and analysis is an important measure for relevant departments handling cases. It mainly refers to linking a series of cases corresponding to a person or a team, and organizing special cases for handling together, which is a case handling method that extends from one case to multiple cases. It can maximize the concentration of case handling information, narrow the scope of case handling, and thus achieve the purpose of quickly closing cases and saving case handling resources.

[0003] However, traditional case linking and analysis methods have problems such as low efficiency or low accuracy. Summary of the Invention

[0004] Based on this, it is necessary to provide a method, device, computer device, and storage medium for case linking and analysis based on multi-dimensional features that can improve efficiency and accuracy in view of the above technical problems.

[0005] In a first aspect, a method for case linking and analysis based on multi-dimensional features is provided. The method includes:

[0006] Obtain sample data of a preset number of case samples, and perform feature denoising processing on each sample data to obtain denoised sample data of the corresponding case sample;

[0007] Perform feature extraction processing on the denoised sample data of each case sample to obtain a case feature set of the corresponding case sample; the case feature set includes each case feature; the case feature includes one or more of a case category feature, a case time domain feature, a case involved amount feature, a case occurrence process feature, a case fraud tool feature, a case fraud-related server feature, a case third-party service information feature, a case fraud-related software application network flow expansion line feature, and a case fund tracking feature;

[0008] Perform vector construction processing according to the case feature sets of each case sample to obtain a multi-dimensional feature vector of the corresponding case sample, calculate a reference multi-dimensional feature vector according to the multi-dimensional feature vectors of each case sample, and perform similarity analysis according to the multi-dimensional feature vectors of each case sample and the reference multi-dimensional feature vector to obtain the case similarity of each case sample; wherein, the case similarity is the similarity between the multi-dimensional feature vector of the corresponding case sample and the reference multi-dimensional feature vector;

[0009] In response to the existence of the similarity of the target case, record the case identity number of the case sample corresponding to the similarity of the target case in the case serial connection analysis and statistics result; the similarity of the target case is the case similarity greater than the similarity threshold.

[0010] In one embodiment, obtain the sample data of a preset number of case samples, including: obtain the original sample data of each case sample; perform data cleaning processing on the original sample data of each case sample to obtain the cleaned original sample data of the corresponding case sample; perform data deduplication processing on the cleaned original sample data of each case sample to obtain the deduplicated original sample data of the corresponding case sample; perform data format conversion processing on the deduplicated original sample data of each case sample to obtain the sample data of the corresponding case sample.

[0011] In one embodiment, after performing feature denoising processing on each sample data, obtain the denoised sample data of the corresponding case sample, including: in response to the selection operation of the feature selection algorithm, determine the target feature selection algorithm; wherein, the feature selection algorithm includes the mutual information algorithm, the F-test algorithm, and the chi-square test algorithm; based on the target feature selection algorithm, perform feature denoising processing on each sample data to obtain the denoised sample data of the corresponding case sample.

[0012] In one embodiment, after performing vector construction processing according to the case feature sets of each case sample, obtain the multi-dimensional feature vectors of the corresponding case samples, including: perform feature quantity statistics according to the case feature sets of each case sample to obtain the feature quantity of the corresponding case sample; determine the maximum feature quantity according to the maximum value in the feature quantities of each case sample, and determine the number of axes of the multi-dimensional space coordinate system according to the maximum feature quantity, and construct a multi-dimensional space coordinate system according to the number of axes; statistically calculate the feature statistical values of each case feature according to the case feature sets of each case sample, and perform normalization processing on the feature statistical values of each case feature to obtain the coordinate value set of the corresponding case sample; the coordinate value set includes the coordinate values of the corresponding case feature on each axis; perform coordinate calculation according to the coordinate value set of each case sample to obtain the multi-dimensional feature vectors of the corresponding case samples.

[0013] In one embodiment, after performing calculations according to the multi-dimensional feature vectors of each case sample, obtain the reference multi-dimensional feature vector, including: perform weighted average calculation according to the feature statistical values of each case feature to obtain the reference multi-coordinate value set; the reference multi-coordinate value set includes the weighted average values of the coordinate values of all case features on each axis; generate a reference multi-dimensional feature vector according to the reference multi-coordinate value set.

[0014] In one embodiment, after performing similarity analysis based on the multi-dimensional feature vectors of each case sample and the reference multi-dimensional feature vector, the case similarity of each case sample is obtained, including: calculating the cosine values of the multi-dimensional feature vectors of each case sample and the reference multi-dimensional feature vector respectively; and determining the cosine value corresponding to each case sample as the case similarity of the corresponding case sample.

[0015] In one embodiment, the method further includes: generating a case similarity statistical graph based on the case similarities of each case sample; and displaying the similarity statistical graph on a case similarity display interface.

[0016] In a second aspect, a case linking and merging analysis device based on multi-dimensional features is provided. The device includes a data acquisition module, a feature extraction module, a similarity analysis module, and a case linking and merging analysis statistical result recording module.

[0017] Among them, the data acquisition module is configured to acquire the sample data of a preset number of case samples, and perform feature denoising processing on each sample data to obtain the denoised sample data of the corresponding case sample; the feature extraction module is configured to perform feature extraction processing on the denoised sample data of each case sample to obtain the case feature set of the corresponding case sample; the case feature set includes each case feature; the case feature includes one or more of a case category feature, a case time domain feature, a case involved amount feature, a case occurrence process feature, a case fraud tool feature, a case fraud-related server feature, a case third-party service information feature, a case fraud-related software application network flow expansion line feature, and a case fund tracking feature; the similarity analysis module is configured to perform vector construction processing based on the case feature sets of each case sample to obtain the multi-dimensional feature vector of the corresponding case sample, calculate a reference multi-dimensional feature vector based on the multi-dimensional feature vectors of each case sample, and perform similarity analysis based on the multi-dimensional feature vectors of each case sample and the reference multi-dimensional feature vector to obtain the case similarity of each case sample; among them, the case similarity is the similarity between the multi-dimensional feature vector of the corresponding case sample and the reference multi-dimensional feature vector; the case linking and merging analysis statistical result recording module is configured to, in response to the existence of a target case similarity, record the case identity number of the case sample corresponding to the target case similarity to the case linking and merging analysis statistical result; the target case similarity is a case similarity greater than the similarity threshold.

[0018] In a third aspect, a computer device is provided. The computer device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, the steps of any one of the methods in the above method embodiments are implemented.

[0019] In a fourth aspect, a computer-readable storage medium is provided. A computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of any one of the methods in the above method embodiments are implemented.

[0020] The above case linking and analyzing method, device, computer device, and storage medium based on multi-dimensional features obtain sample data of a preset number of case samples, and perform feature denoising processing on each sample data to obtain the denoised sample data of the corresponding case sample; then, perform feature extraction processing on the denoised sample data of each case sample to obtain the case feature set of the corresponding case sample; the case feature set includes each case feature; the case feature includes one or more of the case category feature, the case time domain feature, the case involved amount feature, the case occurrence process feature, the case fraud tool feature, the case fraud-related server feature, the case third-party service information feature, the case fraud-related software application network flow expansion line feature, and the case fund tracking feature; then, perform vector construction processing according to the case feature set of each case sample to obtain the multi-dimensional feature vector of the corresponding case sample, calculate according to the multi-dimensional feature vectors of each case sample to obtain a reference multi-dimensional feature vector, and perform similarity analysis according to the multi-dimensional feature vectors of each case sample and the reference multi-dimensional feature vector to obtain the case similarity of each case sample; wherein, the case similarity is the similarity between the multi-dimensional feature vector of the corresponding case sample and the reference multi-dimensional feature vector; finally, in response to the existence of a target case similarity, record the case identity number of the case sample corresponding to the target case similarity in the case linking and analyzing statistical result; the target case similarity is the case similarity greater than the similarity threshold, which improves the efficiency and accuracy of case linking and analysis, thereby improving the efficiency of case detection and broadening the feature range of case linking and analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is an application environment diagram of the case linking and analyzing method based on multi-dimensional features in an embodiment;

[0022] Figure 2 It is the first process schematic diagram of the case linking and analyzing method based on multi-dimensional features in an embodiment;

[0023] Figure 3 It is the process schematic diagram of obtaining the sample data of a preset number of case samples in an embodiment;

[0024] Figure 4 It is the process schematic diagram of performing feature denoising processing on each sample data to obtain the denoised sample data of the corresponding case sample in an embodiment;

[0025] Figure 5 It is the process schematic diagram of performing vector construction processing according to the case feature set of each case sample to obtain the multi-dimensional feature vector of the corresponding case sample in an embodiment;

[0026] Figure 6Schematic flowchart of obtaining a reference multi-dimensional feature vector after calculation based on the multi-dimensional feature vectors of each case sample in an embodiment;

[0027] Figure 7 Schematic flowchart of obtaining the case similarity of each case sample after similarity analysis based on the multi-dimensional feature vectors and the reference multi-dimensional feature vector of each case sample in an embodiment;

[0028] Figure 8 Schematic diagram of a multi-dimensional feature vector in a specific example;

[0029] Figure 9 Second schematic flowchart of a case linking and merging analysis method based on multi-dimensional features in an embodiment;

[0030] Figure 10 Structure block diagram of a case linking and merging analysis device based on multi-dimensional features in an embodiment;

[0031] Figure 11 Internal structure diagram of a computer device in an embodiment. Detailed implementation manners

[0032] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0033] To facilitate understanding of the present application, the present application will be described more comprehensively below with reference to the relevant accompanying drawings. Embodiments of the present application are given in the drawings. However, the present application can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present application more thorough and comprehensive.

[0034] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the technical field to which the present application belongs. The terms used in the specification of the present application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application.

[0035] It can be understood that the terms "first", "second", etc. used in the present application can be used herein to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish a first element from another element. For example, without departing from the scope of the present application, a first resistor can be called a second resistor, and similarly, a second resistor can be called a first resistor. Both the first resistor and the second resistor are resistors, but they are not the same resistor.

[0036] It can be understood that for the "connection" in the following embodiments, if there is a transmission of electrical signals or data between the connected circuits, modules, units, etc., it should be understood as "electrical connection", "communication connection", etc.

[0037] As used herein, the singular forms "a", "an" and "the" may also include the plural forms unless the context clearly dictates otherwise. It should also be understood that the terms "comprises / include" or "has" etc. specify the presence of the stated features, wholes, steps, operations, components, parts or combinations thereof, but do not preclude the possibility of the presence or addition of one or more other features, wholes, steps, operations, components, parts or combinations thereof.

[0038] The method for case clustering and merging analysis based on multi-dimensional features provided by this application can be applied to, for example, Figure 1 the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. Among them, the terminal 102 can be but is not limited to various personal computers, laptop computers, smart phones, tablet computers and portable wearable devices, and the server 104 can be implemented by an independent server or a server cluster composed of multiple servers.

[0039] In one embodiment, as Figure 2 shown, a method for case clustering and merging analysis based on multi-dimensional features is provided. Taking the application of this method to Figure 1 the server 104 as an example, it includes the following steps, step 201 to step 204.

[0040] Step 201, obtain the sample data of a preset number of case samples, and perform feature denoising processing on each sample data to obtain the denoised sample data of the corresponding case sample.

[0041] Specifically, the server 104 obtains the sample data of a preset number of case samples, and performs feature denoising processing on each sample data to obtain the denoised sample data of the corresponding case sample.

[0042] In one of the embodiments, as Figure 3 shown, obtaining the sample data of a preset number of case samples includes steps 301 to 304.

[0043] Step 301, obtain the original sample data of each case sample;

[0044] Step 302, perform data cleaning processing on the original sample data of each case sample to obtain the cleaned original sample data of the corresponding case sample;

[0045] Step 303: Perform data deduplication on the cleaned sample raw data of each case sample to obtain the deduplicated sample raw data of the corresponding case sample;

[0046] Step 304: Perform data format conversion on the deduplicated sample raw data of each case sample to obtain the sample data of the corresponding case sample.

[0047] Among them, the sample raw data is data used to describe the network flow clues, fund flow clues, and communication flow clues of the case sample. In a specific example, the sample raw data can but is not limited to include case category data, case time domain data, case involved amount data, case occurrence process data, case fraud tool data, case fraud-related server data, case third-party service information data, case fraud-related software application network flow expansion line data, case fund tracking data, victim identity recognition data, and suspect identity recognition data. It can be understood that the acquisition of the sample raw data is carried out in compliance with the Personal Information Protection Law of the People's Republic of China and data compliance requirements. The above are only specific examples and are flexibly set according to user needs in actual applications, and are not limited here.

[0048] Specifically, the server 104 obtains the sample raw data of each case sample; then, performs data cleaning on the sample raw data of each case sample to obtain the cleaned sample raw data of the corresponding case sample; then, performs data deduplication on the cleaned sample raw data of each case sample to obtain the deduplicated sample raw data of the corresponding case sample; then, performs data format conversion on the deduplicated sample raw data of each case sample to obtain the sample data of the corresponding case sample, improving the accuracy of the sample data of all case samples and also improving the efficiency and convenience of obtaining the sample data.

[0049] In this embodiment, the sample raw data of each case sample is obtained; then, data cleaning is performed on the sample raw data of each case sample to obtain the cleaned sample raw data of the corresponding case sample; then, data deduplication is performed on the cleaned sample raw data of each case sample to obtain the deduplicated sample raw data of the corresponding case sample; then, data format conversion is performed on the deduplicated sample raw data of each case sample to obtain the sample data of the corresponding case sample, improving the accuracy of the sample data of all case samples and also improving the efficiency and convenience of obtaining the sample data.

[0050] In one of the embodiments, as Figure 4 shown, after performing feature denoising on each sample data, the denoised sample data of the corresponding case sample is obtained, including Step 401 and Step 402.

[0051] Step 401: In response to the selection operation of the feature selection algorithm, determine the target feature selection algorithm;

[0052] Step 402: Based on the target feature selection algorithm, perform feature denoising processing on each sample data to obtain the denoised sample data of the corresponding case sample.

[0053] Among them, the feature selection algorithms include the mutual information algorithm, the F-test algorithm, and the chi-square test algorithm. The server 104 determines the target feature selection algorithm in response to the selection operation of the feature selection algorithm; then, based on the target feature selection algorithm, perform feature denoising processing on each sample data to obtain the denoised sample data of the corresponding case sample, thereby avoiding the analysis of irrelevant features in the case linking and merging process, improving the efficiency and accuracy of the case linking and merging analysis, also avoiding the waste of resources in the case linking and merging analysis, and reducing the influence of noise features.

[0054] In a specific example, the chi-square test, that is, the X2 test, is a method commonly used in mathematical statistics to test the independence of two variables. First, assume the null hypothesis that the two variables are independent, and then calculate the deviation between the observed value and the theoretical value. If the deviation is small enough, then accept the null hypothesis; otherwise, reject the null hypothesis and accept the alternative hypothesis.

[0055] The expression for calculating the deviation value is:

[0056]

[0057] Among them, y is the deviation value; x i is the observed value of the i-th case sample; E is the theoretical value. Compare the calculated deviation value with the threshold in the chi-square table (determined according to the significance level α). If it is less than this threshold, the null hypothesis holds; otherwise, reject the null hypothesis.

[0058] The basic steps of the chi-square test are as follows: First, data collation; call the statistical analysis program to collate each sample data into a list. Among them, the rows of the list represent features (such as case categories, fraud tools), and the columns of the list represent the defrauded results (such as effective linking and merging, ineffective linking and merging). The following is the reference format of the table:

[0059] Feature Effective series-parallel Invalid series-parallel Total Efficiency (%) Case category 20 19 39 51.3 Scam tool 33 15 48 68.8 Total 53 34 87 60.9

[0060] Second, establish hypotheses; among them, the null hypothesis (H0): there is no association between two or more categorical variables, and the differences are caused by random factors; the alternative hypothesis (H1): there is an association between two or more categorical variables, and the differences are not caused by random factors. Third, calculate the expected frequencies; calculate the expected frequencies for each category based on the population proportions and the sample size. Fourth, calculate the chi-square value; use the formula to calculate the differences between the observed frequencies and the expected frequencies, then sum them up and divide by the total sum of the expected frequencies. Fifth, determine the degrees of freedom; determine the degrees of freedom according to the number of rows and columns of the contingency table, and the degrees of freedom calculation formula is: degrees of freedom = (number of rows - 1)×(number of columns - 1). Sixth, look up the chi-square distribution table; according to the degrees of freedom and the significance level (such as 0.05), look up the chi-square distribution table to find the critical test value. Seventh, draw a conclusion; compare the calculated chi-square statistic with the critical test value to determine whether to reject the null hypothesis. The above is only a specific example, and it is flexibly set according to the user's needs in actual applications, and will not be restricted here.

[0061] In this embodiment, in response to the selection operation of the feature selection algorithm, the target feature selection algorithm is determined; then, based on the target feature selection algorithm, feature denoising processing is performed on each sample data to obtain the denoised sample data of the corresponding case sample, thereby avoiding the analysis of irrelevant features in the case linking and merging analysis process, improving the efficiency and accuracy of the case linking and merging analysis, and also avoiding the waste of resources in the case linking and merging analysis.

[0062] Step 202, perform feature extraction processing on the denoised sample data of each case sample to obtain the case feature set of the corresponding case sample.

[0063] Among them, the case feature set includes each case feature; the case feature includes one or more of the case category feature, the case time domain feature, the case involved amount feature, the case occurrence process feature, the case fraud tool feature, the case fraud-related server feature, the case third-party service information feature, the case fraud-related software application network flow expansion line feature, and the case fund tracking feature.

[0064] In a specific example, the case category feature is used to analyze the proportion of the number of cases involved in each case category; the case time domain feature is used to analyze the proportion of the number of cases involved in each time segment of the case time segmentation; the case involved amount feature is used to analyze the proportion distribution of the involved amount intervals of various cases; the case occurrence process feature is used to analyze the proportion of the number of cases involved in different occurrence processes from the start of contact between the victim and the suspect to the current transaction fraud; the case fraud tool feature is used to analyze the distribution of suspect numbers, fund transaction methods, and communication methods; the case fraud-related server feature is used to analyze the proportion of the number of cases where the fraud-related software application or the fraud-related website server is located; the case third-party service information feature is used to analyze the proportion of the number of cases where the third-party service information associated with the involved APP or fraud-related website; the case fraud-related software application network flow expansion feature is used to analyze the same proportion of software application installation devices; the case fund tracking feature is used to analyze the same proportion of the case fund flow and clues. The above are only specific examples, and in actual applications, it is flexibly set according to user needs and is not limited here.

[0065] Specifically, the server 104 performs feature extraction processing on the denoised sample data of each case sample to obtain the case feature set of the corresponding case sample, thereby broadening the feature dimension of case series combination analysis.

[0066] Step 203, after performing vector construction processing according to the case feature set of each case sample, obtain the multi-dimensional feature vector of the corresponding case sample. After calculating according to the multi-dimensional feature vectors of each case sample, obtain the reference multi-dimensional feature vector. After performing similarity analysis according to the multi-dimensional feature vectors of each case sample and the reference multi-dimensional feature vector, obtain the case similarity of each case sample.

[0067] Among them, the case similarity is the similarity between the multi-dimensional feature vector of the corresponding case sample and the reference multi-dimensional feature vector. Specifically, the server 104 performs vector construction processing according to the case feature set of each case sample to obtain the multi-dimensional feature vector of the corresponding case sample, calculates according to the multi-dimensional feature vectors of each case sample to obtain the reference multi-dimensional feature vector, and performs similarity analysis according to the multi-dimensional feature vectors of each case sample and the reference multi-dimensional feature vector to obtain the case similarity of each case sample.

[0068] In one embodiment, as Figure 5 shown, after performing vector construction processing according to the case feature set of each case sample, obtain the multi-dimensional feature vector of the corresponding case sample, including steps 501 to 504.

[0069] Step 501, perform feature quantity statistics according to the case feature set of each case sample to obtain the feature quantity of the corresponding case sample;

[0070] Step 502: Determine the maximum value of the number of features in each case sample, and based on the maximum value of the number of features, determine the number of axes of the multi-dimensional space coordinate system. Construct a multi-dimensional space coordinate system according to the number of axes.

[0071] Step 503: Statistically calculate the feature statistical values of each case feature according to the case feature sets of each case sample, and after normalizing the feature statistical values of each case feature, obtain the coordinate value set of the corresponding case sample. The coordinate value set includes the coordinate values of the corresponding case feature on each axis.

[0072] Step 504: Perform coordinate calculations according to the coordinate value sets of each case sample to obtain the multi-dimensional feature vectors of the corresponding case samples.

[0073] Among them, the coordinate value set includes the coordinate values of the corresponding case sample on each axis. Specifically, the server 104 statistically calculates the number of features of the corresponding case sample according to the case feature sets of each case sample; then, determines the maximum value of the number of features based on the maximum value of the number of features in each case sample, determines the number of axes of the multi-dimensional space coordinate system according to the maximum value of the number of features, and constructs a multi-dimensional space coordinate system according to the number of axes; then statistically calculates the feature statistical values of each case feature according to the case feature sets of each case sample, and after normalizing the feature statistical values of each case feature, obtains the coordinate value set of the corresponding case sample. The coordinate value set includes the coordinate values of the corresponding case feature on each axis; then, performs coordinate calculations according to the coordinate value sets of each case sample to obtain the multi-dimensional feature vectors of the corresponding case samples, thereby improving the efficiency and convenience of case linking and analysis. It can be understood that the feature statistical value is the total value of the case samples including the corresponding case feature.

[0074] In a specific example, the statistical table of the coordinate values corresponding to the case category feature as the case feature is as follows:

[0075] Serial number Case category feature Feature statistical value Coordinate value 1 Brush order rebate type 104 0.83 2 Love scam 13 0.11 3 Online gambling 7 0.06 4 Other types of fraud 2 0.02

[0076] The case time domain feature can be but is not limited to the case formation period, and the case formation period is the number of days from the start of being defrauded to the actual reporting of the fraud by the victim. The statistical table of the coordinate values corresponding to the case time domain feature as the case feature is as follows:

[0077] Serial number Case formation period Feature statistical value Coordinate value 1 Within 1 day 2 0.017 2 1 - 3 days 56 0.479 3 4 - 7 days 44 0.376 4 8 - 15 days 14 0.1197 5 16 - 30 days 0 0 6 Over 30 days 1 0.00855

[0078] The characteristics of the fraud tools in a case can be, but are not limited to, communication tools. It can be understood that when counting the characteristic statistical values corresponding to various communication tools, multiple communication tools can be designed for each case sample. Therefore, the communication tool with the largest proportion in the case sample is taken as the corresponding coordinate value. The statistical table of the coordinate values corresponding to the case characteristics when the case characteristics are communication tools is as follows:

[0079]

[0080]

[0081] The characteristics of the fraud-related servers in a case can be, but are not limited to, the server location, which can be determined according to the server IP address. The statistical table of the coordinate values corresponding to the case characteristics when the case characteristics are the server location is as follows:

[0082] Serial number Server location Feature statistical value Coordinate value 1 Hong Kong, China 105 0.3903 2 Zhejiang Province 93 0.3457 3 Anhui Province 18 0.0669 4 USA 12 0.0446 5 Taiwan, China 10 0.0371 6 Beijing City 7 0.0260 7 Guangdong Province 5 0.0186 8 Singapore 5 0.0186 9 Shanghai City 4 0.0149 10 Tianjin City 2 0.0074 11 Shandong Province 2 0.0074 12 Henan Province 2 0.0074 13 Sichuan Province 1 0.0037 14 Hunan Province 1 0.0037 15 Guizhou Province 1 0.0037 16 Japan 1 0.0037

[0083] The above are only specific examples, which are flexibly set according to user needs in actual applications and are not limited here.

[0084] In a specific example, the example table of the case characteristic set of the case samples and the corresponding coordinate value set of the case samples is as follows:

[0085]

[0086] The above are only specific examples, which are flexibly set according to user needs in actual applications and are not limited here.

[0087] In this embodiment, the number of characteristics of each case sample is counted according to the case characteristic set of each case sample to obtain the corresponding number of characteristics of the case sample; then, the maximum value of the number of characteristics is determined according to the maximum value in the number of characteristics of each case sample, and the number of axes of the multi-dimensional space coordinate system is determined according to the maximum value of the number of characteristics, and the multi-dimensional space coordinate system is constructed according to the number of axes; then, the characteristic statistical values corresponding to the case characteristic set of each case sample are normalized in turn to obtain the corresponding coordinate value set of the case sample; then, coordinate calculations are performed according to the coordinate value set of each case sample to obtain the corresponding multi-dimensional feature vector of the case sample, thereby improving the efficiency and convenience of case linking and analysis.

[0088] In one of the embodiments, as Figure 6 shown, a reference multi-dimensional feature vector is obtained after calculating according to the multi-dimensional feature vectors of each case sample, including step 601 to step 602.

[0089] Step 601, perform weighted average calculation according to the characteristic statistical values of each case characteristic to obtain a reference multi-coordinate value set;

[0090] Step 602: Generate a reference multi-dimensional feature vector according to the reference multi-coordinate value set.

[0091] Among them, the reference multi-coordinate value set includes the weighted average of the coordinate values of all case features on each coordinate axis. Specifically, the server 104 performs weighted average calculation based on the feature statistical values of each case feature to obtain the reference multi-coordinate value set; then, a reference multi-dimensional feature vector is generated according to the reference multi-coordinate value set, which improves the efficiency and convenience of generating the reference multi-dimensional feature vector.

[0092] In this embodiment, the reference multi-coordinate value set is obtained by performing weighted average calculation based on the feature statistical values of each case feature; then, a reference multi-dimensional feature vector is generated according to the reference multi-coordinate value set, which improves the efficiency and convenience of generating the reference multi-dimensional feature vector.

[0093] In one embodiment, as Figure 7 shown, after performing similarity analysis on the multi-dimensional feature vectors and reference multi-dimensional feature vectors of each case sample, the case similarity of each case sample is obtained, including steps 701 to 702.

[0094] Step 701: Calculate the cosine values of the multi-dimensional feature vectors and reference multi-dimensional feature vectors of each case sample respectively;

[0095] Step 702: Determine the cosine value corresponding to each case sample as the case similarity of the corresponding case sample.

[0096] Specifically, the server 104 calculates the cosine values of the multi-dimensional feature vectors and reference multi-dimensional feature vectors of each case sample respectively; then, the cosine value corresponding to each case sample is determined as the case similarity of the corresponding case sample, which improves the efficiency and convenience of obtaining the case similarity.

[0097] In a specific example, as Figure 8 shown, for the vector analysis of different case features, taking the three case features of case category, crime area, and investigation time as the X, Y, and Z axes in a three-dimensional space as an example, according to the values corresponding to these three case features of case sample A and case sample B, it is possible to know the coordinate value sets of case sample A and case sample B in the three-dimensional space, thereby depicting the multi-dimensional feature vectors of case sample A and case sample B in the multi-dimensional space coordinate system. The smaller the angle of intersection of these two vectors, the larger the cosine value, which indicates that their features are more similar. The above is only a specific example, and it is flexibly set according to user needs in actual applications and will not be limited here.

[0098] In a specific example, assume that the coordinates of the multi-dimensional feature vectors a and b are (x1, y1) and (x2, y2) respectively. The expression for case similarity is:

[0099]

[0100] Suppose the coordinates of the multi-dimensional feature vectors A and B are (A1, A2,..., A n ) and (B1, B2,..., B n ), respectively. The expression for the case similarity is:

[0101]

[0102] Taking the calculation of the three-dimensional case features of "a certain case series combination analysis" as an example, the reference vector end point coordinates, that is, the coordinate value set is (case category, involved area, investigation time) = (0.74, 0.021, 0.30). Suppose the calculated reference multi-coordinate value set of the corresponding reference multi-dimensional feature vector of a certain case is (case category, involved area, investigation time) = (0.85, 0.024, 0.32), then the cosine cos of the included angle between the two vectors is:

[0103]

[0104] Judging from the calculation result quotient, the similarity of these two case samples is close to being completely similar. The above is only a specific example, and it is flexibly set according to user needs in actual applications, and no restrictions are imposed here.

[0105] In this embodiment, the cosine values of the multi-dimensional feature vectors of each case sample and the reference multi-dimensional feature vectors are calculated respectively; then, the cosine values corresponding to each case sample are determined as the case similarities of the corresponding case samples, improving the efficiency and convenience of obtaining case similarities.

[0106] Step 204, in response to the existence of a target case similarity, record the case identity number of the case sample corresponding to the target case similarity into the case series combination analysis statistical result.

[0107] Among them, the target case similarity is the case similarity greater than the similarity threshold. The case series combination analysis statistical result is used to record the case identity numbers of the case samples that need to be analyzed for case series and case combination. Specifically, the server 104, in response to the existence of a target case similarity, records the case identity number of the case sample corresponding to the target case similarity into the case series combination analysis statistical result.

[0108] In a specific example, in response to the existence of other target case similarities, the case identity identification numbers of the case samples corresponding to the other target case similarities are recorded in the non-case linking and merging analysis statistical results. The non-case linking and merging analysis statistical results are used to record the case identity identification numbers of the case samples that do not require linking and merging analysis. The other target case similarities are case similarities less than or equal to the similarity threshold. The above is only a specific example, and in actual applications, it can be flexibly set according to user needs, and no restrictions are imposed here.

[0109] In the above method for case linking and merging analysis based on multi-dimensional features, sample data of a preset number of case samples are obtained, and after feature denoising processing on each sample data, the denoised sample data of the corresponding case samples are obtained; then, feature extraction processing is performed on the denoised sample data of each case sample to obtain the case feature set of the corresponding case sample; the case feature set includes each case feature; the case features include one or more of case category features, case time domain features, case involved amount features, case occurrence process features, case fraud tool features, case fraud-related server features, case third-party service information features, case fraud-related software application network flow expansion line features, and case fund tracking features; then, vector construction processing is performed according to the case feature sets of each case sample to obtain the multi-dimensional feature vectors of the corresponding case samples, a reference multi-dimensional feature vector is obtained by calculating according to the multi-dimensional feature vectors of each case sample, and case similarities of each case sample are obtained by performing similarity analysis according to the multi-dimensional feature vectors of each case sample and the reference multi-dimensional feature vector; wherein, the case similarity is the similarity between the multi-dimensional feature vector of the corresponding case sample and the reference multi-dimensional feature vector; finally, in response to the existence of a target case similarity, the case identity identification number of the case sample corresponding to the target case similarity is recorded in the case linking and merging analysis statistical results; the target case similarity is a case similarity greater than the similarity threshold, which improves the efficiency and accuracy of case linking and merging analysis, thus improving the efficiency of case detection and broadening the feature range of case linking and merging analysis.

[0110] In one embodiment, as Figure 9 shown, the method further includes step 901 and step 902.

[0111] Step 901, generating a case similarity statistical chart according to the case similarities of each case sample;

[0112] Step 902, displaying the similarity statistical chart on the case similarity display interface.

[0113] Specifically, the server 104 generates a case similarity statistical chart according to the case similarities of each case sample; then, the similarity statistical chart is displayed on the case similarity display interface, which improves the visibility of case spring pancake analysis.

[0114] In this embodiment, a case similarity statistical chart is generated according to the case similarity of each case sample; then, the similarity statistical chart is displayed on the case similarity display interface, improving the visibility of case spring roll analysis.

[0115] It should be understood that although Figures 2 - 7 and Figure 9 each step in the flowchart of Figures 2 - 7 and Figure 9 is shown in sequence according to the indication of the arrow, these steps are not necessarily executed in the order indicated by the arrow. Unless otherwise clearly stated in this article, the execution of these steps has no strict order limit, and these steps can be executed in other orders. Moreover,

[0116] In a second aspect, as Figure 10 shown, a case series combination analysis device based on multi-dimensional features is provided, and the device includes a data acquisition module 1010, a feature extraction module 1020, a similarity analysis module 1030, and a case series combination analysis statistical result recording module 1040.

[0117] Among them, the data acquisition module 1010 is used to acquire the sample data of a preset number of case samples, and perform feature denoising processing on each sample data to obtain the denoised sample data of the corresponding case sample; the feature extraction module 1020 is used to perform feature extraction processing on the denoised sample data of each case sample to obtain the case feature set of the corresponding case sample; the case feature set includes each case feature; the case feature includes one or more of the case category feature, the case time domain feature, the case involved amount feature, the case occurrence process feature, the case fraud tool feature, the case fraud-related server feature, the case third-party service information feature, the case fraud-related software application network flow expansion line feature, and the case fund tracking feature; the similarity analysis module 1030 is used to perform vector construction processing according to the case feature sets of each case sample to obtain the multi-dimensional feature vector of the corresponding case sample, calculate according to the multi-dimensional feature vectors of each case sample to obtain the reference multi-dimensional feature vector, and perform similarity analysis according to the multi-dimensional feature vectors of each case sample and the reference multi-dimensional feature vector to obtain the case similarity of each case sample; among them, the case similarity is the similarity between the multi-dimensional feature vector of the corresponding case sample and the reference multi-dimensional feature vector; the case clustering and analysis statistical result recording module 1040 is used to respond to the existence of a target case similarity, and record the case identity number of the case sample corresponding to the target case similarity to the case clustering and analysis statistical result; the target case similarity is the case similarity greater than the similarity threshold.

[0118] In one embodiment, the data acquisition module 1010 includes a data processing unit.

[0119] Among them, the data processing unit is used to acquire the original sample data of each case sample; the data processing unit is used to perform data cleaning processing on the original sample data of each case sample to obtain the cleaned original sample data of the corresponding case sample; the data processing unit is used to perform data deduplication processing on the cleaned original sample data of each case sample to obtain the deduplicated original sample data of the corresponding case sample; the data processing unit is used to perform data format conversion processing on the deduplicated original sample data of each case sample to obtain the sample data of the corresponding case sample.

[0120] In one embodiment, the data acquisition module 1010 includes a data denoising unit.

[0121] Among them, the data denoising unit is used to determine the target feature selection algorithm in response to the selection operation of the feature selection algorithm; among them, the feature selection algorithm includes the mutual information algorithm, the F-test algorithm, and the chi-square test algorithm; the data denoising unit is used to perform feature denoising processing on each sample data based on the target feature selection algorithm to obtain the denoised sample data of the corresponding case sample.

[0122] In one embodiment, the similarity analysis module 1030 includes a multi-dimensional feature vector generation unit.

[0123] The multi-dimensional feature vector generation unit is configured to count the number of features according to the case feature sets of each case sample to obtain the number of features of the corresponding case sample; the multi-dimensional feature vector generation unit is configured to determine the maximum value of the number of features according to the maximum value among the number of features of each case sample, and determine the number of axes of the multi-dimensional space coordinate system according to the maximum value of the number of features, and construct a multi-dimensional space coordinate system according to the number of axes; the multi-dimensional feature vector generation unit is configured to count the feature statistical values of each case feature according to the case feature sets of each case sample, and perform normalization processing on the feature statistical values of each case feature to obtain the coordinate value set of the corresponding case sample; the coordinate value set includes the coordinate values of the corresponding case feature on each axis; the multi-dimensional feature vector generation unit is configured to perform coordinate calculation according to the coordinate value sets of each case sample to obtain the multi-dimensional feature vector of the corresponding case sample.

[0124] In one embodiment, the similarity analysis module 1030 includes a reference multi-dimensional feature vector generation unit.

[0125] The reference multi-dimensional feature vector generation unit is configured to perform weighted average calculation according to the feature statistical values of each case feature to obtain a reference multi-coordinate value set; the reference multi-coordinate value set includes the weighted average values of the coordinate values of all case features on each axis; the reference multi-dimensional feature vector generation unit is configured to generate a reference multi-dimensional feature vector according to the reference multi-coordinate value set.

[0126] In one embodiment, the similarity analysis module 1030 includes a similarity calculation unit.

[0127] The similarity calculation unit is configured to calculate the cosine values of the multi-dimensional feature vectors of each case sample and the reference multi-dimensional feature vector respectively; the similarity calculation unit is configured to determine the cosine value corresponding to each case sample as the case similarity of the corresponding case sample.

[0128] In one embodiment, the device further includes a data display module.

[0129] The data display module is configured to generate a case similarity statistical chart according to the case similarities of each case sample; the data display module is configured to display the similarity statistical chart on the case similarity display interface.

[0130] For the specific limitations of the case linking and analysis device based on multi-dimensional features, reference may be made to the limitations of the case linking and analysis method based on multi-dimensional features in the foregoing text, which will not be elaborated herein. Each module in the above-mentioned case linking and analysis device based on multi-dimensional features can be implemented in whole or in part by software, hardware, and their combination. The above-mentioned modules can be embedded in the processor of the computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so as to facilitate the processor to call and execute the operations corresponding to the above-mentioned modules.

[0131] In one embodiment, a computer device is provided. The computer device can be a server, and its internal structure diagram can be as Figure 11 shown. The computer device includes a processor, a memory, a network interface, and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store sample data of case samples. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, it implements a case linking and analysis method based on multi-dimensional features.

[0132] In one embodiment, a computer device is provided. The computer device can be a terminal, and its internal structure diagram can be as Figure 11 shown. The computer device includes a processor, a memory, a network interface, a display screen, and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, it implements a case linking and analysis method based on multi-dimensional features. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer covering the display screen, or a button, a trackball, or a touchpad provided on the housing of the computer device, or an external keyboard, a touchpad, or a mouse, etc.

[0133] Those skilled in the art can understand that Figure 11The structure shown is only a block diagram of some of the structures related to the solution of this application, and does not constitute a limitation on the computer device to which the solution of this application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine some components, or have different component arrangements.

[0134] In a third aspect, a computer device is provided. The computer device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, the steps of any one of the methods in the above method embodiments are implemented.

[0135] In a fourth aspect, a computer-readable storage medium is provided. A computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of any one of the methods in the above method embodiments are implemented.

[0136] Those of ordinary skill in the art can understand that all or part of the processes in the above method embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it may include the processes of the above method embodiments. Among them, any reference to the memory, storage, database or other media used in the various embodiments provided in this application may include non-volatile and / or volatile memories. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and Rambus dynamic RAM (RDRAM), etc.

[0137] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity of description, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered as the scope described in this specification.

[0138] The above-described embodiments merely represent several implementation manners of the present application. The description thereof is relatively specific and detailed, but it should not be construed as a limitation on the scope of the invention patent. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present application, several modifications and improvements can still be made, and these all fall within the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the appended claims.

Claims

1. A case series analysis method based on multi-dimensional features, the method comprising: Obtaining sample data of a preset number of case samples, and performing feature denoising processing on each of the sample data to obtain the denoised sample data corresponding to the case samples; Performing feature extraction processing on the denoised sample data of each of the case samples to obtain a case feature set corresponding to the case samples; the case feature set includes each case feature; the case feature includes one or more of a case category feature, a case time domain feature, a case involved amount feature, a case occurrence process feature, a case fraud tool feature, a case fraud-related server feature, a case third-party service information feature, a case fraud-related software application network flow expansion line feature, and a case fund tracking feature; Performing vector construction processing according to the case feature sets of each of the case samples to obtain a multi-dimensional feature vector corresponding to the case samples, calculating according to the multi-dimensional feature vectors of each of the case samples to obtain a reference multi-dimensional feature vector, and performing similarity analysis according to the multi-dimensional feature vectors and the reference multi-dimensional feature vector of each of the case samples to obtain the case similarity of each of the case samples; wherein, the case similarity is the similarity between the multi-dimensional feature vector of the corresponding case sample and the reference multi-dimensional feature vector; In response to the existence of a target case similarity, recording the case identity number of the case sample corresponding to the target case similarity into the case series analysis statistical result; the target case similarity is the case similarity greater than the similarity threshold.

2. The method according to claim 1, characterized in that, The obtaining sample data of a preset number of case samples includes: Obtaining the sample original data of each of the case samples; Performing data cleaning processing on the sample original data of each of the case samples to obtain the cleaned sample original data corresponding to the case samples; Performing data deduplication processing on the cleaned sample original data of each of the case samples to obtain the deduplicated sample original data corresponding to the case samples; Performing data format conversion processing on the deduplicated sample original data of each of the case samples to obtain the sample data corresponding to the case samples.

3. The method according to claim 1, characterized in that, The performing feature denoising processing on each of the sample data to obtain the denoised sample data corresponding to the case samples includes: In response to a selection operation on a feature selection algorithm, determining a target feature selection algorithm; wherein, the feature selection algorithm includes a mutual information algorithm, an F-test algorithm, and a chi-square test algorithm; Based on the target feature selection algorithm, performing feature denoising processing on each of the sample data to obtain the denoised sample data corresponding to the case samples.

4. The method according to claim 1, characterized in that, The performing vector construction processing according to the case feature sets of each of the case samples to obtain a multi-dimensional feature vector corresponding to the case samples includes: Performing feature quantity statistics according to the case feature sets of each of the case samples to obtain the feature quantity corresponding to the case samples; Determine the maximum value of the number of features based on the maximum value among the number of features of each of the case samples, determine the number of axes of the multi-dimensional space coordinate system according to the maximum value of the number of features, and construct the multi-dimensional space coordinate system according to the number of axes; Statistically calculate the feature statistical values of each of the case features according to the case feature sets of each of the case samples, and obtain the coordinate value set of the corresponding case sample after normalizing the feature statistical values of each of the case features; the coordinate value set includes the coordinate values of the corresponding case features on each of the axes; Perform coordinate calculations according to the coordinate value sets of each of the case samples to obtain the multi-dimensional feature vectors of the corresponding case samples.

5. The method according to claim 4, wherein The calculation to obtain the reference multi-dimensional feature vector according to the multi-dimensional feature vectors of each of the case samples includes: Perform weighted average calculation according to the feature statistical values of each of the case features to obtain a reference multi-coordinate value set; the reference multi-coordinate value set includes the weighted average values of the coordinate values of all the case features on each of the axes; Generate the reference multi-dimensional feature vector according to the reference multi-coordinate value set.

6. The method according to claim 1, wherein The analysis of the similarity to obtain the case similarity of each of the case samples according to the multi-dimensional feature vectors and the reference multi-dimensional feature vectors of each of the case samples includes: Calculate the cosine values of the multi-dimensional feature vectors and the reference multi-dimensional feature vectors of each of the case samples respectively; Determine the cosine values corresponding to each of the case samples as the case similarity of the corresponding case sample.

7. The method according to claim 1, wherein The method further includes: Generate a case similarity statistical graph according to the case similarity of each of the case samples; Display the similarity statistical graph on the case similarity display interface.

8. A case series analysis device based on multi-dimensional features, characterized in that, The device includes: A data acquisition module, configured to acquire the sample data of a preset number of case samples, and perform feature denoising processing on each of the sample data to obtain the denoised sample data corresponding to the case samples; A feature extraction module, configured to perform feature extraction processing on the denoised sample data of each of the case samples to obtain the case feature set of the corresponding case sample; the case feature set includes each case feature; the case feature includes one or more of a case category feature, a case time domain feature, a case involved amount feature, a case occurrence process feature, a case fraud tool feature, a case fraud-related server feature, a case third-party service information feature, a case fraud-related software application network flow expansion line feature, and a case fund tracking feature; A similarity analysis module, configured to perform vector construction processing according to the case feature sets of each of the case samples to obtain the multi-dimensional feature vectors of the corresponding case samples, calculate a reference multi-dimensional feature vector according to the multi-dimensional feature vectors of each of the case samples, and perform similarity analysis according to the multi-dimensional feature vectors and the reference multi-dimensional feature vectors of each of the case samples to obtain the case similarity of each of the case samples; wherein, the case similarity is the similarity between the multi-dimensional feature vector of the corresponding case sample and the reference multi-dimensional feature vector; The case linking and analysis statistical result recording module is used to record the case identity identification number of the case sample corresponding to the target case similarity to the case linking and analysis statistical result in response to the existence of the target case similarity; the target case similarity is the case similarity greater than the similarity threshold.

9. A computer device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images