Cluster type identification method and apparatus, electronic device, and storage medium

Abstract

This invention provides a cluster type identification method, apparatus, electronic device, and storage medium. The method obtains the test features of the cluster to be tested. Since the test features include at least the importance parameters corresponding to each member of the cluster in each preset behavioral parameter category, the test features can characterize the behavioral characteristics between members in the cluster and the importance of each member in each preset behavioral parameter category within the cluster. Because the cluster type prediction model is obtained by training a neural network, it can obtain the cluster structure of the cluster to be tested from multiple angles and dimensions based on the test features. Furthermore, since the training objective of the cluster type prediction model is to minimize the length of the true vector and the difference vector, the cluster type prediction model can accurately predict the probability that the cluster to be tested belongs to any known cluster category.

Description

Technical Field

[0001] This application relates to the field of communication technology, and more specifically to methods, apparatus, electronic devices and storage media for cluster type identification. Background Technology

[0002] Current networks consist of several groups, which are combinations of members with similar characteristics. For example, groups can be QQ groups or WeChat groups. The relationships between members in each group determine whether the groups belong to the same community. For example, if the ratio of the number of overlapping members in each group within the same community to the total number of members in the corresponding group is greater than or equal to a preset threshold, such as a community including two QQ groups.

[0003] The structure of a group reflects the behavioral characteristics of its members. Similarly, the structure of a community reflects the behavioral characteristics of its members. By analyzing the structure of a group, we can determine its category, such as a pyramid scheme group, a gambling group, a group spreading pornography, or a legitimate group. Likewise, by analyzing the structure of a community, we can determine its category, such as a pyramid scheme community, a gambling community, a group spreading pornography, or a legitimate community.

[0004] For the sake of consistency, groups and communities will be collectively referred to as clusters here. That is, a cluster is either a group or a community. Therefore, obtaining the cluster type of a cluster is crucial for identifying illegal clusters. However, currently, obtaining the cluster type is a manual process, which is inefficient. Therefore, how to quickly determine the cluster category of a cluster is a problem that those skilled in the art need to consider. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a cluster type identification method, apparatus, electronic device, and storage medium to overcome the problem of low efficiency in the prior art.

[0006] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0007] A cluster type identification method, comprising:

[0008] Obtain the test features of the cluster under test, wherein the test features include at least: the importance parameters corresponding to each member of the cluster under test on at least one type of preset behavioral parameters;

[0009] The features to be tested are input into a pre-built cluster type prediction model;

[0010] The cluster type prediction model is obtained by training a neural network with the goal of minimizing the length of the difference vector between the predicted vector and the true vector of the sample cluster; the predicted vector includes the predicted probability that the sample cluster belongs to each of the known clusters; the true vector includes the true probability that the sample cluster belongs to each of the known clusters.

[0011] Obtain the predicted probability of the cluster under test belonging to each of the known cluster types, as output by the cluster type prediction model.

[0012] A cluster type identification device, comprising:

[0013] The first acquisition module is used to acquire the test features of the cluster under test, wherein the test features include at least the importance parameters corresponding to each member of the cluster under test on at least one type of preset behavioral parameters.

[0014] The input module is used to input the features to be tested into a pre-built cluster type prediction model;

[0015] The cluster type prediction model is obtained by training a neural network with the goal of minimizing the length of the difference vector between the predicted vector and the true vector of the sample cluster; the predicted vector includes the predicted probability that the sample cluster belongs to each of the known clusters; the true vector includes the true probability that the sample cluster belongs to each of the known clusters.

[0016] The second acquisition module is used to acquire the predicted probabilities of the cluster under test belonging to the various known clusters, as output by the cluster type prediction model.

[0017] An electronic device, comprising:

[0018] Memory, used to store programs;

[0019] A processor is configured to execute the program, the program specifically being used for:

[0020] Obtain the test features of the cluster under test, wherein the test features include at least: the importance parameters corresponding to each member of the cluster under test on at least one type of preset behavioral parameters;

[0021] The features to be tested are input into a pre-built cluster type prediction model;

[0022] The cluster type prediction model is obtained by training a neural network with the goal of minimizing the length of the difference vector between the predicted vector and the true vector of the sample cluster; the predicted vector includes the predicted probability that the sample cluster belongs to each of the known clusters; the true vector includes the true probability that the sample cluster belongs to each of the known clusters.

[0023] Obtain the predicted probability of the cluster under test belonging to each of the known cluster types, as output by the cluster type prediction model.

[0024] A storage medium storing a program suitable for execution by a processor, the program being used to:

[0025] Obtain the test features of the cluster under test, wherein the test features include at least: the importance parameters corresponding to each member of the cluster under test on at least one type of preset behavioral parameters;

[0026] The features to be tested are input into a pre-built cluster type prediction model;

[0027] The cluster type prediction model is obtained by training a neural network with the goal of minimizing the length of the difference vector between the predicted vector and the true vector of the sample cluster; the predicted vector includes the predicted probability that the sample cluster belongs to each of the known clusters; the true vector includes the true probability that the sample cluster belongs to each of the known clusters.

[0028] Obtain the predicted probability of the cluster under test belonging to each of the known cluster types, as output by the cluster type prediction model.

[0029] As can be seen from the above technical solution, compared with the prior art, the embodiments of the present invention provide a cluster type identification method to obtain the test features of the cluster to be tested. Since the test features include at least the importance parameters corresponding to each member of the cluster to be tested in each type of preset behavioral parameter, it shows that the test features can characterize the behavioral characteristics between each member in the cluster to be tested, as well as the importance of each member in each type of preset behavioral parameter in the cluster to be tested. Since the cluster type prediction model is obtained by training a neural network, the cluster type prediction model can obtain the cluster structure of the cluster to be tested from multiple angles and dimensions based on the test features. Moreover, since the training objective of the cluster type prediction model is to minimize the length of the true vector and the difference vector, the cluster type prediction model can accurately predict the probability that the cluster to be tested belongs to each type of known cluster. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0031] Figure 1aThis is a schematic diagram illustrating the process of classifying a cluster under test using a cluster type prediction model, as provided in an embodiment of the present invention.

[0032] Figure 1b This is a schematic diagram illustrating an application scenario of a cluster type identification method provided in an embodiment of the present invention;

[0033] Figure 2 An internal structure diagram of an electronic device provided in an embodiment of the present invention;

[0034] Figure 3 A flowchart illustrating a cluster type identification method provided in an embodiment of the present invention;

[0035] Figure 4 This is a flowchart illustrating an implementation method for obtaining the test features of a cluster under test in a cluster type identification method provided by an embodiment of the present invention.

[0036] Figure 5 A schematic diagram illustrating the relationships between the members of a cluster under test in an example provided for an embodiment of the present invention;

[0037] Figure 6 This is a flowchart illustrating another implementation of a cluster type identification method provided in this invention for obtaining the test features of a cluster under test;

[0038] Figure 7 This is a flowchart illustrating one implementation method of a cluster type identification method provided by an embodiment of the present invention, in which the importance parameters corresponding to the preset behavioral parameters of each member of the cluster under test are determined as elements in the parameter matrix corresponding to the preset behavioral parameters of that type.

[0039] Figure 8 This is a flowchart illustrating another implementation method of a cluster type identification method provided by an embodiment of the present invention, in which the importance parameters corresponding to the preset behavioral parameters of each member of the cluster under test are determined as elements in the parameter matrix corresponding to the preset behavioral parameters of that type.

[0040] Figure 9 A schematic diagram illustrating the process of training a neural network, provided in an embodiment of the present invention;

[0041] Figure 10 This is a structural diagram of a cluster type identification device provided in an embodiment of the present invention. Detailed Implementation

[0042] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0043] The cluster type identification method provided in this invention uses a cluster type prediction model to classify existing clusters (clusters are communities or groups) and detect which type of cluster the cluster to be tested belongs to, such as pyramid scheme clusters, gambling clusters, pornographic website propagation clusters, legitimate clusters, etc. This allows for the timely detection of illegal clusters such as pyramid scheme clusters, gambling clusters, and pornographic website propagation clusters on the network.

[0044] like Figure 1a The diagram shown is a schematic representation of a process for classifying a cluster under test using a cluster type prediction model, as provided in an embodiment of the present invention.

[0045] The features to be tested in the cluster to be tested, such as features representing the amount of money transferred and / or the number of transfers in the QQ group to be tested, are input into the cluster type prediction model 10. The cluster type prediction model can output the predicted probability that the cluster to be tested belongs to each type of cluster, such as... Figure 1a As shown, the predicted probability of the QQ group being tested belonging to a pyramid scheme cluster is 95%; the predicted probability of belonging to a gambling cluster is 3%; the predicted probability of belonging to a pornographic website dissemination cluster is 2%; and the predicted probability of belonging to a legitimate cluster is 0%.

[0046] Optionally, the above cluster type identification method can be applied to electronic devices, such as desktop computers, mobile terminals (e.g., smartphones), iPads, servers, and other electronic devices.

[0047] In one example, the cluster type identification method could be a client running on an electronic device, such as an instant messaging client like WeChat or QQ. This client could be an application client or a web client.

[0048] The aforementioned server can be a single server, a server cluster consisting of several servers, or a cloud computing service center. For example, it could be the backend server for instant messaging clients such as WeChat and QQ.

[0049] The following explanation will be based on specific application scenarios, such as... Figure 1b The diagram shown is an application scenario illustration of a cluster type identification method provided by an embodiment of the present invention.

[0050] The cluster to be tested can be a group or a community. A community can include one or more groups. If a community includes multiple groups, the groups within the community can belong to the same social media platform or the same social networking site. Alternatively, the groups within a community can belong to different social media platforms and / or different social networking sites. For example, a community can include WeChat groups and QQ groups. Therefore, the cluster to be tested in this embodiment of the invention includes one or more groups.

[0051] In practical applications, each member uses social software or social networking sites on a smart terminal 11 (such as a smartphone, computer, or PAD) to interact with other members. Groups can be created in the social software or social networking sites, allowing members to interact within these groups.

[0052] Each smart terminal 11 can upload relevant information about the interaction between the corresponding member and other members in the group to the server 12; the server 12 can obtain the features to be tested based on the relevant information of each member in the cluster under test.

[0053] The memory in server 12 can store the program corresponding to the cluster type prediction model and the cluster type identification method. The processor in server 12 can execute the program based on the features to be tested and call the cluster type prediction model to obtain the predicted probability that the cluster to be tested belongs to various cluster types.

[0054] Server 12 can be a first backend server for social software, such as the QQ server for QQ social software; or a second backend server for social networking sites, such as the A forum social software. Server 12 can also be a server that can obtain relevant information about each member of the cluster under test from the first backend server and / or the second backend server.

[0055] Figure 2 An internal structure diagram of an electronic device provided in an embodiment of the present invention is shown.

[0056] Electronic devices may include: a bus, an input device 1, a memory 2, a processor 3, an output device 4, and a communication interface 5.

[0057] The input device 1, memory 2, processor 3, output device 4, and communication interface 5 are interconnected via a bus.

[0058] Input device 1 may include a device for receiving user input data and information, such as a keyboard, mouse, camera, scanner, light pen, voice input device, touch screen, pedometer, or gravity sensor. For example, the input device can be used to input the characteristics of the QQ group to be tested into a client with cluster type recognition function in an electronic device.

[0059] The memory 2 stores a program that executes the technical solutions of the embodiments of the present invention, and may also store an operating system and other key business functions. Specifically, the program may include program code, which includes computer operation instructions. More specifically, the memory 2 may include read-only memory (ROM), other types of static storage devices capable of storing static information and instructions, random access memory (RAM), other types of dynamic storage devices capable of storing information and instructions, disk storage, flash memory, etc.

[0060] The memory 2 may store the cluster type prediction model and the program corresponding to the cluster type identification method in the embodiments of the present invention.

[0061] Processor 3 can execute programs stored in memory 2 and, during program execution, call the cluster type prediction model. This causes the cluster type prediction model to output the predicted probabilities of the tested QQ groups belonging to different group categories.

[0062] Processor 3 can be a general-purpose processor, such as a general-purpose central processing unit (CPU), network processor (NP), microprocessor, etc., or an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of the program of the embodiment of the present invention. It can also be a digital signal processor (DSP), application-specific integrated circuit (ASIC), off-the-shelf programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component.

[0063] Processor 3 may include a main processor, as well as a baseband chip, modem, etc.

[0064] Output device 4 may include a device that allows information to be output to a user, such as a display screen, printer, speaker, etc. For example, the display screen shows the predicted probability of the QQ group to be tested belonging to various known clusters, as output by the cluster type prediction model. For example, the predicted probability of belonging to a pyramid scheme cluster is 95%; the predicted probability of belonging to a gambling cluster is 3%; the predicted probability of belonging to a pornographic website dissemination cluster is 2%; and the predicted probability of belonging to a legitimate cluster is 0%.

[0065] The processor 3 executes the program stored in the memory 2 and calls other devices, which can be used to implement the various steps in the cluster type identification method provided in the embodiments of the present invention.

[0066] Communication interface 5 may include a device that uses any transceiver to communicate with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Network (WLAN), etc.

[0067] The embodiments of the present invention will be further described in detail below based on the common aspects involved in the above embodiments. For example... Figure 3 The diagram shows a flowchart of a cluster type identification method provided by an embodiment of the present invention. The method includes:

[0068] Step S301: Obtain the features to be tested for the cluster under test.

[0069] The features to be tested include: the importance parameters corresponding to each member of the cluster to be tested on at least one set of preset behavioral parameters.

[0070] The aforementioned "at least one type of preset behavior parameter" can be a P-type preset behavior parameter, where P is a positive integer greater than or equal to 1. The P-type preset behavior parameters are pre-set.

[0071] The predefined behavioral parameters of class P can correspond to at least one behavioral feature of a known cluster, which is used to characterize the interaction features between members in that known cluster.

[0072] The predefined behavior parameters of class P can correspond to at least one known cluster's behavior characteristics, and can include the following cases:

[0073] I. The P-class preset behavioral parameters correspond to the behavioral features of a known cluster, which is any known cluster among all types of known clusters that the cluster type prediction model can predict.

[0074] For example, known clusters include gambling clusters, legitimate clusters, etc.

[0075] Assume that the predefined behavioral parameters of class P correspond to the behavioral characteristics of a pyramid scheme cluster. In a pyramid scheme cluster, lower-level members transfer funds to middle-level members, and middle-level members transfer funds to higher-level members, i.e., there is a hierarchical transfer system. The characteristics of the interaction between members in a pyramid scheme cluster can be: hierarchical transfer behavior characteristics. Therefore, the predefined behavioral parameters of class P can include: a transfer frequency parameter to represent the number of transfers between members and / or a transfer amount parameter to represent the amount of money transferred between members.

[0076] Assume that the predefined behavior parameters of class P correspond to the behavior characteristics of the legitimate cluster. Assume that members in the legitimate cluster only interact and do not transfer funds, then the characteristics of the interaction between members in the legitimate cluster can be: interaction based on text, voice, video, or images. Therefore, the predefined behavior parameters of class P can include: an interaction count parameter to characterize the number of interactions between members.

[0077] In summary, the preset behavioral parameters of class P may differ depending on the behavioral characteristics corresponding to different types of known clusters. The cluster type prediction model is more accurate in predicting the probability that the cluster under test belongs to that type of known cluster if the preset behavioral parameters of class P correspond to the behavioral characteristics of the known clusters.

[0078] For example, the pre-defined behavioral parameters of class P correspond to the behavioral characteristics of legitimate clusters. Assume the predicted behavioral parameter for class P is the interaction count parameter. The cluster type prediction model can predict the probability that the tested cluster belongs to a pyramid scheme cluster based on the interaction count parameter, assuming a 5% probability, which has poor accuracy. However, the predicted probability that the tested cluster belongs to a legitimate cluster, assuming a 95% probability, has higher accuracy.

[0079] In practical applications, determining which illegal known cluster the cluster to be tested belongs to is of great significance. Therefore, the accuracy of predicting the probability that the cluster to be tested belongs to which illegal known cluster is more accurate than the accuracy of predicting the probability that the cluster to be tested belongs to a legal cluster. Thus, it is more meaningful to predict that "the P-type preset behavioral parameters correspond to the behavioral features corresponding to a type of known cluster" is preferred to be "the P-type preset behavioral parameters correspond to the behavioral features corresponding to a type of illegal known cluster".

[0080] Second, the P-class preset behavioral parameters correspond to the behavioral features common to at least two types of known clusters. Each type of known cluster is any known cluster among all types of known clusters that the cluster type prediction model can predict.

[0081] Optionally, "the P-class preset behavior parameters correspond to the behavior features common to at least two known clusters" may include: the P-class preset behavior parameters correspond to the behavior features common to two known clusters, or, the P-class preset behavior parameters correspond to the behavior features common to three known clusters, or, ..., or, the P-class preset behavior parameters correspond to the behavior features common to all known clusters.

[0082] The following explains the predefined behavioral parameters of class P and the behavioral characteristics common to various known clusters.

[0083] Assume that the known clusters include: gambling clusters, pyramid scheme clusters, pornographic website dissemination clusters, and legitimate clusters, etc.

[0084] In pyramid schemes, lower-level members transfer money to middle-level members, and middle-level members transfer money to higher-level members, creating a hierarchical structure. The interaction between members in a pyramid scheme can be characterized by hierarchical transfers. In gambling groups, members transfer money to each other, and since gambling typically occurs at night, the interaction between members in a gambling group is characterized by transfers occurring at night. In groups spreading pornography, members transfer money to members who possess pornographic videos or links; therefore, the interaction between members in such groups is characterized by concentrated transfers to one or a few members.

[0085] Suppose that the legitimate cluster is a cluster containing employees of a certain company. During holidays, one or more leaders in the legitimate cluster send red envelopes. That is, the interaction between members in the legitimate cluster can be characterized by the transfer behavior of the same or several members sending red envelopes of varying amounts to multiple other members at certain fixed times.

[0086] If the preset behavior parameters of class P correspond to the common behavior characteristics of each known cluster, it means that the preset behavior parameters of class P correspond to the common characteristics of interaction between members contained in each known cluster. Taking the above as an example, if the common characteristic of interaction between members contained in each known cluster is the transfer behavior characteristic, then the preset behavior parameters of class P may include: transfer amount parameter, and / or, transfer number parameter.

[0087] In this application embodiment, clusters other than illegally known clusters are considered legitimate clusters. It is understood that there are various types of legitimate clusters. For example, legitimate clusters may also include news exchange clusters or shopping sharing clusters. Different types of legitimate clusters rarely share common behavioral characteristics with illegally known clusters. For example, the interaction between members in a news exchange cluster may only involve text, voice, video, or image interactions, without involving money transfers. Therefore, preferably, "the P-type preset behavioral parameters correspond to the behavioral characteristics shared by at least two types of known clusters" can include: the P-type preset behavioral parameters correspond to the behavioral characteristics shared by at least two types of illegally known clusters, or the P-type preset behavioral parameters correspond to the behavioral characteristics shared by legitimate clusters and at least one type of illegally known cluster.

[0088] The following explains the P-type preset behavioral parameters and the common behavioral characteristics of various illegal known clusters. Taking the above example, the common characteristic of the interaction between members of each illegal known cluster is the transfer behavior characteristic. Therefore, the P-type preset behavioral parameters may include: transfer amount parameter, and / or, transfer number parameter.

[0089] Since the pre-defined behavioral parameters of class P correspond to the behavioral characteristics shared by various illegal known clusters, the accuracy of the cluster type prediction model in predicting the probability that the cluster under test belongs to each illegal known cluster is relatively high.

[0090] The cluster to be tested can be a group, such as a group in social software, such as a QQ group, a WeChat group, or a group on a social networking site.

[0091] The cluster to be tested can be a community, and a community can include at least one group.

[0092] If a community includes multiple groups, then the multiple groups can have at least one of the following characteristics:

[0093] First, the ratio of the number of overlapping members in each group to the total number of members in the corresponding group is greater than or equal to the first preset threshold.

[0094] For example, there are three groups: Group 1, Group 2, and Group 3. Group 1 has 200 members; Group 2 has 150 members; and Group 3 has 300 members. If the number of overlapping members in these three groups is 100, then the ratio of overlapping members in Group 1 to its total number of members is 100 / 200 = 1 / 2; the ratio in Group 2 is 100 / 150 = 2 / 3; and the ratio in Group 3 is 100 / 300 = 1 / 3. Assuming a first preset threshold of 1 / 5, since 1 / 2, 2 / 3, and 1 / 3 are all greater than 1 / 5, Group 1, Group 2, and Group 3 belong to the same community.

[0095] Second, the ratio of the number of overlapping administrators in each group to the total number of administrators in the corresponding group is greater than or equal to the second preset threshold.

[0096] For example, there are currently three groups: Group 1, Group 2, and Group 3. Group 1 has 3 administrators; Group 2 has 5 administrators; and Group 3 has 4 administrators. Assume that there are 2 overlapping administrators in these three groups; the ratio of overlapping administrators in Group 1 to the total number of administrators in Group 1 is 2 / 3; the ratio of overlapping administrators in Group 2 to the total number of administrators in Group 2 is 2 / 5; and the ratio of overlapping administrators in Group 3 to the total number of administrators in Group 3 is 1 / 2. Assume that the second preset threshold is 1 / 4. Since 2 / 3, 2 / 5, and 1 / 2 are all greater than 1 / 4, Group 1, Group 2, and Group 3 belong to the same community.

[0097] Step S302: Input the feature to be tested into the pre-built cluster type prediction model.

[0098] The cluster type prediction model is obtained by training a neural network with the goal of minimizing the length of the difference vector between the predicted vector and the true vector of the sample cluster; the predicted vector includes the predicted probability that the sample cluster belongs to each of the known clusters; the true vector includes the true probability that the sample cluster belongs to each of the known clusters.

[0099] The known clusters can include various illegal clusters and legal clusters.

[0100] Various illegal clusters may include: gambling clusters, pyramid scheme clusters, and pornographic website dissemination clusters; in this embodiment of the invention, all types of clusters other than illegal clusters are referred to as legal clusters.

[0101] Suppose that after inputting the training features of a sample cluster into a neural network, the network outputs the following probabilities: 95% probability that the sample cluster belongs to a gambling cluster; 4% probability that it belongs to a pyramid scheme cluster; 1% probability that it belongs to a pornographic website cluster; and 0% probability that it belongs to a legitimate cluster. Then the predicted vector for the sample cluster is (95%, 4%, 1%, 0%). If, in a real-world scenario, the sample cluster belongs to the gambling cluster type, then the true vector for the sample cluster is (1, 0, 0, 0). The difference vector between the predicted and true vectors is (-0, 05, 0.04, 0.01, 0).

[0102] In this embodiment of the invention, "the training objective of the cluster type prediction model is to minimize the length of the difference vector between the predicted vector and the true vector of the sample cluster" means that the closer the predicted vector of the sample cluster is to the true vector, the better. To achieve this training objective, the neural network can be trained in various ways. Detailed methods will be mentioned later in the description of constructing this cluster type prediction model, and can be referred to accordingly. They will not be repeated here.

[0103] The predicted probability that a sample cluster belongs to a known cluster is obtained by a neural network (the cluster type prediction model is called a neural network before it is trained).

[0104] Step S303: Obtain the predicted probability of the cluster to be tested belonging to each of the known cluster types, output by the cluster type prediction model.

[0105] In one optional embodiment, the cluster type prediction model can obtain the cluster structure of the cluster to be tested based on the characteristics of the cluster to be tested. Since the cluster structures of different cluster types are different, the predicted probability of the cluster to be tested belonging to each of the known cluster types can be obtained based on the cluster structure of the cluster to be tested.

[0106] For example, the cluster structure of a gambling cluster includes at least the following: frequent transfers between members; the cluster structure of a pyramid scheme cluster includes at least the following: members transfer money to their superiors level by level, with very few transfers between members, and there is a hierarchical concept; the cluster structure of a pornographic website distribution cluster includes at least the following: each member transfers money to a few fixed members, and there are generally no transfers between levels or between members.

[0107] If, based on the characteristics of the cluster under test, it is found that members of the cluster frequently transfer money to each other without layer-by-layer transfers, then the probability that the cluster under test belongs to a gambling cluster is very high, the probability that it belongs to a pyramid scheme cluster, and the probability that it belongs to a pornographic website dissemination cluster is very low.

[0108] This invention provides a cluster type identification method to obtain the test features of a cluster to be tested. Since the test features include at least the importance parameters corresponding to each member of the cluster in each preset behavioral parameter category, it indicates that the test features can characterize the behavioral characteristics between members in the cluster and the importance of each member in each preset behavioral parameter category within the cluster. Because the cluster type prediction model is obtained by training a neural network, it can obtain the cluster structure of the cluster to be tested from multiple angles and dimensions based on the test features. Furthermore, since the training objective of the cluster type prediction model is to minimize the length of the true vector and the difference vector, the cluster type prediction model can accurately predict the probability that the cluster to be tested belongs to each of the known cluster categories.

[0109] In this embodiment of the invention, step S301 can be implemented in various ways. This embodiment of the invention provides, but is not limited to, the following methods.

[0110] The first method involves directly using the importance parameters corresponding to each member of the cluster under test on at least one type of predicted behavior parameter as the features to be tested. For details, please refer to [link to specific methods]. Figure 4 , Figure 4 This is a flowchart illustrating an implementation method for obtaining the test features of a cluster under test in a cluster type identification method provided by an embodiment of the present invention. The method may include:

[0111] Step S401: Obtain the behavior parameter values ​​corresponding to each member of the cluster under test in at least one type of preset behavior parameter.

[0112] Step S402: For each type of preset behavior parameter, based on the behavior parameter values ​​corresponding to each member of the cluster under test in that type of preset behavior parameter, determine the importance parameter corresponding to each member of the cluster under test in that type of preset behavior parameter, so as to obtain the importance parameter corresponding to each member of the cluster under test in at least one type of preset behavior parameter.

[0113] Step S403: Determine the importance parameters corresponding to each member of the cluster under test in at least one type of preset behavioral parameters as the test features of the cluster under test.

[0114] The following example illustrates the above method.

[0115] For example, suppose that at least one type of preset behavioral parameters includes: transfer amount parameter and transfer frequency parameter. Then the first method mainly includes the steps of "obtaining the importance parameter corresponding to the transfer amount parameter for each member of the cluster under test" and "obtaining the importance parameter corresponding to the transfer frequency parameter for each member of the cluster under test".

[0116] like Figure 5 The diagram shown illustrates the relationships between the members of a cluster under test in an example.

[0117] Assume the cluster under test includes members A, B, C, and D; assume the cluster consists of two groups. Members A, B, and C belong to group 1; members A, C, and D belong to group 2. Figure 5 The lines connecting each pair of members represent the interaction path.

[0118] In this embodiment of the invention, the relationship between two members who can interact directly is called a first-degree link relationship; for example, the relationship between member A and member B. The relationship between two members who can only interact through at least one member is called a second-degree link relationship; for example, the relationship between member B and member D. The relationship between two members who can only interact through at least two members is called a third-degree link relationship, and so on.

[0119] 1. Obtain the importance parameter of each member of the cluster under test in terms of the transfer amount parameter.

[0120] Suppose that over a period of time, the total amount transferred from member A to member B is 100; the total amount transferred from member A to member C is 0; the total amount transferred from member A to member D is 200; the total amount transferred from member B to member A is 60; the total amount transferred from member B to member C is 150; the total amount transferred from member C to member A is 600; the total amount transferred from member C to member B is 180; the total amount transferred from member C to member D is 300; the total amount transferred from member D to member A is 900; and the total amount transferred from member D to member C is 450. Since there is no interaction path between member B and member D, there are no direct transfers between them.

[0121] The first step is to obtain the behavioral parameter values ​​corresponding to the transfer amount parameter for each member of the cluster under test.

[0122] by Figure 5 For example, the behavioral parameter values ​​corresponding to the transfer amount parameters for each member are as follows: A→A=0, A→B=100, A→C=0, A→D=200; B→A=60, B→B=0, B→C=150, B→D=0; C→A=600, C→B=180, C→C=0, C→D=300; D→A=900, D→B=0, D→C=450, D→D=0.

[0123] To make the above data clear, it will be represented in matrix form, denoted as matrix M1.

[0124]

[0125] The first column represents the transfer amount from member A to members A, B, C, and D respectively; the second column represents the transfer amount from member B to members A, B, C, and D respectively; the third column represents the transfer amount from member C to members A, B, C, and D respectively; and the fourth column represents the transfer amount from member D to members A, B, C, and D respectively.

[0126] The second step is to determine the importance parameter of each member of the cluster under test for that type of transfer amount parameter based on the behavioral parameter values ​​corresponding to each member of the cluster under test for that type of transfer amount parameter.

[0127] Since M1 is the behavioral parameter value of the transfer amount parameter over a period of time, and since the behavioral parameter value can only represent the transfer amount situation in the current time period, it has a certain degree of instability. That is, it cannot represent the historical transfer amount situation of the cluster under test in that period of time. Therefore, in order to make the obtained importance parameter representative, the behavioral parameter values ​​corresponding to the transfer amount parameter of each member are processed below.

[0128] Based on historical data of the cluster under test, the probability of each member initiating a transfer can be obtained. In one example, it is assumed that each member in the cluster under test has the same probability of initiating a transfer. Figure 5 If the probability of each member initiating a transfer is 1 / 4, then the behavioral parameter values ​​corresponding to the transfer amount parameter for each member are processed as follows:

[0129] The following iterations will be continuously performed:

[0130] V je1 =M1*V je0 V je2 =M1*V je1 V je3 =M1*V je2 ;...;V je(n1) =M1*V je(n1-1) ;

[0131] For example,

[0132]

[0133] or,

[0134] V je1 =α1M1*V je0 +(1-α1)e1;V je2 =α1M1*V je1 +(1-α1)e1;

[0135] V je3 =α1M1*V je2 +(1-α1)e1;...;V je(n1) =α1M1*V je (n1-1)+(1-α1)e1;

[0136] Where α1 can be any value greater than 0 and less than 1;

[0137] Optional,

[0138] Until, two consecutive V je(n1) With V je(n1-1) If the result no longer changes, or the difference is within a preset range, then convergence can be considered, meaning it has universal representativeness. Let's assume the convergent result is V. je(n1) =[V je11 V je21 V je31 V je41 ] T Then, the importance parameter of member A in the transfer amount parameter is V. je11Member B's importance parameter corresponding to the transfer amount parameter is V. je21 Member C's importance parameter corresponding to the transfer amount parameter is V. je31 Member D's importance parameter corresponding to the transfer amount parameter is V. je41 .

[0139] 2. Obtain the importance parameter corresponding to the number of transfers for each member of the cluster under test.

[0140] Assumption Figure 5 In the cluster under test shown, over a period of time, member A transferred funds to member B 10 times; member A transferred funds to member C 0 times; member A transferred funds to member D 2 times; member B transferred funds to member A 1 time; member B transferred funds to member C 3 times; member C transferred funds to member A 6 times; member C transferred funds to member B 2 times; member C transferred funds to member D 6 times; member D transferred funds to member A 9 times; and member D transferred funds to member C 9 times.

[0141] The first step is to obtain the behavioral parameter values ​​corresponding to the number of transfers for each member of the cluster under test.

[0142] by Figure 5 For example, the behavioral parameter values ​​corresponding to the number of transfers for each member are as follows: A→A=0, A→B=10, A→C=0, A→D=2; B→A=1, B→B=0, B→C=3, B→D=0; C→A=6, C→B=2, C→C=0, C→D=6; D→A=9, D→B=0, D→C=9, D→D=0.

[0143] To make the above data clear, it will be represented in matrix form, let's call it matrix M2;

[0144]

[0145] The first column represents the number of transfers made by member A to members A, B, C, and D respectively; the second column represents the number of transfers made by member B to members A, B, C, and D respectively; the third column represents the number of transfers made by member C to members A, B, C, and D respectively; and the fourth column represents the number of transfers made by member D to members A, B, C, and D respectively.

[0146] The second step is to determine the importance parameter corresponding to each member of the cluster under test for each type of transfer count parameter based on the behavioral parameter values ​​corresponding to the transfer count parameter.

[0147] Since M2 is the behavioral parameter value of the number of transfers over a period of time, and since the behavioral parameter value can only represent the number of transfers in the current time period, it is unstable and cannot represent the historical general situation of the number of transfers of the cluster under test in that period of time. Therefore, in order to make the obtained importance parameter representative, the behavioral parameter values ​​corresponding to the number of transfers for each member are processed below.

[0148] Based on historical data of the cluster under test, the probability of each member initiating a transfer can be obtained. In one example, it is assumed that each member in the cluster under test has the same probability of initiating a transfer. Figure 5 The probability of each member initiating a transfer is 1 / 4 (this embodiment of the invention is not limited to this); therefore, the behavior parameter values ​​corresponding to the number of transfers for each member are processed as follows:

[0149] The following iterations will be continuously performed:

[0150] V cs1 =M2*V cs0 V cs2 =M2*V cs1 V cs3 =M2*V cs2 ;...;V cs(n2) =M2*V cs(n2-1) ;

[0151] For example,

[0152] or,

[0153] V cs1 =α2M2*V cs0 +(1-α2)e2;V cs2 =α2M2*V cs1 +(1-α2)e2;

[0154] V cs3 =α2M2*V cs2 +(1-α2)e2;...;V cs(n2) =α2M2*V cs(n2-1) +(1-α2)e2

[0155] Where α2 can be any value greater than 0 and less than 1;

[0156] Optional,

[0157] Until, continuous V cs(n2) With V cs(n2-1) Convergence is considered achieved when the results of the two tests no longer change, or when the difference is within a preset range. Let's assume the convergent result is V. cs(n2) =[Vcs11 V cs21 V cs31 V cs41 ] T Then, the importance parameter corresponding to the number of transfers parameter for member A is V. cs11 Member B's importance parameter corresponding to the number of transfers is V. cs21 Member C's importance parameter corresponding to the number of transfers is V. cs31 Member D's importance parameter corresponding to the number of transfers is V. cs41 .

[0158] In summary, the V values ​​corresponding to the transfer parameters of each member in the cluster under test will be determined separately. je11 V je21 V je31 V je41 And, the V corresponding to the number of transfers for each member in the cluster under test. cs11 V cs21 V cs31 V cs41 , as the feature to be tested.

[0159] The above steps, namely obtaining the importance parameters of each member of the cluster under test corresponding to the transfer amount parameter and obtaining the importance parameters of each member of the cluster under test corresponding to the transfer number parameter, are not ordered and can be executed simultaneously. Alternatively, the steps can be executed first, followed by the steps for obtaining the importance parameters of each member of the cluster under test corresponding to the transfer amount parameter and then the steps for obtaining the importance parameters of each member of the cluster under test corresponding to the transfer number parameter.

[0160] The second method involves determining the test features of the cluster based on the importance parameters corresponding to each member of the cluster under test in at least one set of preset behavioral parameters. Specific methods are as follows: Figure 6 As shown, Figure 6 This is a flowchart illustrating another implementation of a cluster type identification method provided in this invention for obtaining the test features of a cluster under test. The method includes:

[0161] Step S601: Obtain the behavior parameter values ​​corresponding to each member of the cluster under test in at least one type of preset behavior parameter;

[0162] Step S602: For each type of preset behavior parameter, based on the behavior parameter values ​​corresponding to each member of the cluster under test in that type of preset behavior parameter, determine the importance parameter corresponding to each member of the cluster under test in that type of preset behavior parameter, so as to obtain the importance parameter corresponding to each member of the cluster under test in at least one type of preset behavior parameter.

[0163] Step S603: For each type of preset behavior parameter, take the importance parameter of each member of the cluster under test corresponding to the preset behavior parameter as each element in the parameter matrix corresponding to the preset behavior parameter, so as to obtain the parameter matrix corresponding to the at least one type of preset behavior parameter.

[0164] Still with Figure 5 For example, for the transfer amount parameter, the elements in its corresponding parameter matrix include: V je11 V je21 V je31 V je41 For the parameter of the number of transfers, the elements in its corresponding parameter matrix include: V cs11 V cs21 V cs31 V cs41 However, the frequency and position of each importance parameter in the parameter matrix differ.

[0165] In one optional embodiment, the parameter matrices corresponding to the at least one type of preset behavior parameters have the same number of rows and the same number of columns.

[0166] A specific implementation method for "determining the importance parameters corresponding to each member of the cluster under test for each type of preset behavioral parameter as elements in the parameter matrix corresponding to that type of preset behavioral parameter" can be as follows: Figure 7 As shown, it includes:

[0167] Step S701: Sort the importance parameters corresponding to each member in the preset behavior parameters of this type in descending order to obtain the first sorting result corresponding to the preset behavior parameters of this type.

[0168] Step S702: Use the first sorting result corresponding to this type of behavior parameter as the first column element in the parameter matrix corresponding to this type of behavior parameter.

[0169] Step S703: For each row in the parameter matrix corresponding to this type of behavior parameter, determine the first member corresponding to the first importance parameter in that row.

[0170] Step S704: Obtain the importance parameter of the first target member that has an X-degree link relationship with the first member corresponding to the row. The initial value of X is 1. An X-degree link relationship means that the first member and the first target member have interacted through at least X-1 members.

[0171] Step S705: Sort the importance parameters of the first target members corresponding to the row in descending order to obtain the second sorting results corresponding to the row.

[0172] Step S706: Identify the importance parameters in the second sorting result corresponding to that row as elements of that row, until the number of elements in that row equals the total number of columns in the parameter matrix. If all importance parameters in the second sorting result are elements of that row, and the number of elements in that row is less than the total number of columns, assign X+1 to X and return to step S704; to obtain all elements contained in each row.

[0173] The steps described above are illustrated with examples below.

[0174] 1. Obtain the parameter matrix corresponding to the transfer amount parameter.

[0175] The first step is to sort the importance parameters corresponding to each member for this type of transfer amount parameter in descending order to obtain the first sorting result for this type of transfer amount parameter.

[0176] Still with Figure 5 For example, suppose V je11 >V je31 >V je41 >V je21 The first sorting result is: V je11 V je31 V je41 V je21 .

[0177] The second step is to use the first sorting result corresponding to the transfer amount parameter of this type as the first column element in the parameter matrix corresponding to the transfer amount parameter of this type.

[0178] In an optional embodiment, since the first sorting result is used as the first column element, the number of rows in the parameter matrix is ​​the total number M of members in the cluster under test. Figure 5 For example, the total number of rows in the parameter matrix is ​​M = 4. The number of columns in the parameter matrix is ​​also preset and optional. The total number of columns in the parameter matrix is ​​N = 1 / 2 * M. This embodiment of the invention does not limit the total number of columns in the parameter matrix. For example, any positive integer less than or equal to M and greater than or equal to 1 can be selected.

[0179] It is understandable that the parameter matrix can be a one-dimensional vector, meaning that the parameter matrix corresponding to this type of transfer amount parameter can include only the elements in the first column.

[0180] In another alternative embodiment, the following steps may also be included.

[0181] The third step is to determine the first member corresponding to the first importance parameter in each row of the parameter matrix for this type of transfer amount parameter.

[0182] Still with Figure 5 For example, the parameter matrix consists of four rows, with the first importance parameter in the first row being V. je11 The first member corresponding to it is member A; the first importance parameter in the second row is V. je31 Its first corresponding member is member C; the first importance parameter in the third row is V. je41 Its first corresponding member is member D; the first importance parameter in the fourth row is V. je21 The first member corresponding to it is member B.

[0183] The fourth step is to obtain the importance parameters of each first target member that has an X-degree link relationship with the first member corresponding to that row.

[0184] The initial value of X is 1. An X-degree connection means that the first member and the first target member have interacted through at least X-1 members.

[0185] Still with Figure 5 For example, in this parameter matrix, the first target members that have a one-degree link to the first member A in the first row include: member B, member C, and member D. The importance parameter of member B is V. je21 The importance parameter for member C is V. je31 The importance parameter of member D is V. je41 . Figure 5 In the example shown, there are no members that have a second-degree link to the first member A.

[0186] The first target members in this parameter matrix that have a first-degree link to the first member C in the second row include: member A, member B, and member D. The importance parameter of member A is V. je11 The importance parameter for member B is V. je21 The importance parameter of member D is V. je41 . Figure 5 In the example shown, there are no members that have a second-degree link to the first member C.

[0187] The first target members in this parameter matrix that have a one-degree link to the first member D in the third row include: member A and member C. The importance parameter of member A is V. je11 The importance parameter for member C is V. je31 The first target members that have a second-degree link with the first member D include: member B.

[0188] In this parameter matrix, the first target members that have a one-degree link to the first member B in the fourth row include: member A and member C. The importance parameter of member A is V. je11 The importance parameter for member C is V. je31 The first target members that have a second-degree link with the first member B include: member D.

[0189] The fifth step is to sort the importance parameters of each first target member corresponding to the row in descending order to obtain the second sorting result for the row.

[0190] The sorting results of the first target member that has a one-degree link relationship with the first member of each row are as follows:

[0191] The second sorting result corresponding to the first row is: V je31 V je41 V je21 The second sorting result corresponding to the second row is: V je11 V je41 V je21 The second sorting result corresponding to the third row is: V je11 V je31 The second sorting result corresponding to the fourth row is: V je11 V je31 .

[0192] The second sorting results for the first target member that has a second-degree link to the first member of each row are as follows:

[0193] exist Figure 5 In the example shown, the first target member that has a second-degree link relationship with the first member A in the first row and the first member C in the second row does not exist. Therefore, the first and second rows will not be explained here.

[0194] The only target member with a second-degree link to the first member D in the third row is member B. Therefore, the second sorting result is: V je21 If the only first target member that has a second-degree link to the first member B in the fourth row is member D, then the second sorting result is V. je41 .

[0195] Step 6: Sequentially determine the importance parameters in the second sorting result corresponding to the row as elements of the row until the number of elements in the row is equal to the total number of columns in the parameter matrix; if all the importance parameters in the second sorting result are elements of the row, the number of elements in the row is less than the total number of columns, assign X+1 to X, and return to step 4.

[0196] Still with Figure 5 For example, if the total number of columns in the parameter matrix N = 4, then for the first row, the second sorting result corresponding to the first target member that has a one-degree link relationship with the first member A of the first row is V. je31 V je41 V je21 V je31 V je41 V je21 The elements in the first row are determined sequentially until the number of elements in the first row equals 4. This is because the importance parameter V in the second sorting result... je31 V je41 V je21 When all elements are included in the first row, the first row contains 4 elements. Therefore, after obtaining all elements in the first row, the first row contains [V]. je11 V je31 V je41 V je21 ].

[0197] For the second row, firstly, the second sorting result corresponding to the first target member that has a one-degree link relationship with the first member C in the second row is V. je11 V je41 V je21 V je11 V je41 V je21 The elements in the second row are determined sequentially until the number of elements in the second row equals 4. This is because the importance parameter V in the second sorting result... je11 V je41 V je21 When all elements are from the second row, the second row contains 4 elements. Therefore, all elements in the second row have been retrieved, and the second row contains the following elements: [V je31 V je11 V je41 V je21 ].

[0198] For the third row, firstly, the second sorting result corresponding to the first target member that has a one-degree link relationship with the first member D in the third row is V. je11 V je31 V je11 Vje31 The elements in the third row are determined sequentially until the number of elements in the third row equals 4. This is because the importance parameter V in the second sorting result... je11 V je31 When all elements are included in the third row, the number of elements in the third row is 3 < 4. Therefore, not all elements in the third row have been obtained. At this point, the elements in the third row are: [V je41 V je11 V je31 The question mark (?) indicates that the fourth element in the third row is undetermined.

[0199] For the fourth row, firstly, the importance parameters V in the second ranking result corresponding to the first target member B, which has a one-degree link relationship with the first member B in the fourth row. je11 V je31 V je11 V je31 The elements in the fourth row are determined sequentially until the number of elements in the fourth row equals 4. This is because the importance parameter V in the second sorting result... je11 V je31 When all elements are included in the fourth row, the number of elements in the fourth row is 3 < 4. Therefore, not all elements in the fourth row have been obtained. At this point, the elements in the fourth row are: [V je21 V je11 V je31 The question mark (?) indicates that the fourth element in the fourth row is undetermined.

[0200] For each row, steps three through six need to be performed until the number of elements in that row equals the total number of columns.

[0201] After executing steps four through six for the first time on the third row, the elements of the third row are [V]. je41 V je11 V je31 The fourth element in the third row is undetermined. Therefore, we need to return to step four. Since X+1 is assigned to X, X becomes 2 during the second execution of steps four through seven. Therefore, step four will obtain the importance parameter of the first target member that has a second-degree link with the first member D in the third row. This first target member is member B, and the importance parameter of member B is V. je21 In step five, V je21 Performing a descending sort, since there is only one importance parameter, the second sorting result is V. je21 Step 6: The importance parameter V in the second ranking result... je21 The element identified as the third row is determined by the importance parameter V. je21After being used as an element in the third row, the third row contains 4 elements. Therefore, the element retrieval for the third row is complete, and the elements of the third row are [V]. je41 V je11 V je31 V je21 ].

[0202] The fourth row is similar, so I won't repeat it here. The elements in the fourth row are [V je21 V je11 V je31 V je41 ].

[0203] Step 7: Repeat steps 4 through 6 until you obtain all the elements contained in each row of the parameter matrix corresponding to this type of transfer amount parameter.

[0204] by Figure 5 For example, the parameter matrix corresponding to the transfer amount parameter is as follows:

[0205] 2. Obtain the parameter matrix corresponding to the number of transfers.

[0206] The first step is to sort the importance parameters corresponding to each member in descending order for the number of transfers in that category, and obtain the first sorting result for that category of transfer count parameter.

[0207] Still with Figure 5 For example, suppose V cs11 >V cs21 ≥V cs31 >V cs41 The first sorting result is: V cs11 V cs21 V cs31 V cs41 .

[0208] The second step is to use the first sorting result corresponding to the number of transfers for that type as the first column element in the parameter matrix corresponding to the number of transfers for that type.

[0209] In an optional embodiment, since the first sorting result is used as the first column element, the number of rows in the parameter matrix is ​​the total number M of members in the cluster under test. Figure 5 For example, the total number of rows in the parameter matrix is ​​M = 4. The number of columns in the parameter matrix is ​​also preset. Preferably, the total number of columns in the parameter matrix is ​​N = 1 / 2 * M. This embodiment of the invention does not limit the total number of columns in the parameter matrix. For example, any positive integer less than or equal to M and greater than or equal to 1 can be selected.

[0210] It is understandable that the parameter matrix can be a one-dimensional vector, meaning that the parameter matrix corresponding to this type of transfer count parameter can include only the first sorted element.

[0211] In another alternative embodiment, the following steps may also be included.

[0212] The third step is to determine the first member corresponding to the first importance parameter in each row of the parameter matrix for this type of transfer frequency parameter.

[0213] Still with Figure 5 For example, the parameter matrix consists of four rows, with the first importance parameter in the first row being V. cs11 The first member corresponding to it is member A; the first importance parameter in the second row is V. cs21 Its first corresponding member is member B; the first importance parameter in the third row is V. cs31 Its first corresponding member is member C; the first importance parameter in the fourth row is V. cs41 Its first corresponding member is member D.

[0214] The fourth step is to obtain the importance parameter of the first target member that has an X-degree link relationship with the first member corresponding to that row.

[0215] The initial value of X is 1. An X-degree connection means that the first member and the first target member have interacted through at least X-1 members.

[0216] Still with Figure 5 For example, in this parameter matrix, the first target members that have a one-degree link to the first member A in the first row include: member B, member C, and member D. The importance parameter of member B is V. cs21 The importance parameter for member C is V. cs31 The importance parameter of member D is V. cs41 . Figure 5 In the example shown, there are no members that have a second-degree link to the first member A.

[0217] In this parameter matrix, the first target members that have a one-degree link to the first member B in the second row include: member A and member C. The importance parameter of member A is V. cs11 The importance parameter for member C is V. cs31 The first target members that have a second-degree link with the first member B include: member D.

[0218] The first target members in this parameter matrix that have a first-degree link to the first member C in the third row include: member A, member B, and member D. The importance parameter of member A is V. cs11 The importance parameter for member B is V. cs21 The importance parameter of member D is V. cs41 . Figure 5 In the example shown, there are no members that have a second-degree link to the first member C.

[0219] In this parameter matrix, the first target members that have a one-degree link to the first member D in the fourth row include: member A and member C. The importance parameter of member A is V. cs11 The importance parameter for member C is V. cs31 The first target members that have a second-degree link with the first member D include: member B.

[0220] The fifth step is to sort the importance parameters of the first target member corresponding to the row in descending order to obtain the second sorting result for the row.

[0221] The sorting results of the first target member that has a one-degree link relationship with the first member of each row are as follows:

[0222] The second sorting result corresponding to the first row is: V cs21 V cs31 V cs41 The second sorting result corresponding to the second row is: V cs11 V cs31 The second sorting result corresponding to the third row is: V cs11 V cs21 V cs41 The second sorting result corresponding to the fourth row is: V cs11 V cs31 .

[0223] The second sorting results for the first target member that has a second-degree link to the first member of each row are as follows:

[0224] exist Figure 5 In the example shown, there is no first target member that has a second-degree link relationship with the first member A in the first row and the first member C in the third row. Therefore, the first and third rows will not be explained here.

[0225] The only target member that has a second-degree link to the first member B in the second row is member D. Therefore, the second sorting result is: V cs41 If the only target member with a second-degree link to the first member D in the fourth row is member B, then the second sorting result is V. cs21 .

[0226] Step 6: Sequentially determine the importance parameters in the second sorting result corresponding to the row as elements of the row until the number of elements in the row is equal to the total number of columns in the parameter matrix; if all the importance parameters in the second sorting result are elements of the row, the number of elements in the row is less than the total number of columns, assign X+1 to X, and return to step 4.

[0227] Still with Figure 5 For example, if the total number of columns in the parameter matrix N = 4, then for the first row, firstly, the second sorting result corresponding to the first target member that has a one-degree link relationship with the first member A corresponding to the first row is V. cs21 V cs31 V cs41 V cs21 V cs31 V cs41 The elements in the first row are determined sequentially until the number of elements in the first row equals 4. This is because the importance parameter V in the second sorting result... cs21 V cs31 V cs41 When all elements are included in the first row, the first row contains 4 elements. Therefore, after obtaining all elements in the first row, the first row contains [V]. cs11 V cs21 V cs31 V cs41 ].

[0228] For the second row, firstly, the second sorting result corresponding to the first target member that has a one-degree link relationship with the first member B in the second row is V. cs11 V cs31 V cs11 V cs31 The elements in the second row are determined sequentially until the number of elements in the second row equals 4. This is because the importance parameter V in the second sorting result... cs11 V cs31 When all elements are from the second row, the number of elements in the second row is 3 < 4. Therefore, not all elements in the second row have been obtained. The elements in the second row are: [V cs21 V cs11 V jcs31 The question mark (?) indicates that the fourth element in the second row is undetermined.

[0229] For the third row, firstly, the second sorting result corresponding to the first target member that has a one-degree link relationship with the first member C in the third row is V. cs11 V cs21 V cs41 V cs11 V cs21 V cs41The elements in the third row are determined sequentially until the number of elements in the third row equals 4. This is because the importance parameter V in the second sorting result... cs11 V cs21 V cs41 When all elements are included in the third row, the third row contains 4 elements. Therefore, all elements in the third row have been obtained. At this point, the third row contains the following elements: [V cs31 V cs11 V cs21 V cs41 ].

[0230] For the fourth row, firstly, the second sorting result corresponding to the first target member that has a one-degree link relationship with the first member D in the fourth row is V. cs11 V cs31 V cs11 V cs31 The elements in the fourth row are determined sequentially until the number of elements in the fourth row equals 4. This is because the importance parameter V in the second sorting result... cs11 V cs31 When all elements are included in the fourth row, the number of elements in the fourth row is 3 < 4. Therefore, not all elements in the fourth row have been obtained. At this point, the elements in the fourth row are: [V cs41 V cs11 V cs31 The question mark (?) indicates that the fourth element in the fourth row is undetermined.

[0231] For each row, steps three through six need to be performed until the number of elements in that row equals the total number of columns.

[0232] After performing steps four through six for the first time on the second row, the elements of the second row are [V]. cs21 V cs11 V jcs31 The fourth element in the second row is undetermined. Therefore, we need to return to step four. Since X+1 is assigned to X, X becomes 2 during the second execution of steps four through six. Therefore, step four will obtain the importance parameter of the first target member that has a second-degree link with the first member B in the second row. This first target member is member D, and the importance parameter of member D is V. cs41 In step five, V cs41 Performing a descending sort, since there is only one importance parameter, the second sorting result is V. cs41 Step 6: The importance parameter V in the second ranking result... cs41 The element identified as the second row is determined by the importance parameter V. cs41After being used as an element in the second row, the second row contains 4 elements. Therefore, the element retrieval for the second row is complete, and the elements of the second row are [V]. cs21 V cs11 V cs31 V cs41 ].

[0233] The fourth row is similar, so I won't repeat it here. The elements in the fourth row are [V cs41 V cs11 V cs31 V cs21 ].

[0234] Step 7: Repeat steps 4 through 6 until you obtain all the elements contained in each row of the parameter matrix corresponding to the number of transfers for that type.

[0235] by Figure 5 For example, the parameter matrix corresponding to the number of transfers parameter is as follows:

[0236] In the above embodiments, "obtaining the parameter matrix corresponding to the transfer amount parameter" and "obtaining the parameter matrix corresponding to the number of transfers parameter" can be executed simultaneously or sequentially.

[0237] The third method, based on the second method, is another specific implementation of "determining the importance parameters corresponding to each member of the cluster under test for each type of preset behavioral parameter as elements in the parameter matrix corresponding to that type of preset behavioral parameter". Figure 8 As shown, it includes:

[0238] Step S801: Sort the importance parameters corresponding to each member in the preset behavior parameters of this type in descending order to obtain the first sorting result corresponding to the preset behavior parameters of this type;

[0239] Step S802: Use the first sorting result corresponding to this type of behavior parameter as the first column element in the parameter matrix corresponding to this type of behavior parameter;

[0240] Step S803: For each row in the parameter matrix corresponding to this type of behavior parameter, determine the first member corresponding to the first importance parameter in that row;

[0241] Step S804: Obtain the importance parameter of the first target member that has an X-degree link relationship with the first member corresponding to the row. The initial value of X is 1. An X-degree link relationship means that the first member and the first target member have interacted through at least X-1 members.

[0242] Step S805: Sort the importance parameters of the first target members corresponding to the row in descending order to obtain the second sorting results corresponding to the row;

[0243] Step S806: The importance parameter in the second sorting result corresponding to the row is determined as the element of the row in turn, until the number of elements in the row is equal to the total number of columns of the parameter matrix;

[0244] If all the importance parameters in the second sorting result are elements of that row, the number of elements in that row is less than the total number of columns, and X is less than the preset value, assign X+1 to X, and return to the step of obtaining the importance parameter of the first target member that has an X-degree link relationship with the first member corresponding to that row, where the preset value is a positive integer greater than or equal to 1.

[0245] If all importance parameters in the second sorting result are elements of that row, the number of elements in that row is less than the total number of columns, and X equals the preset value. Zero elements are added to that row until the number of elements in that row equals the total number of columns, so as to obtain all the elements contained in each row.

[0246] The following example illustrates the steps described above. Let's continue with the example... Figure 5 For example, and assuming the preset value is 1, the preset value can also be 2, 3, etc., and the embodiments of this application do not limit this.

[0247] 1. Obtain the parameter matrix corresponding to the transfer amount parameter.

[0248] The first execution of steps S801 to S805 is the same as the first execution of steps one to five in the second method for "obtaining the parameter matrix corresponding to the transfer amount parameters". When executing step S806, the importance parameters in the second sorting result corresponding to that row are sequentially determined as elements of that row. Since X = preset value = 1, if the number of elements in that row is still not equal to the total number of columns, zero elements are added to that row until the number of elements in that row equals the total number of columns. The above steps are performed on each row to obtain all the elements contained in each row.

[0249] The parameter matrix corresponding to the transfer amount parameter is as follows:

[0250] 2. Obtain the parameter matrix corresponding to the number of transfers.

[0251] The process of executing steps S801 to S805 for the first time is the same as the process of executing steps one to five for the first time in the second method of "obtaining the parameter matrix corresponding to the number of transfers". When executing step S806, the importance parameter in the second sorting result corresponding to the row is determined as the element of the row in sequence. Since X = preset value = 1, if the number of elements in the row is still not equal to the total number of columns, zero elements are added to the row until the number of elements in the row is equal to the total number of columns. The above steps are performed on the elements of each row to obtain all the elements contained in each row.

[0252] The parameter matrix corresponding to the number of transfers parameter is as follows:

[0253] In an optional embodiment, the features to be tested provided by this embodiment of the invention further include: importance parameters corresponding to the social parameters of each member of the cluster to be tested. Therefore, obtaining the features to be tested of the cluster to be tested further includes:

[0254] The first step is to obtain the initial probability of each member in the cluster under test interacting with the member under test for each member to be tested; the member under test is any member in the cluster under test.

[0255] Still with Figure 5 For example, in an optional embodiment, if a member to be tested has a first-degree link relationship with K members, then the initial probability of the member to be tested interacting with any member is 1 / K. For example, if member A has a first-degree link relationship with members B, C and D respectively, then optionally, the initial probability of member A interacting with members B, C and D respectively is 1 / 3.

[0256] Will Figure 5 The initial probabilities of each member interacting with other members are represented by matrix M3.

[0257]

[0258] The first row represents the initial probability of member A, member B, member C, and member D interacting with member A; the second row represents the initial probability of member A, member B, member C, and member D interacting with member B; the third row represents the initial probability of member A, member B, member C, and member D interacting with member C; and the fourth row represents the initial probability of member A, member B, member C, and member D interacting with member D.

[0259] The second step is to obtain the probability of each member in the cluster under test engaging in social behavior.

[0260] Based on historical data of the cluster under test, the probability of each member initiating social behavior can be obtained. In one example, it is assumed that the probability of each member initiating social behavior in the cluster under test is the same. Figure 5 The probability of each member initiating a social action is 1 / 4.

[0261] The third step is to combine the probability of each member engaging in social behavior with the corresponding initial probability of interacting with the member under test to obtain the final probability of each member engaging in social behavior with the member under test.

[0262] The fourth step is to sum the final probabilities of each member engaging in social behavior with the member under test, and determine the social probability of the member under test, so as to obtain the social probability corresponding to each member in the cluster under test.

[0263] Still with Figure 5 For example, steps three and four can be represented by the following formula:

[0264] The following iterations will be continuously performed:

[0265] V sj1 =M3*V sj0 V sj2 =M3*V sj1 V sj3 =M3*V sj2 ;...;V sj(n3) =M3*V sj(n3-1) ;

[0266] or,

[0267] V sj1 =α3M3*V sj0 +(1-α3)e3;V sj2 =α3M3*V sj1 +(1-α3)e3;

[0268] V sj3 =α3M3*V sj2 +(1-α3)e3;...;V sj(n2) =α3M3*V sj(n2-1) +(1-α3)e3

[0269] Where α3 can be any value greater than 0 and less than 1;

[0270] Optional,

[0271] Until, continuous V sj(n3) With V sj(n3-1) Convergence is considered achieved when the results of the two tests do not change, or when the difference is within a preset range. Let's assume the convergent result is V.sj(n3) =[V sj11 V sj21 V sj31 V sj41 ] T Wherein, the social probability corresponding to member A is V. sj11 The social probability corresponding to member B is V. sj21 The social probability corresponding to member C is V. sj31 The social probability corresponding to member D is V. sj41 .

[0272] The fifth step is to obtain the importance parameters of each member of the test cluster in terms of social parameters based on the social probabilities of each member.

[0273] Step five includes three methods:

[0274] First, the social probability corresponding to each member in the cluster under test is directly used as the importance parameter corresponding to each member in the social parameters of the cluster under test.

[0275] by Figure 5 For example, the importance parameters corresponding to the social parameters for each member in the cluster under test are as follows: V sj11 V sj21 V sj31 V sj41 .

[0276] Second, the importance parameters corresponding to each member of the cluster under test for each type of social parameter are used as elements in the parameter matrix corresponding to that type of social parameter.

[0277] 1. Sort each member in descending order of the importance parameter corresponding to this type of social parameter to obtain the first ranking result corresponding to this type of social parameter.

[0278] by Figure 5 For example, suppose V sj11 ≥V sj31 >V sj21 ≥V sj41 The first sorting result is: V sj11 V sj31 V sj21 V sj41 .

[0279] 2. Use the first sorting result corresponding to this type of social parameter as the first column element in the parameter matrix corresponding to this type of social parameter.

[0280] 3. For each row in the parameter matrix corresponding to this type of social parameter, determine the first member corresponding to the first importance parameter in that row.

[0281] 4. Obtain the importance parameters of each first target member that has an X-degree link relationship with the first member corresponding to the row.

[0282] 5. Sort the importance parameters of each first target member corresponding to the row in descending order to obtain the second sorting results corresponding to the row.

[0283] 6. Sequentially assign each importance parameter in the second sorting result corresponding to the row to the elements of the row until the number of elements in the row is equal to the total number of columns in the parameter matrix; if each importance parameter in the second sorting result is an element of the row, and the number of elements in the row is less than the total number of columns, assign X+1 to X and return to step 4.

[0284] The parameter matrix corresponding to the social parameters is:

[0285] The third method involves using the importance parameter and zero element corresponding to each member of the cluster under test for each type of social parameter as elements in the parameter matrix corresponding to that type of social parameter.

[0286] Steps 1 to 6 in this method are the same as steps S801 to S806, and the preset value is assumed to be 1.

[0287] 1. Sort each member in descending order of the importance parameter corresponding to this type of social parameter to obtain the first ranking result corresponding to this type of social parameter.

[0288] by Figure 5 For example, suppose V sj11 ≥V sj31 >V sj21 ≥V sj41 The first sorting result is: V sj11 V sj31 V sj21 V sj41 .

[0289] 2. Use the first sorting result corresponding to this type of social parameter as the first column element in the parameter matrix corresponding to this type of social parameter.

[0290] 3. For each row in the parameter matrix corresponding to this type of social parameter, determine the first member corresponding to the first importance parameter in that row.

[0291] 4. Obtain the importance parameters of each first target member that has an X-degree link relationship with the first member corresponding to the row.

[0292] 5. Sort the importance parameters of each first target member corresponding to the row in descending order to obtain the second sorting results corresponding to the row.

[0293] 6. In the second sorting result corresponding to the row, each importance parameter is sequentially determined as an element of the row until the number of elements in the row is equal to the total number of columns of the parameter matrix; if each importance parameter in the second sorting result is an element of the row, the number of elements in the row is less than the total number of columns, and X = 1, zero elements are added to the row until the number of elements in the row is equal to the total number of columns, so as to obtain all the elements contained in each row.

[0294] The parameter matrix corresponding to the social parameters is:

[0295] In one optional embodiment, a type of preset behavioral parameter (for distinction, this type of preset behavioral parameter is referred to as preset first target behavioral parameter) can be a combination of at least two types of preset behavioral parameters (for distinction, at least two types of preset behavioral parameters are referred to as at least two types of preset second target behavioral parameters), or a combination of at least one type of preset behavioral parameter (for distinction, at least one type of preset behavioral parameter is referred to as at least one type of preset second target behavioral parameter) and social parameters. Then, the importance parameters of each member of the test cluster corresponding to the preset first target behavioral parameter include: the combination of the importance parameters of each member of the test cluster corresponding to each type of preset second target behavioral parameter; or, the combination of the importance parameters of each member of the test cluster corresponding to each type of preset second target behavioral parameter and the corresponding importance parameters of each member of the test cluster corresponding to each social parameter.

[0296] For example, at least one type of preset behavior parameter may include: a type of transfer parameter that is a combination of transfer amount parameter and transfer frequency parameter.

[0297] Therefore, the importance parameters corresponding to the transfer parameters for each member of the cluster under test are as follows:

[0298] The importance parameters of each member of the cluster under test corresponding to the transfer amount parameter are linear or nonlinear combinations of the importance parameters of the corresponding members of the cluster under test corresponding to the transfer number parameter. For example, the importance parameters of each member of the cluster under test corresponding to the transfer parameter include: first preset weight * (importance parameters of each member of the cluster under test corresponding to the transfer amount parameter) + second preset weight * (importance parameters of each member of the cluster under test corresponding to the transfer number parameter).

[0299] Still with Figure 5 For example, assuming that both the first and second preset weights are 1 / 2, then the parameter matrix corresponding to the transfer parameters is...

[0300] In one optional embodiment, the core members of the cluster under test can be obtained based on the parameter matrices corresponding to the at least one type of behavioral parameters.

[0301] Because the importance parameters in the first column of the parameter matrix corresponding to each type of behavior parameter are arranged in descending order, and all rows in the parameter matrix corresponding to each type of behavior parameter are arranged in descending order except for the first element, it is possible to obtain the candidate core members with higher importance parameters from the parameter matrices corresponding to each type of behavior parameter. By combining the candidate core members corresponding to each type of behavior parameter, the core members in the cluster to be tested can be determined.

[0302] For example, member A, who is a candidate core member in both the transfer amount parameter and the transfer number parameter, is identified as a core member in the cluster to be tested.

[0303] To help those skilled in the art better understand the cluster type identification method provided in the embodiments of the present invention, a specific example is given below for illustration.

[0304] Still with Figure 5 For example, suppose the cluster to be tested is a community, which includes two groups, namely group 1 and group 2. Group 1 includes members A, B and C; group 2 includes members A, C and D.

[0305] First, obtain the characteristics to be tested for the community.

[0306] Suppose that the characteristics to be tested for this community include:

[0307] The parameter matrix corresponding to the transfer amount parameter is as follows: The parameter matrix corresponding to the number of transfers parameter is as follows: The parameter matrix corresponding to the social parameters is:

[0308] Secondly, the features to be tested are input into a pre-built cluster type prediction model.

[0309] That is, the features to be tested for the cluster to be tested in Figure 1 are the three matrices mentioned above.

[0310] The pre-built cluster type prediction model can obtain the community structure of the community based on the above three matrices, and thus predict the probability that the community belongs to each of the known communities.

[0311] Suppose that the community structure includes: each member transfers money to the next higher-level member, there are very few transfers between members, and there is a hierarchical concept.

[0312] Finally, the pre-built cluster type prediction model outputs a 95% probability that the community belongs to a pyramid scheme; a 3% probability that it belongs to a gambling community; a 2% probability that it belongs to a pornographic website dissemination community; and a 0% probability that it belongs to a legitimate community.

[0313] It is understandable that the cluster type prediction model mentioned above is obtained through neural network training. The method for constructing this cluster type prediction model will be explained below.

[0314] The first step is to obtain multiple positive sample clusters and multiple negative sample clusters to obtain multiple sample clusters.

[0315] Positive sample clusters can be illegal clusters. Negative sample clusters can be legal clusters.

[0316] In this embodiment of the invention, a legitimate cluster is any cluster other than an illegal cluster.

[0317] The second step is to obtain the training features corresponding to each sample cluster.

[0318] The training features of a sample cluster include: the importance parameters corresponding to each member of the sample cluster in at least one set of preset behavioral parameters.

[0319] The process of obtaining the training features corresponding to the sample cluster is the same as the process of obtaining the test features corresponding to the test cluster. Please refer to the process of obtaining the test features corresponding to the test cluster. It will not be repeated here.

[0320] The third step is to use the training features corresponding to each sample cluster as the training input of the neural network to train the cluster type prediction model.

[0321] In an optional embodiment, the third step may specifically include:

[0322] 1. Using the training features corresponding to each sample cluster as the training input of the neural network, the predicted probability of each sample cluster belonging to the known clusters of each class is obtained, and the prediction vector corresponding to each sample cluster is obtained.

[0323] 2. Based on the comparison results of the predicted vectors corresponding to each sample cluster and the real vectors corresponding to the corresponding sample clusters, update the feature extraction parameters and probability calculation parameters in the neural network.

[0324] The feature extraction parameters are used at least to extract the cluster structure of the sample cluster from the training features of the sample cluster; the probability calculation parameters are used to obtain the predicted probability that the sample cluster belongs to each of the known clusters based on the cluster structure of the sample cluster.

[0325] 3. Return to step 1; until the comparison result meets the termination condition; obtain the cluster type prediction model.

[0326] Performing steps 1 and 2 once is called an iteration process. In each iteration, the neural network estimates the predicted probability that each sample cluster belongs to the known clusters based on the updated feature extraction parameters and probability calculation parameters.

[0327] In this embodiment of the invention, "the cluster type prediction model takes minimizing the length of the difference vector between the predicted vector and the true vector of the sample cluster as its training objective" means that the closer the predicted vector of the sample cluster is to the true vector, the better. To achieve this training objective, the neural network can be trained in several ways, and this embodiment of the invention provides, but is not limited to, the following methods.

[0328] The first method involves obtaining the difference vector between the predicted vector corresponding to each sample cluster and the true vector corresponding to the corresponding sample cluster; obtaining the sum of the difference vectors corresponding to each sample cluster to obtain the sum vector; and updating the feature extraction parameters and probability calculation parameters in the neural network based on the sum vector.

[0329] During the continuous iteration process, the feature extraction parameters and probability calculation parameters in the neural network are continuously updated, making the length of the sum vector smaller and smaller.

[0330] The second method involves obtaining the predicted vector corresponding to each sample cluster and the difference vector between the predicted vector and the true vector corresponding to the corresponding sample cluster; based on the difference vector corresponding to each sample cluster, the feature extraction parameters and probability calculation parameters in the neural network are updated.

[0331] During the continuous iteration process, the feature extraction parameters and probability calculation parameters in the neural network are continuously updated, so that the length of the difference vector corresponding to each sample cluster becomes smaller and smaller.

[0332] The third method involves obtaining the difference vector between the predicted vector corresponding to each sample cluster and the true vector corresponding to the corresponding sample cluster; for each dimension of the difference vector, obtaining the probability of the difference with the largest absolute value in that dimension from the difference vector corresponding to each sample cluster; obtaining the probability of the difference with the largest absolute value corresponding to each dimension; forming a target difference vector from the probability of the difference with the largest absolute value corresponding to each dimension; and updating the feature extraction parameters and probability calculation parameters based on the target difference vector.

[0333] During the continuous iteration process, the feature extraction parameters and probability calculation parameters in the neural network are continuously updated, making the length of the target difference vector smaller and smaller.

[0334] Taking the difference vector (-0, 05, 0.04, 0.01, 0) as an example, this difference vector includes four dimensions. The number of dimensions in the difference vector is determined by the number of known clusters that the neural network can predict. The number of dimensions in the difference vector is the same as the number of known clusters that the neural network can predict. Each dimension of the difference vector corresponds to a known cluster. The specific value of the dimension corresponding to each known cluster is the difference between the predicted probability that the sample cluster belongs to that known cluster and the true probability that the sample cluster belongs to that known cluster. For example, the above difference probability 0.04 = the predicted probability that the sample cluster belongs to the pyramid scheme cluster type 0.04 - the true probability that the sample cluster belongs to the pyramid scheme cluster type 0 = 0.04.

[0335] Regardless of which method is used to update the parameters of the neural network, the training objective is to minimize the length of the difference vector between the predicted vector and the true vector for each sample cluster.

[0336] The termination condition can be that the length of the difference vector of each sample cluster is less than or equal to a first preset length threshold; and / or, the length of the difference vector is less than or equal to a second preset length threshold; and / or, the length of the target difference vector is less than or equal to a third preset length threshold.

[0337] The first preset length threshold, the second preset length threshold, and the third preset length threshold may be equal or unequal; the embodiments of the present invention do not impose specific limitations on this.

[0338] Optionally, the neural network can be a fully connected neural network (such as an MLP network, where MLP stands for Multi-layer Perceptron), or other forms of neural networks (such as convolutional neural networks, deep neural networks, etc.).

[0339] It should be noted that the parameters used at the beginning of the neural network can be initial random parameters. The neural network first processes the training features corresponding to each sample cluster based on the random parameters, and updates the parameters based on the processing results. Then, the neural network processes the training features corresponding to each sample cluster based on the updated parameters, and updates the parameters again based on the processing results. After multiple iterations, if the number of iterations exceeds the preset number, or the processing results meet the termination condition, the training stops, and the final cluster type prediction model is obtained.

[0340] Optionally, the neural network can use the backpropagation gradient descent algorithm to update the parameters of the neural network, thereby achieving iterative training and convergence of the neural network.

[0341] To help those skilled in the art better understand the training process of the cluster type prediction model in the embodiments of the present invention, a specific example is provided below.

[0342] like Figure 9 The diagram shown is a schematic representation of a process for training a neural network according to an embodiment of the present invention.

[0343] Cluster type prediction models include at least: convolutional layers, pooling layers, fully connected layers, and normalization layers.

[0344] The process of convolution in a convolutional layer is as follows: Figure 9 As shown in 91.

[0345] Convolutional layers can obtain the cluster structure of a sample cluster from the training features of the input sample cluster.

[0346] The convolutional layer has multiple convolutional kernels, which convolve with the input training features to obtain the cluster structure of sample clusters from the training features. The feature extraction parameters include the multiple convolutional kernels in the convolutional layer.

[0347] In one alternative embodiment, the training features can be parameter matrices corresponding to at least one class of behavioral parameters.

[0348] Assuming there are P classes of behavioral parameters, then P parameter matrices can be input into the input layer; each parameter matrix in the convolutional layer can be convolved with multiple convolutional kernels. Suppose that convolving the P parameter matrices yields Q first matrices. The value of Q is very large, much larger than P.

[0349] A pooling layer is added after the convolutional layer because it reduces the amount of data to be computed, thereby improving computation speed. A pooling layer can also be called a downsampling layer.

[0350] The pooling layer consists of multiple pooling kernels, which are used to further extract the cluster structure of the sample clusters from the Q first matrices. Assume the pooling layer downsamples the Q first matrices respectively, resulting in Q second matrices. Figure 9 In section 92, we describe the process of downsampling the Q first matrices after convolution to obtain Q second matrices.

[0351] Feature extraction parameters can also include multiple pooling kernels in the pooling layer.

[0352] Fully connected layers (FC) act as a "classifier" in the entire neural network. Based on probability calculations, FC layers combine the Q pooled second matrices to calculate the scores indicating which sample clusters belong to which known clusters. Figure 9Figure 93 shows the process by which the fully connected layer combines Q second matrices to obtain an overall cluster structure.

[0353] Normalization layer 94 is used to normalize the scores of sample clusters belonging to each of the known clusters, and outputs the predicted probability of sample clusters belonging to each of the known clusters.

[0354] That is, the sum of the probabilities that the sample cluster belongs to each of the known clusters is 1. Assume that the known clusters are: gambling cluster type, pyramid scheme cluster type, and pornographic website propagation type; and that the score of the sample cluster belonging to the gambling cluster type is 90 (or a decimal, not specifically limited in this embodiment), the score of the sample cluster belonging to the pyramid scheme cluster type is 80, and the score of the sample cluster belonging to the pornographic website propagation type is 70; then, with a normalization layer of 94, the predicted probability that the sample cluster belongs to the gambling cluster type is 90 / (90+70+80) = 0.375; the predicted probability that this cluster belongs to the pyramid scheme cluster type is 80 / (90+70+80) = 0.333; and the predicted probability that the sample cluster belongs to the pornographic website propagation type is 70 / (90+70+80) = 0.292.

[0355] Neural networks update feature extraction parameters and probability calculation parameters based on the difference between the predicted and true vectors of a sample cluster. For example, this involves updating each convolutional kernel in the convolutional layer, each pooling kernel in the pooling layer, and the probability calculation parameters in the fully connected layer. Parameter updates are performed based on the error between the predicted and true vectors. Because this process is backwards, it is also called the backpropagation process of the neural network.

[0356] After updating the parameters, the training features of the sample clusters need to be input into the neural network again. The convolutional layers in the neural network extract the cluster structure of the sample clusters from the training features based on the updated convolutional kernels; the pooling layers further extract the cluster structure from the Q first matrices after convolution based on the updated pooling kernels; the fully connected layers combine the Q second matrices after pooling based on the updated probability calculation parameters to calculate the scores of the sample clusters belonging to each of the known clusters; the normalization layer 94 is used to normalize the scores of the sample clusters belonging to each of the known clusters and output the predicted probability of the sample clusters belonging to each of the known clusters.

[0357] The neural network updates the feature extraction parameters and probability calculation parameters again based on the difference vector between the predicted vector and the true vector of this sample cluster.

[0358] Repeat the above iterative process until the length of the difference vector between the predicted vector and the true vector for each sample cluster is less than or equal to a preset length threshold, or until the preset number of iterations is reached, to obtain the final cluster type prediction model.

[0359] In one optional embodiment, the cluster type prediction model may include multiple convolutional layers. The purpose of multiple convolutions is that the cluster structure learned by a single convolutional layer is often local; the higher the number of convolutional layers, the more global the learned cluster structure. That is, a global cluster structure can be obtained through multiple convolutional layers. The cluster type prediction model includes at least a set of convolutional layers and pooling layers; that is, the cluster type prediction model may also include: convolutional layers, pooling layers, convolutional layers, pooling layers, fully connected layers, and normalization layers.

[0360] Figure 9 The ellipsis in the text represents multiple omitted processes 91 and 92.

[0361] like Figure 10 The diagram shown is a structural diagram of a cluster type identification device provided in an embodiment of the present invention. The device includes:

[0362] The first acquisition module 1001 is used to acquire the test features of the cluster under test, wherein the test features include at least the importance parameters corresponding to each member of the cluster under test on at least one type of preset behavioral parameters.

[0363] Input module 1002 is used to input the feature to be tested into a pre-constructed cluster type prediction model;

[0364] The cluster type prediction model is obtained by training a neural network with the goal of minimizing the length of the difference vector between the predicted vector and the true vector of the sample cluster; the predicted vector includes the predicted probability that the sample cluster belongs to each of the known clusters; the true vector includes the true probability that the sample cluster belongs to each of the known clusters.

[0365] The second acquisition module 1003 is used to acquire the predicted probabilities of the cluster under test belonging to the various known clusters, as output by the cluster type prediction model.

[0366] Optionally, the first acquisition module includes:

[0367] The first acquisition unit is used to acquire the behavior parameter values ​​corresponding to each member of the cluster under test in the at least one type of preset behavior parameter;

[0368] The first determining unit is used to determine the importance parameters of each member of the cluster under test in each of the preset behavioral parameters according to the behavioral parameter values ​​of each member of the cluster under test in each of the preset behavioral parameters, so as to obtain the importance parameters of each member of the cluster under test in each of the at least one preset behavioral parameters.

[0369] The second determining unit is used to determine the test features of the cluster under test based at least on the importance parameters corresponding to each member of the cluster under test in at least one type of preset behavioral parameters.

[0370] Optionally, the feature to be tested further includes: the importance parameters corresponding to the social parameters of each member of the cluster to be tested; the first acquisition module further includes:

[0371] The second acquisition unit is used to acquire, for each member in the cluster under test, the initial probability of interaction between each member in the cluster under test and the member under test; the member under test is any member in the cluster under test.

[0372] The third acquisition unit is used to acquire the probability of each member in the cluster under test engaging in social behavior;

[0373] The fourth acquisition unit is used to combine the probability of each member engaging in social behavior with the corresponding initial probability of interacting with the member under test to obtain the final probability of each member engaging in social behavior with the member under test.

[0374] The third determining unit is used to determine the sum of the final probabilities of each member engaging in social behavior with the member under test as the social probability of the member under test, so as to obtain the social probability corresponding to each member in the cluster under test.

[0375] The fifth acquisition unit is used to obtain the importance parameters of each member of the test cluster in terms of social parameters based on the social probabilities of each member in the test cluster.

[0376] Optionally, the second determining unit includes:

[0377] A subunit is defined for each type of preset behavior parameter, which is used as an element in the parameter matrix corresponding to the importance parameter of each member of the cluster under test for each type of preset behavior parameter, so as to obtain the parameter matrix corresponding to the at least one type of preset behavior parameter.

[0378] Optionally, the determining subunit includes:

[0379] The first acquisition submodule is used to sort the importance parameters of each member in descending order for each type of preset behavior parameter, and obtain the first sorting result corresponding to the type of preset behavior parameter.

[0380] The first determining submodule is used to take the first sorting result corresponding to the type of behavior parameter as the first column element in the parameter matrix corresponding to the type of behavior parameter, so as to obtain the first column element in the parameter matrix corresponding to the at least one type of preset behavior parameter respectively.

[0381] Optionally, the determining subunit further includes:

[0382] The second determination submodule is used to determine the first member corresponding to the first importance parameter in each row of the parameter matrix corresponding to the type of behavior parameter;

[0383] The second acquisition submodule is used to acquire the importance parameter of the first target member that has an X-degree connection relationship with the first member corresponding to the row. The initial value of X is 1. An X-degree connection relationship means that the first member and the first target member have interacted through at least X-1 members.

[0384] The third acquisition submodule is used to sort the importance parameters of the first target members corresponding to the row in descending order to obtain the second sorting results corresponding to the row.

[0385] The third determining submodule is used to sequentially determine the importance parameters in the second sorting result corresponding to the row as elements of the row, until the number of elements in the row is equal to the total number of columns of the parameter matrix;

[0386] The return submodule is used to assign X+1 to X if the importance parameters in the second sorting result are all elements of the row, and the number of elements in the row is less than the total number of columns. Then, the return step is used to obtain the importance parameters of each first target member that has an X-degree link relationship with the first member corresponding to the row, so as to obtain all the elements contained in each row.

[0387] Optionally, the returned submodule can be specifically used for:

[0388] If all the importance parameters in the second sorting result are elements of that row, the number of elements in that row is less than the total number of columns, and X is less than the preset value, assign X+1 to X, and return to the step of obtaining the importance parameter of the first target member that has an X-degree link relationship with the first member corresponding to that row, where the preset value is a positive integer greater than or equal to 1.

[0389] If all importance parameters in the second sorting result are elements of that row, the number of elements in that row is less than the total number of columns, and X equals the preset value. Zero elements are added to that row until the number of elements in that row equals the total number of columns, so as to obtain all the elements contained in each row.

[0390] Optional, also includes:

[0391] The third acquisition module is used to acquire the core members in the cluster under test based on the parameter matrices corresponding to the at least one type of behavioral parameter.

[0392] Optional, also includes:

[0393] The fourth acquisition module is used to acquire multiple positive sample clusters and multiple negative sample clusters to obtain multiple sample clusters;

[0394] The fifth acquisition module is used to acquire the training features corresponding to each sample cluster. The training features of a sample cluster include: the importance parameters corresponding to each member of the sample cluster in at least one class of preset behavioral parameters.

[0395] The training module is used to train the cluster type prediction model by taking the training features corresponding to each sample cluster as the training input of the neural network.

[0396] Optionally, the training module includes:

[0397] The sixth acquisition unit is used to take the training features corresponding to each sample cluster as the training input of the neural network, obtain the predicted probability that each sample cluster belongs to the known clusters of each type, and obtain the prediction vector corresponding to each sample cluster.

[0398] The update unit is used to update the feature extraction parameters and probability calculation parameters in the neural network based on the comparison results of the prediction vectors corresponding to each sample cluster and the real vectors corresponding to the corresponding sample clusters.

[0399] A triggering unit is used to trigger the sixth acquisition unit; until the comparison result meets the termination condition; the cluster type prediction model is obtained.

[0400] The feature extraction parameters are used at least to extract the cluster structure of the sample cluster from the training features of the sample cluster; the probability calculation parameters are used to obtain the predicted probability that the sample cluster belongs to each of the known clusters based on the cluster structure of the sample cluster.

[0401] This invention also provides a storage medium storing a program suitable for execution by a processor, the program being used for:

[0402] Obtain the test features of the cluster under test, wherein the test features include at least: the importance parameters corresponding to each member of the cluster under test on at least one type of preset behavioral parameters;

[0403] The features to be tested are input into a pre-built cluster type prediction model;

[0404] The cluster type prediction model is obtained by training a neural network with the goal of minimizing the length of the difference vector between the predicted vector and the true vector of the sample cluster; the predicted vector includes the predicted probability that the sample cluster belongs to each of the known clusters; the true vector includes the true probability that the sample cluster belongs to each of the known clusters.

[0405] Obtain the predicted probability of the cluster under test belonging to each of the known cluster types, as output by the cluster type prediction model.

[0406] Optionally, when the processor performs the task of acquiring the characteristics to be tested of the cluster under test, it is specifically used for:

[0407] Obtain the behavior parameter values ​​corresponding to each member of the cluster under test in at least one type of preset behavior parameter;

[0408] For each type of preset behavior parameter, based on the behavior parameter values ​​corresponding to each member of the cluster under test in that type of preset behavior parameter, the importance parameters corresponding to each member of the cluster under test in that type of preset behavior parameter are determined, so as to obtain the importance parameters corresponding to each member of the cluster under test in at least one type of preset behavior parameter.

[0409] The test features of the cluster under test are determined based on the importance parameters corresponding to each member of the cluster under test in at least one type of preset behavioral parameters.

[0410] Optionally, the feature to be tested further includes: importance parameters corresponding to the social parameters of each member of the cluster to be tested. When the processor executes the process of acquiring the feature to be tested of the cluster to be tested, it is also specifically used for:

[0411] For each member to be tested, obtain the initial probability of interaction between each member in the cluster to be tested and the member to be tested; the member to be tested is any member in the cluster to be tested.

[0412] Obtain the probability of each member in the cluster under test engaging in social behavior;

[0413] The probability of each member engaging in social behavior is combined with the initial probability of interacting with the member under test to obtain the final probability of each member engaging in social behavior with the member under test.

[0414] The sum of the final probabilities of each member engaging in social behavior with the member under test is determined as the social probability of the member under test, so as to obtain the social probability corresponding to each member in the cluster under test.

[0415] Based on the social probabilities of each member in the cluster under test, the importance parameters of each member in the cluster under test corresponding to the social parameters are obtained.

[0416] Optionally, when the processor determines the test features of the cluster under test based on the importance parameters corresponding to each member of the cluster under test in at least one type of preset behavioral parameters, it specifically performs the following:

[0417] For each type of preset behavior parameter, the importance parameter of each member of the cluster under test corresponding to that type of preset behavior parameter is used as the element in the parameter matrix corresponding to that type of preset behavior parameter, so as to obtain the parameter matrix corresponding to the at least one type of preset behavior parameter.

[0418] Optionally, when the processor determines the importance parameters corresponding to each member of the cluster under test for each type of preset behavioral parameter as elements in the parameter matrix corresponding to that type of preset behavioral parameter, it specifically performs the following:

[0419] Sort the importance parameters of each member in descending order according to the preset behavior parameters of this type, and obtain the first sorting result corresponding to the preset behavior parameters of this type.

[0420] The first sorting result corresponding to this type of behavior parameter is used as the first column element in the parameter matrix corresponding to this type of behavior parameter.

[0421] Optionally, the processor, in executing the process of determining the importance parameters corresponding to each member of the cluster under test for each type of preset behavioral parameter as elements in the parameter matrix corresponding to that type of preset behavioral parameter, is further configured to:

[0422] For each row in the parameter matrix corresponding to this type of behavior parameter, determine the first member corresponding to the first importance parameter in that row;

[0423] Obtain the importance parameter of the first target member that has an X-degree link relationship with the first member corresponding to the row. The initial value of X is 1. An X-degree link relationship means that the first member and the first target member have interacted through at least X-1 members.

[0424] Sort the importance parameters of the first target members corresponding to the row in descending order to obtain the second sorting results for the row.

[0425] The importance parameters in the second sorting result corresponding to that row are sequentially determined as elements of that row, until the number of elements in that row is equal to the total number of columns in the parameter matrix;

[0426] If all the importance parameters in the second sorting result are elements of that row, and the number of elements in that row is less than the total number of columns, assign X+1 to X, and return to the step of obtaining the importance parameter of the first target member that has an X-degree link relationship with the first member corresponding to that row; so as to obtain all the elements contained in each row.

[0427] Optionally, when the processor executes the step of obtaining the importance parameter of the first target member with an X-degree link relationship to the first member corresponding to the first member of the row if the importance parameter in the second sorting result is all elements of that row, and the number of elements in that row is less than the total number of columns, X+1 is assigned to X, and the process returns to the step of obtaining the importance parameter of the first target member with an X-degree link relationship to the first member of that row, the processor is specifically used for:

[0428] If all the importance parameters in the second sorting result are elements of that row, the number of elements in that row is less than the total number of columns, and X is less than the preset value, assign X+1 to X, and return to the step of obtaining the importance parameter of the first target member that has an X-degree link relationship with the first member corresponding to that row, where the preset value is a positive integer greater than or equal to 1.

[0429] If all importance parameters in the second sorting result are elements of that row, and the number of elements in that row is less than the total number of columns, and X equals the preset value, then zero elements are added to that row until the number of elements in that row equals the total number of columns.

[0430] Optionally, the processor is also used to perform:

[0431] Based on the parameter matrices corresponding to the at least one type of behavioral parameter, the core members in the cluster under test are obtained.

[0432] Optionally, the processor is also used for:

[0433] Obtain multiple sample clusters;

[0434] Obtain the training features corresponding to each sample cluster. The training features of a sample cluster include: the importance parameters of each member of the sample cluster in at least one class of preset behavioral parameters.

[0435] The training features corresponding to each sample cluster are used as the training input of the neural network to train the cluster type prediction model.

[0436] Optionally, when the processor executes the training of the cluster type prediction model by using the training features corresponding to each sample cluster as the training input of the neural network, it specifically performs the following:

[0437] The training features corresponding to each sample cluster are used as the training input of the neural network to obtain the predicted probability that each sample cluster belongs to the known clusters of each class, and the prediction vector corresponding to each sample cluster is obtained.

[0438] Based on the comparison results of the predicted vectors corresponding to each sample cluster and the real vectors corresponding to the corresponding sample clusters, the feature extraction parameters and probability calculation parameters in the neural network are updated.

[0439] The feature extraction parameters are used at least to extract the cluster structure of the sample cluster from the training features of the sample cluster; the probability calculation parameters are used to obtain the predicted probability that the sample cluster belongs to each of the known clusters based on the cluster structure of the sample cluster.

[0440] The return step uses the training features corresponding to each sample cluster as the training input of the neural network to obtain the predicted probability that each sample cluster belongs to the known clusters of each type; until the comparison result meets the termination condition; and obtains the cluster type prediction model.

[0441] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0442] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0443] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for identifying cluster types, characterized in that, Applications in the field of communication technology, including: Obtain the behavioral parameter values ​​corresponding to the transfer amount parameter for each member of the cluster under test, and obtain the behavioral parameter values ​​corresponding to the transfer number parameter for each member of the cluster under test. Based on the behavioral parameter values ​​corresponding to the transfer amount parameter of each member of the cluster under test, the importance parameter corresponding to the transfer amount parameter of each member of the cluster under test is determined. Based on the behavioral parameter values ​​corresponding to the transfer number parameter of each member of the cluster under test, the importance parameter corresponding to the transfer number parameter of each member of the cluster under test is determined. The importance parameters corresponding to the transfer amount parameter of each member of the cluster under test are used as elements in the parameter matrix corresponding to the transfer amount parameter, and the importance parameters corresponding to the number of transfers parameter of each member of the cluster under test are used as elements in the parameter matrix corresponding to the number of transfers parameter. The parameter matrix corresponding to the transfer amount parameter and the parameter matrix corresponding to the number of transfers parameter are used as the features to be tested of the cluster under test. The features to be tested are input into a pre-constructed cluster type prediction model; the cluster type prediction model includes convolutional layers, pooling layers, fully connected layers, and normalization layers; The cluster type prediction model is obtained by training a neural network with the goal of minimizing the length of the difference vector between the predicted vector and the true vector of the sample cluster; the predicted vector includes the predicted probability that the sample cluster belongs to each of the known clusters, and the predicted probability that the sample cluster belongs to each of the known clusters is predicted by the neural network; the true vector includes the true probability that the sample cluster belongs to each of the known clusters. The convolutional layer is used to perform convolution processing on the features to be tested to obtain the cluster structure of the cluster to be tested. The cluster structure is then processed sequentially through the pooling layer, the fully connected layer, and the normalization layer to obtain the predicted probability that the cluster to be tested belongs to each of the known clusters. The predicted probability that the cluster to be tested belongs to each of the known clusters is used to identify whether the cluster to be tested is an illegal cluster.

2. The cluster type identification method according to claim 1, characterized in that, The features to be tested also include: importance parameters corresponding to the social parameters for each member of the cluster to be tested; the method also includes: For each member to be tested, obtain the initial probability of interaction between each member in the cluster to be tested and the member to be tested; the member to be tested is any member in the cluster to be tested. Obtain the probability of each member in the cluster under test engaging in social behavior; The probability of each member engaging in social behavior is combined with the initial probability of interacting with the member under test to obtain the final probability of each member engaging in social behavior with the member under test. The sum of the final probabilities of each member engaging in social behavior with the member under test is determined as the social probability of the member under test, so as to obtain the social probability corresponding to each member in the cluster under test. Based on the social probabilities corresponding to each member in the cluster under test, the importance parameters corresponding to the social parameters of each member in the cluster under test are obtained.

3. The cluster type identification method according to claim 1, characterized in that, The step of using the importance parameters corresponding to the transfer amount parameters of each member of the cluster under test as elements in the parameter matrix corresponding to the transfer amount parameters includes: Sort each member in descending order of importance for the transfer amount parameter to obtain the first sorting result for the transfer amount parameter. The first sorting result corresponding to the transfer amount parameter is used as the first column element in the parameter matrix corresponding to the transfer amount parameter.

4. The cluster type identification method according to claim 3, characterized in that, The step of using the importance parameters corresponding to the transfer amount parameters of each member of the cluster under test as elements in the parameter matrix corresponding to the transfer amount parameters further includes: For each row in the parameter matrix corresponding to the transfer amount parameter, determine the first member corresponding to the first importance parameter of that row; Obtain the importance parameter of the first target member that has an X-degree link relationship with the first member corresponding to the row. The initial value of X is 1. An X-degree link relationship means that the first member and the first target member have interacted through at least X-1 members. Sort the importance parameters of the first target members corresponding to the row in descending order to obtain the second sorting results for the row. The importance parameters in the second sorting result corresponding to that row are sequentially determined as elements of that row, until the number of elements in that row is equal to the total number of columns in the parameter matrix; If all the importance parameters in the second sorting result are elements of that row, and the number of elements in that row is less than the total number of columns, assign X+1 to X, and return to the step of obtaining the importance parameter of the first target member that has an X-degree link relationship with the first member corresponding to that row; so as to obtain all the elements contained in each row.

5. The cluster type identification method according to claim 4, characterized in that, If all importance parameters in the second sorting result are elements of that row, and the number of elements in that row is less than the total number of columns, assign X+1 to X, and return to the step of obtaining the importance parameter of the first target member that has an X-degree link relationship with the first member corresponding to that row, including: If all the importance parameters in the second sorting result are elements of that row, the number of elements in that row is less than the total number of columns, and X is less than the preset value, assign X+1 to X, and return to the step of obtaining the importance parameter of the first target member that has an X-degree link relationship with the first member corresponding to that row, where the preset value is a positive integer greater than or equal to 1. If all importance parameters in the second sorting result are elements of that row, and the number of elements in that row is less than the total number of columns, and X equals the preset value, then zero elements are added to that row until the number of elements in that row equals the total number of columns.

6. The cluster type identification method according to any one of claims 1 to 5, characterized in that, Also includes: Based on the parameter matrices corresponding to the transfer amount parameter and the number of transfers parameter, the core members in the cluster under test are obtained.

7. The cluster type identification method according to claim 1, characterized in that, The method for constructing the cluster type prediction model includes: Obtain multiple sample clusters; Obtain the training features corresponding to each sample cluster. The training features of a sample cluster include: the importance parameters of each member of the sample cluster in terms of the transfer amount parameter and the number of transfers parameter, respectively. The training features corresponding to each sample cluster are used as the training input of the neural network to train the cluster type prediction model.

8. The cluster type identification method according to claim 7, characterized in that, The step of using the training features corresponding to each sample cluster as the training input of the neural network to train the cluster type prediction model includes: The training features corresponding to each sample cluster are used as the training input of the neural network to obtain the predicted probability that each sample cluster belongs to the known clusters of each class, and the prediction vector corresponding to each sample cluster is obtained. Based on the comparison results of the predicted vectors corresponding to each sample cluster and the real vectors corresponding to the corresponding sample clusters, the feature extraction parameters and probability calculation parameters in the neural network are updated. The feature extraction parameters are used at least to extract the cluster structure of the sample cluster from the training features of the sample cluster; the probability calculation parameters are used to obtain the predicted probability that the sample cluster belongs to each of the known clusters based on the cluster structure of the sample cluster. The return step uses the training features corresponding to each sample cluster as the training input of the neural network to obtain the predicted probability that each sample cluster belongs to the known clusters of each type; until the comparison result meets the termination condition; and obtains the cluster type prediction model.

9. A cluster type identification device, characterized in that, Applications in the field of communication technology, including: The first acquisition module is used to acquire the behavioral parameter values ​​corresponding to the transfer amount parameter of each member of the cluster under test, and the behavioral parameter values ​​corresponding to the transfer number parameter of each member of the cluster under test; based on the behavioral parameter values ​​corresponding to the transfer amount parameter of each member of the cluster under test, the module determines the importance parameter corresponding to the transfer amount parameter of each member of the cluster under test, and based on the behavioral parameter values ​​corresponding to the transfer number parameter of each member of the cluster under test, the module determines the importance parameter corresponding to the transfer number parameter of each member of the cluster under test; the module uses the importance parameter corresponding to the transfer amount parameter of each member of the cluster under test as each element in the parameter matrix corresponding to the transfer amount parameter, and uses the importance parameter corresponding to the transfer number parameter of each member of the cluster under test as each element in the parameter matrix corresponding to the transfer number parameter; the module uses the parameter matrix corresponding to the transfer amount parameter and the parameter matrix corresponding to the transfer number parameter as the features to be tested of the cluster under test. The input module is used to input the features to be tested into a pre-constructed cluster type prediction model; the cluster type prediction model includes convolutional layers, pooling layers, fully connected layers, and normalization layers. The cluster type prediction model is obtained by training a neural network with the goal of minimizing the length of the difference vector between the predicted vector and the true vector of the sample cluster; the predicted vector includes the predicted probability that the sample cluster belongs to each of the known clusters, and the predicted probability that the sample cluster belongs to each of the known clusters is predicted by the neural network; the true vector includes the true probability that the sample cluster belongs to each of the known clusters. The second acquisition module is used to perform convolution processing on the features to be tested using the convolutional layer to obtain the cluster structure of the cluster to be tested, and to process the cluster structure sequentially through the pooling layer, the fully connected layer and the normalization layer to obtain the predicted probability that the cluster to be tested belongs to each of the known clusters; the predicted probability that the cluster to be tested belongs to each of the known clusters is used to identify whether the cluster to be tested is an illegal cluster.

10. An electronic device, characterized in that, Applications in the field of communication technology, including: Memory, used to store programs; A processor is configured to execute the program, the program specifically being used for: Obtain the behavioral parameter values ​​corresponding to the transfer amount parameter for each member of the cluster under test, and obtain the behavioral parameter values ​​corresponding to the transfer number parameter for each member of the cluster under test. Based on the behavioral parameter values ​​corresponding to the transfer amount parameter of each member of the cluster under test, the importance parameter corresponding to the transfer amount parameter of each member of the cluster under test is determined. Based on the behavioral parameter values ​​corresponding to the transfer number parameter of each member of the cluster under test, the importance parameter corresponding to the transfer number parameter of each member of the cluster under test is determined. The importance parameters corresponding to the transfer amount parameter of each member of the cluster under test are used as elements in the parameter matrix corresponding to the transfer amount parameter, and the importance parameters corresponding to the number of transfers parameter of each member of the cluster under test are used as elements in the parameter matrix corresponding to the number of transfers parameter. The parameter matrix corresponding to the transfer amount parameter and the parameter matrix corresponding to the number of transfers parameter are used as the features to be tested of the cluster under test. The features to be tested are input into a pre-constructed cluster type prediction model; the cluster type prediction model includes convolutional layers, pooling layers, fully connected layers, and normalization layers; The cluster type prediction model is obtained by training a neural network with the goal of minimizing the length of the difference vector between the predicted vector and the true vector of the sample cluster; the predicted vector includes the predicted probability that the sample cluster belongs to each of the known clusters, and the predicted probability that the sample cluster belongs to each of the known clusters is predicted by the neural network; the true vector includes the true probability that the sample cluster belongs to each of the known clusters. The convolutional layer is used to perform convolution processing on the features to be tested to obtain the cluster structure of the cluster to be tested. The cluster structure is then processed sequentially through the pooling layer, the fully connected layer, and the normalization layer to obtain the predicted probability that the cluster to be tested belongs to each of the known clusters. The predicted probability that the cluster to be tested belongs to each of the known clusters is used to identify whether the cluster to be tested is an illegal cluster.

11. A storage medium, characterized in that, In the field of communication technology, the storage medium stores a program suitable for execution by a processor, the program being used for: Obtain the behavioral parameter values ​​corresponding to the transfer amount parameter for each member of the cluster under test, and obtain the behavioral parameter values ​​corresponding to the transfer number parameter for each member of the cluster under test. Based on the behavioral parameter values ​​corresponding to the transfer amount parameter of each member of the cluster under test, the importance parameter corresponding to the transfer amount parameter of each member of the cluster under test is determined. Based on the behavioral parameter values ​​corresponding to the transfer number parameter of each member of the cluster under test, the importance parameter corresponding to the transfer number parameter of each member of the cluster under test is determined. The importance parameters corresponding to the transfer amount parameter of each member of the cluster under test are used as elements in the parameter matrix corresponding to the transfer amount parameter, and the importance parameters corresponding to the number of transfers parameter of each member of the cluster under test are used as elements in the parameter matrix corresponding to the number of transfers parameter. The parameter matrix corresponding to the transfer amount parameter and the parameter matrix corresponding to the number of transfers parameter are used as the features to be tested of the cluster under test. The features to be tested are input into a pre-constructed cluster type prediction model; the cluster type prediction model includes convolutional layers, pooling layers, fully connected layers, and normalization layers; The cluster type prediction model is obtained by training a neural network with the goal of minimizing the length of the difference vector between the predicted vector and the true vector of the sample cluster; the predicted vector includes the predicted probability that the sample cluster belongs to each of the known clusters, and the predicted probability that the sample cluster belongs to each of the known clusters is predicted by the neural network; the true vector includes the true probability that the sample cluster belongs to each of the known clusters. The convolutional layer is used to perform convolution processing on the features to be tested to obtain the cluster structure of the cluster to be tested. The cluster structure is then processed sequentially through the pooling layer, the fully connected layer, and the normalization layer to obtain the predicted probability that the cluster to be tested belongs to each of the known clusters. The predicted probability that the cluster to be tested belongs to each of the known clusters is used to identify whether the cluster to be tested is an illegal cluster.

Images