A multi-dimensional feature map embedding method, device, equipment and medium

Abstract

The multi-dimensional feature graph embedding method provided by the present application includes: constructing a first matrix according to the similarity of the first feature between the nodes of the server, the first matrix records the similarity between the nodes about the first feature; constructing a second matrix according to the similarity of the second feature between the nodes of the server, the second matrix records the similarity between the nodes about the second feature, and the second feature is a feature different from the first feature; training the model according to the first matrix and the second matrix to obtain the first model; obtaining the node vector of each node in the server according to the first model. The embodiment of the present application also provides a device, equipment and medium, in the process of generating vectors, by introducing constraints of additional features, so that the finally generated vector can not only reflect the topological information of the graph, but also integrate the attribute characteristics of the node itself.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and more specifically, to a multi-dimensional feature map embedding method, device, equipment and medium. Background Art

[0002] Machine Learning (ML) is a multi-disciplinary subject that involves probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and other disciplines. It specializes in studying how computers simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications are spread across all areas of artificial intelligence. Machine learning and deep learning usually include artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and self-learning.

[0003] Among them, graph embedding (graph embedding, network embedding) is a process of mapping graph data (usually high-dimensional dense matrices) into low-dimensional dense vectors, which can effectively solve the problem that graph data is difficult to efficiently input into machine learning algorithms.

[0004] In existing graph embedding technologies, only the vector representation of graph topology nodes is considered, ignoring the characteristics of the nodes themselves. The common practice is to simply splice together the manually extracted node features and the vector generated by the node generation vector Node2vec. This approach is not conducive to subsequent model learning. Another approach is to integrate the node information into the edge weight through artificial experience. This approach has a relatively large subjective intervention and may not reflect the actual graph topology structure.

[0005] Therefore, the problems existing in the prior art still need to be improved. Summary of the invention

[0006] In view of this, in order to solve the above problems, the technical solution provided by the present invention is as follows:

[0007] A multi-dimensional feature map embedding method, comprising:

[0008] Constructing a first matrix according to the similarity of the first feature between the nodes of the server, wherein the first matrix records the similarity between the nodes with respect to the first feature;

[0009] constructing a second matrix according to the similarity of the second feature between the nodes of the server, wherein the second matrix records the similarity between the nodes with respect to the second feature, and the second feature is a feature different from the first feature;

[0010] Performing model training according to the first matrix and the second matrix to obtain a first model;

[0011] A node vector of each node in the server is obtained according to the first model.

[0012] A multi-dimensional feature map embedding device, comprising:

[0013] A first construction unit, the first construction unit is used to construct a first matrix according to the similarity of the first feature between the nodes of the server, and the first matrix records the similarity between the nodes with respect to the first feature;

[0014] a second construction unit, the second construction unit being configured to construct a second matrix according to the similarity of the second feature between the nodes of the server, wherein the second matrix records the similarity between the nodes with respect to the second feature, and the second feature is a feature different from the first feature;

[0015] A training unit, configured to perform model training according to the first matrix constructed by the first construction unit and the second matrix constructed by the second construction unit to obtain a first model;

[0016] An acquisition unit, wherein the acquisition unit is used to acquire a node vector of each node in the server according to the first model trained by the training unit.

[0017] Optionally, the first building unit is further used for:

[0018] When the first sub-features between the first node i and the second node j are the same, obtaining a first score;

[0019] When the second sub-features between the first node i and the second node j are the same, obtaining a second score;

[0020] The first node i and the second node j are any two nodes in the server, and the first sub-feature and the second sub-feature are sub-features under the first feature;

[0021] The sum of the first score and the second score is obtained as the first element value, and the element a in the first matrix i,j is equal to the first element value, the a i,j The horizontal row of the first matrix corresponds to the first node i, the a i,j The vertical column of the first matrix corresponds to the second node j.

[0022] Optionally, the first building unit is further used for:

[0023] The first element value is normalized to obtain the second element value, the a i,j is equal to the second element value.

[0024] Optionally, the second building unit is further used for:

[0025] The second matrix is ​​constructed according to the first data value sent and received between the first node i and the second node j, wherein the element b of the second matrix i,j is equal to the first data value, the b i,j The rows of the second matrix correspond to the first node i, the b i,j The vertical column of the second matrix corresponds to the second node j.

[0026] Optionally, the training unit is further used for:

[0027] Obtaining a node vector ui of the first node i and a node vector uj of the second node in the second matrix;

[0028] The following objective function is implemented in the first model:

[0029]

[0030] Among them, the The word vector Word2vec is the maximum likelihood estimation part, the f(u) is the function mapping of any node vector, the Ns(u) is the function mapping of the nodes adjacent to the f(u), the conditional probability of the similarity between any node and the adjacent node is calculated Pr(), and then the maximum likelihood estimation of a node and the adjacent nodes is obtained by taking the logarithm, the node u belongs to any node in the node set V, and the maximum likelihood estimation of all nodes is obtained after summing;

[0031] For the custom function part, the a i,j is an element in the first matrix;

[0032] The acquiring the node vector of each node in the server according to the first model includes:

[0033] A node vector of each node in the server is obtained based on the Skip-gram model of negative sampling and the objective function.

[0034] Optionally, the training unit is further used for:

[0035] The maximum likelihood estimation part is calculated based on the context node sequence generated by random walk:

[0036]

[0037] Calculate the user-defined function part according to the first matrix and the second matrix:

[0038] u i :=u i +[a ij -u i ·u j ]·u j

[0039] Among them, the u i +[a ij -u i ·u j ]·u j For the The result after derivation, that is, the node vector u i After the update, it is equal to the original first node vector u i Add the original second node vector u j Multiply the element a i,j Subtract the original first node vector u i Multiply by the original second node vector u j difference;

[0040] The maximum likelihood estimation part is added to the custom function part to obtain the final update vector:

[0041] v(w):=v(w)+u i .

[0042] Optionally, the device further comprises a clustering unit, wherein the clustering unit is configured to:

[0043] Clustering the node vectors by using a clustering algorithm to obtain multiple clusters;

[0044] The maliciousness of the node corresponding to the node vector in each cluster is determined according to the maliciousness of each cluster.

[0045] Optionally, the device further comprises a classification unit, wherein the classification unit is used to:

[0046] The known black and white labels and the node vector are used as input, and the output is a binary classification probability value;

[0047] For nodes whose binary classification probability values ​​are greater than the threshold, they are determined to be malicious black nodes;

[0048] For nodes whose binary classification probability values ​​are less than the threshold, they are determined to be white nodes without malicious intent.

[0049] A computer storage medium includes instructions. When the instructions are executed on a computer device, the computer device executes any one of the above methods.

[0050] A computer-readable storage medium includes instructions. When the instructions are executed on a computer device, the computer device executes any one of the methods described above.

[0051] The multi-dimensional feature graph embedding method provided by the present application includes: constructing a first matrix according to the similarity of the first feature between the nodes of the server, the first matrix records the similarity between the nodes regarding the first feature; constructing a second matrix according to the similarity of the second feature between the nodes of the server, the second matrix records the similarity between the nodes regarding the second feature, and the second feature is a feature different from the first feature; training the model according to the first matrix and the second matrix to obtain the first model; obtaining the node vector of each node in the server according to the first model. The embodiment of the present application also provides a device, equipment and medium, in the process of generating a vector, by introducing the constraint of additional features, so that the finally generated vector can not only reflect the topological information of the graph, but also can integrate the attribute characteristics of the node itself. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0053] Figure 1 A flowchart of an embodiment of the multi-dimensional feature map embedding method provided in an embodiment of the present application;

[0054] Figure 2 A flowchart of another embodiment of the multi-dimensional feature map embedding method provided in an embodiment of the present application;

[0055] Figure 3 A schematic diagram of a first matrix in the multi-dimensional feature map embedding method provided in an embodiment of the present application;

[0056] Figure 4 A schematic diagram of a second matrix in the multi-dimensional feature map embedding method provided in an embodiment of the present application;

[0057] Figure 5 A schematic diagram of a clustering method for a multi-dimensional feature graph embedding method provided in an embodiment of the present application;

[0058] Figure 6 A schematic diagram of a classification method for a multi-dimensional feature graph embedding method provided in an embodiment of the present application;

[0059] Figure 7A comparison chart of the effects of the multi-dimensional feature map embedding method provided in the embodiment of the present application and the method in the prior art;

[0060] Figure 8 A schematic diagram of a computer device provided in an embodiment of the present application;

[0061] Fig. 9 A schematic diagram of a multi-dimensional feature map embedding device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0062] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0063] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0064] Machine Learning (ML) is a multi-disciplinary subject that involves probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and other disciplines. It specializes in studying how computers simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications are spread across all areas of artificial intelligence. Machine learning and deep learning usually include artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and self-learning.

[0065] Among them, graph embedding (graph embedding, network embedding) is a process of mapping graph data (usually high-dimensional dense matrices) into low-dimensional dense vectors, which can effectively solve the problem that graph data is difficult to efficiently input into machine learning algorithms.

[0066] In areas where business security is required, such as gaming security or financial security, it is necessary to build a relationship network through graph embedding technology to screen out illegal users. Therefore, it is necessary to analyze the behavior of each game user in the server through machine learning to screen out illegal users.

[0067] In existing graph embedding technologies, only the vector representation of graph topology nodes is considered, ignoring the characteristics of the nodes themselves. The common practice is to simply splice together the manually extracted node features and the vector generated by the node generation vector Node2vec. This approach is not conducive to subsequent model learning. Another approach is to integrate the node information into the edge weight through artificial experience. This approach has a relatively large subjective intervention and may not reflect the actual graph topology structure.

[0068] Therefore, in order to solve the above problems, the embodiment of the present application provides a multi-dimensional feature map embedding method. It should be noted that the multi-dimensional feature map embedding method provided by the embodiment of the present application can be implemented on various types of data, including game security services or financial security services, etc., and the embodiment of the present application is not limited to this. For ease of understanding, the method provided by the embodiment of the present application is described in detail below.

[0069] See also Figure 1 ,like Figure 1 As shown, the multi-dimensional feature map embedding method provided in the embodiment of the present application includes the following steps.

[0070] 101. Construct a first matrix according to the similarity of the first feature between each node of the server.

[0071] In this embodiment, the first matrix records the similarity between each node about the first feature. For example, in the field of financial security, a user logs in to an online bank through a mobile phone app to perform operations. The first feature may be the device used by the user, user name and other user information. The first matrix is ​​a similarity matrix, which records the similarity between all nodes of the server about user information.

[0072] 102. Construct a second matrix according to the similarity of the second features between the nodes of the server.

[0073] In this embodiment, the second matrix records the similarity between each node regarding the second feature, where the second feature is a feature different from the first feature. For example, taking the financial security field as an example, a user logs in to an online bank through a mobile app to perform operations. The second feature may be transaction information such as the user's transfer amount. The second matrix is ​​a similarity matrix, where the larger the transaction amount of the transaction information between two nodes of the server, the higher the similarity between the two nodes.

[0074] 103. Perform model training according to the first matrix and the second matrix to obtain a first model.

[0075] In this embodiment, model training is the process of constructing a graph topology between each node of the server, wherein the node refers to each account that logs into the server. In the process of model training, by introducing the first matrix and the second matrix, in the process of training the first model, one feature can be used to constrain another feature to be close to the real graph topology. In the field of financial security, the first feature can be user information, and the second feature can be transaction information. For example, there are three accounts in the server, namely, account A, account B, and account C. According to the record of user information, the login devices of account A and account B are both device A, and the login device of account C is device B. At this time, the similarity matrix constructed with user information: in the first matrix, the similarity between account A and account B is greater than the similarity between account A and account C; according to the record of transaction information, account A transfers 100 yuan to account B, and account A transfers 10,000 yuan to account C. Then the similarity matrix constructed with transaction information: in the second matrix, the similarity between account A and account B is less than the similarity between account A and account C. At this time, whether the model is trained using the first matrix alone or the second matrix alone, it cannot objectively reflect the characteristic relationship between accounts A, B, and C. In the steps provided in the embodiment of the present application, model training is performed based on the first matrix and the second matrix at the same time to obtain a first model, which can objectively reflect the real graph topology structure based on the characteristics between the accounts.

[0076] 104. Obtain a node vector of each node in the server according to the first model.

[0077] In this embodiment, the method of training node vectors through the first model can be specifically: each node in the server is regarded as a natural language. For example, if there are three nodes in the server, namely account A, account B and account C, they are converted into natural sentences A+B+C. Thereafter, the natural sentences are subjected to word segmentation, vectorization training and other operations through the first model. Each word vector obtained is the node vector corresponding to each node. The specific vector training method can be any vector training method in the prior art, which will not be repeated in the embodiments of this application.

[0078] The above-mentioned multi-dimensional feature graph embedding method includes: constructing a first matrix according to the similarity of the first feature between the nodes of the server, the first matrix records the similarity of the first feature between the nodes; constructing a second matrix according to the similarity of the second feature between the nodes of the server, the second matrix records the similarity of the second feature between the nodes, and the second feature is a feature different from the first feature; training the model according to the first matrix and the second matrix to obtain the first model; obtaining the node vector of each node in the server according to the first model. In the process of generating the vector, by introducing the constraints of additional features, the finally generated vector can not only reflect the topological information of the graph, but also integrate the attribute characteristics of the node itself.

[0079] Optionally, as a more detailed implementation, the multi-dimensional feature map embedding method provided in the embodiment of the present application is further described below.

[0080] See also Figure 2 ,like Figure 2 As shown, another embodiment of the multi-dimensional feature map embedding method provided in the embodiment of the present application includes the following steps.

[0081] 201. When the first sub-features of the first node i and the second node j are the same, obtain a first score.

[0082] In this embodiment, the first node i and the second node j are any two nodes in the server, the first sub-feature and the second sub-feature are sub-features under the first feature. For example, the first sub-feature is the login device, and the first score is 0.8 points. If the first node i and the second node j both log in to the server through the same device, the first score is 0.8 points.

[0083] 202. When the second sub-features between the first node i and the second node j are the same, obtain a second score.

[0084] In this embodiment, the second sub-feature is a feature of the first feature that is different from the first sub-feature. For example, the second sub-feature is a user name, and the second score is 0.5. If the login user name of the first node i and the second node j is the same, the second score is 0.5.

[0085] 203. Obtain a sum of the first score and the second score as a first element value.

[0086] In this embodiment, the score obtained by adding the first node i and the second node j, for example, if the first sub-feature and the second sub-feature are the same, then the first element value is equal to the first score + the second score; if only the first sub-feature is the same between the first node i and the second node j, then the first element value is equal to the first score; if only the second sub-feature is the same between the first node i and the second node j, then the first element value is equal to the second score. The first matrix finally obtained is as follows Figure 3 As shown, the first matrix records the normalized score relationship between any two nodes in the server, where the element a corresponding to the first node i and the second node j in the first matrix is i,j is equal to the first element value. For example, if the first node i and the second node j have the same login device and the same user name, then the first element value = 0.8 + 0.5 = 1.3 points. After normalization, 1.3 = 1. In the first matrix, a i,j =1.

[0087] 204. Normalize the first element value to obtain the second element value, and ai,j is equal to the second element value.

[0088] In this embodiment, normalization is a dimensionless processing method that converts the absolute value of the physical system numerical value into a relative value relationship. It is an effective way to simplify calculations and reduce the value. In this step, the first element value is normalized to between [0, 1], so that the elements in the first matrix are expressed by the normalized numerical value to simplify the first matrix.

[0089] 205. Construct a second matrix according to the first data value sent and received between the first node i and the second node j.

[0090] In this embodiment, the element b of the second matrix i,j Equal to the first data value, b i,j The row of the second matrix corresponds to the first node i, b i,j The column in the second matrix corresponds to the second node j, for example, Figure 4 As shown in the second matrix, the first node i transfers 10,000 yuan to the second node j, then the element b corresponding to the first node i and the second node j is i,j =10000. Optionally, the elements in the second matrix can also be normalized to between [0,1], so that the elements in the second matrix can express the second matrix through the normalized values. For example, b i,j =10000, after normalization b i,j =0.8.

[0091] 206. Obtain the node vector u of the first node i in the second matrix i and the node vector u of the second node j .

[0092] In this embodiment, by vectorizing the nodes in the second matrix, the vector corresponding to each node in the second matrix can be obtained. The vector can be obtained through training and gradually converges during the training process.

[0093] 207. Execute the target function.

[0094] In this embodiment, the objective function is:

[0095]

[0096] Among them, the The word vector Word2vec is the maximum likelihood estimation part, the f(u) is the function mapping of any node vector, the Ns(u) is the function mapping of the nodes adjacent to the f(u), the conditional probability of the similarity between any node and the adjacent node is calculated Pr(), and then the maximum likelihood estimation of a node and the adjacent nodes is obtained by taking the logarithm, the node u belongs to any node in the node set V, and the maximum likelihood estimation of all nodes is obtained after summing; For the custom function part, the a i,j is an element in the first matrix. For example, in the first matrix, the first node i and the second node j have the same login device and the same user name, then after normalization a i,j is the maximum value: 1; in the second matrix, the first node i transfers 100 yuan to the second node j, and the amount is small. Then, in the second matrix, the similarity between the first node i and the second node j is small, u i with u j The product of is smaller. At this time, if only the first feature (first matrix) is considered, the result will be too large, and if only the second feature (second matrix) is considered, the result will be too small. The objective function defined in the embodiment of the present application adds By subtracting two features, constraints are imposed on each other, thereby reflecting the similarity between nodes on the basis of considering the two features, which is more in line with the actual graph topology.

[0097] Further, acquiring the node vector of each node in the server according to the first model includes:

[0098] A node vector of each node in the server is obtained based on the Skip-gram model of negative sampling and the objective function.

[0099] Furthermore, the acquiring the node vector of each node in the server according to the first model includes:

[0100] Acquiring the update vector of each node according to the objective function includes:

[0101] The maximum likelihood estimation part is calculated based on the context node sequence generated by random walk:

[0102]

[0103] Calculate the user-defined function part according to the first matrix and the second matrix:

[0104] u i :=u i +[a ij -u i ·u j ]·u j

[0105] Among them, the u i +[a ij -u i ·u j ]·u j For the The result after derivation, that is, the node vector u i After the update, it is equal to the original first node vector u i Add the original second node vector u j Multiply the element a i,j Subtract the original first node vector u i Multiply by the original second node vector u j difference;

[0106] The maximum likelihood estimation part is added to the custom function part to obtain the final update vector:

[0107] v(w):=v(w)+u i .

[0108] 208. Obtain a node vector of each node in the server according to the first model.

[0109] In this embodiment, the step of obtaining the node vector according to the trained first model can refer to the above step 104. Optionally, the first model can be a Skip-gram model based on negative sampling, and the objective function is the above objective function.

[0110] After the above steps 101 to 104 or steps 201 to 208, the node vectors of each node in the server are obtained, so that the subsequent steps can perform clustering or classification operations on the obtained node vectors. As a preferred implementation, the embodiments of the present application provide a specific implementation of a clustering and a classification scheme respectively, and for ease of understanding, they are described in detail below with reference to the accompanying drawings.

[0111] 1. Clustering.

[0112] See also Figure 5 ,like Figure 5 As shown, a clustering algorithm provided in an embodiment of the present application includes the following steps.

[0113] 501. Cluster the node vectors using a clustering algorithm to obtain multiple clusters.

[0114] In this embodiment, the clustering algorithm can be any algorithm in the prior art, which is not limited in this embodiment of the application. The obtained multiple clusters are sets that are clustered together according to features after the node vectors are clustered according to the clustering algorithm.

[0115] 502. The maliciousness of the node corresponding to the node vector in each cluster is determined according to the maliciousness of each cluster.

[0116] In this embodiment, after clustering is completed, the node vectors in each cluster have similar characteristics. When the number of black nodes in a cluster is greater than a threshold, it can be determined that the cluster has a high degree of malice. The specific degree of malice can be set according to the number of black nodes included in each cluster, which is not limited here. The black node refers to an illegal node or a node with malicious operation behavior, such as a malicious operation node in a game that frequently registers small accounts in exchange for benefits such as game points.

[0117] 2. Classification.

[0118] See also Figure 6 ,like Figure 6 As shown, a classification algorithm provided in an embodiment of the present application includes the following steps.

[0119] 601. Using the known black and white labels and the node vector as input, the output is a binary classification probability value.

[0120] In this embodiment, the known black and white labels refer to: node vectors that have been determined to be malicious black nodes or have been determined to be non-malicious white nodes, so that through the classification operation, it can be known that the node vectors that are closer to the known black nodes are black nodes, and the node vectors that are closer to the known white nodes are white nodes.

[0121] 602. For nodes whose binary classification probability values ​​are greater than a threshold, they are determined to be malicious black nodes.

[0122] In this embodiment, when the binary classification probability value is greater than the threshold, it can be determined that the current node vector is closer to the black node, and thus the current node vector can be determined to be a black node.

[0123] 603. For nodes whose binary classification probability values ​​are less than the threshold, they are determined to be white nodes without malicious intent.

[0124] In this embodiment, when the binary classification probability value is less than the threshold, it can be determined that the current node vector is closer to a white node, and thus the current node vector can be determined to be a white node.

[0125] In the above working process, since the generation process of the node vector is limited by the second feature to the first feature, the constraint of the additional feature is introduced, so that the vector finally generated can not only reflect the topological information of the graph, but also integrate the attribute characteristics of the node itself. It should be noted that more features can be added to limit the first feature as needed, and the specific implementation method is the same as above, so it is not limited here.

[0126] It should be further explained that the comparison between the node vector obtained by the above method and the node algorithm vector in the prior art is as follows: Figure 7 As shown, each point represents a different node, and the distance between the points represents the similarity between the nodes. The above is the Node2vec algorithm process in the prior art, and the below is the process of the method provided by the embodiment of the present application. Figure 7 In the figure, a group of node vectors 701 are processed by the Node2vec algorithm to obtain the vectors in 702. Since only the influence of a single feature is considered, the distance between each node vector does not change. In the figure below, the node vector 703 is processed by the method provided in the embodiment of the present application to obtain the vectors in 704. It can be seen that in 704, since the login cities between nodes 1, 6 and 8 are the same, the distances between nodes 1, 6 and 8 are closer than before due to the limitation of the login city feature. The same is true between nodes 0 and 2. The login devices between 0 and 2 are the same, and the distance is closer than before. For another example, between nodes 5 and 9, due to different genders, the distance between nodes 5 and 9 is farther than before. After adding the gender feature, the distance between nodes 5 and 9 has changed. The above changes make the obtained topological structure closer to the original topological structure.

[0127] In summary, the multi-dimensional feature graph embedding method provided by the present application includes: constructing a first matrix according to the similarity of the first feature between the nodes of the server, the first matrix records the similarity between the nodes regarding the first feature; constructing a second matrix according to the similarity of the second feature between the nodes of the server, the second matrix records the similarity between the nodes regarding the second feature, and the second feature is a feature different from the first feature; training the model according to the first matrix and the second matrix to obtain the first model; obtaining the node vector of each node in the server according to the first model. The embodiments of the present application also provide a device, an apparatus and a medium, which, in the process of generating a vector, introduces constraints of additional features so that the finally generated vector can not only reflect the topological information of the graph, but also integrate the attribute characteristics of the node itself.

[0128] The above is an introduction to the scheme provided by the embodiment of the present application. It is understandable that, in order to realize the above functions, the computer device includes a hardware structure and / or software module corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the modules and algorithm steps of each example described in the embodiment disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present application.

[0129] Describing from the perspective of hardware structure, the above method can be implemented by one physical device, can be implemented by multiple physical devices together, or can be a logical function module within a physical device, and the embodiments of the present application do not make specific limitations on this.

[0130] For example, the above methods can be Figure 8 This is achieved by using the computer equipment in the system. Figure 8 The hardware structure diagram of the computer device provided in the embodiment of the present application includes at least one processor 801, a communication line 802, a memory 803 and at least one communication interface 804.

[0131] Processor 801 can be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (server IC), or one or more integrated circuits used to control the execution of the program of the present application.

[0132] The communication link 802 may include a pathway to transmit information between the above-mentioned components.

[0133] The communication interface 804 uses any transceiver or other device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0134] The memory 803 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory may exist independently and be connected to the processor via a communication line 802. The memory may also be integrated with the processor.

[0135] The memory 803 is used to store computer-executable instructions for executing the solution of the present application, and the execution is controlled by the processor 801. The processor 801 is used to execute the computer-executable instructions stored in the memory 803, thereby implementing the method provided by the above embodiment of the present application.

[0136] Optionally, the computer-executable instructions in the embodiments of the present application may also be referred to as application code, which is not specifically limited in the embodiments of the present application.

[0137] In a specific implementation, as an embodiment, the processor 801 may include one or more CPUs, such as Figure 8 CPU0 and CPU1 in.

[0138] In a specific implementation, as an embodiment, a computer device may include multiple processors, such as Figure 8 801 and processor 807 in the embodiment of the present invention. Each of these processors may be a single-CPU processor or a multi-CPU processor. The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0139] In a specific implementation, as an embodiment, the computer device may further include an output device 805 and an input device 806. The output device 805 communicates with the processor 801 and may display information in a variety of ways. For example, the output device 805 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. The input device 806 communicates with the processor 801 and may receive user input in a variety of ways. For example, the input device 806 may be a mouse, a keyboard, a touch screen device, or a sensor device.

[0140] The computer device may be a general-purpose device or a dedicated device. In a specific implementation, the computer device may be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, an embedded device or a computer with Figure 8 The embodiments of the present application do not limit the type of computer device.

[0141] The embodiment of the present application can divide the storage device into functional units according to the above method example. For example, each functional unit can be divided according to each function, or two or more functions can be integrated into one processing unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional units. It should be noted that the division of units in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0142] For example, when each functional unit is divided in an integrated manner, Fig. 9 A schematic diagram of a multi-dimensional feature map embedding device is shown.

[0143] like Fig. 9 As shown, the multi-dimensional feature map embedding device provided in the embodiment of the present application includes:

[0144] A first construction unit 901, the first construction unit 901 is used to construct a first matrix according to the similarity of the first feature between the nodes of the server, and the first matrix records the similarity between the nodes with respect to the first feature;

[0145] A second construction unit 902, the second construction unit 902 is used to construct a second matrix according to the similarity of the second feature between the nodes of the server, the second matrix records the similarity between the nodes about the second feature, and the second feature is a feature different from the first feature;

[0146] A training unit 903, wherein the training unit 903 is used to perform model training according to the first matrix constructed by the first construction unit 901 and the second matrix constructed by the second construction unit 902 to obtain a first model;

[0147] An acquisition unit 904 is used to acquire a node vector of each node in the server according to the first model trained by the training unit 903.

[0148] Optionally, the first construction unit 901 is further used for:

[0149] When the first sub-features between the first node i and the second node j are the same, obtaining a first score;

[0150] When the second sub-features between the first node i and the second node j are the same, obtaining a second score;

[0151] The first node i and the second node j are any two nodes in the server, and the first sub-feature and the second sub-feature are sub-features under the first feature;

[0152] The sum of the first score and the second score is obtained as the first element value, and the element a in the first matrix i,j is equal to the first element value, the a i,j The horizontal row of the first matrix corresponds to the first node i, the a i,j The vertical column of the first matrix corresponds to the second node j.

[0153] Optionally, the first construction unit 901 is further used for:

[0154] The first element value is normalized to obtain the second element value, the a i,j is equal to the second element value.

[0155] Optionally, the second constructing unit 902 is further used for:

[0156] The second matrix is ​​constructed according to the first data value sent and received between the first node i and the second node j, wherein the element b of the second matrix i,j is equal to the first data value, the b i,j The rows of the second matrix correspond to the first node i, the bi,j The vertical column of the second matrix corresponds to the second node j.

[0157] Optionally, the training unit 903 is further configured to:

[0158] Obtaining a node vector ui of the first node i and a node vector uj of the second node in the second matrix;

[0159] The following objective function is implemented in the first model:

[0160]

[0161] in, The algorithm used to calculate the maximum likelihood estimate in Word2vec for generating word vectors is described as follows: i,j is an element in the first matrix.

[0162] Optionally, the apparatus further includes a clustering unit 905, and the clustering unit 905 is configured to:

[0163] Clustering the node vectors by using a clustering algorithm to obtain multiple clusters;

[0164] The maliciousness of the node corresponding to the node vector in each cluster is determined according to the maliciousness of each cluster.

[0165] Optionally, the apparatus further includes a classification unit 906, wherein the classification unit 906 is configured to:

[0166] The known black and white labels and the node vector are used as input, and the output is a binary classification probability value;

[0167] For nodes whose binary classification probability values ​​are greater than the threshold, they are determined to be malicious black nodes;

[0168] For nodes whose binary classification probability values ​​are less than the threshold, they are determined to be white nodes without malicious intent.

[0169] Furthermore, an embodiment of the present invention also provides a computer storage medium, including instructions, which, when executed on a computer device, enable the computer device to execute the above method.

[0170] For a detailed description of the program stored in the computer storage medium provided in the embodiments of the present application, reference can be made to the above embodiments and will not be repeated here.

[0171] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0172] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0173] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0174] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the core concept or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A multi-dimensional feature map embedding method, characterized in that: include: A first matrix is ​​constructed according to the similarity of the first feature between each node of the server, which includes: when the first sub-features between the first node i and the second node j are the same, a first score is obtained; when the second sub-features between the first node i and the second node j are the same, a second score is obtained; wherein the first node i and the second node j are any two nodes in the server, and the first sub-feature and the second sub-feature are sub-features of the first feature; the sum of the first score and the second score is obtained as the first element value, and the element a in the first matrix ij is equal to the first element value, the a ij The horizontal row of the first matrix corresponds to the first node i, the a ij The vertical column of the first matrix corresponds to the second node j, and the first matrix records the similarity between the nodes with respect to the first feature; A second matrix is ​​constructed according to the similarity of the second feature between the nodes of the server, wherein the second matrix records the similarity between the nodes with respect to the second feature, wherein the second feature is a feature different from the first feature, the nodes refer to the accounts for logging into the server, the first feature is user information, and the second feature is transaction information; Performing model training according to the first matrix and the second matrix to obtain a first model; A node vector of each node in the server is obtained according to the first model.

2. The method according to claim 1, characterized in that After obtaining the sum of the first score and the second score as the first element value, the method further includes: The first element value is normalized to obtain the second element value, the a ij is equal to the second element value.

3. The method according to claim 2, characterized in that The constructing a second matrix according to the similarity of the second feature between the nodes of the server includes: The second matrix is ​​constructed according to the first data value sent and received between the first node i and the second node j, wherein the element b of the second matrix ij is equal to the first data value, the b ij The rows of the second matrix correspond to the first node i, the b ij The vertical column of the second matrix corresponds to the second node j.

4. The method according to claim 3, characterized in that Performing model training according to the first matrix and the second matrix to obtain a first model includes: Get the node vector u of the first node i in the second matrix i and the node vector u of the second node j j ; The following objective function is implemented in the first model: in, The word vector Word2vec is the maximum likelihood estimation part, the f(u) is the function mapping of any node vector, the Ns(u) is the function mapping of the nodes adjacent to the f(u), the conditional probability of the similarity between any node and the adjacent node is calculated Pr(), and then the maximum likelihood estimation of a node and the adjacent nodes is obtained by taking the logarithm, the node u belongs to any node in the node set V, and the maximum likelihood estimation of all nodes is obtained after summing; For the custom function part, the a ij is an element in the first matrix; The acquiring the node vector of each node in the server according to the first model includes: A node vector of each node in the server is obtained based on the Skip-gram model of negative sampling and the objective function.

5. The method according to claim 4, characterized in that The acquiring the node vector of each node in the server according to the first model includes: Acquiring the update vector of each node according to the objective function includes: The maximum likelihood estimation part is calculated based on the context node sequence generated by random walk: Calculate the user-defined function part according to the first matrix and the second matrix: u i :=u i +[a ij -u i ·u j ]·u j Among them, the u i +[a ij -u i ·u j ]·u j For the The result after derivation, that is, the node vector u i After the update, it is equal to the original first node vector u i Add the original second node vector u j Multiply the element a ij Subtract the original first node vector u i Multiply by the original second node vector u j difference; The maximum likelihood estimation part is added to the custom function part to obtain the final update vector: v(w):=v(w)+u i 。 6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: Clustering the node vectors by using a clustering algorithm to obtain multiple clusters; According to the maliciousness of each cluster, the maliciousness of the node corresponding to the node vector in each cluster is judged, including: The known black and white labels and the node vector are used as input, and the output is a binary classification probability value; For nodes whose binary classification probability values ​​are greater than the threshold, they are determined to be malicious black nodes; For nodes whose binary classification probability values ​​are less than the threshold, they are determined to be white nodes without malicious intent.

7. A multi-dimensional feature map embedding device, characterized in that: include: A first construction unit, the first construction unit is used to construct a first matrix according to the similarity of the first feature between the nodes of the server, including: when the first sub-features between the first node i and the second node j are the same, a first score is obtained; when the second sub-features between the first node i and the second node j are the same, a second score is obtained; wherein the first node i and the second node j are any two nodes in the server, and the first sub-feature and the second sub-feature are sub-features of the first feature; the sum of the first score and the second score is obtained as the first element value, and the element a in the first matrix ij is equal to the first element value, the a ij The horizontal row of the first matrix corresponds to the first node i, the a ij The vertical column of the first matrix corresponds to the second node j, and the first matrix records the similarity between the nodes with respect to the first feature; a second construction unit, the second construction unit being used to construct a second matrix according to the similarity of the second feature between the nodes of the server, the second matrix recording the similarity between the nodes with respect to the second feature, the second feature being a feature different from the first feature, the node being each account for logging into the server, the first feature being user information, and the second feature being transaction information; A training unit, configured to perform model training according to the first matrix constructed by the first construction unit and the second matrix constructed by the second construction unit to obtain a first model; An acquisition unit, wherein the acquisition unit is used to acquire a node vector of each node in the server according to the first model trained by the training unit.

8. The device according to claim 7, characterized in that The first building block is further used for: The first element value is normalized to obtain the second element value, the a ij is equal to the second element value.

9. The device according to claim 8, characterized in that The second building block is further used for: The second matrix is ​​constructed according to the first data value sent and received between the first node i and the second node j, wherein the element b of the second matrix ij is equal to the first data value, the b ij The rows of the second matrix correspond to the first node i, the b ij The vertical column of the second matrix corresponds to the second node j.

10. The device according to claim 9, characterized in that The training unit is further used for: Get the node vector u of the first node i in the second matrix i and the node vector u of the second node j j ; The following objective function is implemented in the first model: in, The word vector Word2vec is the maximum likelihood estimation part, the f(u) is the function mapping of any node vector, the Ns(u) is the function mapping of the nodes adjacent to the f(u), the conditional probability of the similarity between any node and the adjacent node is calculated Pr(), and then the maximum likelihood estimation of a node and the adjacent nodes is obtained by taking the logarithm, the node u belongs to any node in the node set V, and the maximum likelihood estimation of all nodes is obtained after summing; For the custom function part, the a ij is an element in the first matrix; The acquisition unit is used to: A node vector of each node in the server is obtained based on the Skip-gram model of negative sampling and the objective function.

11. The device according to claim 10, characterized in that The acquisition unit is used to: Acquiring the update vector of each node according to the objective function includes: The maximum likelihood estimation part is calculated based on the context node sequence generated by random walk: Calculate the user-defined function part according to the first matrix and the second matrix: u i :=u i +[a ij -u i ·u j ]·u j Among them, the u i +[a ij -u i ·u j ]·u j For the The result after derivation, that is, the node vector u i After the update, it is equal to the original first node vector u i Add the original second node vector u j Multiply the element a ij Subtract the original first node vector u i Multiply by the original second node vector u j difference; The maximum likelihood estimation part is added to the custom function part to obtain the final update vector: v(w):=v(w)+u i 。 12. The device according to any one of claims 7 to 11, characterized in that: The device also includes a classification unit; The classification unit is used to: Clustering the node vectors by using a clustering algorithm to obtain multiple clusters; According to the maliciousness of each cluster, the maliciousness of the node corresponding to the node vector in each cluster is judged, including: The known black and white labels and the node vector are used as input, and the output is a binary classification probability value; For nodes whose binary classification probability values ​​are greater than the threshold, they are determined to be malicious black nodes; For nodes whose binary classification probability values ​​are less than the threshold, they are determined to be white nodes without malicious intent.

13. A computer device, characterized in that: The computer device comprises: an interactive device, an input / output interface, a processor and a memory, wherein the memory stores program instructions; The interaction device is used to obtain an operation instruction input by a user; The processor is used to execute program instructions stored in the memory to perform the method according to any one of claims 1 to 6.

14. A computer-readable storage medium comprising instructions, characterized in that: When the instructions are executed on a computer device, the computer device is caused to execute the method according to any one of claims 1 to 6.

Images