Abnormal delivery behavior identification method, device, computer equipment and storage medium

Abstract

The embodiment of the present invention discloses a method, device, computer equipment and storage medium for identifying abnormal delivery behavior. The method includes: obtaining delivery relationship data, the delivery relationship data includes the delivery data between the delivery node and the receiving node; pruning the delivery relationship data to obtain the target delivery relationship data; constructing a delivery graph according to the target delivery relationship data; performing graph analysis on the delivery graph to obtain an analysis result; and determining the target node with abnormal delivery behavior in the delivery node and the receiving node according to the analysis result. The embodiment of the present invention can improve the efficiency and accuracy of identifying abnormal delivery behavior.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method, device, computer equipment and storage medium for identifying abnormal delivery behavior. Background Art

[0002] With the rapid development of the logistics industry and the characteristics of the logistics industry, relevant personnel use online transactions and offline express delivery to mail such products to the destination. The existing identification of such abnormal delivery behaviors is mainly manual identification, such as using blacklists and mailing express data combined with experience to determine. This manual identification method can mostly only identify directly related suspicious nodes (such as suspicious senders), or there are too many suspicious nodes, resulting in poor operability and low accuracy. Summary of the invention

[0003] Embodiments of the present invention provide a method, apparatus, computer equipment and storage medium for identifying abnormal delivery behavior, which can improve the efficiency and accuracy of identifying abnormal delivery behavior.

[0004] An embodiment of the present invention provides a method for identifying abnormal delivery behavior, including:

[0005] Acquire delivery relationship data, wherein the delivery relationship data includes delivery data between a delivery node and a delivery node;

[0006] Pruning the delivery relationship data to obtain target delivery relationship data;

[0007] Constructing a delivery graph according to the target delivery relationship data;

[0008] Performing a graph analysis on the delivery graph to obtain an analysis result;

[0009] Determine the target node among the sending node and the receiving node where abnormal delivery behavior occurs based on the analysis result.

[0010] The embodiment of the present invention also provides a device for identifying abnormal delivery behavior, including:

[0011] An acquisition unit, used for acquiring delivery relationship data, wherein the delivery relationship data includes delivery data between a delivery node and a delivery node;

[0012] a pruning unit, configured to prune the delivery relationship data to obtain target delivery relationship data;

[0013] A construction unit, used for constructing a delivery graph according to the target delivery relationship data;

[0014] An analysis unit, used for performing a graph analysis on the delivery graph to obtain an analysis result;

[0015] A determination unit is used to determine the target node with abnormal delivery behavior among the sending node and the receiving node according to the analysis result.

[0016] The nodes include the sending node and the receiving node, and the pruning unit includes:

[0017] Category acquisition unit, used to obtain a list of risk categories;

[0018] A category pruning unit, configured to prune the shipment data corresponding to the nodes in the shipment relationship data that are not related to the risk category in the risk category list, to obtain candidate shipment relationship data;

[0019] A whitelist determination unit, used to determine whitelist nodes among the sender node and the recipient node;

[0020] The whitelist pruning unit is used to prune the mailing data corresponding to the whitelist nodes in the candidate delivery relationship data to obtain target delivery relationship data.

[0021] Among them, the whitelist determination unit is specifically used to: determine the total number of sender contacts and the number threshold of each node, the frequency and frequency threshold of the total mailing volume of each node; determine the first candidate whitelist node according to the total number of sender contacts and the number threshold; determine the second candidate whitelist node according to the frequency of the mailing volume and the frequency threshold; determine the node that exists in both the first candidate whitelist node and the second candidate whitelist node as a whitelist node.

[0022] Wherein, the analysis unit comprises:

[0023] A community division unit, used for iteratively dividing the delivery graph into communities to obtain a community division result;

[0024] A candidate node determination unit, configured to determine candidate abnormal nodes with abnormal delivery behavior according to the community division result;

[0025] The risk level determination unit is used to determine the risk level corresponding to the candidate abnormal node according to a preset scoring card strategy, and take the risk level corresponding to the candidate abnormal node as the analysis result.

[0026] Among them, the community division unit is specifically used to perform iterative community division on the delivery graph to obtain an intermediate result of community division; detect whether the community in the intermediate result of community division is a star structure or a community with a node number less than a preset number of nodes; if so, use the intermediate result of community division as the community division result; if not, perform iterative community division on communities that are not star structures and have a node number not less than a preset number of nodes, until the community obtained after community division is a star structure or a community with a node number less than a preset number of nodes.

[0027] Among them, the candidate node determination unit is specifically used to determine the central nodes of all communities in the community division results, and determine the number of neighbors of each node in all communities; the central node and the node with the largest number of neighbors are used as candidate abnormal nodes with abnormal delivery behavior.

[0028] Among them, the risk level determination unit is specifically used to calculate the scorecard score corresponding to the candidate abnormal node according to a preset scorecard strategy; obtain the score corresponding to the risk level; and determine the risk level corresponding to the candidate abnormal node according to the scorecard score and the score corresponding to the risk level.

[0029] An embodiment of the present invention also provides a computer device, comprising: one or more processors; a memory; and one or more applications, wherein the processor and the memory are connected, the one or more applications are stored in the memory, and are configured so that the processor executes the above-mentioned abnormal delivery behavior identification method.

[0030] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. The computer program is loaded by a processor to execute the above-mentioned method for identifying abnormal delivery behavior.

[0031] The embodiment of the present invention prunes the delivery relationship data, constructs a delivery graph for the target delivery relationship data, and performs graph analysis on the delivery graph to identify the target nodes with abnormal delivery behavior in the delivery relationship data. By finding redundant nodes through the pruning strategy, the graph structure of the delivery graph can be greatly reduced, and the efficiency of identifying abnormal delivery behavior can be improved; by analyzing the graph structure and determining the target nodes with abnormal delivery behavior based on the analysis results, the nodes and communities suspected of abnormal delivery can be accurately located, thereby improving the accuracy of identifying abnormal delivery behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0033] Figure 1 is a flow chart of a method for identifying abnormal delivery behavior provided by an embodiment of the present invention;

[0034] Figure 2 is a flowchart of a community iteration strategy provided by an embodiment of the present invention;

[0035] Figure 3 is a flow chart of a method for identifying abnormal delivery behavior provided by an embodiment of the present invention;

[0036] Figure 4 is a flow chart of a method for identifying abnormal delivery behavior provided by an embodiment of the present invention;

[0037] Figure 5 is a schematic block diagram of an abnormal delivery behavior identification device provided by an embodiment of the present invention;

[0038] Figure 6 is another schematic block diagram of the abnormal delivery behavior identification device provided by an embodiment of the present invention;

[0039] Figure 7 It is a schematic block diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0041] In the description of the present invention, it should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined. In addition, the terms "first" and "second" are used to distinguish multiple elements from each other. For example, without departing from the scope of the present invention, the first constraint may be referred to as the second constraint, and similarly, the second constraint may be referred to as the first constraint. Both the first constraint and the second constraint are constraints, but they are not the same constraint.

[0042] In the present invention, the word "exemplary" is used to mean "used as an example, illustration or description". Any embodiment described as "exemplary" in the present invention is not necessarily to be construed as being preferred or advantageous over other embodiments. The following description is given to enable any technician in the field to implement and use the present invention. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art can recognize that the present invention can be implemented without using these specific details. In other instances, well-known structures and processes will not be elaborated in detail to avoid obscuring the description of the present invention with unnecessary details. Therefore, the present invention is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed in the present invention.

[0043] The embodiments of the present invention provide a method, device, computer equipment and storage medium for identifying abnormal delivery behavior. The method for identifying abnormal delivery behavior runs in a device, which can be a server or a terminal, such as a mobile phone, a pad, a desktop computer and the like. The following are detailed descriptions.

[0044] Figure 1 FIG. 1 is a flow chart of a method for identifying abnormal delivery behavior provided by an embodiment of the present invention. Figure 1 As shown, the specific process of the method is as follows:

[0045] 101. Acquire delivery relationship data, where the delivery relationship data includes delivery data between nodes.

[0046] Specifically, step 101 includes: obtaining delivery source data; and determining delivery relationship data based on the delivery source data.

[0047] Among them, the delivery source data is the delivery data from the sending node to the receiving node in a certain period of time. For example, half a year, a quarter, etc. The delivery source data includes the sender information (information of the sending node), the recipient information (information of the receiving node), the waybill data (including the sending address, the receiving address, etc.), and the routing information such as the transfer station passed through. Among them, the sender information includes at least one of the sender's phone number, ID number or a QR code representing an independent individual, and the recipient information includes at least one of the recipient's phone number, ID number or a QR code representing an independent individual. Take the sender or the recipient as the node, the sender as the sending node, and the recipient as the receiving node. The sending node and the receiving node are collectively referred to as nodes hereinafter. Specifically, any one of the telephone number, ID number or QR code representing an independent individual represents the node.

[0048] The information in the delivery source data is very comprehensive and the data volume is very large. If statistical analysis and abnormal identification of the data are directly performed on this basis, the workload will be very large and the efficiency will be reduced. Therefore, in the delivery source data, data related to the identification of abnormal delivery behavior is counted and extracted, for example, delivery relationship data, and a delivery relationship data table can be constructed based on the delivery relationship data; further, node data can be extracted, and a node data table can be constructed based on the node data. Based on the statistically extracted data related to the identification of abnormal delivery behavior, abnormal delivery behavior identification is further performed on this basis to improve the efficiency of abnormal delivery behavior identification.

[0049] Among them, the node data can count the basic information of all nodes, such as the total number of mailing contacts, the total mailing volume, and other information, so that these statistical data can be directly used in the subsequent abnormal delivery behavior identification. It should be noted that the values ​​of these statistical fields can also be counted when they are needed in the future.

[0050] The delivery relationship data includes the delivery data between the sending node and the receiving node. For example, if A sends an item to B, a new delivery data will be added to the delivery relationship data to record A's behavior of sending to B. Conversely, if B sends to A, a new delivery data will also be added. Statistical fields include the total number of items sent by the node. In addition to the sending node and the receiving node, the delivery relationship data also includes the delivery category, the sending address, the receiving address, the total number of items sent by the node, etc. The delivery category refers to the category of the delivered item, such as the category entered on the waybill, for example, documents, clothes, vegetables, etc.

[0051] In some cases, when additional shipping data is needed later, in addition to adding the corresponding data to the delivery source data, the corresponding shipping data is also added to the delivery relationship data. Furthermore, the shipping data can also be updated in the node data. In this way, the node data and delivery relationship data are updated in real time, which can facilitate the subsequent use of node data and delivery relationship data to identify abnormal delivery behaviors at any time, thereby improving identification efficiency.

[0052] 102. Prune the delivery relationship data to obtain target delivery relationship data.

[0053] There are a large number of delivery data in the delivery relationship data, many of which are normal delivery data (also called positive samples). Therefore, it is necessary to filter the normal delivery data, that is, to prune the delivery relationship data to obtain the target delivery relationship data, reduce the impact of normal delivery data on the abnormal delivery behavior identification results, and further reduce the amount of data for subsequent processing, thereby improving the efficiency of abnormal delivery behavior identification.

[0054] Pruning delivery relationship data is mainly divided into two steps: the first step is risk category pruning; the second step is whitelist pruning.

[0055] Specifically, step 102 includes: obtaining a risk category list; pruning the mailing data corresponding to the nodes in the delivery relationship data that are not related to the risk categories in the risk category list to obtain candidate delivery relationship data; determining the whitelist nodes in the nodes (including the sending nodes and the receiving nodes); pruning the mailing data corresponding to the whitelist nodes in the candidate delivery relationship data to obtain the target delivery relationship data.

[0056] Among them, according to the business characteristics in the actual application scenario, a risk category list is extracted, and the risk category represents the category of frequently delivered blacklisted goods or the relevant risk category refined based on business experience. The risk category list can be extracted when needed according to demand, or it can be extracted and saved in advance, and the risk category list can be directly obtained when needed.

[0057] Pruning the mailing data corresponding to the nodes in the delivery relationship data that are not related to the risk categories in the risk category list can also be understood as filtering the mailing data corresponding to the nodes in the delivery relationship data that are not related to the risk categories in the risk category list, or deleting the mailing data corresponding to the nodes in the delivery relationship data that are not related to the risk categories in the risk category list, so as to obtain candidate delivery relationship data. Specifically, all mailing data corresponding to each node in the delivery relationship data are obtained; whether the mailing category in all mailing data of the node is a risk category in the risk category list; if it is detected that the mailing category of all mailing data of the node contains a risk category in the risk category list, then the node is determined to be a node related to the risk category; if it is detected that the mailing category of all mailing data of the node does not contain a risk category in the risk category list, then the node is determined to be a node not related to the risk category; all mailing data corresponding to the nodes not related to the risk category are deleted; so as to obtain candidate delivery relationship data.

[0058] The whitelist nodes in the nodes (including the sending nodes and the receiving nodes) can be determined based on data of multiple different dimensions. Specifically, the frequency corresponding to the data of each dimension is counted, and the threshold corresponding to the data of each dimension is determined; the candidate whitelist nodes corresponding to each dimension data in the node are determined based on the frequency of each dimension data and the corresponding threshold; the nodes existing in the candidate whitelist nodes corresponding to each dimension data are determined as whitelist nodes, or the nodes that hit the candidate whitelist nodes of n dimensions at the same time are determined as whitelist nodes, where n is less than the total dimension N.

[0059] Assuming that the number of different dimensions is N, that is, the total number of dimensions is N, the nodes that exist in the candidate whitelist nodes corresponding to each dimension data are determined as whitelist nodes, which can also be understood as determining the nodes that hit the candidate whitelist nodes of N dimension data at the same time as whitelist nodes. For example, N=4, assuming that a certain node is a candidate whitelist node for N1, N2, and N3 dimension data, then the node is determined not to be a whitelist node; assuming that a certain node is a candidate whitelist node for N1, N2, N3, and N4 dimension data, then the node is determined to be a whitelist node.

[0060] Assuming that the number of different dimensions is N, that is, the total dimension is N, the node that hits the candidate whitelist node of n dimensional data at the same time is determined as a whitelist node, where N>n. For example, N=4, n=3, assuming that a certain node is a candidate whitelist node of N1, N2, and N3 dimensional data, then the node is determined to be a whitelist node; assuming that other nodes are candidate whitelist nodes of N1, N2, and N4 dimensional data, or candidate whitelist nodes of N2, N3, and N4 dimensional data, or candidate whitelist nodes of N1, N3, and N4 dimensional data, then these nodes are determined to be whitelist nodes; assuming that a certain node is a candidate whitelist node of N1 and N3 dimensional data, then the node is determined not to be a whitelist node.

[0061] Among them, multiple different dimensional data can be determined according to specific scenarios. The following is an analysis of how to obtain candidate whitelist nodes corresponding to the dimensional data, using four dimensional data, including the total number of sending contacts of the node (including the sending node and the receiving node), the total shipping volume of the node (including the sending node and the receiving node), the category length corresponding to the shipping data of the node (including the sending node and the receiving node), and the sending address and receiving address of the node (including the sending node and the receiving node). It should be noted that there can be more dimensional data or fewer dimensional data.

[0062] (1) Total number of mailing contacts of the node

[0063] The total number of mailing contacts of each node is obtained (or counted), and a quantity threshold is determined; if the total number of mailing contacts exceeds the quantity threshold, the node is determined to be the first candidate whitelist node.

[0064] For example, if node A sends mail to father, mother, and colleagues, the total number of mailing contacts of node A is 3. The quantity threshold can be determined according to the total number of specific mailing contacts, for example, the quantity threshold is determined to be 100. It can be understood that it is generally believed that the merchant is a whitelist and the total number of mailing contacts of the merchant is relatively large. The purpose of this dimension data is to filter merchants.

[0065] Among them, the quantity threshold can be determined through the following steps: First, calculate the number of occurrences of the total number of senders' contact persons for each node; if the proportion of a certain number of occurrences to the sum of the number of occurrences of the total number of senders' contact persons for all nodes exceeds P1, where P1 is a percentage or the corresponding decimal, 0% < P1 < 100%, and can be 80%, 50%, etc., then remove the node corresponding to this number of occurrences; among the number of occurrences of the total number of senders' contact persons for the remaining nodes, if the proportion of a certain number of occurrences of the remaining nodes to the sum of the number of occurrences of the total number of senders' contact persons for the remaining nodes exceeds P1, then remove the node corresponding to this number of occurrences, until among all the remaining numbers of occurrences, there is no longer a number of occurrences whose proportion to the sum of the number of occurrences of the total number of senders' contact persons for the remaining nodes exceeds P1; then determine the quantity threshold from the remaining numbers of occurrences according to the quantile. For example, determine the quantile corresponding to 3 / 4 as the quantity threshold.

[0066] For example, assume P1 is 50%, and there are 100 nodes in total. Among them, the total number of senders' contact persons for 60 nodes is 5, and the number of occurrences of the total number of senders' contact persons being 5 is 60. Then the proportion of the number of occurrences 60 to the sum of the number of occurrences 100 is 60 / 100 = 0.6, which is greater than 50%. Then remove these 60 nodes with the total quantity of 5. The remaining nodes become 40. Next, repeat the above steps among the 40 nodes until among all the numbers of occurrences, there is no longer a remaining number of occurrences whose proportion to the sum of the number of occurrences of the total number of senders' contact persons for the remaining nodes exceeds P1. Determine the quantity threshold from the remaining numbers of occurrences according to the quantile. For example, determine the quantile corresponding to 3 / 4 as the quantity threshold.

[0067] It can be understood that when determining the quantity threshold, first calculate the number of occurrences of the total number of senders' contact persons for each node; remove the outliers from these numbers of occurrences; determine the quantity threshold from the numbers of occurrences after removing the outliers according to the quantile. Among them, removing the outliers is to reduce the influence of the outliers on the whole; in addition, using the quantile to determine the quantity threshold is to measure from the whole, remove the influence of the outliers on the whole, and then use the quantile to determine the quantity threshold, making the final result more accurate.

[0068] For example, in the above example, the total number of senders' contact persons for 60 nodes is 5, and this 5 can be understood as an outlier. If the outlier is not removed, then the threshold formulated by the fractional method will be too high because the number of occurrences of 5 affects the whole, and it is very likely that in the end, there is no node whose total number of senders' contact persons is greater than the determined quantity threshold.

[0069] (2) The total quantity of outgoing shipments of the node

[0070] Obtain (or count) the total number of outgoing parcels for each node; count the frequency of occurrence of the total number of outgoing parcels for each node, and determine the frequency threshold; if the frequency of occurrence of the total number of outgoing parcels for a node exceeds the frequency threshold, then determine that node as the second candidate white list node. Among them, the frequency threshold can be determined according to the frequency of occurrence of the total number of outgoing parcels for each node.

[0071] For example, the total number of outgoing parcels for a certain node is 5, and the total number of outgoing parcels for some other nodes also includes 2, 3, 4, 5, 6, 100, 500, 1000. Among them, the number of occurrences of the total number of outgoing parcels being 2, 3, 4, 5, 6, 100, 500, 1000 are 700, 1000, 800, 600, 900, 500, 200, 10 respectively. Then the frequency of occurrence of the total number of outgoing parcels being 5 is counted as 600 / (700 + 1000 + 800 + 600 + 900 + 500 + 200 + 10). If the frequency threshold is 0.3, the nodes whose frequency of occurrence of the total number of outgoing parcels exceeds 0.3 are determined as the second candidate white list nodes. It can be understood that the higher the frequency of occurrence of the total number of outgoing parcels for a node, the more times of sending parcels. It is impossible that most of the outgoing parcel data are abnormal data. Therefore, the nodes whose frequency of occurrence of the total number of outgoing parcels exceeds the frequency threshold are determined as candidate white list nodes.

[0072] Among them, the method for determining the frequency threshold is determined through the following steps: first obtain (or count) the frequency of occurrence of the total number of outgoing parcels for each node; if the ratio of a certain frequency to the sum of the frequencies of occurrence of the total number of outgoing parcels for all nodes (the sum of frequencies is 1) exceeds P2, where P1 is a percentage or the corresponding decimal, 0% < P1 < 100%, it can be 80%, 50%, etc., then remove the node corresponding to that frequency; among the frequencies of occurrence of the total number of outgoing parcels for the remaining nodes, if the ratio of a certain frequency to the sum of the frequencies of occurrence of the total number of outgoing parcels for the remaining nodes exceeds P, then remove the node corresponding to that frequency, until among all the frequencies, there is no longer a frequency whose ratio to the sum of the frequencies of occurrence of the total number of outgoing parcels for the remaining nodes exceeds P; then determine the frequency threshold according to the quantile from the remaining frequencies. For example, determine the quantile corresponding to 3 / 4 of the remaining frequencies as the frequency threshold.

[0073] It can be understood that when determining the frequency threshold, first calculate the frequency of occurrence of the total number of outgoing parcels for each node; remove the outliers from the frequencies; determine the frequency threshold according to the quantile from the number of times after removing the outliers. Among them, removing the outliers is to reduce the influence of the outliers on the whole; in addition, using the quantile to determine the frequency threshold is to measure from the whole, remove the influence of the outliers on the whole, and then use the quantile to determine the frequency threshold, making the final result more accurate.

[0074] (3) The category length corresponding to the outgoing parcel data of the node

[0075] The category length refers to the length of the string corresponding to the category of the item being sent. Generally, if you send something yourself, the category length is relatively small, for example, the category length will be directly written as documents, clothes, shoes, etc., while if a merchant sends something, they will generally use the name of the product directly, and the corresponding category length will be relatively long.

[0076] Obtain (or count) the category length of the node's mail category; count the total number of category deliveries corresponding to each category length; calculate the ratio of the total number of deliveries of each corresponding category to the total number of deliveries of all categories; if the ratio exceeds a preset ratio, determine the node as a third candidate whitelist node. The determination of the preset ratio can refer to the determination of the frequency threshold above.

[0077] For example, if the ratio of the total number of deliveries of a category with a length of 2 to the total number of deliveries of all categories exceeds 50%, the node corresponding to the delivery data of the category with a length of 2 is considered to be the third candidate whitelist node. It can be understood that it is impossible for more than 50% of the data to be abnormal data.

[0078] The purpose of this dimension is to filter merchants.

[0079] (4) The node’s shipping address and receiving address

[0080] It can be understood that for each node, there are multiple corresponding shipping addresses and receiving addresses in the delivery relationship data.

[0081] For each node, obtain (or count) the number of times each mailing address is used to send mail and the number of times each mailing address is used to receive mail; determine whether the number of times the mailing address is used exceeds the mailing address usage threshold or whether the number of times the mailing address is used exceeds the mailing address usage threshold; if so, determine the node as the fourth candidate whitelist node. For example, if the mailing volume of the same mailing address exceeds the mailing address usage threshold, it may be a merchant, corresponding to the merchant return scenario.

[0082] The fourth candidate whitelist node may also be determined in combination with other methods. For example, for each node, the number of times each mailing address is used for mailing, the number of times each mailing address is used for mailing, the mailing address repetition rate, and the mailing address repetition rate may be obtained (or calculated) respectively; it is determined whether the number of mailing uses exceeds the mailing use threshold, or whether the number of mailing uses exceeds the mailing use threshold, or whether the mailing address repetition rate exceeds the mailing repetition rate threshold, or whether the mailing address repetition rate exceeds the mailing repetition rate threshold; if so, the node is determined to be the fourth candidate whitelist node.

[0083] Here, the mailing address duplication rate is taken as an example for explanation. For each node, the sum of all mailing volumes N of the node and all mailing addresses Nunique of the node (the mailing addresses after duplication) are obtained (or counted). The address mailing duplication rate is calculated according to the sum of all mailing volumes N of the node and all mailing addresses Nunique of the node, such as by calculating according to the formula (N-Nunique) / N to obtain the mailing address duplication rate. For example, the number of mailings of a node is [2605, 763, 732, 1, 1], then N is 2605+763+732+ 1+1=4102, and Nunique is 5, then its address duplication rate is (4102-5) / 4102 = 0.999. The mailing duplication rate threshold, the receiving duplication rate threshold, etc. can be determined according to the method of determining the frequency threshold as described above; the mailing usage threshold, the receiving usage threshold, etc. can be determined according to the method of determining the quantity threshold.

[0084] The above is the process of determining the corresponding candidate whitelist node based on the four-dimensional data. Among them, other methods can be used to determine the candidate whitelist node corresponding to the four-dimensional data, and other dimensional data can also be used to determine the candidate whitelist node. It should be noted that the process of determining the corresponding candidate whitelist node based on the above four-dimensional data can be executed synchronously or asynchronously; it can be executed in parallel or serially.

[0085] After determining the candidate whitelist nodes corresponding to each dimension data, determine the whitelist nodes from the corresponding candidate whitelist nodes, such as determining the nodes that exist in the candidate whitelist nodes corresponding to each dimension data as whitelist nodes, or determining the nodes that hit the candidate whitelist nodes of n dimensions at the same time as whitelist nodes, where n is less than the total dimension N. For example, determine the nodes that exist in the first candidate whitelist node, the second candidate whitelist node, the third candidate whitelist node, and the fourth candidate whitelist node as whitelist nodes; or determine the nodes that exist in any n candidate whitelist nodes among the four candidate whitelist nodes as whitelist nodes, where n<=3. For details, please refer to the above description.

[0086] According to the determined whitelist nodes, the mailing data corresponding to the whitelist nodes in the candidate delivery relationship data are pruned, which can also be understood as filtering the mailing data corresponding to the whitelist nodes in the candidate delivery relationship data, or deleting the mailing data corresponding to the whitelist nodes in the candidate delivery relationship data, so as to obtain the target delivery relationship data. Specifically, all mailing data corresponding to each node in the candidate delivery relationship data are obtained; detect whether the node is a whitelist node; if so, delete all mailing data corresponding to the node. Other methods can also be used to delete the mailing data corresponding to the whitelist nodes in the candidate delivery relationship data. In this way, the target delivery relationship data is obtained.

[0087] The above is the process of using the risk category list and whitelist nodes to prune the delivery relationship data to obtain the target delivery relationship data, reducing the impact of normal delivery data on the abnormal delivery behavior identification results, that is, reducing the impact of redundant nodes. At the same time, it greatly reduces the amount of data for subsequent processing, shrinks the graph structure, and improves the efficiency of abnormal delivery behavior identification.

[0088] 103. Construct a delivery graph based on the target delivery relationship data.

[0089] According to the target delivery relationship data, any one of the telephone number, ID card number or QR code representing an independent individual is used as a node, and the delivery relationship (i.e., the mailing relationship) is used as an edge to draw a graph to construct a directed graph corresponding to the target delivery relationship data, and the directed graph is used as a delivery graph (also called a delivery graph network). Among them, the attributes of the node include whether it is on the blacklist, and the attributes of the edge include the total mailing volume. The method of constructing a directed graph can refer to any existing method of constructing a directed graph.

[0090] 104, performing a graph analysis on the delivery graph to obtain an analysis result.

[0091] The community division algorithm is used to iteratively divide the delivery graph into communities to obtain community division results. The community division results are further analyzed to obtain the risk level corresponding to the node, and the risk level corresponding to the node is used as the analysis result.

[0092] Specifically, step 104 includes: iteratively dividing the delivery graph into communities to obtain community division results; determining candidate abnormal nodes with abnormal delivery behaviors based on the community division results; determining the risk levels corresponding to the candidate abnormal nodes based on a preset scoring card strategy, and using the risk levels corresponding to the candidate abnormal nodes as analysis results.

[0093] The delivery graph is iteratively divided into communities using a community division algorithm. For example, the delivery graph can be divided into communities using a label propagation algorithm (LPA) or a random walk algorithm (Walk Trap). The label propagation algorithm is a local community division method based on label propagation. It uses its own network structure to guide label propagation without any optimization function. The logic is simple and the division speed is very fast for networks with many nodes and complex structures. Preferably, the label propagation algorithm is used to iteratively divide the delivery graph into communities.

[0094] The process of label propagation algorithm is as follows:

[0095] (1) Initialize the community label of each node in the delivery graph network. For example, for node x, initialize its community label as ;

[0096] (2) Set the number of iterations t;

[0097] (3) Set the traversal order and node set X for the nodes in the delivery graph network;

[0098] (4) For each node x∈X,

[0099] make ,in, It represents the community label of the node at the tth iteration. The function represents taking the parameter node with the most community labels.

[0100] (5) Determine whether the iteration can be terminated. If not, set t = t + 1 and re-iterate, that is, re-execute step (3).

[0101] Among them, based on the label propagation algorithm, a set of iterative strategies for community division is formulated, as follows Figure 2 As shown, the following steps are included:

[0102] 201, iteratively divide the delivery graph into communities and obtain an intermediate result of the community division.

[0103] Specifically, the community partitioning algorithm can be used to iteratively partition the delivery graph into communities. If the label propagation algorithm is used to iteratively partition the delivery graph into communities, the process of (1), (3), and (4) in the above label propagation algorithm can be referred to.

[0104] 202, detecting whether all communities in the intermediate result of community division are star-shaped communities.

[0105] If there are communities that are not star-structured, step 203 is executed; if all communities in the intermediate result of community division are star-structured communities, step 205 is executed.

[0106] 203 , detecting whether the community with a non-star structure is a community with a node number less than a preset node number.

[0107] The specific data of the preset number of nodes can be formulated according to the actual application scenario, for example, the preset number of nodes is set to 15. If the non-star structured communities are all communities with less than the preset number of nodes, step 205 is executed; if the non-star structured communities are communities with no less than the preset number of nodes, step 204 is executed.

[0108] 204, iteratively divide the communities with non-star structures and the number of nodes not less than the preset number of nodes into communities to obtain the intermediate results of community division. Specifically, please refer to the processes (3) and (4) in the above-mentioned label propagation algorithm, and then execute step 202 until the community obtained after community division is a star structure or a community with the number of nodes less than the preset number of nodes.

[0109] 205, the intermediate result of community division is used as the community division result.

[0110] That is, for each community division intermediate result after the community division algorithm is used, determine whether the community in the community division intermediate result is a star-shaped community or a community with a number of nodes not less than the preset number of nodes, so as to determine whether the next iteration is to be performed and whether the iteration can be ended. Specifically, the community division intermediate result is obtained using the community division algorithm. If the community in the community division intermediate result is either a star-shaped community or a community with a number of nodes less than the preset number of nodes, the iteration is determined to be over; otherwise, if there is a community with a non-star structure and a number of nodes not less than the preset number of nodes in the community division intermediate result, the community division algorithm needs to be used to perform the next iteration on the community with a non-star structure and a number of nodes not less than the preset number of nodes. The community in the final community division result is either a star-shaped community or a community with a number of nodes less than the preset number of nodes.

[0111] It can be understood that when the signature propagation algorithm is used in the embodiment of the present application, whether the iteration can be terminated is no longer determined by the number of iterations, but by the situation of the community obtained by the iteration, so that the communities obtained by the iteration are all communities that meet the conditions, which is conducive to subsequent analysis of the community.

[0112] After obtaining the community division results, determine the candidate abnormal nodes with abnormal delivery behavior according to the community division results. Specifically, determine the candidate abnormal nodes with abnormal delivery behavior according to the community division results, including: determining the central nodes of all communities in the community division results, and determining the number of neighbors of each node in all communities; taking the central node and the node with the largest number of neighbors (or the node with more than the preset number of neighbors) as the candidate abnormal nodes with abnormal delivery behavior. Among them, determining the central nodes of all communities can be achieved by using any existing scheme for determining the central nodes of the community. This step further determines the candidate abnormal nodes with abnormal delivery behavior and narrows the range of nodes for abnormal delivery behavior identification.

[0113] After determining the candidate abnormal nodes with abnormal delivery behavior, the risk level corresponding to the candidate abnormal node can be determined according to the preset scoring card strategy, and the risk level corresponding to the candidate abnormal node can be used as the analysis result. Specifically, according to the preset scoring card strategy, the scoring card score corresponding to the candidate abnormal node is calculated; the score corresponding to the risk level is obtained; the risk level corresponding to the candidate abnormal node is determined according to the scoring card score and the score corresponding to the risk level, and the risk level corresponding to the candidate abnormal node is used as the analysis result.

[0114] The scoring dimensions and scoring methods in the preset scoring card strategy are as follows:

[0115] Scoring dimensions include: the number of neighbors of a node, the number of contacts with blacklisted nodes, whether a node is a central node, etc. It should be noted that the scoring dimensions in the embodiments of the present application are only a few of the dimensions, and the scoring dimensions may include more dimensions. In specific implementation, scoring may be implemented based on fewer or more dimensions.

[0116] When the scoring dimension is the number of neighbors of a node: obtain (or count) the number of neighbors corresponding to all nodes of candidate abnormal delivery behaviors; normalize the obtained number of neighbors to obtain a normalized value of the number of neighbors of the node.

[0117] For example, the number of neighbors of a certain node is 2, the number of neighbors of another node is 3, and the number of neighbors of another node is N. Assuming that N is the largest number of neighbors, then N is normalized to 1, the number of neighbors of 2 is normalized to 2 / N, and the number of neighbors of 3 is normalized to 3 / N.

[0118] When the scoring dimension is the number of contacts of the blacklist node: obtain (or count) the number of contacts of the blacklist node corresponding to all candidate abnormal delivery behavior nodes; normalize the obtained number of contacts to obtain the normalized value of the number of contacts of the node.

[0119] For example, the number of contacts between a node and a blacklist node is 2, and the number of contacts between another node and the blacklist node is 1000. Assuming that 1000 is the maximum number of contacts, the number of contacts between the blacklist node and 1000 is normalized to 1, and the number of contacts between the blacklist node and 2 is normalized to 2 / 1000.

[0120] When the scoring dimension is whether the node is a central node, if the node is a central node, the node normalization value of the central node is directly set to 1; if the node is not a central node, the node normalization value is directly set to 0.

[0121] Finally, the node's scorecard score is determined based on the normalized value of the number of neighbors, the normalized value of the number of contacts, the normalized value of the node, etc. Specifically, the node's scorecard score = normalized value of the number of neighbors + normalized value of the number of contacts + normalized value of the node + ...

[0122] According to the scorecard score of the candidate abnormal node, the risk level corresponding to the candidate abnormal node is determined. The score corresponding to the risk level can be pre-defined, and the higher the risk level, the higher the corresponding score. The score corresponding to the risk level is obtained; according to the scorecard score of the node and the score corresponding to the risk level, the risk level corresponding to the candidate abnormal node is determined, and the risk level of the candidate abnormal node is determined as the analysis result, wherein the analysis result is the analysis result obtained by analyzing the delivery map. The higher the scorecard score, the higher the risk of the node.

[0123] 105. Determine the target node with abnormal delivery behavior among the sending node and the receiving node according to the analysis result.

[0124] Specifically, the node with the highest risk level can be determined as the target node with abnormal delivery behavior among the sending node and the receiving node in the delivery relationship data. That is, the node with the highest risk level is output as the target node with abnormal delivery behavior.

[0125] For target nodes with abnormal delivery behavior, label data can be accumulated after verification and used as blacklist nodes to make subsequent identification of abnormal delivery behavior more accurate.

[0126] The above method embodiment can prune the delivery relationship data, construct a delivery graph for the target delivery relationship data, divide the delivery graph into communities and score it, so as to identify the nodes corresponding to the abnormal delivery behaviors in the delivery relationship data. By finding redundant nodes through the pruning strategy, the graph structure of the delivery graph can be greatly reduced, and the efficiency of identifying abnormal delivery behaviors can be improved; by dividing the community through the community division method, analyzing the graph structure, and formulating a score card, the nodes and communities suspected of abnormal delivery can be accurately located, and the accuracy of identifying abnormal delivery behaviors can be improved.

[0127] Figure 3 Schematic diagram of the process of identifying abnormal delivery behavior provided by the embodiment of the present application. Figure 1 and Figure 3The abnormal delivery behavior identification method in the embodiment of the present application includes: counting and extracting delivery source data to obtain delivery relationship data; pruning the delivery relationship data, which mainly includes two aspects: pruning the delivery data corresponding to the nodes in the delivery relationship data that are not related to the risk categories in the risk category list to obtain candidate delivery relationship data, and pruning the delivery data corresponding to the whitelist nodes in the candidate delivery relationship data to obtain target delivery relationship data; constructing a delivery graph according to the target delivery relationship data; performing graph analysis on the delivery graph to obtain an analysis result, which includes iterative community division of the delivery graph to obtain a community division result, determining candidate abnormal nodes with abnormal delivery behavior according to the community division result, calculating the scorecard score of the candidate abnormal node according to a preset scorecard strategy, determining the risk level corresponding to the candidate abnormal node according to the scorecard score, and taking the risk level corresponding to the candidate abnormal node as the analysis result; determining the target node with abnormal delivery behavior in the delivery node and the receiving node in the delivery relationship data according to the analysis result.

[0128] Figure 4 : is a flow chart of the abnormal delivery behavior identification method provided in the embodiment of the present application, such as Figure 4 As shown, the flowchart of the abnormal delivery behavior identification method includes the following steps:

[0129] 301, obtaining delivery relationship data, wherein the delivery relationship data includes delivery data between a sending node and a receiving node.

[0130] 302, obtain a list of risk categories.

[0131] The risk category list can be obtained in advance or when needed.

[0132] 303, prune the mailing data corresponding to the nodes in the mailing relationship data that are not related to the risk categories in the risk category list to obtain candidate mailing relationship data, wherein the nodes include mailing nodes and receiving nodes.

[0133] 304, determine the whitelist nodes in the sending node and the receiving node.

[0134] Among them, four dimensional data, including the total number of sending contacts of the nodes (sending nodes and receiving nodes), the total sending volume of the nodes (sending nodes and receiving nodes), the category length corresponding to the sending data of the nodes (sending nodes and receiving nodes), and the sending addresses and receiving addresses of the nodes (sending nodes and receiving nodes), are used for analysis to obtain candidate whitelist data corresponding to the four dimensional data, and nodes that exist in the candidate whitelist nodes corresponding to each dimensional data are determined as whitelist nodes, or nodes that hit the candidate whitelist nodes of n dimensions at the same time are determined as whitelist nodes, where n is less than the total dimension N.

[0135] 305, prune the mailing data corresponding to the whitelist nodes in the candidate delivery relationship data to obtain the target delivery relationship data.

[0136] 306, construct a delivery graph according to the target delivery relationship data.

[0137] 307, iteratively divide the delivery graph into communities to obtain community division results.

[0138] Use the community partitioning algorithm to iteratively partition the delivery graph into communities and obtain the community partitioning results. If you can use the label propagation algorithm to iteratively partition the delivery graph into communities, please refer to Figure 2 shown.

[0139] 308. Determine candidate abnormal nodes with abnormal delivery behaviors according to the community division result.

[0140] 309 , according to a preset scoring card strategy, determine the risk level corresponding to the candidate abnormal node, and use the risk level corresponding to the candidate abnormal node as the analysis result.

[0141] Specifically, according to the preset scoring card strategy, the scoring card score corresponding to the candidate abnormal node is calculated; the score corresponding to the risk level is obtained; the risk level corresponding to the candidate abnormal node is determined according to the scoring card score and the score corresponding to the risk level, and the risk level corresponding to the candidate abnormal node is used as the analysis result.

[0142] 310. Determine the target node with abnormal delivery behavior among the sending node and the receiving node according to the analysis result.

[0143] The node with the highest risk level can be determined as the target node with abnormal delivery behavior among the sending node and the receiving node. That is, the node with the highest risk level is output as the target node.

[0144] For more details on the above steps, please refer to Figure 1 The specific description in the embodiments will not be repeated here.

[0145] In order to better implement the abnormal delivery behavior identification method in the embodiment of the present invention, on the basis of the abnormal delivery behavior identification method, an abnormal delivery behavior identification device is also provided in the embodiment of the present invention. The abnormal delivery behavior identification device is applied in a device, which can be a server or a terminal, such as a mobile phone, a pad, a desktop computer and other devices.

[0146] Figure 54 is a schematic block diagram of an abnormal delivery behavior identification device provided by an embodiment of the present invention. The abnormal delivery behavior identification device includes an acquisition unit 401, a pruning unit 402, a construction unit 403, an analysis unit 404 and a determination unit 405.

[0147] The acquisition unit 401 is used to acquire delivery relationship data, wherein the delivery relationship data includes the delivery data between the sending node and the receiving node.

[0148] Obtain delivery source data; determine delivery relationship data based on the delivery source data. In the delivery source data, count and extract data related to the identification of abnormal delivery behavior, for example, extract delivery relationship data, and construct a delivery relationship data table based on the delivery relationship data; further, extract node data, and construct a node data table based on the node data.

[0149] The pruning unit 402 is used to prune the delivery relationship data to obtain target delivery relationship data.

[0150] like Figure 6 As shown, the pruning unit 402 includes: a category acquisition unit 4021, a category pruning unit 4022, a whitelist determination unit 4023, and a whitelist pruning unit 4024.

[0151] The category acquisition unit 4021 is used to acquire a list of risk categories.

[0152] The category pruning unit 4022 is used to prune the mailing data corresponding to the nodes in the mailing relationship data that are not related to the risk categories in the risk category list to obtain candidate mailing relationship data, and the nodes include mailing nodes and receiving nodes.

[0153] Pruning the mailing data corresponding to the nodes in the delivery relationship data that are not related to the risk categories in the risk category list can also be understood as filtering the mailing data corresponding to the nodes in the delivery relationship data that are not related to the risk categories in the risk category list, or deleting the mailing data corresponding to the nodes in the delivery relationship data that are not related to the risk categories in the risk category list, so as to obtain candidate delivery relationship data.

[0154] The whitelist determination unit 4023 is used to determine the whitelist nodes in the sending node and the receiving node.

[0155] The whitelist node can be determined based on data of multiple different dimensions. Specifically, the frequency corresponding to each dimension of data is counted, and the threshold corresponding to each dimension of data is determined; the candidate whitelist node corresponding to each dimension of data is determined based on the frequency of each dimension of data and the corresponding threshold; the node that exists in the candidate whitelist node corresponding to each dimension of data is determined as a whitelist node, or the node that hits the candidate whitelist node of n dimensions at the same time is determined as a whitelist node, where n is less than the total dimension N.

[0156] For example, determine the total number of mailing contacts and the number threshold for each node, and the frequency and frequency threshold of the total mailing volume of each node; determine the first candidate whitelist node based on the total number of mailing contacts and the number threshold, and determine the second candidate whitelist node based on the frequency and frequency threshold of the mailing volume; determine the node that exists in both the first candidate whitelist node and the second candidate whitelist node as a whitelist node.

[0157] The whitelist pruning unit 4024 is used to prune the mailing data corresponding to the whitelist nodes in the candidate delivery relationship data to obtain the target delivery relationship data.

[0158] The mailing data corresponding to the whitelist nodes in the candidate delivery relationship data are filtered, or the mailing data corresponding to the whitelist nodes in the candidate delivery relationship data are deleted to obtain the target delivery relationship data.

[0159] The construction unit 403 is used to construct a delivery graph according to the target delivery relationship data.

[0160] According to the target delivery relationship data, any one of the phone number, ID card number or QR code representing an independent individual is used as a node, and the delivery relationship (i.e., the mailing relationship) is used as an edge to draw a graph to construct a directed graph corresponding to the target delivery relationship data, and the directed graph is used as a delivery graph (also called a delivery graph network). Among them, the attributes of the node include whether it is on the blacklist, and the attributes of the edge include the total mailing volume.

[0161] The analysis unit 404 is used to perform a graph analysis on the delivery graph to obtain an analysis result.

[0162] like Figure 6 As shown, the analysis unit 404 includes: a community division unit 4041, a candidate node determination unit 4042, and a risk level determination unit 4043.

[0163] The community division unit 4041 is used to perform iterative community division on the delivery graph to obtain a community division result. Specifically, the community division unit 4041 is used to perform iterative community division on the delivery graph to obtain an intermediate community division result; detect whether the community in the intermediate community division result is a star-shaped community or a community with a node number less than a preset node number; if so, use the intermediate community division result as the community division result; if not, perform iterative community division on a community that is not a star-shaped community and has a node number not less than a preset node number to obtain an intermediate community division result, and perform the step of detecting whether the community in the intermediate community division result is a star-shaped community or a community with a node number less than a preset node number, until the community obtained after the community division is a star-shaped community or a community with a node number less than a preset node number.

[0164] The candidate node determination unit 4042 is used to determine the candidate abnormal nodes with abnormal delivery behavior according to the community division results. The candidate node determination unit 4042 is specifically used to determine the central nodes of all communities in the community division results, and determine the number of neighbors of each node in all communities; the central node and the node with the largest number of neighbors are selected as candidate abnormal nodes with abnormal delivery behavior.

[0165] The risk level determination unit 4043 is used to determine the risk level corresponding to the candidate abnormal node according to a preset scoring card strategy, and use the risk level corresponding to the candidate abnormal node as the analysis result.

[0166] Among them, the risk level determination unit 4043 is specifically used to calculate the scorecard score corresponding to the candidate abnormal node according to the preset scorecard strategy; obtain the score corresponding to the risk level; determine the risk level corresponding to the candidate abnormal node according to the scorecard score and the score corresponding to the risk level, and use the risk level corresponding to the candidate abnormal node as the analysis result.

[0167] Among them, according to the preset scoring card strategy, the scoring card scores corresponding to the candidate abnormal nodes are calculated, including: obtaining the number of neighbors of each node, the number of contacts of each node with the blacklist nodes, and whether each node is a central node; normalizing the number of neighbors to obtain a normalized value of the number of neighbors, normalizing the number of contacts to obtain a normalized value of the number of contacts, and normalizing whether it is a central node to obtain a normalized value of the node; determining the scoring card score of each node according to the normalized value of the number of neighbors, the normalized value of the number of contacts, and the normalized value of the node.

[0168] The determination unit 405 is used to determine the target node with abnormal delivery behavior among the sending node and the receiving node according to the analysis result.

[0169] For example, the node with the highest risk level can be determined as the target node with abnormal delivery behavior among the sending node and the receiving node in the delivery relationship data. That is, the node with the highest risk level is output as the target node.

[0170] It should be noted that technicians in the relevant field can clearly understand that the specific implementation process and beneficial effects achieved by the above-mentioned devices and each unit can refer to the corresponding description in the aforementioned method embodiment. For the convenience and conciseness of the description, they will not be repeated here.

[0171] The embodiment of the present invention further provides a computer device, which integrates any one of the abnormal delivery behavior identification methods provided by the embodiment of the present invention, and the computer device includes:

[0172] one or more processors;

[0173] Memory; and

[0174] One or more applications, wherein the one or more applications are stored in the memory and are configured to be executed by the processor to execute the steps of the abnormal delivery behavior identification method described in any of the above-mentioned abnormal delivery behavior identification method embodiments.

[0175] The embodiment of the present invention further provides a computer device, which integrates any abnormal delivery behavior identification device provided by the embodiment of the present invention. Figure 7 As shown, it shows a schematic diagram of the structure of a computer device involved in an embodiment of the present invention, specifically:

[0176] The computer device may include one or more processing core processors 501, one or more computer-readable storage media memories 502, a power supply 503, an input unit 504 and other components. Those skilled in the art will appreciate that Figure 7 The computer device structure shown in the figure does not constitute a limitation on the computer device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. Among them:

[0177] The processor 501 is the control center of the computer device. It uses various interfaces and lines to connect various parts of the entire computer device. By running or executing software programs and / or modules stored in the memory 502 and calling data stored in the memory 502, it executes various functions of the computer device and processes data, thereby monitoring the computer device as a whole. Optionally, the processor 501 may include one or more processing cores; preferably, the processor 501 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 501.

[0178] The memory 502 can be used to store software programs and modules. The processor 501 executes various functional applications and data processing by running the software programs and modules stored in the memory 502. The memory 502 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the computer device, etc. In addition, the memory 502 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. Accordingly, the memory 502 can also include a memory controller to provide the processor 501 with access to the memory 502.

[0179] The computer device also includes a power supply 503 for supplying power to various components. Preferably, the power supply 503 can be logically connected to the processor 501 through a power management system, so as to manage charging, discharging, power consumption and other functions through the power management system. The power supply 503 can also include one or more DC or AC power supplies, recharging systems, power failure detection circuits, power converters or inverters, power status indicators and other arbitrary components.

[0180] The computer device may further include an input unit 504, which may be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control.

[0181] Although not shown, the computer device may further include a display unit, etc., which will not be described in detail herein. Specifically in this embodiment, the processor 501 in the computer device will load the executable files corresponding to the processes of one or more application programs into the memory 502 according to the following instructions, and the processor 501 will run the application programs stored in the memory 502, thereby realizing various functions, as follows:

[0182] Acquire delivery relationship data, wherein the delivery relationship data includes delivery data between a delivery node and a delivery node;

[0183] Pruning the delivery relationship data to obtain target delivery relationship data;

[0184] Constructing a delivery graph according to the target delivery relationship data;

[0185] Performing a graph analysis on the delivery graph to obtain an analysis result;

[0186] Determine the target node among the sending node and the receiving node where abnormal delivery behavior occurs based on the analysis result.

[0187] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0188] To this end, an embodiment of the present invention provides a computer-readable storage medium, which may include: a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc. A computer program is stored thereon, and the computer program is loaded by a processor to execute the steps in any of the abnormal delivery behavior identification methods provided in the embodiments of the present invention. For example, the computer program can be loaded by a processor to execute the following steps:

[0189] Acquire delivery relationship data, wherein the delivery relationship data includes delivery data between a delivery node and a delivery node;

[0190] Pruning the delivery relationship data to obtain target delivery relationship data;

[0191] Constructing a delivery graph according to the target delivery relationship data;

[0192] Performing a graph analysis on the delivery graph to obtain an analysis result;

[0193] Determine the target node among the sending node and the receiving node where abnormal delivery behavior occurs based on the analysis result.

[0194] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the detailed description of other embodiments above, and will not be repeated here.

[0195] In specific implementation, the above units or structures can be implemented as independent entities, or can be arbitrarily combined to be implemented as the same or several entities. The specific implementation of the above units or structures can refer to the previous method embodiments, which will not be repeated here.

[0196] The specific implementation of the above operations can be found in the previous embodiments, which will not be described in detail here.

[0197] The above is a detailed introduction to an abnormal delivery behavior identification method, device, computer equipment and storage medium provided in an embodiment of the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for identifying abnormal delivery behavior, characterized in that: include: Acquire delivery relationship data, wherein the delivery relationship data includes delivery data between a delivery node and a delivery node; Pruning the delivery relationship data to obtain target delivery relationship data; Constructing a delivery graph according to the target delivery relationship data; Performing a graph analysis on the delivery graph to obtain an analysis result; Determine, according to the analysis result, a target node among the sending node and the receiving node that has abnormal delivery behavior; The sending node and the receiving node are collectively referred to as nodes, and the pruning of the delivery relationship data to obtain target delivery relationship data includes: Get a list of risk categories; Pruning the mailing data corresponding to the nodes in the mailing relationship data that are not related to the risk categories in the risk category list to obtain candidate mailing relationship data; Determine a whitelist node among the nodes; Pruning the shipment data corresponding to the whitelist node in the candidate shipment relationship data to obtain target shipment relationship data; The candidate delivery relationship data includes data of multiple different dimensions, and determining the whitelist node includes: Count the frequency corresponding to each dimension of data and determine the threshold corresponding to each dimension of data; the data of multiple dimensions include the total number of mailing contacts of the node, the total mailing volume of the node, the category length corresponding to the mailing data of the node, and the mailing address and receiving address of the node; Determine the candidate whitelist node corresponding to each dimension data in the node according to the frequency of each dimension data and the corresponding threshold; A node that simultaneously hits the candidate whitelist nodes of n dimensions is determined as a whitelist node, where n is greater than 1 and less than or equal to the total dimension N.

2. The method for identifying abnormal delivery behavior according to claim 1, characterized in that: The step of determining the whitelist node comprises: Determine the total number of mailing contacts and the number threshold of each node, the frequency and frequency threshold of the total mailing volume of each node; Determine a first candidate whitelist node according to the total number of sender contacts and the number threshold; Determine a second candidate whitelist node according to the frequency of the mailing volume and the frequency threshold; A node that exists in both the first candidate whitelist node and the second candidate whitelist node is determined as a whitelist node.

3. The method for identifying abnormal delivery behavior according to claim 1, characterized in that: The step of performing a graph analysis on the delivery graph to obtain an analysis result includes: Iteratively dividing the delivery graph into communities to obtain community division results; Determine candidate abnormal nodes with abnormal delivery behavior according to the community division result; According to a preset scoring card strategy, the risk level corresponding to the candidate abnormal node is determined, and the risk level corresponding to the candidate abnormal node is used as the analysis result.

4. The method for identifying abnormal delivery behavior according to claim 3, characterized in that: The iterative community division of the delivery graph to obtain a community division result includes: Iteratively divide the delivery graph into communities to obtain an intermediate result of community division; Detecting whether the community in the intermediate result of the community division is a star structure or a community with a node number less than a preset node number; If yes, the intermediate result of community division is used as the result of community division; If not, the community with non-star structure and whose number of nodes is not less than the preset number of nodes is iteratively divided until the community obtained after the community division is a star structure or a community with less than the preset number of nodes.

5. The method for identifying abnormal delivery behavior according to claim 3, characterized in that: The determining of candidate abnormal nodes with abnormal delivery behavior according to the community division result includes: Determine the central nodes of all communities in the community division result, and determine the number of neighbors of each node in all communities; The central node and the node with the largest number of neighbors are taken as candidate abnormal nodes with abnormal delivery behavior.

6. The method for identifying abnormal delivery behavior according to claim 3, characterized in that: Determining the risk level corresponding to the candidate abnormal node according to the preset scoring card strategy includes: According to the preset scoring card strategy, the scoring card score corresponding to the candidate abnormal node is calculated; Get the score corresponding to the risk level; The risk level corresponding to the candidate abnormal node is determined according to the scorecard score and the score corresponding to the risk level.

7. A device for identifying abnormal delivery behavior, characterized in that: include: An acquisition unit, used for acquiring delivery relationship data, wherein the delivery relationship data includes delivery data between a delivery node and a delivery node; a pruning unit, configured to prune the delivery relationship data to obtain target delivery relationship data; A construction unit, used for constructing a delivery graph according to the target delivery relationship data; An analysis unit, used for performing a graph analysis on the delivery graph to obtain an analysis result; A determination unit, configured to determine a target node among the sending node and the receiving node having abnormal delivery behavior according to the analysis result; The pruning unit includes: a category acquisition unit, a category pruning unit, a whitelist determination unit, and a whitelist pruning unit; Category acquisition unit, used to obtain a list of risk categories; A category pruning unit, used to prune the mailing data corresponding to the nodes in the mailing relationship data that are not related to the risk categories in the risk category list, to obtain candidate mailing relationship data, where the nodes include mailing nodes and receiving nodes; A whitelist determination unit is used to determine whitelist nodes in the sending node and the receiving node; specifically, the candidate delivery relationship data includes data of multiple dimensions, the frequency corresponding to the data of each dimension is counted, and the threshold corresponding to the data of each dimension is determined; the data of multiple dimensions include the total number of sending contacts of the node, the total shipping volume of the node, the category length corresponding to the shipping data of the node, and the shipping address and receiving address of the node; the candidate whitelist node corresponding to each dimension data in the node is determined according to the frequency of each dimension data and the corresponding threshold; the node that hits the candidate whitelist node of n dimensions at the same time is determined as the whitelist node, where n is greater than 1 and less than or equal to the total dimension N; The whitelist pruning unit is used to prune the mailing data corresponding to the whitelist nodes in the candidate delivery relationship data to obtain the target delivery relationship data.

8. A computer device, characterized in that: The computer device comprises: One or more processors; a memory; and one or more applications, wherein the processor is connected to the memory, the one or more applications are stored in the memory, and are configured to be executed by the processor to implement the abnormal delivery behavior identification method described in any one of claims 1 to 6.

9. A computer storage medium, characterized in that A computer program is stored thereon, and the computer program is loaded by a processor to execute the steps in the method for identifying abnormal delivery behavior as described in any one of claims 1 to 6.

Images