A method for identifying interactive risk groups based on stock community relationship graph

Abstract

The present invention relates to a method for identifying interactive risk groups based on a stock community relationship map. In the present invention, according to the characteristics of the more intricate relationships generated in the stock community, from a relatively simple entity relationship to the complex relationship network between community stockholders and between users and other entities, the behavior of fraud risk exposed and reflected is analyzed and mined. The present invention selects the improved Louvain algorithm because of its superior stability, and the optimization and improvement to solve the timeliness problem, as well as the weight calculation of the edges in the modularity to improve the adaptability to the business model. In the present invention, the Lockinfer algorithm and the strategy of selecting seeds are used to discover the groups of brushing behavior, which can support the business to perform specific intention analysis on the groups of brushing behavior later. And the present invention uses the improved PageRank algorithm to obtain the influence score of the group members in the relationship, so as to further obtain the role of the members in the group.

Description

Technical Field

[0001] The invention relates to an interactive risk group identification method based on a stock community relationship map, belonging to the technical field of anti-fraud methods. Background Art

[0002] In the stock market, illegal groups often use methods such as increasing exposure and influence by inflating the volume of stock communities, publishing diversion information, or diverting stockholders to social software or live broadcast rooms for illegal group stock recommendations, etc., to trick investors into buying at high prices for illegal profit. This not only disrupts the market order and infringes on the interests of investors, but also has a negative impact on companies on stock community platforms. Online fraud risks vary. Traditional, single anti-fraud methods targeting individual risks, as well as detection using rule engines and supervised machine learning algorithms, can no longer solve the new cheating and fraud risk models that continue to emerge in the current market environment, as well as organized, large-scale risk detection that forms a group division of labor.

[0003] For example, the invention patent application with publication number CN109918511A (hereinafter referred to as "Document [1]") discloses a knowledge graph anti-fraud feature extraction method based on BFS and LPA, which includes the following steps: Step 1: Standardize the original data, convert the original data into labeled data in different dimensions, clean and convert it, and form data that conforms to knowledge graph modeling; Step 2: Construct a knowledge graph model, including ontology construction, semantic annotation and information extraction. For the problem of fraud group cases in the field of consumer finance anti-fraud, Document [1] uses an entity sub-group mining method based on label propagation to mine entity sub-group information and extract corresponding feature variables.

[0004] The invention patent application with publication number CN110188198A (hereinafter referred to as "Document [2]") discloses an anti-fraud method and device based on a knowledge graph, the method comprising: extracting entities, entity attribute data and relationship data from a data source; screening and processing the entity attribute data, and constructing a knowledge graph using the processed entity attribute data and the relationship data, the knowledge graph comprising a first type of node and a second type of node, the first type of node being a node with a known label, and the second type of node being a node with a label to be predicted; based on the knowledge graph, predicting the label of the second type of node.

[0005] The invention patent application with publication number CN112053221A (hereinafter referred to as "Document [3]") discloses a method for detecting fraudulent behavior of Internet financial gangs based on knowledge graph, which includes the following steps: obtaining personal application information, operation behavior tracking data and blacklist data of users from multiple preset data sources; pre-processing the application information and operation behavior tracking data and dividing them into training set and test set, marking the customers as fraud nodes and unmarked nodes according to the blacklist hit situation, and then calculating the similarity and attribution factor between the fraud nodes and their adjacent user nodes, assessing the fraud risk of unmarked nodes, using Neo4j graph database to build a knowledge graph, testing the fraud risk assessment results of the verification set, and detecting and processing the fraudulent behavior of real-time application users.

[0006] The invention patent application with publication number CN110223168A (hereinafter referred to as "Document [4]") discloses a label propagation anti-fraud detection method and system based on an enterprise relationship graph, comprising the following steps: S1. Establishing an enterprise blacklist library; S2. Constructing a relationship graph: screening the relevant tables and fields included in the relationship graph in the relational database, extracting the relational database object entities and entity relationships; S3. Performing anti-fraud detection on the enterprise based on the self-built blacklist library and the enterprise relationship graph: identifying the blacklist nodes of the relationship graph based on the blacklist library, extracting the blacklist node connection subgraph, using the label propagation algorithm to identify the fraudulent enterprise nodes in each connection subgraph, and estimating the probability of enterprise anti-fraud.

[0007] The invention patent application with publication number CN110413707A (hereinafter referred to as "Document [5]") discloses a method for mining and troubleshooting fraud gang relationships on the Internet. The method obtains Internet financial data, constructs a financial relationship graph using the knowledge graph construction principle, and mines groups with similar behaviors based on the constructed financial relationship graph through a clustering algorithm. By analyzing the composition of the group, the fraud gang is identified, completing the mining and troubleshooting of the fraud gang relationships.

[0008] The invention patent application with publication number CN108681936A (hereinafter referred to as "Document [6]") discloses a fraud gang identification method based on modularity and balanced label propagation, including: using ID features combined with the user's own known fraud identification, calculating the pairwise similarity of all users, establishing a similarity matrix, and establishing an association graph through the similarity matrix; running the Louvain algorithm on the established graph to obtain the community and hierarchical information of each node; using the community, hierarchical information and fraud identification of each node as the initial community information of each node, running the balanced label propagation process to obtain the final community to which each node belongs, and then dividing the network according to whether it belongs to the common community, and dividing the fraud gangs according to the fraud identification obtained by propagation.

[0009] The invention patent application with publication number CN111369139A (hereinafter referred to as "Document [7]") discloses an individual credit assessment method, which is based on obtaining the user's relationship network and adverse event information; establishing assumptions, setting the risk weight of the user node, and obtaining a set of n other user nodes connected to the user node u; using the time function to analyze and process the risk weight of the node where the user has an adverse credit event, and transmitting the risk weight to the node connected to the user's current node; improving the personalized PageRank algorithm and traversing all nodes through the algorithm at the same time, and calculating the risk weight of the adverse credit event of all nodes in the relationship network; sorting according to the risk weight, and obtaining a user risk ranking table based on the impact of adverse credit events.

[0010] The invention patent application with publication number CN110348978A (hereinafter referred to as "Document [8]") discloses a risk group identification method, apparatus, device and storage medium based on graph computing. The method comprises: receiving a business request, wherein the business request includes a business type and user attribute information; performing social network analysis on the business type, the user attribute information and the historical business data corresponding to the business request to generate a corresponding social network; segmenting a sub-network corresponding to the business request from the social sub-network according to the cohesion; and inputting the adjacency matrix of the sub-network into a preset prediction model to obtain a risk group identification result corresponding to the business request.

[0011] The invention patent application with publication number CN109299811A (hereinafter referred to as "Document [9]") discloses a method for identifying fraud gangs and predicting risk propagation based on complex networks, comprising the following steps: obtaining individual attributes; determining the unique coding of the attribute values ​​of the subject attributes and non-subject attributes; data filtering; establishing a data structure for storage and calculation; establishing a connected graph, abstracting the subject attribute values ​​and non-subject attribute values ​​into nodes, and abstracting the attribution relationship between the subject attribute values ​​and non-subject attribute values ​​into edges connecting the nodes, wherein the nodes and edges form a connected graph; obtaining a model graph based on the connected graph; calculating model parameters based on the data structure; and identifying fraud gangs and predicting fraud risk propagation based on the model parameters.

[0012] The invention patent application with publication number CN110569509A (hereinafter referred to as "Document

[10] ") discloses a method and device for identifying risk groups, wherein the method comprises: obtaining multiple accounts registered within a set time window and the registration information of each account; determining the similarity between any two accounts based on the registration information of each account; clustering the multiple accounts based on the similarity to obtain one or more account sets; for each account set, if it is determined that the number of accounts in the account set meets the set conditions, then the account set is used as risk group data.

[0013] The above technical solution has the following problems:

[0014] 1) The main risks faced by literature [1], literature [2], literature [3], literature [4], and literature [5] are mainly fraud risks and credit risks in the credit field: such as evaluating lending risks when applying for loans. In the stock community financial field scenario, the risks faced are the risks of abnormal community interaction groups and the resulting fraudulent behavior. Due to different scenarios, the specific risk characteristics and group characteristics are different.

[0015] 2) Document [2] only contains one entity, namely the enterprise, which is a relatively single entity, so the network it constructs is not a large-scale network.

[0016] 3) In simple terms, both references [2] and [3] predict and evaluate the risk of unlabeled nodes through labeled nodes. Reference [2] uses LightGBM to make predictions and evaluations, while reference [3] uses the similarity and attribution factors of adjacent nodes. Neither of them proposes further mining and analysis of the constructed network and methods for identifying gangs. Reference [8] simply describes building communities and then dividing them based on cohesion. It uses a prediction model to identify risk gangs, but it is not possible to mine risk gangs when the gangs are at risk of unknown user nodes.

[0017] 4) References [1], [4], and [5] all use the LPA label propagation algorithm to determine whether a user has a fraud risk. However, the current disadvantage of this algorithm is that the iteration results are oscillating and there is a non-convergence problem in actual situations. However, no relevant solutions to this problem have been proposed in the relevant literature.

[0018] 5) Reference [5] mentions several graph algorithms, including community discovery algorithm Fast Unfolding, overlapping community detection algorithm BigClam, LPA label propagation algorithm, graph embedding, etc. However, since each algorithm has its own advantages and disadvantages and solves different problems in different business scenarios, no detailed solutions are given. For example, Fast Unfolding, also known as Louvain, can also detect overlapping communities, and LPA itself also supports community discovery.

[0019] 6) Reference [6] proposed that how online payment services can effectively and timely identify frequently occurring online frauds has become an urgent problem that needs to be solved. In order to solve this problem, reference [6] uses the Louvain algorithm and balanced label propagation to obtain the fraud gangs that finally belong to the community and the fraud identification through the constructed association graph. Although reference [6] mentioned that the technical solution disclosed by it has excellent accuracy, the implementation requires an iterative method to calculate the modularity gain of all neighbor nodes, and no corresponding solution is given to whether it can solve the timeliness of large-scale graphs.

[0020] 7) Reference [7] uses an improved personalized PageRank algorithm for individual credit assessment, specifically ranking all users in the relationship network of the individual user whose credit needs to be assessed, and obtaining a user credit risk ranking table based on the impact of bad credit events, thereby assessing the size of individual credit risk. Reference [7] does not conduct risk assessment on the entire community relationship corresponding to the graph, and time decay only acts on nodes with bad events, and is not widely applicable to network relationships.

[0021] 8) Reference [9] obtains the model graph based on the connected graph and then hierarchizes it. The first model graph is mined through depth and breadth-first search, and the common non-subject attribute values ​​between individuals in the first model graph are used as edges to construct the second model graph, based on which fraud gangs are identified and fraud risk is propagated. The detection method disclosed in reference [9] is also not suitable for scenarios of risky users and risky gangs.

[0022] 9) Reference

[10] mainly obtains account sets by clustering based on similarity, which is used to detect risk groups such as batch registration. Reference

[10] does not use graph technology and network relationship mining and anomaly discovery to detect risk groups. Summary of the invention

[0023] The purpose of the present invention is to overcome the above-mentioned deficiencies of the prior art anti-fraud technology in the Internet financial industry.

[0024] In order to achieve the above object, the technical solution of the present invention is to provide a method for identifying interactive risk groups based on a stock community relationship map, which is characterized by comprising the following steps:

[0025] S1 collects server log data and client log data of specific behavior tracking points, and pre-processes the collected data to obtain input data for building a relationship graph;

[0026] S2 extracts information based on the data obtained in the previous step, including the extraction of entities, the extraction of entity relationships, and the extraction of attributes, where:

[0027] The extraction of entities includes extracting user entities, device terminal entities, post entities and stock entities;

[0028] According to the associations among users, post entities, stocks and device terminals, the relationships among user entities, device terminal entities, post entities and stock entities are extracted, and the entity relationships are divided into community interaction behavior relationships and non-community interaction behavior relationships. Among them, the relationships among user entities, the relationships between user entities and post entities, and the relationships between user entities and stock entities are community interaction behavior relationships; the relationships between user entities and device terminal entities, and the relationships between post entities and stock entities are non-community interaction behavior relationships;

[0029] The extraction of attributes includes the extraction of attributes of entities and the extraction of attributes of entity relationships. The attributes include indicator data directly counted and extracted from the input data obtained in step S1, and also include labels obtained by combining the indicator data.

[0030] S3 builds a relationship graph model

[0031] Based on the massive data of entities, entity attributes, relationships between entities, and attributes of relationships between entities extracted in step S2, two types of relationship graph models are constructed: one is a general relationship graph constructed based on non-community interaction behavior relationships to identify risky groups and define the size of general groups; the other is a community interaction relationship graph constructed based on community interaction behavior relationships to identify groups with the risk of fake volume in the interaction and to judge the influence of users in the group, thereby marking the role of users in the group for mining;

[0032] S4 risk identification, including the following steps

[0033] S4.1 Based on the universal relationship graph, the Louvain algorithm is used to divide the universal community to obtain the universal community division result, thereby realizing the identification of universal gangs;

[0034] The Louvain algorithm is divided into two parts: real-time online and offline. The offline processing specifically includes the following steps:

[0035] S4A.1.1 Initialize offline data, and each node in the general relationship graph is regarded as an independent community;

[0036] S4A.1.2 Pre-prune the general relationship graph based on prior business knowledge to effectively reduce the amount of data used for graph calculations and the amount of computation generated;

[0037] S4A.1.3 For each node i, assign node i to the community where each of its neighboring nodes is located in turn, calculate the modularity increment ΔQ before and after the assignment, record the neighboring node with the largest ΔQ, and the largest ΔQ>0; then assign node i to the community where the neighboring node with the largest ΔQ is located, otherwise give up this division;

[0038] The modularity Q is calculated as follows:

[0039]

[0040] In formula (1), A i,j represents the weight of the edge between node i and node j, and the calculation formula is shown in the following formula (2):

[0041]

[0042] In formula (2), Case 1 means that the indicator data based on the attributes of the edge needs to reflect the absolute difference in value, and case 2 means that the indicator data based on the attributes of the edge needs to reflect the relative difference in direction; δ′ is a custom parameter;

[0043] In formula (1), k i =∑ j A i,j , represents the sum of the weights of all edges connected to node i; k j represents the sum of the weights of all edges connected to node j; represents the sum of the weights of all edges; c i represents the community to which vertex i belongs, c j represents the community to which vertex j belongs;

[0044] S4A.1.4 Repeat step S4A.1.3 until all the communities corresponding to the nodes no longer change;

[0045] S4A.1.5 compresses the universal relationship graph, compresses all nodes in the same community into a new node, converts the edge weights between nodes in the community into the ring weights of the new node, and converts the edge weights between communities into the edge weights between new nodes;

[0046] S4A.1.6 Repeat step 4A.1.1 until the modularity of the entire universal relationship graph no longer changes;

[0047] S4A.1.7 Filtering, merging, and pruning.

[0048] When processing in real time, the processing of the newly added node i in real time includes the following steps:

[0049] S4B.1.1 For the newly added node i, randomly assign the newly added node i to the community where one of its neighboring nodes is located, and calculate the modularity increment ΔQ before and after the assignment, where the modularity Q is calculated according to formula (1);

[0050] Step S4B.1.2: If the ΔQ calculated in the previous step is not greater than the threshold, randomly select another neighbor node and return to step S4B.1.1; otherwise, assign the newly added node i to the community where the current neighbor node is located and end the division;

[0051] S4.2 Identify fraud groups and user roles based on community interaction relationship graphs

[0052] The Lockstep behavior risk group detection and improvement of the personalized PageRank algorithm are performed through the Lockinfer algorithm to obtain the fraud propagation score of the user node in the interactive relationship network for user role determination, which specifically includes the following steps:

[0053] Step S4.2.1 Detect risk groups of fraudulent activity through the Lockinfer algorithm

[0054] Define s as the source node user, then S is the source node user set, t is the target node user, then T is the target node user set, then step S4.2.1 specifically includes the following steps:

[0055] Step S4.2.1.1 selects a seed node set consisting of seed nodes with suspected Lockstep behavior based on a seed selection algorithm, wherein the seed selection algorithm specifically includes the following steps:

[0056] Step S4.2.1.1.1 performs singular value decomposition on the interaction relationship graph, calculates the left singular vector U and the right singular vector V of the adjacency matrix A based on the K-SVD algorithm, and uses the left singular vectors U to draw the spectrum subspace in pairs:

[0057] For each pair (i, j), 1≤i<j≤k, k is the number of iterations of K-SVD, plot the left singular vector U i VsU j The spectrum subspace, U i is the left singular vector obtained in the i-th iteration, U j For the left singular vectors obtained at the jth iteration, look for anomalies such as "Rays", "Staircase" and "Pearls" in the following table:

[0058]

[0059]

[0060] Step S4.2.1.1.2: Use Hough transform to transform the spectrum subspace from Cartesian coordinate system to polar coordinate system, that is, for each user node u in the spectrum subspace x , x≤N, N is the total number of user nodes, and the following formula (3) is obtained:

[0061]

[0062] In formula (3), the Cartesian coordinates (U i,x ,U j,x ) is converted into polar coordinates (r x ,θ x ), r x is user node u x The polar coordinate radius, θ x is user node u x The polar coordinate angle of

[0063] Step S4.2.1.1.3 draws the r frequency and θ frequency distribution histogram of the node, and the following formula (4) is obtained:

[0064]

[0065] In formula (4), freq(r) is the r frequency of the node, freq(θ) is the θ frequency of the node;

[0066] Step S4.2.1.1.3 detects the peak of the histogram obtained in the previous step, and uses the node set corresponding to the peak as the seed node set;

[0067] Step S4.2.1.1.4 further filters the seed nodes in the seed node set based on business experience to obtain a final seed node set;

[0068] Step S4.2.1.2 performs Lockstep propagation: Based on the seed node set selected in the previous step, the Lockstep value is propagated in the community interaction relationship graph to detect user nodes with Lockstep behavior. The specific algorithm propagation process is as follows:

[0069] Step S4.2.1.2.1 Initialization:

[0070] Define the seed nodes in the seed node set as the Lockstep volume-boosting users in round 0;

[0071] The source node set S and the target node set T form an m×n matrix (S, T), m≤M, n≤N, and the size of the adjacency matrix A of the community interaction relationship graph is M×N;

[0072] The minimum Lockstep abnormal dense block size m min ×nmin And the corresponding density threshold The density threshold It is expressed as the following formula (5):

[0073]

[0074] In formula (5), D = d(A) represents the density of the adjacency matrix A. When , the matrix (S, T)(S, T) is considered to be the first Lockstep abnormally dense block in the adjacency matrix A;

[0075] Define the time-decayed weight adjacency matrix W1 = (w 1 i,j ), then:

[0076]

[0077] In the formula, γ represents the decay constant, and its value represents the rate at which historical information decays, and limited historical information needs to be considered; h is the time after node i and node j are connected, and h = 0 represents the current relationship;

[0078] Step S4.2.1.2.2 propagates Lockstep from the source node user set S to the target node user set T; S->T: Use the source node user of Lockstep brushing user as the seed node, count the number of source node users with Lockstep brushing behavior associated with each target node user, and if the ratio exceeds the threshold And the scale is greater than n min , then it is marked as the target node user with Lockstep brushing behavior, that is,

[0079] Step S4.2.1.2.3 Propagate LockStep from the target node user set T to the source node user set S

[0080] T->S: Count the number of target node users with Lockstep volume-boosting behavior associated with each source node user (e.g., how many target node users with Lockstep volume-boosting behavior the source node user follows). If the ratio exceeds the threshold And the scale is greater than m min , then it is marked as a source node user with Lockstep brushing behavior, that is,

[0081] Step S4.2.1.2.4 repeats steps S4.2.1.2.2 and S4.2.1.2.3 until convergence;

[0082] Step S4.2.2 obtains the fraud propagation score by improving the personalized PageRank algorithm, including the following steps:

[0083] Step S4.2.2.1 obtains a bipartite graph G = (ν, ε) containing two types of nodes of the community interaction relationship graph: e(v1, v2)∈ε|v1∈ν1and v2∈ν2, where ν represents an entity node, ν1ν2 represent two types of nodes of the bipartite graph, one type is the user account entity node, and the other type is the post entity node corresponding to the user post; ε represents an edge, and e(v1, v2) represents the edge corresponding to the two types of nodes ν1ν2 of the bipartite graph;

[0084] Step S4.2.2.2 calculates the scores of all nodes in the bipartite graph using the PageRank algorithm:

[0085] Define the time-decayed weight adjacency matrix W 2 n×m =(w 2 i,j ) is shown in the following formula (7):

[0086]

[0087] In formula (7), μ is the weighting constant, d is the density of frequent operations in the time interval;

[0088] The PageRank algorithm starts by selecting a node from a specific set of nodes each time it re-walks.

[0089] have:

[0090]

[0091] The time-decayed weight adjacency matrix W 2 i,j Expanded into a (i+j)×(i+j) symmetric matrix Q:

[0092]

[0093] In formula (8), W' i×j It means W i,j The transposed matrix of

[0094] After column normalization of the symmetric matrix Q, the symmetric matrix Q is obtained norm , then the iterative propagation process is transformed into formula (9):

[0095]

[0096] In formula (9), the vector and The size is i+j, vector Indicates the PageRank score corresponding to the node. For the relationship between users and posts, is the probability of being selected during the restarted random walk of users and posts;

[0097] The final score can be interpreted as the importance of the user node in the group, that is, influence. The higher the value, the more important the user node is in the group.

[0098] Preferably, in step S1, the collected data includes: API server logs including user account registration and login, which are used to obtain the relationship between the user account and the terminal device; server logs of user account interactive operations in the online community; post review background log data, including the review disposal mark for the user and the disposal mark for the post.

[0099] Preferably, in step S2, the user entity is a user account ID, the device terminal entity is a device terminal ID, the post entity is a post ID, and the stock entity is a stock code.

[0100] Preferably, in step S2, the labels in the attributes of the user entity include user risk profile labels, and the user risk profile labels are divided into account security risk labels and account business behavior risk labels according to behaviors and intentions;

[0101] Then in step S4.2.1.1, in addition to selecting the seed algorithm, user nodes with corresponding user risk profile labels and business audit results defined and screened by business experts can also be selected as seed nodes to form a seed node set.

[0102] Preferably, in step S3, when constructing the relationship graph, the indicator data in the attributes of the edge are used as filtering conditions, and according to the rule model designed by the business experts, the edges whose corresponding indicator data in the attributes of the edge meet the mapping standards are selected for construction.

[0103] Compared with the prior art, the present invention has the following advantages:

[0104] 1) At present, anti-fraud risk detection and identification for relationship graphs are mainly concentrated in scenarios such as the assessment of lending risks by financial credit institutions and anti-fraud identification in the consumer finance field of asset management companies, such as: using corporate relationship networks to analyze and mine the fraud risks reflected in relationships, and using marked risk users to conduct potential risk warnings. Due to its relatively single entity relationship, such as only taking the enterprise as an entity, it is not suitable for the current scenario where entities are more diversified and relationships are more complex. In the present invention, based on the characteristics of the more complex relationships generated by the stock community, from a relatively single entity relationship, to the analysis and mining of behaviors that expose and reflect fraud risks that can be realized through complex relationship networks between community stockholders and between users and other entities.

[0105] 2) In the prior art, many algorithms rely on the original algorithms provided by the Neo4j graph algorithm library, and there is no targeted algorithm improvement to adapt to the current business problems that need to be solved. In the present invention, an algorithm that is more suitable for the scenario is selected in model selection, such as the LPA label propagation algorithm, which is more efficient, but due to the existence of random selection, the iterative result will have the disadvantage of oscillating, and there will be non-convergence problems in actual business scenarios, which is not conducive to the continuous tracking and business disposal of subsequent gangs. Therefore, the present invention selects the improved Louvain algorithm, because the algorithm has a relatively superior stability, and the optimization and improvement solves the timeliness problem, as well as the weight calculation of the edge in the modularity to improve the adaptability to the business model.

[0106] 3) Existing technologies have proposed using community partitioning algorithms based on relationship network graphs or based on the similarity of adjacent nodes to determine whether a user has a fraud risk. However, they are currently unable to effectively solve the identification of groups with different risk behaviors and intentions, and the identification of the roles played by users in the group in the current scenario. The present invention uses the Lockinfer algorithm and a seed selection strategy to discover groups with inflated volume behaviors, which can support the subsequent business to conduct specific intent analysis on inflated volume groups. In addition, the present invention uses an improved PageRank algorithm to obtain the influence scores of group members in the relationship, thereby further obtaining the roles played by members in the group, and finally obtaining a comprehensive risk profile of the group to support the business system and perform differentiated treatment on users. BRIEF DESCRIPTION OF THE DRAWINGS

[0107] Figure 1 Provide a principle framework diagram of the method for the example of the present invention;

[0108] Figure 2 An example of a network constructed by interactive relationships in a method is provided for an example of the present invention. DETAILED DESCRIPTION

[0109] The present invention will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent forms fall within the scope limited by the appended claims of the application equally.

[0110] The present invention provides a method for identifying interactive risk groups based on a stock community relationship graph, which specifically includes the following steps:

[0111] S1 Data collection, data processing and standardization

[0112] According to the specific scenarios in which risk groups need to be detected and identified in business needs, the server log data that needs to be collected and the client log data of specific behavior tracking points are planned. The collected data is divided according to the data standards defined by business experts, with the aim of dividing the data according to business logic and user interaction behavior types. After data cleaning, processing and conversion, these data are formed as input data for building relationship maps.

[0113] In this embodiment, the collected data mainly includes all APP / JS client behavior tracking logs of the user account, and the relationship between the user account and the device terminal is obtained. The specific fields are shown in the following table.

[0114]

[0115]

[0116] In this embodiment, the following types of data are mainly collected:

[0117] 1. API server logs such as user account registration and login, obtain the relationship between user accounts and devices. Examples of specific fields are shown in the following table.

[0118]

[0119] 2. The server log of user accounts performing interactive operations in the community, such as posting, replying to comments, reading, liking, collecting, forwarding, and other interactive behaviors. The specific fields are shown in the following table.

[0120] a. Publish the main post:

[0121]

[0122] b. Post a reply:

[0123]

[0124]

[0125] The same applies to the data structure of interactive behaviors such as likes, favorites, and forwarding.

[0126] 3. Posting review background logs are divided into two categories:

[0127] a. User review and disposal identification:

[0128] Fields Notes The account ID of the user who posted the reply Generate format specifications based on user account ID User's current credit status Such as: banned, suspicious, normal user, high-quality user, etc. User credit time User review, background marking time

[0129] b. Disposition mark of the post:

[0130]

[0131] S2 Information Extraction

[0132] The relationship graph constructed by the present invention is mainly divided into nodes, edges, and attributes. Therefore, in this step, information extraction for constructing the relationship graph is performed, which is mainly divided into: extraction of entities, extraction of entity relationships, and extraction of attributes.

[0133] S2.1 Entity Extraction

[0134] The entity extraction in the current field is different from the traditional text extraction process. The entity concerned in the present invention includes not only the user who generates the interactive behavior, but also the corresponding post entity, stock entity, and device terminal entity, each of which is a node.

[0135] In this embodiment, user entity: user account ID (pass ID);

[0136] Device terminal entity: device terminal ID;

[0137] Post entity: post ID (processed into a unified code ID using splicing logic based on the main post ID and the reply ID of the main post);

[0138] Stock Entity: Stock symbol.

[0139] S2.2 Entity Relationship Extraction

[0140] According to the association relationship between users, post entities, stocks and device terminals, the relationship between user entities, device terminal entities, post entities and stock entities is extracted. The present invention distinguishes the relationship between entities based on whether it is a rule of community interaction behavior, and divides it into the following two categories:

[0141] 1. Community interaction behavior relationships, further including:

[0142] a. The relationship between user accounts, including direct relationships between user accounts through interactions such as following, subscribing, and @mentioning a specified user account, as well as indirect relationships between user accounts through user account-post-user account;

[0143] b. The relationship between user accounts and posts, including posting, replying to, commenting on, reading, liking, collecting, forwarding, and other interactions between user accounts through posts and other media;

[0144] c. The relationship between user accounts and stocks, including user interaction behaviors such as user accounts following stocks.

[0145] 2. Non-community interactive behavior relationships, further including:

[0146] a. The relationship between user accounts and device terminals, including the relationship between user accounts and device terminal IDs corresponding to operations such as user registration and login, user posting and liking;

[0147] b. The relationship between posts and stocks, including the specific stocks to which the main post and replies belong.

[0148] S2.3 Attribute extraction

[0149] Generally, attribute extraction refers to extracting attribute information of an entity from a text, such as "age", "gender" and other attributes of a "user". In the present invention, entity attributes focus on the attributes of the entity itself, such as the user risk profile label, on the one hand; on the other hand, they focus on the attributes of the relationship between entities. That is, in the present invention, the attributes of each entity are extracted as the attributes of the node, and the attributes of the relationship between entities are extracted as the attributes of the edge. In the present invention, attributes include indicator data directly counted and extracted from the data input in step S1 according to expert rules, and also include labels obtained according to expert rules combined with indicator data.

[0150] In the present invention, the attributes of nodes are usually mainly labels, while the attributes of edges are usually mainly indicator data.

[0151] The attributes of the extracted user account entity are: The user account entity attributes mainly reflect user information and characteristics, including but not limited to name, age, gender, account registration time, account registration source, etc., user behavior statistical indicators, and risk portrait labels marked for user accounts.

[0152] The attributes of the extracted device terminal entity are: device information including but not limited to device terminal type, model, manufacturer, device behavior statistical indicators (such as: the first post of the device, the number of posts of the device in the past 7 days and other related indicator data, etc.), and risk portrait labels and risk levels marked for the device (such as: simulators, modification tools, Hook frameworks, reverse tools, third-party Android Rom, Root, etc.); used to discover accounts in the gang that use simulators, modification tools, etc. to simulate APP devices and tamper with device information in large quantities.

[0153] The attributes of the extracted post entity are: post statistical indicators, including but not limited to the number of words in the post, the post similarity score, the post popularity index, etc.

[0154] The attributes of the extracted stock entity (stock code) are: the attributes mainly cover the market value attributes of the stock itself and the popularity of the stock community, including but not limited to the current market value of the stock, whether the stock is a small-cap stock, the popularity ranking index of the individual stock bar in the past 7 days, the sentiment index of the individual stock bar in the past 7 days, etc.

[0155] The attributes of the extracted inter-entity relationships are as follows: according to the relationships generated by different entities, corresponding indicators that can reflect the characteristics of the relationships between entities are constructed to construct relationship attributes.

[0156] In this embodiment, the labels in the attributes of the user entity may include user risk profile labels. According to the behavior and intention, the user risk profile labels are subdivided into account security risk labels and account business behavior risk labels. Specific examples are as follows:

[0157] Registration machine users: Account security risks, using registration tools to batch register login accounts;

[0158] Posting machine users: Business behavior risk tags, business behaviors of using posting tools to post on a large scale;

[0159] Suspected traffic diversion users: Business behavior risk labels, accounts that publish traffic diversion information in personal information and post content; including but not limited to: personal profile, personal avatar, real-time simulated stock portfolio name, main post, comments, pictures in post content, etc.;

[0160] Suspected water army users: Business behavior risk labels, accounts that increase likes, increase followers, increase comments, and make top comments, etc.

[0161] Ban users: Ban some user accounts in the review background.

[0162] Examples of indicator data in the attributes of the user entity include: the time of the user's first posting, the number of posts the user has posted in the past 7 days, the number of historical posts the user has posted, the number of posts the user has deleted in the past 7 days, the number of historical posts the user has posted, and other related indicator data.

[0163] The following table is an example of indicator data in the [user-terminal device] relationship attribute (i.e., the attribute of the edge between the user node and the terminal device node):

[0164]

[0165]

[0166] The attributes of the edges vary depending on the relationships between entities. In subsequent steps, the weights of the edges can be calculated using the indicator data in the extracted edge attributes.

[0167] Furthermore, when constructing the relationship graph in the subsequent step S3, the indicator data in the edge attributes are used as filtering conditions to reduce resource consumption. Specifically, according to the rule model designed by the business experts, the edges whose corresponding indicator data in the edge attributes meet the graph construction standards are selected for construction. For example, if a user only logs in on a certain device for one day and there is no corresponding post record, then when constructing the relationship graph, this relationship is filtered and the corresponding edge is not constructed.

[0168] S3 builds a relationship graph model

[0169] Based on the massive data of entities, entity attributes, relationships between entities, and attributes of relationships between entities extracted in step S2, two types of relationship graph models at the billion level were constructed using Python: one is a general relationship graph constructed based on general relationships, i.e., non-community interaction behavior relationships, to identify risky groups and define the size of general groups; the other is a community interaction relationship graph constructed based on community interaction behavior relationships, to identify groups with the risk of brushing behavior in the interaction, and to judge the influence of users in the group, thereby marking the role of users in the group for mining.

[0170] S4 Risk Identification

[0171] S4.1 Dividing universal communities based on universal relationship graphs

[0172] The general relationship graph is first constructed based on the general relationship to form a connectivity graph, and then the community discovery algorithm of the complex network is integrated to divide the community. In the algorithm selection, the efficiency, accuracy and stability are comprehensively considered, and the construction of the general relationship graph selects the community discovery algorithm based on modularity, the Louvain algorithm. The Louvain algorithm supports multi-layer clustering and can discover hierarchical community structures. The Louvain algorithm first divides all users into small groups, and then further clusters the small groups into large groups to discover larger or more hidden groups.

[0173] The Louvain algorithm needs to traverse all nodes and is not suitable for business scenarios with high timeliness, and there will be problems of merging communities when the modularity increment is small. To solve the above problems, the present invention improves the original Louvain algorithm.

[0174] First of all, the idea of ​​the Louvain algorithm is to find out the community to which each entity node belongs, and to maximize the modularity of the partitioning structure. Community discovery is performed by calculating the modularity increment ΔQ, which is to put an isolated node into a community and then calculate the change in modularity. However, since most of the overhead is used to calculate and compare the modularity gains of all neighboring nodes, large-scale communities need to traverse all nodes, which is not suitable for scenarios requiring high timeliness. In response to this problem, the present invention introduces the idea of ​​the random neighbor Louvain algorithm to improve the original algorithm. In real time, nodes are randomly extracted to calculate whether the modularity increment is higher than the set threshold to perform community division. Offline, all nodes are continued to be traversed, and the real-time and offline algorithm results are subsequently compared to perform business intervention difference correction.

[0175] Secondly, when the Louvain algorithm divides communities, the modularity increment is calculated by subtracting the number of edges connecting the node and the community in the random graph from the number of edge connections within the community. When the scale of the graph is very large, then in a random case, when the degree of the node is very small, it means that the probability of the node being connected to any community is very small, that is, the modularity increment is very small, then as long as there is an edge connecting the two communities, the communities will merge. In order to solve this problem, it is necessary to set weights for the edges for modularity calculation. The weight calculation method of the present invention is obtained according to whether the indicator logic focuses on the absolute difference in value or the relative difference in direction.

[0176] The specific process of the algorithm is as follows:

[0177] The Louvain algorithm of the present invention is divided into two parts: real-time online and offline. The offline processing specifically includes the following steps:

[0178] S4A.1.1 Initialize offline data, and each node in the general relationship graph is regarded as an independent community;

[0179] S4A.1.2 Pre-prune the general relationship graph based on prior business knowledge to effectively reduce the amount of data used for graph calculations and the amount of computation generated;

[0180] S4A.1.3 For each node i, assign node i to the community where each of its neighboring nodes is located in turn, calculate the modularity increment ΔQ before and after the assignment, record the neighboring node with the largest ΔQ, and the largest ΔQ>0; then assign node i to the community where the neighboring node with the largest ΔQ is located, otherwise give up this division;

[0181] The modularity Q is calculated as follows:

[0182]

[0183] In formula (1), A i,j represents the weight of the edge between node i and node j, and the calculation formula is shown in the following formula (2):

[0184]

[0185] In formula (2), Case 1 indicates that the indicator data based on the attributes of the edge needs to reflect the absolute difference in value, and case 2 indicates that the indicator data based on the attributes of the edge needs to reflect the relative difference in direction; δ′ is a custom parameter; corresponding to the division of case 1 and case 2, the specific examples are shown in the following table:

[0186] Indicator Index item content Edge weight calculation Indicator 1 Whether to register the terminal Focus on relative differences, using cosine distance Indicator 2 Post terminal Focus on relative differences, using cosine distance Indicator 3 Login terminal historical active days Focus on the absolute difference in values, using Euclidean distance Indicator 4 Number of days the terminal was active in the past 30 days Focus on the absolute difference in values, using Euclidean distance Indicator 5 Cumulative posting days of user terminals Focus on the absolute difference in values, using Euclidean distance

[0187] In formula (1), k i =∑ j A i,j , represents the sum of the weights of all edges connected to node i; k j represents the sum of the weights of all edges connected to node j; represents the sum of the weights of all edges; c i represents the community to which vertex i belongs;

[0188] S4A.1.4 Repeat step S4A.1.3 until all the communities corresponding to the nodes no longer change;

[0189] S4A.1.5 compresses the universal relationship graph, compresses all nodes in the same community into a new node, converts the edge weights between nodes in the community into the ring weights of the new node, and converts the edge weights between communities into the edge weights between new nodes;

[0190] S4A.1.6 Repeat step 4A.1.1 until the modularity of the entire universal relationship graph no longer changes;

[0191] S4A.1.7 Filtering, merging, and pruning.

[0192] During real-time line processing, for the newly added node i, the iterative method of calculating the modularity gain of all its neighboring nodes is changed to randomly selecting a node j from all neighboring nodes to calculate whether ΔQ is higher than the threshold, so as to perform community division. The remaining steps of the algorithm remain unchanged. Subsequently, the real-time line algorithm results are compared with the offline algorithm results, and the real-time line algorithm results are corrected with reference to the offline algorithm results, which specifically includes the following steps:

[0193] S4B.1.1 For the newly added node i, randomly assign the newly added node i to the community where one of its neighboring nodes is located, and calculate the modularity increment ΔQ before and after the assignment, where the modularity Q is calculated according to formula (1);

[0194] Step S4B.1.2: If the ΔQ calculated in the previous step is not greater than the threshold, randomly select another neighbor node and return to step S4B.1.1; otherwise, assign the newly added node i to the community where the current neighbor node is located and end the division.

[0195] In this embodiment, a connectivity graph is constructed, and specific examples of community division results obtained based on the improved Louvain algorithm are shown in the following table:

[0196] Fields Field Description Connectivity Graph ID Construct the ID of the connection graph Gang ID The ID of the community after the connected graph is divided, used as the group ID Node ID The ID of the entity node Node Type Type of entity node, such as user, APP device terminal, etc. Update time Calculate the update time

[0197] S4.2 Identify fraud groups and user roles based on community interaction relationship graphs

[0198] Since the black industry can obtain a large number of user accounts through registration, raise accounts in the community, and resell some accounts with different sales values ​​to downstream for targeted harvesting or complete tasks according to the downstream customers, etc. For example, a big V account is cultivated to call itself a "teacher", "expert", or "stock god", and various small accounts are used to complete tasks (bulk likes for targeted posts, comments to pin posts to increase exposure, batch follow target users, etc.), to enhance the image and promote its stocks in the stock bar, and deceive the trust of ordinary stockholders to achieve the purpose of attracting traffic and illegal stock recommendations.

[0199] The present invention is based on the community interaction relationship graph, uses the Lockinfer algorithm to detect and discover risk groups of Lockstep behavior and improves the personalized PageRank algorithm to obtain the fraud propagation score of user nodes in the interaction relationship network for user role determination.

[0200] Step S4.2 specifically includes the following steps:

[0201] Step S4.2.1 Detect risk groups of fraudulent activity through the Lockinfer algorithm

[0202] Define s as the source node user, then S is the source node user set, t is the target node user, then T is the target node user set. According to different scenarios, the source node user s and the target node user t are specifically defined as follows:

[0203] 1. Like: s is the user who liked the post, and t is the user whose post was liked;

[0204] Brushing behavior: the act of posting likes in batches;

[0205] 2. Comments: s is the user who commented on the post, and t is the user whose post was commented on;

[0206] Brushing behavior: the act of posting comments in batches;

[0207] 3. Reposting: s is the user who forwards the post, and t is the user whose post is forwarded;

[0208] Brushing behavior: the behavior of forwarding in batches;

[0209] 4. Follow-up: s is the user who follows and subscribes, and t is the user who is followed and subscribed;

[0210] Brushing behavior: the behavior of following in batches.

[0211] The black industry uses the accounts it controls to increase the exposure of a stock bar post by liking, replying, and forwarding in batches, or cheating by increasing the number of fans for a user. This behavior is called Lockstep volume-boosting behavior. Therefore, the Lockinfer algorithm is introduced to detect it. This algorithm has been appropriately changed according to the actual business scenario requirements, such as the strategy for selecting seed nodes and deleting the logic of propagation that is not related to degree during the propagation process, judging that in the current scenario, propagation is related to degree.

[0212] In actual cheating scenarios, users who cheat will use various cheating strategies to bypass risk control in order to evade detection, such as:

[0213] Note 1. Zombie fans (S) controlled by black market gangs will not all follow / reply / ... / like the users (T) who assign traffic-increasing tasks; they will follow / reply / ... / like some normal users and big V users to disguise themselves.

[0214] Note 2: There may be a collaborative model between different black market groups, such as the target user (T) assigning the task of brushing volume to multiple black market groups (S).

[0215] Note 3. In addition to zombie fans, the fans of the target user (T) also include some normal users attracted through fan-sucking methods.

[0216] Currently, the Lockinfer algorithm can be used to detect groups that engage in Lockstep volume-boosting behavior in stock bar interactions. The specific algorithm process is as follows:

[0217] Step S4.2.1.1 selects a seed node set consisting of seed nodes with suspected Lockstep behavior.

[0218] The Lockinfer algorithm supports random selection of seed nodes, but selecting appropriate seed nodes can speed up the detection process. Therefore, the selection is made based on the strategy for selecting seed nodes, which includes the following:

[0219] Select one of the following strategies for selecting seed nodes:

[0220] Strategy 1: Select user nodes with corresponding user risk profile labels and business review results defined and screened by business experts as seed nodes, and then form a seed node set;

[0221] Strategy 2: According to the algorithm for selecting seeds, it includes the following steps:

[0222] Step S4.2.1.1.1 performs singular value decomposition on the interaction relationship graph, calculates the left singular vector U and the right singular vector V of the adjacency matrix A based on the K-SVD algorithm, and uses the left singular vectors U to draw the spectrum subspace in pairs:

[0223] For each pair (i, j), 1≤i<j≤k, k is the number of iterations of K-SVD, plot the left singular vector U i VsU j The spectrum subspace, U i is the left singular vector obtained in the i-th iteration, U j is the left singular vector obtained at the j-th iteration.

[0224]

[0225] Step S4.2.1.1.2: Use Hough transform to transform the spectrum subspace from Cartesian coordinate system to polar coordinate system, that is, for each user node u in the spectrum subspace x , x≤N, N is the total number of user nodes, and the following formula (3) is obtained:

[0226]

[0227] In formula (3), the Cartesian coordinates (U i,x ,U j,x ) is converted into polar coordinates (r x ,θ x ), r is the polar coordinate radius, and θ is the polar coordinate angle.

[0228] Step S4.2.1.1.3 draws the r frequency and θ frequency distribution histogram of the node, and the following formula (4) is obtained:

[0229]

[0230] In formula (4), freq(r) is the r frequency of the node, freq(θ) is the θ frequency of the node;

[0231] Step S4.2.1.1.3 uses the median filter algorithm to detect the peak of the histogram obtained in the previous step, and uses the node set corresponding to the peak as the seed node set;

[0232] Step S4.2.1.1.4 further filters the seed nodes in the seed node set based on business experience to obtain the final seed node set.

[0233] Step S4.2.1.2 performs Lockstep propagation: Based on the seed node set selected in the previous step, the Lockstep value is propagated in the community interaction relationship graph to detect user nodes with Lockstep behavior. The specific algorithm propagation process is as follows:

[0234] Step S4.2.1.2.1 Initialization:

[0235] 1. Define the seed nodes in the seed node set as the Lockstep volume-boosting users in round 0;

[0236] 2. The source node set S and the target node set T form an m×n matrix (S, T), m≤M, n≤N, and the size of the adjacency matrix A of the community interaction relationship graph is M×N;

[0237] 3. The smallest Lockstep abnormally dense block size m min ×n min And the corresponding density threshold The density threshold It is expressed as the following formula (5):

[0238]

[0239] In formula (5), D = d(A) represents the density of the adjacency matrix A. When , the matrix (S, T)(S, T) is considered to be the first Lockstep abnormally dense block in the adjacency matrix A;

[0240] 4. Define the time-decayed weight adjacency matrix W = (w i,j ), then:

[0241]

[0242] Where γ represents the decay constant, and its value represents the decay rate of historical information, which requires considering limited historical information; h is the time after node i and node j are connected, and h = 0 represents the current relationship.

[0243] Step S4.2.1.2.2 Propagate Lockstep from the source node user set S to the target node user set T

[0244] S->T: Take the source node user of Lockstep brushing user as the seed node, count the number of source node users with Lockstep brushing behavior associated with each target node user (e.g. how many source node users with Lockstep brushing behavior follow the target node user), if the ratio exceeds the threshold And the scale is greater than n min , then it is marked as the target node user with Lockstep brushing behavior, that is,

[0245] Step S4.2.1.2.3 Propagate LockStep from the target node user set T to the source node user set S

[0246] T->S: Count the number of target node users with Lockstep volume-boosting behavior associated with each source node user (e.g., how many target node users with Lockstep volume-boosting behavior the source node user follows). If the ratio exceeds the threshold And the scale is greater than m min , then it is marked as a source node user with Lockstep brushing behavior, that is,

[0247] Step S4.2.1.2.4 repeats steps S4.2.1.2.2 and S4.2.1.2.3 until convergence.

[0248] The following table illustrates the results obtained through the above steps:

[0249] Fields Field Description Gang ID Specific gang ID User ID ID of the user entity node LockStep Tag Mark LockStep Follower / Followee details LockStep Value Lockstep value obtained in graph propagation Update time Calculate the update time

[0250] Step S4.2.2 Obtaining the Fraud Propagation Score by Improving the Personalized PageRank Algorithm

[0251] The PageRank algorithm is a technology that calculates the importance of web pages by the number and quality of connections between web pages. In anti-fraud scenarios, it can be compared to the number and quality of connections between members of a black market gang, and used to analyze the importance of black market members, thereby further analyzing the roles of members in the gang.

[0252] The present invention introduces the concept of improved personalized PageRank. This type of algorithm is proposed for fraud detection against corporate tax evasion, but it is not used to detect interactive risk groups in interactive relationships and for in-depth analysis of their interactive risk intentions, to judge the importance and influence of users in the group; and to further explore and define the roles of risk users in the group.

[0253] The network structure of the community interaction relationship graph is mainly divided into two types: single entity graph and bipartite graph, such as Figure 2 Example of a legend in :

[0254] [User-User] is a single entity graph, and the corresponding relationship is: follow.

[0255] [User-Post-User] is a bipartite graph with two different entities, user and post; users are indirectly connected through posts.

[0256] Step S4.2.2 further comprises the following steps:

[0257] Step S4.2.2.1 obtains a bipartite graph G = (ν, ε) containing two types of nodes: e(v1, v2)∈ε|v1∈ν1and v2∈ν2, where ν represents an entity node, ν1ν2 represent two types of nodes in the bipartite graph, one type is the user account entity node, and the other type is the post entity node corresponding to the user post; ε represents an edge, and e(v1, v2) represents the edge corresponding to the two types of nodes ν1ν2 in the bipartite graph;

[0258] In the present invention, there are two types of nodes in the bipartite graph, one type is the user account ID, and the other type is the post ID corresponding to the user's post.

[0259] Step S4.2.2.2 calculates the scores of all nodes in the bipartite graph using the PageRank algorithm. The iterative propagation process is represented by the following formula (6):

[0260]

[0261] vector and The size is i+j, vector Indicates the PageRank score corresponding to the node. For the relationship between users and posts, is the probability of being selected during the restarted random walk for users and posts.

[0262] The traditional PageRank algorithm iterative propagation process is represented by A represents an n×m adjacency matrix. In the formula (7) of the present invention, the column-normalized symmetric matrix Q norm Replace the adjacency matrix A, the symmetric matrix Q norm Obtained by the following steps:

[0263] Define the time-decayed weight adjacency matrix W n×m =(w i,j ), there may be a situation where the black industry gang adopts a collaborative mode and conducts frequent operations in a certain period of history. After the time decays completely, the frequent activities in some historical intervals will be lost. Therefore, the time decay weight adjacency matrix W n×m =(w i,j) is defined as the following formula (8):

[0264]

[0265] In formula (8), μ is the weighting constant, d is the density of frequent operations in the time interval;

[0266] Each time you re-walk, you choose to start from a node in a specific set of nodes, then:

[0267]

[0268] The time-decayed weight adjacency matrix W i,j Expanded into a (i+j)×(i+j) symmetric matrix Q:

[0269]

[0270] In formula (9), W' i×j W i,j Transpose a matrix;

[0271] After column normalization of the symmetric matrix Q, the symmetric matrix Q is obtained norm , then the iterative propagation process is transformed into formula (7).

[0272] The final score can be interpreted as the importance of the user node in the group, that is, influence. The higher the value, the more important the user node is in the group.

[0273] Step S4 can be summarized as:

[0274] After the general relationship graph is built, the community is divided by improving the Louvain algorithm model to find groups that meet the business agreed group size. Then, the overall group risk is defined according to the risk labels corresponding to the user nodes, and abstracted into group indicators to further track the user groups.

[0275] After the interactive relationship graph is constructed, the Lockinfer algorithm model is used to find the fraudulent groups for targeted risk analysis and mining. Risk labels are then added to users with fraudulent risks, and the overall risk groups are output.

[0276] After the interactive relationship graph is constructed, the PageRank score is obtained by improving the personalized PageRank algorithm model to identify the degree of risk propagation to judge the importance of members in risk propagation, that is, risk influence, and then further define the role of users in the group, such as; gang leader, gang backbone, gang member, etc.

[0277] A possible example is shown in the following table:

[0278]

[0279]

[0280] Based on the above results, groups are merged and pruned to characterize group risk profiles, support the business system to further process business policies, and import the result data into the Neo4j graph database for storage, which facilitates business queries and visual monitoring of group evolution.

[0281] The present invention provides an interactive risk group identification method based on a stock community relationship map, which specifically relates to a group discovery technology in the field of anti-fraud risk control in stock communities. Compared with the prior art, the present invention has the following advantages:

[0282] (1) Transform the relationships obtained from data collection from relatively simple entity relationships to support the analysis and mining of fraud risks exposed by the complex interactive relationship network of stockholders in the stock community.

[0283] (2) When building a graph, we distinguish between general relationships and interactive relationships, and observe the general groups formed by users and terminals and the interactive groups formed by community communication and interaction relationships. We also use different algorithms to conduct targeted analysis and mining based on the differences in the graph structure composed of entity nodes.

[0284] (3) Do not rely on original algorithms provided by graph algorithm libraries such as Neo4j. Targeted algorithm improvements are made according to business scenarios to balance stability and timeliness, and the calculation of some items is optimized to adapt to the business model output.

[0285] (4) By using algorithms and defining relevant indicators, we can effectively solve the problems of group analysis and identification of different risk behaviors and intentions in the current scenario, as well as the identification of users in the group who play risky roles, and realize differentiated decision-making processing in the business system.

Claims

1. A method for identifying interactive risk groups based on a stock community relationship graph, characterized in that: The following steps are involved: S1 collects server log data and client log data of specific behavior tracking points, and pre-processes the collected data to obtain input data for building a relationship graph; S2 extracts information based on the data obtained in the previous step, including the extraction of entities, the extraction of entity relationships, and the extraction of attributes, where: The extraction of entities includes extracting user entities, device terminal entities, post entities and stock entities; According to the associations among users, post entities, stocks and device terminals, the relationships among user entities, device terminal entities, post entities and stock entities are extracted, and the entity relationships are divided into community interaction behavior relationships and non-community interaction behavior relationships. Among them, the relationships among user entities, the relationships between user entities and post entities, and the relationships between user entities and stock entities are community interaction behavior relationships; the relationships between user entities and device terminal entities, and the relationships between post entities and stock entities are non-community interaction behavior relationships; The extraction of attributes includes the extraction of attributes of entities and the extraction of attributes of entity relationships. The attributes include indicator data directly extracted from the input data obtained in step S1, and also include labels obtained by combining the indicator data. S3 builds a relationship graph model Based on the massive data of entities, entity attributes, relationships between entities, and attributes of relationships between entities extracted in step S2, two types of relationship graph models are constructed: one is a general relationship graph constructed based on non-community interaction behavior relationships to identify risky groups and define the size of general groups; the other is a community interaction relationship graph constructed based on community interaction behavior relationships to identify groups with the risk of fake volume in the interaction and to judge the influence of users in the group, thereby marking the role of users in the group for mining; S4 risk identification, including the following steps S4.1 Based on the universal relationship graph, the Louvain algorithm is used to divide the universal community to obtain the universal community division result, thereby realizing the identification of universal gangs; The Louvain algorithm is divided into two parts: real-time online and offline. The offline processing specifically includes the following steps: S4A.1.1 Initialize offline data, and each node in the general relationship graph is regarded as an independent community; S4A.1.2 Pre-prune the general relationship graph based on prior business knowledge to effectively reduce the amount of data used for graph calculations and the amount of computation generated; S4A.1.3 For each node i, assign node i to the community where each of its neighboring nodes is located in turn, calculate the modularity increment ΔQ before and after the assignment, record the neighboring node with the largest ΔQ, and the largest ΔQ>0; then assign node i to the community where the neighboring node with the largest ΔQ is located, otherwise give up this division; The modularity Q is calculated as follows: In formula (1), A i,j represents the weight of the edge between node i and node j, and the calculation formula is shown in the following formula (2): In formula (2), Case 1 means that the indicator data based on the attributes of the edge needs to reflect the absolute difference in value, and case 2 means that the indicator data based on the attributes of the edge needs to reflect the relative difference in direction; δ′ is a custom parameter; In formula (1), k i =∑A i,j , represents the sum of the weights of all edges connected to node i; k j represents the sum of the weights of all edges connected to node j; represents the sum of the weights of all edges; c i represents the community to which vertex i belongs, c j represents the community to which vertex j belongs; S4A.1.4 repeats step S4A.1.3 until the communities corresponding to all nodes no longer change; S4A.1.5 compresses the universal relationship graph, compresses all nodes in the same community into a new node, converts the edge weights between nodes in the community into the ring weights of the new node, and converts the edge weights between communities into the edge weights between new nodes; S4A.1.6 Repeat step 4A.1.1 until the modularity of the entire universal relationship graph no longer changes; S4A.1.7 Filtering, merging, and pruning; When processing in real time, the processing of the newly added node i in real time includes the following steps: S4B.1.1 For the newly added node i, randomly assign the newly added node i to the community where one of its neighboring nodes is located, and calculate the modularity increment ΔQ before and after the assignment, where the modularity Q is calculated according to formula (1); Step S4B.1.2: If the ΔQ calculated in the previous step is not greater than the threshold, randomly select another neighbor node and return to step S4B.1.1; otherwise, assign the newly added node i to the community where the current neighbor node is located and end the division; S4.2 Identify fraud groups and user roles based on community interaction relationship graphs The Lockstep behavior risk group detection and improvement of the personalized PageRank algorithm are performed through the Lockinfer algorithm to obtain the fraud propagation score of the user nodes in the interactive relationship network for user role determination, which specifically includes the following steps: Step S4.2.1 Detect risk groups of fraudulent activity through the Lockinfer algorithm Define s as the source node user, then S is the source node user set, t is the target node user, then T is the target node user set, then step S4.2.1 specifically includes the following steps: Step S4.2.1.1 selects a seed node set consisting of seed nodes with suspected Lockstep behavior based on a seed selection algorithm, wherein the seed selection algorithm specifically includes the following steps: Step S4.2.1.1.1 performs singular value decomposition on the interaction relationship graph, calculates the left singular vector U and the right singular vector V of the adjacency matrix A based on the K-SVD algorithm, and uses the left singular vectors U to draw the spectrum subspace in pairs: For each pair (i, j), where 1 ≤ i < j ≤ k and k is the number of iterations of K-SVD, plot the spectral subspace of the left singular vectors U i vs U j , where U i is the left singular vector obtained in the i-th iteration and U j is the left singular vector obtained in the j-th iteration, and look for anomalies where "Rays", "Staircase", and "Pearls" appear in the following table: Step S4.2.1.1.2: Use Hough transform to transform the spectrum subspace from Cartesian coordinate system to polar coordinate system, that is, for each user node u in the spectrum subspace x , x≤X, X is the total number of user nodes, and the following formula (3) is obtained: In formula (3), the Cartesian coordinates (U i,x ,U j,x ) into polar coordinates (r x ,θ x ), r x is user node u x The polar radius, θ x is user node u x The polar coordinate angle of Step S4.2.1.1.3 draws the r frequency and θ frequency distribution histogram of the node, and the following formula (4) is obtained: In formula (4), freq(r) is the r frequency of the node, freq(θ) is the θ frequency of the node; Step S4.2.1.1.3 detects the peak of the histogram obtained in the previous step, and uses the node set corresponding to the peak as the seed node set; Step S4.2.1.1.4 further filters the seed nodes in the seed node set based on business experience to obtain a final seed node set; Step S4.2.1.2 performs Lockstep propagation: Based on the seed node set selected in the previous step, the Lockstep value is propagated in the community interaction relationship graph to detect user nodes with Lockstep behavior. The specific algorithm propagation process is as follows: Step S4.2.1.2.1 Initialization: Define the seed nodes in the seed node set as the Lockstep volume-boosting users in round 0; The source node set S and the target node set T form an m×n matrix (S, T), m≤M, n≤N, and the size of the adjacency matrix A of the community interaction relationship graph is M×N; The minimum Lockstep abnormal dense block size m min ×n min And the corresponding density threshold The density threshold It is expressed as the following formula (5): In formula (5), D = d(A) represents the density of the adjacency matrix A. When , the matrix (S, T) is considered to be the first Lockstep abnormally dense block in the adjacency matrix A; Define the time-decayed weight adjacency matrix W1 = (w 1 i,j ), then: In the formula, γ represents the decay constant, and its value represents the rate at which historical information decays, and limited historical information needs to be considered; h is the time after node i and node j are connected, and h = 0 represents the current relationship; Step S4.2.1.2.2 propagates Lockstep from the source node user set S to the target node user set T; S->T: Take the source node user of Lockstep volume-boosting user as the seed node, and count the number of source node users with Lockstep volume-boosting behavior associated with each target node user. If the ratio exceeds the threshold, And the scale is greater than n min , then it is marked as the target node user with Lockstep brushing behavior, that is, Step S4.2.1.2.3 propagates LockStep from the target node user set T to the source node user set S; T->S: Count the number of target node users with Lockstep volume-boosting behavior associated with each source node user, that is, how many target node users with Lockstep volume-boosting behavior the source node user follows. If the ratio exceeds the threshold And the scale is greater than m min , then it is marked as a source node user with Lockstep brushing behavior, that is, Step S4.2.1.2.4 repeats steps S4.2.1.2.2 and S4.2.1.2.3 until convergence; Step S4.2.2 obtains the fraud propagation score by improving the personalized PageRank algorithm, including the following steps: Step S4.2.2.1 obtains a bipartite graph G = (ν, ε) containing two types of nodes of the community interaction relationship graph: e(v1, v2)∈ε|v1∈ν1and v2∈ν2, where ν is an entity node, ν1ν2 represent two types of nodes of the bipartite graph, one is the user account entity node, and the other is the post entity node corresponding to the user post; ε represents an edge, and e(v1, v2) represents the edge corresponding to the two types of nodes ν1ν2 of the bipartite graph; Step S4.2.2.2 calculates the scores of all nodes in the bipartite graph using the PageRank algorithm: Define the time-decayed weight adjacency matrix W 2 n×m =(w 2 i,j ) is shown in the following formula (7): In formula (7), μ is the weighting constant, d is the density of frequent operations in the time interval; The PageRank algorithm chooses to start from a node in a specific set of nodes each time it re-walks, so: The time-decayed weight adjacency matrix W 2 i,j Expanded into a (i+j)×(i+j) symmetric matrix Q: In formula (8), W' i×j W i,j Transpose a matrix; After column normalization of the symmetric matrix Q, the symmetric matrix Q is obtained norm , then the iterative propagation process is transformed into formula (9): In formula (9), the vector and The size is i+j, vector Indicates the PageRank score corresponding to the node. For the relationship between users and posts, is the probability of users and posts being selected when restarting the random walk; The final score can be interpreted as the importance of the user node in the group, that is, influence. The higher the value, the more important the user node is in the group.

2. The interactive risk group identification method based on the stock community relationship map according to claim 1 is characterized in that: In step S1, the collected data include: API server logs including user account registration and login, which are used to obtain the relationship between the user account and the terminal device; server logs of user account interaction operations in the online community; post review background log data, including the review and disposal mark for the user and the disposal mark for the post.

3. The interactive risk group identification method based on the stock community relationship map according to claim 1 is characterized in that: In step S2, the user entity is a user account ID, the device terminal entity is a device terminal ID, the post entity is a post ID, and the stock entity is a stock code.

4. The interactive risk group identification method based on the stock community relationship map according to claim 1 is characterized in that: In step S2, the tags in the attributes of the user entity include user risk profile tags. According to the behavior and intention, the user risk profile tags are divided into account security risk tags and account business behavior risk tags; Then, in step S4.2.1.1, in addition to selecting the seed algorithm, user nodes with corresponding user risk profile labels and business audit results defined and screened by business experts are selected as seed nodes to form a seed node set.

5. The interactive risk group identification method based on the stock community relationship map according to claim 1 is characterized in that: In step S3, when constructing the relationship graph, the indicator data in the edge attributes are used as filtering conditions, and according to the rule model designed by the business experts, the edges whose corresponding indicator data in the edge attributes meet the mapping standards are selected for construction.

Images