Gang behavior identification and devices, storage media and electronic devices

Abstract

The present disclosure relates to the computer field, and specifically to a group behavior identification method and device, a computer-readable storage medium, and an electronic device. The method includes: obtaining user data of multiple users; determining the behavior similarity of multiple users based on the behavior information, and screening out target users that meet the screening criteria based on the behavior similarity; clustering the target users to obtain clusters, using the users in the clusters as nodes, building edges between users, using the behavior similarity and strong correlation media between users as edges to determine a first topology network and a second topology network, and then determining a third topology network based on the first topology network and the second topology network and performing community division, where users in the community are the same group. Through the technical solution of the embodiments of the present disclosure, users of a group can be more accurately determined.

Description

Background Art

[0002] In today's society, the use of the Internet is becoming more and more extensive. At the same time, the frequency of gang behavior is also increasing, and gang behavior usually has similar behavior sequences. For example, fraud gang behavior refers to a series of identical operations by a batch of users to conduct fraudulent transactions, while the probability of normal users performing this series of actions is low.

[0003] Therefore, how to extract the above-mentioned group users from a large number of users is a key issue. In the relevant community division technology, by calculating the similarity of behavior sequences, users with similar behavior sequences are placed in the same category, and users in this category are considered to be users of the same group.

[0004] However, the existing community division technology only uses the behavioral similarity between nodes to determine group users, and takes into account the behavioral similarity of all behaviors. The accuracy of group users obtained by the existing method needs to be improved.

[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0006] The purpose of the present disclosure is to provide a group behavior identification method and a group behavior identification device, a computer-readable storage medium and an electronic device, which can screen out users whose behavior similarity meets the standards, while considering the influence of behavior similarity and strong correlation media, so as to make the group users divided more accurate.

[0007] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0008] According to a first aspect of the present disclosure, a group behavior identification method is provided, comprising: obtaining user data of multiple users, wherein the user data of each user includes behavior information corresponding to the user; determining the behavior similarity of the multiple users based on the behavior information, and screening out target users that meet the screening criteria based on the behavior similarity; clustering the target users to obtain clusters, using users in the same cluster as nodes, building edges between users in the same cluster, and determining a first topological network using the behavior similarity between the users as the first weight of the edge; using users in the cluster as nodes, building edges between users in the same cluster, and determining a second topological network using a strongly correlated medium as the second weight of the edge; combining the first topological network with the second topological network, determining a third weight of the edge between users in a third topological network based on the first weight of the edge and the second weight of the edge, and determining a third topological network based on the third weight of the edge; performing community division on the third topological network to obtain subcommunities, and determining the users in each subcommunity as the same group.

[0009] In an exemplary embodiment of the present disclosure, based on the aforementioned scheme, the method further includes: obtaining an initial user set, the initial user set including multiple users; screening out multiple users that meet preset screening conditions from the initial user set, and obtaining user data corresponding to the users; wherein the preset screening conditions include whether the user has potential risks.

[0010] In an exemplary embodiment of the present disclosure, based on the above-mentioned scheme, weight information corresponding to the behavior information is obtained; and the behavior similarity between the users is determined according to the weight information.

[0011] In an exemplary embodiment of the present disclosure, based on the above-mentioned scheme, the behavior information is sorted according to a preset order to obtain a behavior sequence; and the behavior similarity between the users is determined according to the behavior sequence.

[0012] In an exemplary embodiment of the present disclosure, based on the above-mentioned scheme, a clustering network is constructed with the correlation between the target users as edges; a connected subgraph detection is performed on the clustering network to obtain at least one connected subgraph; and each connected subgraph is clustered to obtain a cluster.

[0013] In an exemplary embodiment of the present disclosure, based on the aforementioned scheme, the behavioral similarity between multiple target users in each of the connected subgraphs is obtained; the inter-class distance between the target users is determined according to the behavioral similarity; when the inter-class distance meets the clustering criteria, the target users are clustered to obtain clusters.

[0014] In an exemplary embodiment of the present disclosure, based on the above scheme, target users meeting the clustering criteria are clustered; when the average value of the behavioral similarity between the users is greater than a preset threshold, the target user clustering is stopped to obtain a cluster of the target users;

[0015] In an exemplary embodiment of the present disclosure, the strongly correlated medium has a plurality of them, and based on the above scheme, a strongly correlated medium weight corresponding to the strongly correlated medium is obtained; the second weight of the edge is determined according to the strongly correlated medium weight, wherein the strongly correlated medium weight corresponds to the second weight of the edge one by one; and a second topological network is determined according to the second weight of the edge;

[0016] In an exemplary embodiment of the present disclosure, based on the aforementioned scheme, the first weight of the edge and the second weight of the edge are compared to obtain the maximum value of the first weight of the edge and the second weight of the edge; the maximum value is used as the third weight of the edge between users in the third topology network.

[0017] In an exemplary embodiment of the present disclosure, based on the aforementioned scheme, the first weight of the edge and the second weight of the edge are calculated to obtain the average of the first weight of the edge and the second weight of the edge; and the average is used as the third weight of the edge between users in the third topology network.

[0018] In an exemplary embodiment of the present disclosure, based on the above-mentioned scheme, the third topological network is obtained, and each node in the third topological network is divided into a user community; wherein the user community has a modularity index; the nodes are traversed, and the nodes with the maximum increment of the modularity index corresponding to the user community where its adjacent nodes are located after accepting the node are selected, and the nodes are divided into the user community to obtain subcommunities; when the nodes in the user community are not divided into communities, the traversal is stopped; each of the subcommunities obtained by the division is compressed into a community node; the community nodes are restored, and the users corresponding to the nodes in the same subcommunity are determined to be the same group.

[0019] According to a second aspect of the present disclosure, a group behavior identification device is provided, comprising: a user data acquisition module, used to acquire user data of multiple users, wherein the user data of each user includes behavior information corresponding to the user; a target user screening module, used to determine the behavior similarity of the multiple users according to the behavior information, and screen out target users that meet the screening criteria according to the behavior similarity; a first topology network construction module, used to cluster the target users to obtain clusters, using users in the same cluster as nodes, building edges between users in the same cluster, and using the behavior similarity between the users as the first weight of the edge to determine A first topological network; a second topological network construction module, used to use users in the cluster as nodes, build edges between users in the same cluster, and determine the second topological network with a strong correlation medium as the second weight of the edge; a third topological network construction module, used to combine the first topological network with the second topological network, determine the third weight of the edge between users in the third topological network according to the first weight of the edge and the second weight of the edge, and determine the third topological network with the third weight of the edge; a community division module, used to divide the third topological network into communities to obtain sub-communities, and determine the users in each sub-community as the same group.

[0020] According to a third aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the method for identifying gang behavior as described in the first aspect of the above embodiment is implemented.

[0021] According to a fourth aspect of the present disclosure, there is provided an electronic device, including:

[0022] Processor; and

[0023] A storage device is used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the gang behavior identification method as described in the first aspect of the above embodiment.

[0024] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects:

[0025] In a group behavior identification method provided in an embodiment of the present disclosure, after obtaining user data, the behavior similarity between users is determined, and users meeting the screening criteria are screened based on the behavior similarity, and the users are clustered. A network is constructed with behavior similarity and strong correlation media, and the network is divided into communities. The users in the same group are determined based on the results of the division.

[0026] On the one hand, users whose behavioral similarity meets the standards can be screened out, and behavioral similarities with low reference can be filtered out, reducing the amount of calculation in the clustering process, improving calculation efficiency, and making the screened behavioral similarities more in line with the application scenario; on the other hand, constructing a topological network can simultaneously consider the impact of behavioral similarity and strongly correlated media, so that community division has multi-dimensional reference standards, thereby making the accuracy of gang identification higher.

[0027] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present disclosure, and together with the specification, are used to explain the principles of the present disclosure. Obviously, the drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0029] Figure 1 A schematic diagram schematically shows an exemplary system architecture of a gang behavior identification method to which the embodiments of the present disclosure can be applied;

[0030] Figure 2 A flowchart schematically illustrates a method for identifying gang behavior in an exemplary embodiment of the present disclosure;

[0031] Figure 3 A flowchart for screening users in an exemplary embodiment of the present disclosure is schematically shown;

[0032] Figure 4 A flowchart schematically illustrates a method of determining user behavior similarity based on the weight of behavior information in an exemplary embodiment of the present disclosure;

[0033] Figure 5 Schematically showing a flow chart of determining user behavior similarity based on behavior sequence in an exemplary embodiment of the present disclosure;

[0034] Figure 6 Schematically showing a flow chart of connecting subgraphs and performing clustering in an exemplary embodiment of the present disclosure;

[0035] Figure 7 A flowchart of clustering connected subgraphs according to clustering criteria in an exemplary embodiment of the present disclosure is schematically shown;

[0036] Figure 8 A flowchart of stopping clustering of connected subgraphs in an exemplary embodiment of the present disclosure is schematically shown;

[0037] Fig. 9 Schematically showing a flow chart of determining a second topology network according to weights of strongly correlated media in an exemplary embodiment of the present disclosure;

[0038] Fig.10 A flowchart schematically illustrates a method of determining a third weight of an edge according to a maximum value of a first weight of the edge and a second weight of the edge in an exemplary embodiment of the present disclosure;

[0039] Fig.11 A flowchart schematically illustrates a method of using an average value of a first weight of an edge and a second weight of an edge as a third weight of an edge in an exemplary embodiment of the present disclosure;

[0040] Fig.12 Schematically showing a flow chart of traversing nodes and compressing and dividing communities in a third topology network in an exemplary embodiment of the present disclosure;

[0041] Fig.13 A schematic diagram schematically shows the composition of a gang behavior identification device in an exemplary embodiment of the present disclosure;

[0042] Fig.14 The structure diagram of a computer system suitable for implementing the electronic device of the exemplary embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0043] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concept of the example embodiments will be fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In addition, the described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known structures, methods, devices, implementations, materials, or operations are not shown or described in detail to avoid blurring various aspects of the present disclosure.

[0044] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or these functional entities or parts of functional entities may be implemented in one or more software hardened modules, or these functional entities may be implemented in different networks and / or processor devices and / or microcontroller devices.

[0045] Figure 1 A schematic diagram showing an exemplary system architecture to which the gang behavior identification method according to an embodiment of the present disclosure can be applied.

[0046] like Figure 1 As shown, the system architecture 1000 may include one or more of terminal devices 1001, 1002, 1003, a network 1004, and a server 1005. The network 1004 is used to provide a medium for communication links between the terminal devices 1001, 1002, 1003 and the server 1005. The network 1004 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0047] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. According to the implementation requirements, there may be any number of terminal devices, networks and servers. For example, the server 1005 may be a server cluster composed of multiple servers.

[0048] Users can use terminal devices 1001, 1002, 1003 to interact with server 1005 through network 1004 to receive or send messages, etc. Terminal devices 1001, 1002, 1003 can be various electronic devices with display screens, including but not limited to smart phones, tablet computers, portable computers, desktop computers, etc. In addition, server 1005 can be a server that provides various services.

[0049] In one embodiment, the execution subject of the group behavior identification method of the present disclosure may be an embodiment of the server 1005, and the server 1005 may obtain user data sent by the terminal devices 1001, 1002, and 1003, and process the user data according to the group behavior identification method of the present disclosure, and then return the processed user data to the terminal devices 1001, 1002, and 1003. In addition, the group behavior identification method of the present disclosure may also be executed by the terminal devices 1001, 1002, 1003, etc., to realize the process of obtaining the same group user according to the user data.

[0050] In addition, the implementation process of the gang behavior identification method disclosed in the present invention can also be implemented by the terminal devices 1001, 1002, 1003 and the server 1005. For example, the terminal devices 1001, 1002, 1003 and the server 1005 can be implemented together.

[0051] 1002 and 1003 can obtain user data, determine the behavioral similarity of users, screen out users that meet the standards, and then send the obtained users to server 1005 so that server 1005 can cluster the above users, build a topological network with behavioral similarity and strong correlation media, and divide the topological network into communities to obtain users in the same group.

[0052] The scheme for identifying gang behavior in the present disclosure can be applied to various scenarios in the Internet environment where it is necessary to obtain users of the same type from a large database. For example, in online fraud transactions, users in the same fraud group are obtained; for another example, when it is necessary to analyze the preferences of a certain type of users, users in the same preference group are obtained; for another example, when doing customer-oriented mining, users in the same online community are obtained. The present disclosure does not specifically limit the application scenarios.

[0053] According to the group behavior identification method provided in this exemplary embodiment, when user data is obtained, the behavior similarity between users is determined, and target users are screened based on the behavior similarity, and these users are clustered, and a topological network is constructed based on the behavior similarity and the strong correlation medium topological network, and the topological network is divided into communities, and the users in the same group are determined based on the results of the community division. Figure 2 As shown, the gang behavior identification method may include the following steps:

[0054] S210, obtaining user data of multiple users, where the user data of each user includes behavior information corresponding to the user;

[0055] S220, determining the behavior similarity of the multiple users according to the behavior information, and screening out target users that meet the screening criteria according to the behavior similarity;

[0056] S230, clustering the target users to obtain clusters, using users in the same cluster as nodes, building edges between users in the same cluster, and determining a first topological network using behavioral similarity between users as a first weight of the edge;

[0057] S240, using users in the cluster as nodes, building edges between users in the same cluster, and using strongly correlated media as second weights of the edges to determine a second topological network;

[0058] S250, combining the first topology network and the second topology network, determining a third weight of an edge between users in a third topology network according to the first weight and the second weight, and determining the third topology network according to the third weight;

[0059] S260: Divide the third topology network into communities to obtain sub-communities, and determine users in each sub-community as the same group.

[0060] In the gang behavior identification method provided in this example implementation, on the one hand, after obtaining user data, the behavioral similarity between users can be determined, and then users who meet the screening criteria are screened out based on the user's behavioral similarity, and behavioral similarities with low reference value are filtered out; on the other hand, the screened users are clustered to obtain clusters, and a topological network is constructed based on the clusters, while considering the influence of behavioral similarity and strongly correlated media, so that the accuracy of gang identification is higher.

[0061] Next, steps S210 to S260 of the gang behavior identification method in this exemplary embodiment will be described in more detail with reference to the accompanying drawings and embodiments.

[0062] Step S210, obtaining user data of multiple users, where the user data of each user includes behavior information corresponding to the user.

[0063] In an exemplary embodiment of the present disclosure, a user has a window that is connected to an Internet environment. Further, the user may include a terminal user, and the terminal user may include a software operator, that is, a person who uses certain software or applications; the user may have a user account, and the user may authenticate the identity of the user to the system service through the account, and the user account carries the storage address of the user data. For example, the users of the present disclosure may include a certain concentrated group, such as buyer and seller accounts used in trading websites, social accounts in communication communities, transaction accounts of Internet financial software, service accounts of life service software, etc. The present disclosure does not specifically limit the type of users, and the solution of the present disclosure can be applied when it is necessary to identify group users among these users.

[0064] In an exemplary embodiment of the present disclosure, a user may have multiple types of user data. User data may include various data generated by the user when performing Internet activities. User data is the form and carrier of information and may include symbols, text, numbers, voice, images, videos, etc. Data and information are inseparable. Data is the expression of information, and information is the connotation of data. Data itself has no meaning. Data becomes information only when it affects the behavior of an entity.

[0065] In an exemplary embodiment of the present disclosure, user data may include behavior information corresponding to the user, and the behavior information may include behavior logs generated when the user conducts Internet activities, or system logs generated when a user performs system maintenance, or a collection of corresponding relationships between a specific action of the user in Internet activities and the time when the action occurs. For example, user data corresponding to a user on a transaction website may include payment, adding to favorites, adding to a shopping cart, browsing a product page, changing a password, logging in from a different location, etc.

[0066] In an exemplary embodiment of the present disclosure, when a large number of users need to be group identified, user data corresponding to the above-mentioned multiple users are first obtained. The user data can be stored in the above-mentioned terminal devices 1001, 1002, 1003 or in the server 1005. When obtaining the user data corresponding to the user, it can be directly obtained in the terminal device, or the user data corresponding to the user in the terminal device can be uploaded to the server and then obtained from the server. The present disclosure does not specifically limit the storage location or storage method of the user data, as long as the user data can be obtained and processed.

[0067] In an exemplary embodiment of the present disclosure, before obtaining the user data of multiple users, the multiple users may be screened first. Figure 3 As shown, screening users may include the following steps S310 to S320:

[0068] Step S310: obtaining an initial user set, where the initial user set includes multiple users.

[0069] In an exemplary embodiment of the present disclosure, the initial user set may include different types of sets. For example, all users stored in commercial activities on certain trading websites, or all users in a certain area, or all users who purchase a specific product. Before implementing the solution of the present disclosure, a specific initial user set may be obtained, and these user sets may include multiple users.

[0070] Step S320, screening out multiple users that meet preset screening conditions from the initial user set, and acquiring user data corresponding to the users; wherein the preset screening conditions include whether the user has potential risks.

[0071] In an example embodiment of the present disclosure, the preset screening condition may include whether the user is a potential risk. When screening users, policy screening may be used. For example, in a scenario where payment occurs, users who are easily attacked by fraud gangs include accounts with low security factors. At this time, the preset screening condition may be set to detect that an account with a password of less than 8 digits is an account with potential risk, an account with a password consisting of only a single form (such as numbers, letters, symbols, etc.) may be set as an account with potential risk, an account that is not bound to a mobile phone may be set as an account with potential risk, an account that has not been logged in for a long time (such as 3 months), and an account with low user information integrity (less than 50%) may be set as an account with potential risk; in addition, model screening may be used to establish a risk supervision model based on user historical data, and then determine whether the user is a potential risk based on the risk supervision model. For example, a risk supervision model may be established based on the user's historical stolen transaction records, and then the information of a certain transaction may be input into the risk supervision model. The risk supervision model determines whether a certain transaction has a potential risk based on the historical stolen transaction records. If a certain transaction has a potential risk, it indicates that the user of the transaction has a potential risk. In different scenarios, the preset screening conditions need to be adjusted according to the needs of group identification. The present disclosure does not specifically limit the specific types of potential risks in the preset screening conditions, as long as multiple users identified in this group can be screened out from the user set.

[0072] In an exemplary embodiment of the present disclosure, when filtering users in a user set, each user in the user set can be traversed, and the user data of each user can be compared with the preset filtering conditions. When the comparison result is yes, the user is determined to be a user that meets the filtering conditions. When the comparison result is no, the user is filtered.

[0073] In an embodiment of the present disclosure, according to steps S310 to S320, before obtaining user data of multiple users, a user set may be obtained first, and users meeting the preset screening conditions may be selected according to the preset screening conditions. According to the embodiment of the present disclosure, the complexity of the calculation may be effectively reduced, and the amount of user data to be processed in subsequent steps may also be reduced.

[0074] Furthermore, since building a network based on behavioral similarity requires comparing the behavioral similarities between users and the computational complexity is O(n 2 ), n is the total number of users. When the user data in the user set is reduced to 1 / k of the original, k is a constant, the complexity is:

[0075]

[0076] That is, by filtering the users in the user set through the solution in this embodiment, the number of users is reduced, thereby reducing the complexity O(n 2 ), thereby improving the efficiency of gang identification.

[0077] Step S220, determining the behavior similarity of multiple users according to the behavior information, and screening out target users that meet the screening criteria according to the behavior similarity.

[0078] In one embodiment of the present disclosure, after obtaining multiple user data, the user's behavioral similarity can be determined based on the behavioral information in the user data. The user data of each user may include multiple types of behavioral information. When comparing the behavioral similarity between users, the behavioral information between multiple users can be compared, and the behavioral similarity can be determined based on the occurrence of the behavioral information. Specifically, the behavioral similarity is an indicator of the degree of similarity of the behavioral information between users. For example, user A's data includes abcd behavioral information, and user B's data includes abc behavioral information. The behavioral information in user A's data is compared with that in user B's data, and it is determined that the behavioral similarity between user A and user B is 75%.

[0079] Specifically, the scheme of the present disclosure defines a user as U, i as a user to be compared, j as another user, and the time when the behavior information occurs is T, and the behavior type is C. The scheme of the present disclosure considers that different users who perform the same behavior C at a certain time interval T_sep have the same behavior information in the time interval. At this time, the expression of the behavior similarity between users is as follows:

[0080] i , T i , C i >≈ j , T j , C j >ifC i =C j andT i -T j |≤T sep

[0081] The value of the T_sep interval can be set according to the average time interval of a specific business scenario. For example, in an online payment website, the time interval T_sep between payment behavior information of two users can be set to two hours, that is, if two users make a payment within two hours, it can be considered that the two users have made the same behavior information within the time interval T_sep.

[0082] In one embodiment of the present disclosure, the corresponding weight of the user's behavior information can be considered to determine the behavior similarity between users, referring to Figure 4 ​​As shown, determining the behavior similarity based on the weight of the user behavior information may include the following steps S410 to S420:

[0083] Step S410: Obtain weight information corresponding to the behavior information.

[0084] In one embodiment of the present disclosure, since different behavior information corresponds to different business meanings, different weight information can be pre-set for different behavior information, and a behavior information-weight correspondence table can be pre-set. When obtaining the weight information corresponding to the behavior information, the weight information corresponding to the behavior information can be obtained in the behavior information-weight correspondence table. For some high-frequency behavior information, the weight information corresponding to these behavior information can be set relatively low. For example, in an online shopping environment, browsing the product page belongs to high-frequency behavior information, but this behavior information is universal, so the behavior information of browsing the product page can be excluded from the behavior similarity consideration range (weight is zero), or the weight of the behavior information of browsing the product page can be set to a lower weight information (such as 30%); for some low-frequency behavior information, the weight information corresponding to these behavior information can be set relatively high. For example, in an online shopping environment, modifying account passwords, changing bound mobile phone numbers, logging in from a different location, etc. belong to low-frequency behavior information. These low-frequency behavior information may be actions taken by a gang to manipulate other people's accounts, so low-frequency behavior information such as modifying account passwords, changing bound mobile phone numbers, and logging in from a different location can be set to a higher weight information (such as 80%).

[0085] Step S420: Determine the behavior similarity between users according to the weight information.

[0086] In one embodiment of the present disclosure, after obtaining the weight information corresponding to the behavior information, the weights of the two users can be set for a certain behavior information, and the user is defined as U, i is a user to be compared, j is another user, the time of occurrence of the behavior information is T, the behavior type is C, and k is a constant. The weight corresponding to the behavior information is expressed as λ k ,λ k Hyperparameters can be included and adjusted according to business scenarios. Suppose the expression of user behavior information set A is as follows:

[0087] A={<U,T,C> |U=U i}

[0088] Set user specific behavior information collection The expression is as follows:

[0089]

[0090] At this time, considering the time interval, the behavior similarity SimA(U i , U j ) is as follows:

[0091]

[0092] In one embodiment of the present disclosure, according to steps S410 to S420, after the weight information corresponding to the behavior information is obtained, the behavior similarity between users can be determined based on the weight information. Different weights can be selected according to business needs to determine the behavior similarity between users. This can make the determined behavior similarity more in line with the application scenario. The weight information corresponding to different behavior information can also be adjusted according to the business scenario, thereby making the accuracy of gang identification higher.

[0093] In one embodiment of the present disclosure, when determining the behavior similarity between users, the influence of the behavior sequence of the behavior information on the behavior similarity may also be considered. Figure 5 As shown, determining behavior similarity based on the behavior sequence of user behavior information may include the following steps S510 to S520:

[0094] Step S510: sorting the behavior information according to a preset order to obtain a behavior sequence.

[0095] In one embodiment of the present disclosure, the user's behavior information can be sorted in a preset order. The preset order can include sorting in the order of the time when the behavior information occurs, sorting in a time order from front to back, or sorting in a time order from back to front. Further, the obtained user's behavior information is used to determine the behavior sequence in a preset order. The present disclosure does not specifically limit the sorting method of the preset order, as long as the user's behavior information can be arranged in a certain order.

[0096] Step S520: determining the behavior similarity between users according to the behavior sequence.

[0097] In one embodiment of the present disclosure, in different application scenarios, the order of behavior will also affect the user's behavior similarity, and there are users from different groups with the same behavior sequence. For example, in an online transaction scenario, the usual order of behavior information is: search for product name, browse product brief information, browse product page information, select product specifications, place an order, pay, and confirm the order. For users from abnormal groups, the order in which their behavior information occurs may change. For example, the order in which the behavior information of users in an abnormal group occurs is: browse product brief information, browse product page information, select product specifications, place an order, pay, and confirm the order. At this point, the abnormal user can be determined based on the order in which the user's behavior information occurs.

[0098] Specifically, after obtaining the behavior sequence sorted according to the preset order, the behavior similarity of users can be determined by the behavior sequence between users. The user is defined as U, i is a user to be compared, j is another user, and the time when the behavior information occurs is T, the behavior type is C, and the behavior sequence is R. At this time, the expression of the behavior similarity between users determined by the behavior sequence determined in time order considering the time interval is as follows:

[0099] i , T i , C i , R i >≈ j , T j , C j , R j >ifC i =C j andR i =R j and|T i -T j |≤T sep

[0100] In one embodiment of the present disclosure, according to steps S510 to S520, when the behavior information is sorted in chronological order to obtain a behavior sequence, the behavior similarity between users can be determined based on the behavior sequence, which can make the determined behavior similarity more in line with the application scenario, thereby making the accuracy of gang identification higher.

[0101] In one embodiment of the present disclosure, the behavior similarity between users can be determined based on the weight information and behavior sequence of the user's behavior information while considering the time interval. The user is defined as U, i is a user to be compared, j is another user, the time of occurrence of the behavior information is T, the behavior type is C, the behavior sequence is R, and k is a constant. At this time, the expression of the user behavior information set B is as follows:

[0102] B={<U,T,C,R> |U=U i}

[0103] Set user specific behavior information collection The expression is as follows:

[0104]

[0105] At this time, considering the time interval, the behavior similarity SimB(U i , U j ​​) is as follows, where γ is a hyperparameter that can be adjusted according to the actual application scenario:

[0106]

[0107] In one embodiment of the present disclosure, the time interval, weight information, and behavior sequence of the user's behavior information can be considered simultaneously to determine the user's behavior similarity, so that the behavior similarity is more in line with the application scenario, thereby making the accuracy of gang identification higher.

[0108] In one embodiment of the present disclosure, after determining the behavioral similarity between users, the target users can be screened according to the screening criteria, and the screening criteria may include a preset threshold or a preset range, etc. For example, the preset threshold can be set to 60%, and the behavioral similarity between the multiple users determined in the above steps is screened with 60% as the threshold, and users with behavioral similarity greater than 60% are screened as target users; for another example, the preset range can be set to 60% to 80%, and the behavioral similarity between the multiple users determined in the above steps is screened with 60% to 80% as the screening range, and users with behavioral similarity of 60% to 80% are screened as target users. Screening the behavioral similarity between the multiple users determined in the above steps can make the behavioral similarity more in line with the application scenario, thereby making the accuracy of gang identification higher.

[0109] Step S230, clustering the target users to obtain clusters, using users in the same cluster as nodes, building edges between users in the same cluster, and determining a first topological network using behavioral similarity between users as a first weight of the edge.

[0110] In one embodiment of the present disclosure, the target users can be taken as a class and the target users obtained in the above steps can be clustered, that is, the target users of the same class are clustered to obtain a cluster, which includes multiple target users, and the target users have the behavioral similarities obtained in the above steps.

[0111] In one embodiment of the present disclosure, a first topological network can be constructed based on clusters, with users in the clusters as nodes of the first topological network. When users have similarities, it is determined that there is a correlation between the users, and edges are constructed based on the correlation between users. The behavioral similarity determined in the above steps is used as the first weight of the edge, and the first weight of the edge can be determined based on the numerical value of the behavioral similarity. It can be set that when the numerical value of the behavioral similarity is larger, the first weight of the edge is higher, or when the numerical value of the behavioral similarity is larger, the first weight of the edge is lower. For example, when the behavioral similarity between two users is 65%, the first weight of the edge between the two users is determined to be 0.65.

[0112] In one embodiment of the present disclosure, a connected subgraph detection can be performed on the clustering network constructed by the target user, and each connected subgraph can be clustered to obtain a cluster. Figure 6 As shown, clustering the connected subgraphs of the target user to obtain clusters may include the following steps S610 to S620:

[0113] Step S610: construct a clustering network with the correlation between target users as edges.

[0114] In one embodiment of the present disclosure, when the target users obtained in the above steps have behavioral similarities between the target users, it is determined that there is a correlation between the target users. At this time, a clustering network can be constructed with these users with the correlation as nodes and the connections between these target users as edges. The clustering network may include multiple target users. The target users in the same clustering network include the results of preliminary clustering. Both nodes connected by an edge in the clustering network have behavioral similarities.

[0115] Step S620: Perform connected subgraph detection on the clustering network to obtain at least one connected subgraph.

[0116] In one embodiment of the present disclosure, after the cluster network is obtained, a connected subgraph detection can be performed on the cluster network. All nodes in the cluster network are traversed. During the traversal process, some or all edges in the cluster network are traversed, and the vertices and the traversed edges are connected to construct a subgraph. At this time, the constructed subgraph is a connected subgraph. Some nodes in the cluster network are not connected together, so after the connected subgraph detection is performed on the cluster network, at least one connected subgraph will be obtained.

[0117] Step S630: clustering each connected subgraph to obtain a cluster.

[0118] In one embodiment of the present disclosure, after each connected subgraph is obtained, the connected subgraphs can be clustered, and each connected subgraph can be clustered as a class. When the target users in each connected subgraph have behavioral similarities, there is a correlation between these target users. At this time, each connected subgraph is clustered to obtain a cluster.

[0119] In one embodiment of the present disclosure, according to steps S610 to S620, by constructing a clustering network based on the correlation between target users and performing connected subgraph detection on the clustering network, the clustering network can be divided into multiple connected subgraphs, and multiple connected subgraphs can be clustered in parallel. Through the solution of this embodiment, the speed of target user clustering can be improved, making the target user clustering more efficient.

[0120] In one embodiment of the present disclosure, when clustering the connected subgraphs, the target users may be clustered according to the clustering criteria to obtain clusters. Figure 7 As shown, clustering the connected subgraphs of the target user according to the clustering criteria may include the following steps S710 to S730:

[0121] Step S710: Obtaining the behavior similarity between multiple target users in each connected subgraph.

[0122] In one embodiment of the present disclosure, after obtaining at least one connected subgraph, multiple target users in each connected subgraph can be obtained. When there is behavioral similarity between the target users in each connected subgraph, it is determined that there is a correlation between these target users, and the behavioral similarity between multiple users with the correlation is obtained.

[0123] Step S720: Determine the inter-class distance between target users according to the behavior similarity.

[0124] In one embodiment of the present disclosure, when the behavior similarity between multiple users with a correlation is obtained, the behavior similarity between the multiple users with a correlation can be used as the inter-class distance between the multiple users with a correlation. For example, when the behavior similarity between two users with a correlation is 65%, the inter-class distance between the two users with a correlation is determined to be 0.65.

[0125] Step S730: When the inter-class distance meets the clustering standard, the target users are clustered to obtain clusters.

[0126] In one embodiment of the present disclosure, when clustering multiple target users with correlation, the target users can be clustered according to the clustering criteria, and two users with the greatest behavioral similarity can be clustered. Specifically, there are multiple target users with correlation in the connected subgraph, and when the behavioral similarity between the multiple target users with correlation is obtained, the target users with the greatest behavioral similarity are clustered, that is, the target users with the largest inter-class distance are clustered.

[0127] In an embodiment of the present disclosure, according to steps S610 to S620, the target users in the connected subgraph may be clustered according to a clustering standard to achieve a better clustering effect.

[0128] In an embodiment of the present disclosure, when clustering target users according to the clustering criteria, clustering can be stopped according to a preset threshold value, thereby determining a cluster. Figure 8 As shown, clustering the connected subgraphs of the target user according to the preset may include the following steps S810 to S830:

[0129] Step S810: clustering target users that meet the clustering criteria.

[0130] In an embodiment of the present disclosure, when clustering multiple target users with related relationships, the target users may be clustered according to a clustering criterion, and the clustering criterion may include clustering two users with the greatest behavioral similarity.

[0131] Step S820: When the average value of the behavior similarities between users is greater than a preset threshold, the target user clustering is stopped to obtain a target user cluster.

[0132] In one embodiment of the present disclosure, multiple target users with related relationships are clustered according to a clustering standard. At this time, multiple target users may be included in the same class, and multiple target users may have different behavioral similarities. A preset threshold can be set. When the average value of the possible behavioral similarities between multiple target users is greater than the preset threshold, the clustering between the target users is stopped. At this time, a cluster of target users of a class is obtained. For example, the preset threshold can be set to 65%. When the average value of the behavioral similarities between multiple target users in the same class is greater than 65%, the clustering between the target users is stopped, and multiple clusters are obtained by clustering the current user.

[0133] In an embodiment of the present disclosure, through steps S810 to S830, the target users are clustered according to the clustering criteria, and clustering can be stopped according to a preset threshold, thereby determining a cluster. Through the solution of this embodiment, the behavior similarity of users in each cluster in the cluster can be dynamically controlled, so that the cluster is more in line with the application scenario.

[0134] Step S240: using users in the cluster as nodes, constructing edges between users in the same cluster, and using strongly correlated media as second weights of the edges to determine a second topological network.

[0135] In one embodiment of the present disclosure, when users on the Internet conduct Internet activities, there will be strongly correlated media at the same time, that is, when conducting Internet activities, users usually indirectly complete a certain function through multiple media. For example, in the online payment scenario, devices will be used, and the devices may include terminal devices 1001, 1002, 1003, and may also include other devices that can complete online payment; for another example, in the online payment scenario, user IP will be applied, and the server can obtain user IP through the device to complete functions such as user verification; for another example, the delivery address will be applied in the online payment scenario, and the delivery location information of this purchase can be determined based on the delivery address.

[0136] In one embodiment of the present disclosure, after obtaining a cluster, it is possible to determine whether multiple users have a correlation relationship based on whether the users in the cluster include the same strong correlation medium. If multiple users include the same strong correlation medium, it is considered that there is a correlation relationship between these users; if multiple users do not include the same strong correlation medium, it is considered that there is no correlation between these users. Users with correlation relationships are used as nodes, and edges are constructed using the connections between users with correlation relationships. Then, the second weight of the edge is set according to the strong correlation medium, and the second topological network is determined according to the second weights of the nodes and edges.

[0137] In one embodiment of the present disclosure, the weight of the edge can be set according to the weight corresponding to the strongly correlated medium. Fig. 9 As shown, the weight of the strongly correlated medium determines the second topology network may include the following steps S910 to S930:

[0138] Step S910: Obtain the strong correlation medium weight corresponding to the strong correlation medium.

[0139] In one embodiment of the present disclosure, a variety of strongly correlated media will be applied in Internet activities. For different application scenarios, the strongly correlated media weights corresponding to the strongly correlated media can be set in advance. For example, in an online payment scenario, the strongly correlated media may include devices, IP, payment bank cards, delivery addresses, mobile phone numbers, etc., and different weights may be set for each strongly correlated medium. For example, the strongly correlated media weight of the device may be set to 0.10, the strongly correlated media weight of the IP may be set to 0.20, the strongly correlated media weight of the payment bank card may be set to 0.05, the strongly correlated media weight of the delivery address may be set to 0.08, the strongly correlated media weight of the mobile phone number may be set to 0.30, etc. The present disclosure does not make any special restrictions on the weights set for the strongly correlated media, and only needs to be reasonably adjusted according to the actual application scenario.

[0140] Step S920: Determine the second weight of the edge according to the strong correlation medium weight, wherein the strong correlation medium weight corresponds to the second weight of the edge one by one.

[0141] In one embodiment of the present disclosure, the strong correlation medium weight corresponding to the strong correlation medium is obtained in the above steps, and the second weight of the edge can be determined based on the one-to-one correspondence between the strong correlation medium weight corresponding to the strong correlation medium and the second weight of the edge. For example, the second weight of the edge can be set to be the same as the strong correlation medium weight. Assume that in an online payment scenario, the strong correlation medium weight of the device is set to 0.10, and the second weight of the edge corresponding to the device is also set to 0.10. The present disclosure does not impose specific restrictions on the correspondence between the strong correlation medium weight and the second weight of the edge, as long as the second weight of the edge can be obtained according to the strong correlation medium weight.

[0142] Step S930: determining a second topological network according to the second weights of the edges.

[0143] In one embodiment of the present disclosure, when multiple users include the same strongly correlated medium, there is a correlation between these users, the users with the correlation are used as nodes, and edges are constructed with the connections between the users with the correlation. Then, the second weight of the edge is determined based on the strongly correlated medium and the second weight of the edge, so as to determine the second topological network based on the nodes and the edges between multiple users.

[0144] In one embodiment of the present disclosure, through steps S910 to S930, the second topological network can be determined according to the correspondence between the weight of the strongly correlated medium and the second weight of the edge, so that the second topological network can take into account the impact of the weight of the strongly correlated medium, making the second topological network more suitable for the application scenario.

[0145] Step S250: combining the first topology network and the second topology network, determining a third weight of the edge between users in the third topology network according to the first weight and the second weight, and determining the third topology network with the third weight.

[0146] In one embodiment of the present disclosure, after determining a first topological network based on behavioral similarity between users and determining a second topological network based on a strong correlation medium between users, the first topological network can be combined with the second topological network. A cluster includes multiple users, and the users have behavioral similarity or a strong correlation medium, or both behavioral similarity and a strong correlation medium. The users have a first weight of an edge based on the weight of behavioral similarity, and the users have a second weight of an edge based on the weight of a strong correlation medium. The first weight of the edge is combined with the second weight of the edge to obtain a third weight of the edge. The users in the topological network are nodes, the edges are constructed with the connections between the users, and the third topological network is determined with the third weight of the edge.

[0147] In one embodiment of the present disclosure, when the first weight of the edge is combined with the second weight of the edge to obtain the third weight of the edge, the maximum value of the first weight of the edge and the second weight of the edge can be used as the third weight of the edge. Fig.10 As shown, determining the third weight of the edge according to the maximum value of the first weight of the edge and the second weight of the edge may include the following steps S1010 to S1020:

[0148] Step 1010: Compare the first weight of the edge and the second weight of the edge to obtain the maximum value of the first weight of the edge and the second weight of the edge.

[0149] Step 1020: Using the maximum value as the third weight of the edge between users in the third topology network.

[0150] In one embodiment of the present disclosure, the maximum value of the first weight of the edge and the second weight of the edge determined in the above steps is determined as the third weight of the edge. For example, the first weight of the edge is 0.65, and the second weight of the edge is 0.68. At this time, the first weight of the edge 0.65 and the second weight of the edge 0.68 are compared, and the maximum value 0.68 of the first weight of the edge 0.65 and the second weight of the edge 0.68 is taken as the third weight of the edge, that is, the third weight of the edge is 0.68 at this time.

[0151] In one embodiment of the present disclosure, through steps S1010 to S1020, the third weight of the edge is determined according to the maximum value of the first weight of the edge and the second weight of the edge, and the third weight of the edge can be adjusted according to the application scenario so that the third weight of the edge is more in line with the business scenario.

[0152] In one embodiment of the present disclosure, when the first weight of the edge is combined with the second weight of the edge to obtain the third weight of the edge, the average value of the first weight of the edge and the second weight of the edge can be used as the third weight of the edge. Fig.11 As shown, taking the average of the first weight of the edge and the second weight of the edge as the third weight of the edge may include the following steps S1010 to S1020:

[0153] Step 1010: Compare the first weight of the edge and the second weight of the edge to obtain an average value of the first weight of the edge and the second weight of the edge.

[0154] In an embodiment of the present disclosure, after obtaining the first weight of the edge and the second weight of the edge, the first weight of the edge and the second weight of the edge may be compared to determine an average value of the first weight of the edge and the second weight of the edge.

[0155] Step 1020: Using the average value as the third weight of the edge between users in the third topology network.

[0156] In one embodiment of the present disclosure, the average value of the first weight of the edge and the second weight of the edge determined in the above steps is determined as the third weight of the edge. For example, the first weight of the edge is 0.66, and the second weight of the edge is 0.68. At this time, the first weight of the edge 0.66 and the second weight of the edge 0.68 are compared, and the average value of the first weight of the edge 0.66 and the second weight of the edge 0.68 is taken as the third weight of the edge, that is, the third weight of the edge is 0.67.

[0157] In one embodiment of the present disclosure, through steps S1110 to S1120, the third weight of the edge is determined according to the first weight of the edge and the average of the second weight of the edge, and the third weight of the edge can be adjusted according to the application scenario so that the third weight of the edge is more in line with the business scenario.

[0158] Step S260: Divide the third topology network into communities to obtain sub-communities, and determine users in each sub-community as the same group.

[0159] In one embodiment of the present disclosure, after obtaining the third topological network, the third topological network may be divided into communities to obtain sub-communities. Specifically, a KL algorithm, a spectral flattening algorithm, a random walk algorithm, a faction filtering algorithm, etc. may be used. After the third topological network is divided into communities to obtain sub-communities, the users included in each sub-community have the same behavioral similarity and strong correlation medium, and at this time, these users may be considered to be users of the same group.

[0160] In an embodiment of the present disclosure, the third topology network may be traversed through nodes, then divided into sub-communities, and then compressed into sub-communities, so as to achieve the purpose of community division. Fig.12 As shown, traversing nodes and compressing the third topology network to perform community division may include the following steps S1210 to S1250:

[0161] Step S1210: Acquire a third topology network, and classify each node in the third topology network as a user community.

[0162] In one embodiment of the present disclosure, the third topology network includes multiple users, and the users have behavioral similarities and strong correlation media. The users are set as nodes, and each node is a user community, that is, the users in the third topology network are divided into user communities.

[0163] Step S1220: traverse the nodes, select the node with the maximum increment of the corresponding modularity index after the user community where its adjacent node is located accepts the node, and divide the node into the user community to obtain a subcommunity.

[0164] In one embodiment of the present disclosure, all nodes in the third topology network can be traversed, and the traversed nodes are compared with their adjacent nodes. When the increment of the corresponding modularity index after the adjacent nodes are divided together with the currently traversed nodes is the maximum value, the currently traversed node is divided into user communities corresponding to the adjacent nodes to obtain multiple sub-communities, wherein the modularity index is a commonly used method for measuring the strength of the network community structure.

[0165] Step S1230: when the nodes in the user community are not divided into communities, stop traversing;

[0166] In one embodiment of the present disclosure, when all nodes in the third topology network are traversed and there is no maximum value of the increment of the modularity index corresponding to the adjacent nodes divided together with the currently traversed node, the node traversal is stopped.

[0167] Step S1240: compressing each subcommunity obtained by division into a community node;

[0168] In one embodiment of the present disclosure, the subcommunities obtained in the above steps are obtained, and the subcommunities are compressed. The subcommunities include edge weights, the subcommunities include multiple nodes, and the nodes include edge weights. The edge weights between the nodes in the subcommunities are converted into the weights of the rings of the new nodes, and the edge weights between the communities are converted into the edge weights between the new nodes, thereby completing the process of subcommunity compression.

[0169] Step S1250: restore the community nodes, and determine the users corresponding to the nodes in the same sub-community as the same group.

[0170] In an embodiment of the present disclosure, the compressed new node can be restored, and users in the same sub-community are users in the same group.

[0171] In an embodiment of the present disclosure, through step S1210 to step S1250, the nodes of the third topology network may be traversed, and then sub-communities may be divided, and then the sub-communities may be compressed to achieve the purpose of community division.

[0172] In one embodiment of the present disclosure, after obtaining the user data of multiple users through steps S210 to S260, the behavioral similarity between the multiple users is determined, and the target users that meet the screening criteria are determined based on the behavioral similarity between the users, and the target users are clustered to obtain clusters, and the first topological network is determined by the clusters, and the second topological network is determined by the strongly correlated medium, and then the third topological network is determined based on the first topological network and the second topological network, and the third topological network is divided into communities to obtain sub-communities, and the users in each sub-community obtained at this time are the same group. Through the scheme of the present disclosure, on the one hand, users whose behavioral similarity meets the standards can be screened out, and behavioral similarities with low reference can be filtered out; on the other hand, a topological network is constructed, and the influence of behavioral similarity and strongly correlated media is considered at the same time, so that the accuracy of group identification is higher.

[0173] It should be noted that the above figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present disclosure, and are not intended to be limiting. It is easy to understand that the processes shown in the above figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0174] In addition, in an exemplary embodiment of the present disclosure, a gang behavior identification device is also provided. Fig.13As shown, a gang behavior identification device 1300 includes: a user data acquisition module 1310, a target user screening module 1320, a first topology network construction module 1330, a second topology network construction module 1340, a third topology network construction module 1350 and a community division module 1360.

[0175] Among them, the user data acquisition module 1310 is used to obtain user data of multiple users, and the user data of each user includes the behavior information corresponding to the user; the target user screening module 1320 is used to determine the behavior similarity of multiple users based on the behavior information, and screen out target users that meet the screening criteria based on the behavior similarity; the first topology network construction module 1330 is used to cluster the target users to obtain clusters, use the users in the clusters as nodes, build edges between users, and use the behavior similarity between users as the first weight of the edge to determine the first topology network; the second topology network construction module 1340 is used to use the users in the clusters as nodes, build edges between users, and use the strongly correlated medium as the second weight of the edge to determine the second topology network; the third topology network construction module 1350 is used to combine the first topology network and the second topology network, determine the third weight of the edge between users in the third topology network based on the first weight of the edge and the second weight of the edge, and determine the third topology network based on the third weight of the edge; the community division module 1360 is used to divide the third topology network into communities to obtain sub-communities, and the users in each sub-community are the same group.

[0176] In an exemplary embodiment of the present disclosure, based on the aforementioned scheme, before obtaining user data of multiple users, the method also includes: obtaining an initial user set, the initial user set including multiple users; screening out multiple users that meet preset screening conditions from the initial user set, the users including user data; wherein the preset screening conditions include whether the user has potential risks.

[0177] In an exemplary embodiment of the present disclosure, based on the above-mentioned scheme, weight information corresponding to the behavior information is obtained; and the behavior similarity between users is determined according to the weight information.

[0178] In an exemplary embodiment of the present disclosure, based on the above-mentioned scheme, the behavior information is sorted according to a preset order to obtain a behavior sequence; and the behavior similarity between users is determined according to the behavior sequence.

[0179] In an exemplary embodiment of the present disclosure, based on the above-mentioned scheme, a clustering network is constructed with the correlation between target users as edges; a connected subgraph detection is performed on the clustering network to obtain at least one connected subgraph; and each connected subgraph is clustered to obtain a cluster.

[0180] In an exemplary embodiment of the present disclosure, based on the above-mentioned scheme, the behavioral similarity between multiple target users in each connected subgraph is obtained; the inter-class distance between the target users is determined according to the behavioral similarity; when the inter-class distance meets the clustering criterion, the target users are clustered to obtain clusters.

[0181] In an exemplary embodiment of the present disclosure, based on the above scheme, target users that meet the clustering criteria are clustered; when the average value of the behavioral similarity between users is greater than a preset threshold, the target user clustering is stopped to obtain a cluster of the target users.

[0182] In an exemplary embodiment of the present disclosure, based on the aforementioned scheme, a strong correlation medium weight corresponding to the strong correlation medium is obtained; the second weight of the edge is determined according to the strong correlation medium weight, wherein the strong correlation medium weight corresponds one-to-one to the second weight of the edge; and the second topological network is determined according to the second weight of the edge.

[0183] In an exemplary embodiment of the present disclosure, based on the above scheme, the first weight of the edge and the second weight of the edge are compared to obtain the maximum value of the first weight of the edge and the second weight of the edge; the maximum value is used as the third weight of the edge between users in the third topology network.

[0184] In an exemplary embodiment of the present disclosure, based on the above scheme, the first weight of the edge and the second weight of the edge are calculated to obtain the average of the first weight of the edge and the second weight of the edge; the average is used as the third weight of the edge between users in the third topology network.

[0185] In an exemplary embodiment of the present disclosure, based on the above-mentioned scheme, a third topological network is obtained, and each node in the third topological network is divided into a user community; wherein the user community has a modularity index; the nodes are traversed, and the node with the maximum increment of the corresponding modularity index after the user community where its adjacent node is located accepts the node is selected, and the node is divided into the user community to obtain a subcommunity; when the node in the user community is not divided into a community, the traversal is stopped; each subcommunity obtained by the division is compressed into a community node; the community nodes are restored, and the users corresponding to the nodes in the same subcommunity are determined to be the same group.

[0186] Since the various functional modules of the gang behavior identification device of the example embodiment of the present disclosure correspond to the steps of the example embodiment of the gang behavior identification method described above, for details not disclosed in the embodiment of the device of the present disclosure, please refer to the embodiment of the gang behavior identification method described above in the present disclosure.

[0187] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0188] In addition, in an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above-mentioned gang behavior identification method is also provided.

[0189] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware embodiments, complete software embodiments (including firmware, microcode, etc.), or embodiments combining hardware and software aspects, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0190] Refer to the following Fig.14 1400 according to this embodiment of the present disclosure is described. Fig.14 The electronic device 1400 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0191] like Fig.14 As shown, the electronic device 1400 is in the form of a general computing device. The components of the electronic device 1400 may include, but are not limited to: the at least one processing unit 1410, the at least one storage unit 1420, a bus 1430 connecting different system components (including the storage unit 1420 and the processing unit 1410), and a display unit 1440.

[0192] The storage unit stores program codes, which can be executed by the processing unit 1410, so that the processing unit 1410 performs the steps according to various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification. For example, the processing unit 1410 can perform the following steps: Figure 2In step S210 shown in the figure, user data of multiple users are obtained, and the user data of each user includes behavior information corresponding to the user; in step S220, the behavior similarity of the multiple users is determined based on the behavior information, and the target users that meet the screening criteria are screened out based on the behavior similarity; in step S230, the target users are clustered to obtain clusters, and the users in the clusters are used as nodes, edges are constructed between the users, and the first topological network is determined based on the behavior similarity between the users as the first weight of the edge; in step S240, the users in the clusters are used as nodes, edges are constructed between the users, and the second topological network is determined based on the strong correlation medium as the second weight of the edge; in step S250, the first topological network and the second topological network are combined, and the third weight of the edge between the users in the third topological network is determined based on the first weight and the second weight, and the third topological network is determined based on the third weight; in step S260, the third topological network is divided into communities to obtain sub-communities, and the users in each sub-community are in the same group.

[0193] For example, electronic devices can achieve Figure 2 The steps shown.

[0194] The storage unit 1420 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 1421 and / or a cache storage unit 1422 , and may further include a read-only storage unit (ROM) 1423 .

[0195] The storage unit 1420 may also include a program / utility 1424 having a set (at least one) of program modules 1425, such program modules 1425 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0196] Bus 1430 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0197] The electronic device 1400 may also communicate with one or more external devices 1470 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 1400, and / or communicate with any device that enables the electronic device 1400 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1450. Furthermore, the electronic device 1400 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 1460. As shown, the network adapter 1460 communicates with other modules of the electronic device 1400 via a bus 1430. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 1400, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0198] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiment of the present disclosure.

[0199] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible embodiments, various aspects of the present disclosure can also be implemented in the form of a program product, which includes a program code. When the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of the present disclosure described in the above "Exemplary Method" section of the present specification.

[0200] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0201] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0202] Program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0203] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present disclosure, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0204] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The specification and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

Claims

1. A gang behavior identification method, characterized in that: The method comprises: Acquire user data of multiple users, where the user data of each user includes behavior information corresponding to the user; Determining the behavioral similarity of the multiple users according to the behavioral information, and screening out target users that meet the screening criteria according to the behavioral similarity; Clustering the target users to obtain clusters, using users in the same cluster as nodes, building edges between users in the same cluster, and using the behavior similarity between the users as a first weight of the edge to determine a first topological network; Using users in the cluster as nodes, building edges between users in the same cluster, and using a strong correlation medium as a second weight of the edge to determine a second topological network; wherein the strong correlation medium is used to indicate that there is a correlation between users in the cluster; Combining the first topology network with the second topology network, determining a third weight of an edge between users in a third topology network according to the first weight of the edge and the second weight of the edge, and determining a third topology network according to the third weight of the edge; The third topology network is divided into communities to obtain sub-communities, and the users in each sub-community are determined to be in the same group.

2. The method according to claim 1, characterized in that Before obtaining the user data of the plurality of users, the method further includes: Acquire an initial user set, where the initial user set includes multiple users; Filtering out a plurality of users meeting a preset filtering condition from the initial user set, and acquiring user data corresponding to the users; The preset screening condition includes whether the user has potential risks.

3. The method according to claim 1, characterized in that The determining the behavior similarity of the multiple users according to the behavior information includes: Obtaining weight information corresponding to the behavior information; The behavior similarity between the users is determined according to the weight information.

4. The method according to claim 1, characterized in that The determining the behavior similarity of the multiple users according to the behavior information includes: Sorting the behavior information according to a preset order to obtain a behavior sequence; The behavior similarity between the users is determined according to the behavior sequence.

5. The method according to claim 1, characterized in that The step of clustering the target users to obtain clusters includes: Building a clustering network with the correlation between the target users as edges; Performing connected subgraph detection on the clustering network to obtain at least one connected subgraph; Each of the connected subgraphs is clustered to obtain a cluster.

6. The method according to claim 5, characterized in that The step of clustering the connected subgraphs to obtain clusters includes: Obtaining behavior similarities between multiple target users in each of the connected subgraphs; Determining the inter-class distance between target users based on the behavioral similarity; When the inter-class distance meets the clustering standard, the target users are clustered to obtain clusters.

7. The method according to claim 6, characterized in that When the inter-class distance meets the clustering standard, clustering the target users to obtain clusters includes: Cluster the target users that meet the clustering criteria; When the average value of the behavior similarities between the users is greater than a preset threshold, the target user clustering is stopped to obtain a target user cluster.

8. The method according to claim 1, characterized in that The strongly correlated medium has a plurality of media, and the second topological network is determined by using the strongly correlated medium as the second weight of the edge, including: Obtain the strong correlation medium weight corresponding to the strong correlation medium; Determining the second weight of the edge according to the strong correlation medium weight, wherein the strong correlation medium weight corresponds to the second weight of the edge one by one; A second topological network is determined according to the second weights of the edges.

9. The method according to claim 1, characterized in that: Determining a third weight of an edge between users in a third topology network according to the first weight and the second weight includes: Comparing the first weight of the edge with the second weight of the edge to obtain a maximum value between the first weight of the edge and the second weight of the edge; The maximum value is used as the third weight of the edge between users in the third topology network.

10. The method according to claim 1, characterized in that Determining a third weight of an edge between users in a third topology network according to the first weight and the second weight includes: Calculating the first weight of the edge and the second weight of the edge to obtain an average value of the first weight of the edge and the second weight of the edge; The average value is used as the third weight of the edge between users in the third topology network.

11. The method according to claim 1, characterized in that: The community division of the third topology network to obtain sub-communities, wherein the users in each sub-community are in the same group, includes: Acquire the third topological network, and classify each node in the third topological network as a user community; wherein the user community has a modularity index; Traversing the nodes, selecting the node with the maximum increment of the modularity index corresponding to the user community where the adjacent node is located after accepting the node, and dividing the node into the user community to obtain a subcommunity; When the nodes in the user community are not divided into communities, stop traversing; Compressing each of the subcommunities obtained by the division into a community node; The community nodes are restored, and users corresponding to the nodes in the same sub-community are determined to be in the same group.

12. A gang behavior identification device, characterized in that: The device comprises: A user data acquisition module, used to acquire user data of multiple users, wherein the user data of each user includes behavior information corresponding to the user; A target user screening module, used to determine the behavior similarity of the multiple users according to the behavior information, and screen out target users that meet the screening criteria according to the behavior similarity; A first topology network construction module is used to cluster the target users to obtain clusters, use users in the same cluster as nodes, build edges between users in the same cluster, and use the behavior similarity between the users as the first weight of the edge to determine the first topology network; A second topology network construction module is used to use users in the cluster as nodes, to construct edges between users in the same cluster, and to determine a second topology network using a strong correlation medium as a second weight of the edge; wherein the strong correlation medium is used to indicate that there is a correlation between users in the cluster; A third topology network construction module, used to combine the first topology network and the second topology network, determine a third weight of an edge between users in a third topology network according to the first weight of the edge and the second weight of the edge, and determine the third topology network with the third weight of the edge; The community division module is used to divide the third topology network into communities to obtain sub-communities, and determine the users in each sub-community as the same group.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 11 is implemented.

14. An electronic device, characterized in that: include: processor; as well as A memory, used to store one or more programs, when the one or more programs are executed by the one or more processors, enables the one or more processors to implement the method according to any one of claims 1 to 11.

Images