Fraud community discovery method, device, apparatus and storage medium

Abstract

The application relates to a fraud community discovery method, device and equipment and a storage medium, wherein the method comprises the following steps: firstly, generating an initial heterogeneous graph according to the topological relationship of a plurality of network nodes, inputting node parameters into a supervised model to obtain fraud community judgment basis, then pruning the initial heterogeneous graph to obtain a preset number of suspicious heterogeneous graphs, determining a suspicious community corresponding to all network nodes in each suspicious heterogeneous graph, and finally determining a fraud community from all suspicious communities by using the fraud community judgment basis. The process of obtaining the initial heterogeneous graph and the suspicious heterogeneous graph belongs to an unsupervised algorithm, and the fraud community judgment basis is obtained by using the node parameters of the network nodes. The application can utilize the topological relationship focused on by the unsupervised algorithm and the node parameters focused on by the supervised model, and can make up for the shortcomings caused by the single use of the unsupervised algorithm or the supervised model.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of social network, and particularly relates to a fraud community discovery method and device, equipment and a storage medium. BACKGROUND

[0002] With the continuous development of Internet technology, people's social activities extend from offline to online. At present, online social activities involve all aspects of people's work and life, such as family shopping, company business, personal socialization, etc., which brings convenience to people's work and life, but also breeds many black industries, such as fraud to Internet users through fraud community. Such black industry will have a certain impact on the development of the Internet.

[0003] In order to find the fraud community that has been formed from the many nodes of the Internet, the supervised model and the unsupervised model are often used to determine the fraud community, such as using a supervised model based on node characteristics and risk labels to determine the fraud community, which often focuses on the characteristics of the node itself, lacks the judgment of the associated groups formed between the nodes, and leads to a decrease in the accuracy of determining the fraud community. For example, an unsupervised model based on clustering and anomaly value detection is used to determine the fraud community, and the unsupervised model has the problem of unclear purpose, which leads to the lack of evaluability and explainability of the output results. For example, an unsupervised module based on a relationship network graph is used, which focuses on the topological relationship between nodes and lacks consideration of the node itself, which also causes the problem of low accuracy and even misjudgment and omission. SUMMARY

[0004] In order to at least partially overcome the problems in the related art, the present application provides a fraud community discovery method, device, equipment and storage medium.

[0005] According to a first aspect of the present application, a fraud community discovery method is provided, the method comprising:

[0006] generating an initial heterogeneous graph according to the topological relationship of a plurality of network nodes;

[0007] inputting the node parameters of the plurality of network nodes into a pre-constructed supervised model to obtain fraud community judgment basis;

[0008] pruning the initial heterogeneous graph according to a preset pruning rule, obtaining a preset number of suspicious heterogeneous graphs, and determining a suspicious community corresponding to all network nodes in each suspicious heterogeneous graph as a suspicious community;

[0009] determining a fraud community from all suspicious communities according to the fraud community judgment basis.

[0010] Optionally, the pruning the initial heterogeneous graph according to a preset pruning rule to obtain a preset number of suspicious heterogeneous graphs comprises repeatedly performing the following iteration operation:

[0011] iteratively pruning the current heterogeneous graph node by node to obtain a suspicious heterogeneous graph;

[0012] and pruning the suspicious heterogeneous graph from the current heterogeneous graph to obtain a new heterogeneous graph, until the number of obtained suspicious heterogeneous graphs reaches the preset number, and stopping all iteration operations, wherein the current heterogeneous graph is the initial heterogeneous graph, or a new heterogeneous graph obtained after pruning a suspicious heterogeneous graph from the initial heterogeneous graph, or a new heterogeneous graph obtained again after pruning a suspicious heterogeneous graph from the new heterogeneous graph.

[0013] Optionally, the iteratively pruning the current heterogeneous graph node by node to obtain a suspicious heterogeneous graph comprises:

[0014] pruning an nth network node from the current heterogeneous graph to obtain an nth candidate suspicious heterogeneous graph, wherein n is a positive integer less than or equal to the total number of network nodes in the current heterogeneous graph, n is sequentially incremented, and the initial value of n is 1;

[0015] determining a global suspicious degree of the nth candidate suspicious heterogeneous graph according to a preset suspicious degree determination rule;

[0016] selecting a candidate suspicious heterogeneous graph with the largest global suspicious degree from all candidate suspicious heterogeneous graphs to determine the suspicious heterogeneous graph.

[0017] Optionally, the nth candidate suspicious heterogeneous graph comprises a plurality of network nodes and a plurality of edges, and the plurality of network nodes are divided into at least two types;

[0018] The determining the global suspicious degree of the new nth candidate suspicious heterogeneous graph according to the preset suspicious degree determination rule comprises:

[0019] determining a preset type network node connected to a first edge, and determining the number of edges connected to the preset type network node, wherein the preset type network node is one of the at least two types of network nodes;

[0020] determining an edge suspicious degree of the first edge according to the number of edges connected to the preset type network node, wherein the first edge is any edge in the nth candidate suspicious heterogeneous graph;

[0021] determining a node suspicious degree of a first network node in the nth candidate suspicious heterogeneous graph according to the edge suspicious degrees of all edges connected to the first network node, wherein the first network node is any network node in the nth candidate suspicious heterogeneous graph.

[0022] determine a global suspicious degree of the nth candidate suspicious heterogeneous graph according to suspicious degrees of all network nodes in the nth candidate suspicious heterogeneous graph.

[0023] Optionally, the fraud community judgment basis comprises a model score corresponding to each network node, and at least two fraud community judgment features.

[0024] The fraud community is determined from all suspicious communities according to the fraud community judgment basis, and specifically comprises:

[0025] A community model score of each suspicious community is determined according to the model score corresponding to each network node.

[0026] A community clustering degree of each suspicious community is determined according to the intra-class similarity between the at least two fraud community judgment features.

[0027] The fraud community is determined from all suspicious communities according to the community model score and the community clustering degree corresponding to all suspicious communities.

[0028] Optionally, before the initial heterogeneous graph is pruned according to the preset pruning rule to obtain a preset number of suspicious heterogeneous graphs, the method further comprises:

[0029] A node suspicious degree of each network node in the initial heterogeneous graph and an initial global suspicious degree of the initial heterogeneous graph are determined according to a preset suspicious degree determination rule.

[0030] A batch pruning threshold is determined according to the initial global suspicious degree.

[0031] All network nodes with a node suspicious degree less than the batch pruning threshold in the initial heterogeneous graph are pruned.

[0032] Optionally, after it is determined whether each suspicious community is a fraud community according to the fraud community judgment basis, the method further comprises:

[0033] Fraud features are extracted from the network nodes in the fraud community.

[0034] The network nodes in the fraud community are labeled to obtain network nodes with fraud labels.

[0035] The fraud features are input into the supervised model, and the supervised model is optimized and trained according to the fraud labels.

[0036] According to a second aspect of the present application, a fraud community discovery device is provided, and the device comprises:

[0037] The isomorphic graph generation module is configured to generate an initial isomorphic graph composed of the plurality of network nodes according to a topological relationship of the plurality of network nodes;

[0038] The acquisition module is configured to input node parameters of the plurality of network nodes into a pre-constructed supervised model to acquire a fraud community judgment basis;

[0039] The pruning module is configured to prune the initial isomorphic graph according to a preset pruning rule, acquire a preset number of suspicious isomorphic graphs, and determine a suspicious community corresponding to a community composed of all network nodes in each suspicious isomorphic graph as a suspicious community;

[0040] The determination module is configured to determine a fraud community from all suspicious communities according to the fraud community judgment basis.

[0041] Optionally, the pruning module comprises:

[0042] The first pruning unit is configured to perform node-by-node iterative pruning on a current isomorphic graph to acquire a suspicious isomorphic graph;

[0043] The second pruning unit is configured to prune the suspicious isomorphic graph from the current isomorphic graph to acquire a new isomorphic graph, and stop all iteration operations when the number of acquired suspicious isomorphic graphs reaches the preset number, wherein the current isomorphic graph is the initial isomorphic graph, or a new isomorphic graph acquired after the suspicious isomorphic graph is pruned from the initial isomorphic graph, or a new isomorphic graph acquired again after the suspicious isomorphic graph is pruned from the new isomorphic graph.

[0044] Optionally, the first pruning unit comprises:

[0045] The pruning subunit is configured to prune an nth network node from the current isomorphic graph to obtain an nth candidate suspicious isomorphic graph, wherein n is a positive integer less than or equal to a total number of network nodes in the current isomorphic graph, n is sequentially and progressively valued, and an initial value of n is 1;

[0046] The first determination subunit is configured to determine a global suspicious degree of the nth candidate suspicious isomorphic graph according to a preset suspicious degree determination rule;

[0047] The second determination subunit is configured to select a candidate suspicious isomorphic graph with a maximum global suspicious degree from all candidate suspicious isomorphic graphs to determine as the suspicious isomorphic graph.

[0048] Optionally, the nth candidate suspicious isomorphic graph comprises a plurality of network nodes and a plurality of edges, and the plurality of network nodes are divided into at least two types;

[0049] The first determination subunit comprises:

[0050] The first determination layer is configured to determine a preset type network node connected with the first edge, and determine a number of edges connected with the preset type network node, wherein the preset type network node is one of at least two types of network nodes;

[0051] The second determination layer is configured to determine an edge suspicious degree of the first edge according to the number of edges connected with the preset type network node, wherein the first edge is any edge in the nth candidate suspicious heterogeneous graph;

[0052] The third determination layer is configured to determine a node suspicious degree of a first network node in the nth candidate suspicious heterogeneous graph according to the edge suspicious degrees of all edges connected with the first network node, wherein the first network node is any network node in the nth candidate suspicious heterogeneous graph;

[0053] The fourth determination layer is configured to determine a global suspicious degree of the nth candidate suspicious heterogeneous graph according to the node suspicious degrees of all network nodes in the nth candidate suspicious heterogeneous graph.

[0054] Optionally, the fraud community judgment basis comprises a model score corresponding to each network node respectively, and at least two fraud community judgment features;

[0055] The determination module specifically comprises:

[0056] The first determination unit is configured to determine a community model score of each suspicious community according to the model scores corresponding to all network nodes respectively;

[0057] The second determination unit is configured to determine a community clustering degree of each suspicious community according to the intra-class similarity between the at least two fraud community judgment features;

[0058] The third determination unit is configured to determine a fraud community from all suspicious communities according to the community model scores and the community clustering degrees corresponding to all suspicious communities respectively.

[0059] Optionally, the device further comprises:

[0060] The initial suspicious degree determination module is configured to determine a node suspicious degree of each network node in an initial heterogeneous graph and an initial global suspicious degree of the initial heterogeneous graph according to a preset suspicious degree determination rule;

[0061] The threshold determination module is configured to determine a batch pruning threshold according to the initial global suspicious degree;

[0062] The batch pruning module is configured to prune all network nodes with a node suspicious degree less than the batch pruning threshold in the initial heterogeneous graph.

[0063] Optionally, the device further comprises:

[0064] a feature extraction module, configured to perform feature extraction on the network nodes in the fraudulent community to obtain fraudulent features;

[0065] a labeling module, configured to label the network nodes in the fraudulent community to obtain network nodes with fraudulent labels;

[0066] an optimization training module, configured to input the fraudulent features into the supervised model and perform optimization training on the supervised model according to the fraudulent labels.

[0067] According to a third aspect of the present application, a fraudulent community discovery device is provided, comprising at least one processor and a memory.

[0068] The processor is configured to execute a fraudulent community discovery program stored in the memory to implement the fraudulent community discovery method according to the first aspect of the present application.

[0069] According to a fourth aspect of the present application, a computer storage medium is provided, which stores one or more programs executable by the fraudulent community discovery device according to the third aspect of the present application to implement the fraudulent community discovery method according to the first aspect of the present application.

[0070] The technical solution provided by the present application can have the following beneficial effects: first, an initial heterogeneous graph is generated according to the topological relationship of a plurality of network nodes, the node parameters are input into a pre-constructed supervised model to obtain fraudulent community evaluation criteria, then the initial heterogeneous graph is pruned according to a preset pruning rule to obtain a preset number of suspicious heterogeneous graphs, a community formed by all network nodes in each suspicious heterogeneous graph is determined as a suspicious community, and finally the fraudulent community evaluation criteria are used to determine the fraudulent community from all suspicious communities. The process of obtaining the initial heterogeneous graph and pruning the initial heterogeneous graph to obtain the suspicious heterogeneous graph by the preset pruning rule belongs to the process of executing an unsupervised algorithm, and the fraudulent community evaluation criteria output by the supervised model are determined by using the node parameters of the network nodes. This method of combining the unsupervised algorithm and the supervised model to determine the fraudulent community can make use of the topological relationship focused on by the unsupervised algorithm and the node parameters focused on by the supervised model, and make up for the shortcomings of using a single unsupervised algorithm or supervised model.

[0071] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and cannot limit the present application. BRIEF DESCRIPTION OF DRAWINGS

[0072] The accompanying drawings, which are incorporated herein and constitute part of this specification, illustrate embodiments consistent with the application and, together with the description, further serve to explain the principles of the application.

[0073] Figure 1 is a flowchart of a fraud community discovery method provided by an embodiment of the application;

[0074] Figure 2 is a flowchart of obtaining a preset number of suspicious heterogeneous graphs by the application;

[0075] Figure 3 is a flowchart of pruning a current heterogeneous graph to obtain a suspicious heterogeneous graph in the application;

[0076] Figure 4 is a flowchart of determining the global suspicious degree of the nth candidate suspicious heterogeneous graph in the application;

[0077] Figure 5 is a flowchart of determining a fraud community in the application;

[0078] Figure 6 is a flowchart of batch-pruning weak suspicious degree network nodes in the application;

[0079] Figure 7 is a flowchart of optimizing and training a supervised model in the application;

[0080] Figure 8 is a structural diagram of a fraud community discovery device provided by another embodiment of the application;

[0081] Figure 9 is a structural diagram of fraud community discovery provided by another embodiment of the application. DETAILED DESCRIPTION

[0082] The exemplary embodiments will be described in detail herein with reference to the attached drawings. When the description below refers to accompanying drawings, unless otherwise noted, the same numbers in different drawings refer to the same or similar elements. The implementations described in the following exemplary embodiments are not meant to represent all implementations consistent with the application. Rather, they are merely examples of apparatus and methods consistent with some aspects of the application as detailed in the appended claims.

[0083] Please refer to Figure 1 , Figure 1 is a flowchart of a fraud community discovery method provided by an embodiment of the application.

[0084] As Figure 1 shown, in the embodiment, the fraud community discovery method can include:

[0085] Step S101, generating an initial heterogeneous graph according to the topological relationship of the plurality of network nodes.

[0086] In one example, the plurality of network nodes has at least two types, such as in the current popular network shopping process, the network nodes are called merchants and consumers, and the merchants and consumers have a transaction relationship, and the specific manifestation of the transaction relationship in the network is that the data involved in the transaction is transmitted between the merchant network nodes and the consumer network nodes, Therefore, the merchant network nodes and the consumer network nodes have a topological relationship in the network.

[0087] It should be noted that the heterogeneous graph refers to a relationship network composed of multiple types of nodes, and the initial heterogeneous graph generated according to the topological relationship of the plurality of network nodes in this step refers to the network nodes being embodied into a graph, and then the network nodes with data transmission relationship are connected in a wired manner. In the above process, the graph can be a circle, a square, etc. The graph only represents the network nodes, and the line connecting the network nodes in the heterogeneous graph can be referred to as an edge.

[0088] That is, the initial heterogeneous graph includes the plurality of network nodes and the edges connecting the network nodes.

[0089] Step S102, inputting the node parameters of the plurality of network nodes into the pre-constructed supervised model to obtain a fraud community evaluation basis.

[0090] Among them, the node parameters will involve different aspects of data of the network nodes according to different types of network nodes. Taking the merchant network nodes and the consumer network nodes involved in network shopping as an example, the node parameters of the merchant network nodes can include transaction volume, transaction amount, shipment volume, logistics data, etc., and the node parameters of the consumer network nodes can include purchase volume, transaction amount, commodity information, logistics data, etc.

[0091] It should be noted that the pre-constructed supervised model can obtain a fraud community evaluation basis according to the node parameters of the network nodes. Specifically, the supervised model can obtain a model score corresponding to each network node and at least two fraud community determination features according to the node parameters of the network nodes, and the above model score and fraud community determination features are used as the fraud community evaluation basis.

[0092] Each model score can correspond to a degree of suspicion of a network node. Specifically, the model score can be a numerical value, and the larger the numerical value, the greater the degree of suspicion of the corresponding network node. In a specific example, the node parameters corresponding to all network nodes are input into the supervised model. The supervised model determines the degree of suspicion of each network node according to the node parameters, and scores each network node according to the degree of suspicion, thereby obtaining the model score of each network node. The model score can be a numerical value between 0 and 1. For example, for three network nodes a, b, and c, the model scores can be 0.75 for a, 0.8 for b, and 0.9 for c. The larger the score, the higher the degree of suspicion of the network node. Among the three network nodes a, b, and c, the degree of suspicion of c is the highest.

[0093] In addition, the node parameters input into the supervised model can point to many aspects of features. Still taking the network shopping scenario as an example, the node parameters input by the consumer network node can include purchase quantity, transaction amount, commodity information, logistics data, user name data, platform registration date data, consumption preference data, gender data, age data, and the like. Among them, the node parameters pointing to features such as gender, user name, and age can have a relatively low contribution to the judgment of the degree of suspicion of the node. Therefore, the supervised model can discard these features and output, as the final fraud community judgment features, node parameters pointing to features such as purchase quantity, transaction amount, commodity information, and logistics, which have a relatively large contribution to the judgment of the degree of suspicion and whether the community is a fraud community.

[0094] During the construction of the supervised model, the node parameters of the sample network nodes and the pre-labeled suspicious labels of the sample network nodes are used to train the supervised model. During the training process, the node parameters are input into the supervised model, and the supervised model outputs the model score of each sample network node and at least two fraud community judgment features. Then, the output data is judged to determine whether the training is complete. Since the pre-labeled suspicious labels can include the labeled score of each sample network node and the labeled features (i.e., the pre-labeled features that have a relatively large contribution to the fraud community judgment), the output model score is judged during the judgment. The specific judgment method can be, but is not limited to, the following method: for each network node, the absolute value of the difference between the model score and the labeled score is calculated. At this time, each network node corresponds to an absolute value. At this time, the average value of all absolute values is calculated, and the average value is compared with a preset threshold. If the average value is less than the preset threshold, it indicates that the output model score meets the training completion condition. The training is completed, and a trained supervised model is obtained.

[0095] In addition, taking a common machine learning model such as random forest and extreme gradient boosting (XGboost) as an example, different features have different contributions to loss reduction when splitting the sub-decision tree, the splitting feature that can make the loss as low as possible is the current optimal feature, and is given a high score. Finally, the scores of all sub-decision tree features are averaged, and the score ranking is the feature importance ranking. According to the feature importance ranking, the top pre-set number of features are taken as the fraud community evaluation features. Since the above process of outputting fraud community evaluation features is based on the characteristics of supervised models, in the training process, the features output by the supervised model do not need to be judged again to determine whether the supervised model is trained. In the present embodiment, when the model score output above meets the training completion condition, it is determined that the supervised model is trained.

[0096] Step S103, pruning the initial heterogeneous graph according to a pre-set pruning rule to obtain a pre-set number of suspicious heterogeneous graphs, and determining each suspicious community formed by all network nodes in each suspicious heterogeneous graph as a suspicious community.

[0097] In the present embodiment, pruning refers to the process of removing one or more network nodes and the edges connected to the network nodes from the heterogeneous graph to obtain a new heterogeneous graph.

[0098] Specifically, the process of obtaining a pre-set number of suspicious heterogeneous graphs can be referred to Figure 2 , Figure 2 is a flowchart of the present application for obtaining a pre-set number of suspicious heterogeneous graphs.

[0099] The process of obtaining a pre-set number of suspicious heterogeneous graphs is a constantly iterative process, that is, the output of one iteration process is taken as the input of the next iteration until the iteration end condition is met. As Figure 2 shown, the process of obtaining a pre-set number of suspicious heterogeneous graphs can include:

[0100] Step S201, performing node-by-node iterative pruning on the current heterogeneous graph to obtain a suspicious heterogeneous graph.

[0101] Since the process of obtaining the preset number of suspicious heterogeneous graphs is an iterative process, the heterogeneous graph processed each time is different, and therefore, the current heterogeneous graph is used to limit the heterogeneous graph to be processed in this step, such as the first iteration, the current heterogeneous graph is the initial heterogeneous graph; the second iteration, the current heterogeneous graph is a new heterogeneous graph obtained by removing the suspicious heterogeneous graph from the initial heterogeneous graph; the third iteration, the current heterogeneous graph is a new heterogeneous graph obtained by removing the suspicious heterogeneous graph from the new heterogeneous graph obtained in the second iteration; the fourth iteration, the current heterogeneous graph is a new heterogeneous graph obtained by removing the suspicious heterogeneous graph from the new heterogeneous graph obtained in the third iteration.

[0102] Therefore, in this embodiment, the current heterogeneous graph can be the initial heterogeneous graph, or a new heterogeneous graph obtained by removing the suspicious heterogeneous graph from the initial heterogeneous graph, or a new heterogeneous graph obtained by removing the suspicious heterogeneous graph from the new heterogeneous graph.

[0103] In addition, the process of removing the suspicious heterogeneous graph from the current heterogeneous graph by node-by-node iteration pruning can be understood with reference to Figure 3 , Figure 3 is a flowchart of the process of removing the suspicious heterogeneous graph from the current heterogeneous graph in this application.

[0104] As Figure 3 indicated, the process of removing the suspicious heterogeneous graph from the current heterogeneous graph can include:

[0105] Step S301, removing the nth network node from the current heterogeneous graph to obtain the nth candidate suspicious heterogeneous graph, wherein n is a positive integer less than or equal to the total number of network nodes in the current heterogeneous graph, n is sequentially incremented, and the initial value is 1.

[0106] In this step, the nth network node is removed as an example, wherein the value of n is from 1 to the total number of network nodes in the current heterogeneous graph (herein, N represents the total number of network nodes in the current heterogeneous graph), and the value rule can be sequentially incremented, such as 1, 2, 3, …, N.

[0107] It should be noted that the pruning of the current heterogeneous graph in this step is also iterative pruning, and after removing a network node in a certain iteration, a candidate suspicious heterogeneous graph is obtained, and the next time a network node is removed, the pruning is performed based on the candidate suspicious heterogeneous graph obtained in the last time. The following is an example of removing the (n-1)th and nth network nodes to illustrate:

[0108] After the n-2th network node is pruned, the n-2th candidate suspicious heterogeneous graph is obtained, and then the n-1th network node is pruned based on the n-2th candidate suspicious heterogeneous graph (i.e., the n-1th network node is pruned from the n-2th candidate suspicious heterogeneous graph), the n-1th candidate suspicious heterogeneous graph is obtained, and then the nth network node is pruned based on the n-1th candidate suspicious heterogeneous graph, so as to obtain the nth candidate suspicious heterogeneous graph.

[0109] In step S302, the global suspicious degree of the nth candidate suspicious heterogeneous graph is determined according to the preset suspicious degree determination rule.

[0110] It should be noted that the global suspicious degree is a value representing the suspicious degree of a heterogeneous graph as a whole, which can be obtained by calculating the node suspicious degree of each network node in the heterogeneous graph, and of course, the global suspicious degree of the heterogeneous graph can also be obtained by the connection relationship of each network node in the heterogeneous graph or the node parameter of the heterogeneous graph. As long as it is a value representing the suspicious degree of the heterogeneous graph as a whole, it should be within the scope covered by the embodiment.

[0111] In a specific example, the global suspicious degree of the heterogeneous graph can be obtained by calculating the node suspicious degree of each network node in the heterogeneous graph. Specifically, the process of determining the global suspicious degree of the nth candidate suspicious heterogeneous graph according to the preset suspicious degree determination rule can be referred to Figure 4 , Figure 4 is a flowchart of determining the global suspicious degree of the nth candidate suspicious heterogeneous graph in the present application.

[0112] It should be noted that the nth candidate suspicious heterogeneous graph includes a plurality of network nodes and a plurality of edges, and the plurality of network nodes are divided into at least two types. As Figure 4 shown, the process of determining the global suspicious degree of the nth candidate suspicious heterogeneous graph can include:

[0113] In step S401, a preset type network node connected with the first edge is determined, and the number of edges connected with the preset type network node is determined, wherein the preset type network node is one type of network node in the at least two types of network nodes.

[0114] In step S402, the edge suspicious degree of the first edge is determined according to the number of edges connected with the preset type network node, wherein the first edge is any edge in the nth candidate suspicious heterogeneous graph.

[0115] To determine the node suspicious degree of the network node, it is necessary to first determine the edge suspicious degree of each edge in the candidate suspicious heterogeneous graph. This step will take the first edge in the candidate suspicious heterogeneous graph as an example to illustrate.

[0116] Since in the heterogeneous graph, one edge can only connect two network nodes, and the two network nodes need to belong to different categories, that is, if there are only two types of network nodes in the candidate suspicious heterogeneous graph, then each edge must be connected to two types of nodes.

[0117] Therefore, in this step, when determining the edge suspicious degree of the first edge, first determine the preset type of network node connected by the first edge, and then obtain the number of edges connected by the network node. In a specific example, the preset type of network node can be an A-type network node. After determining that the A-type network node connected by the first edge is node a, the edges connected to node a are queried, and the number of edges is accumulated, such as one, 1, until all edges are queried, and the number of edges connected to node a is obtained (of course, the number must include the first edge mentioned above).

[0118] After obtaining the number of edges, the edge suspicious degree of the first edge is determined using the number. Specifically, the edge suspicious degree of the first edge can be determined according to the principle that the higher the number, the smaller the edge suspicious degree of the first edge. In a specific example, a preset formula can be used to calculate, such as:

[0119]

[0120] Where y represents the edge suspicious degree, and x represents the number of edges.

[0121] In the above manner, the edge suspicious degree of all edges in the nth candidate suspicious heterogeneous graph is calculated.

[0122] Step S403, according to the edge suspicious degree of all edges connected to the first network node in the nth candidate suspicious heterogeneous graph, determine the node suspicious degree of the first network node, wherein the first network node is any network node in the nth candidate suspicious heterogeneous graph.

[0123] Based on step S402, the edge suspicious degree of all edges can be obtained, and the node suspicious degree of all network nodes in the nth candidate suspicious heterogeneous graph can be calculated. Specifically, the node suspicious degree of a certain network node can be the sum of the edge suspicious degrees of all edges connected thereto. In a specific example, if the edges connected to node b are the first edge, the second edge, and the third edge, and the edge suspicious degrees of the first edge, the second edge, and the third edge calculated in S401 are 0.4, 0.85, and 0.2, respectively, then the node suspicious degree of node b can be 0.4+0.85+0.2, i.e., 1.45.

[0124] In addition, since the suspicious degree of the network node is obtained only by the topological relationship between the network nodes in the above process, the node parameters of the network node itself can be lost. Therefore, in order to combine the topological relationship and the node parameters of the network node itself, the model score obtained in step S102 can be used to weight the suspicious degree of the network node obtained above, so as to obtain a new suspicious degree of the network node corresponding to the network node. Here, still taking the b node as an example, the model score obtained in step S102 for the b node can be 0.1. Then, the suspicious degree of the b node obtained above can be multiplied by 0.1 to obtain the final suspicious degree of the b node.

[0125] Based on the above method, the suspicious degrees of all network nodes in the nth candidate suspicious heterogeneous graph are obtained.

[0126] Step S404, determining the global suspicious degree of the nth candidate suspicious heterogeneous graph according to the suspicious degrees of all network nodes in the nth candidate suspicious heterogeneous graph.

[0127] For the global suspicious degree of the nth candidate suspicious heterogeneous graph, there are various methods for calculation. The suspicious degrees of all network nodes can be summed up, and the sum value obtained is taken as the global suspicious degree of the nth candidate suspicious heterogeneous graph. Alternatively, the average value of the suspicious degrees of all network nodes can be calculated, and the average value obtained is taken as the global suspicious degree of the nth candidate suspicious heterogeneous graph.

[0128] After the pruning from the first network node to the Nth network node (here, N represents the total number of network nodes in the current heterogeneous graph) through steps S301 and S302, N candidate suspicious heterogeneous graphs and their respective global suspicious degrees are obtained.

[0129] Step S303, selecting the candidate suspicious heterogeneous graph with the largest global suspicious degree from all candidate suspicious heterogeneous graphs, and determining the candidate suspicious heterogeneous graph as the suspicious heterogeneous graph.

[0130] In this step, the N candidate suspicious heterogeneous graphs can be sorted in descending order of their respective global suspicious degrees. After the sorting is completed, the candidate suspicious heterogeneous graph ranked first (i.e., the candidate suspicious heterogeneous graph with the largest global suspicious degree) is directly selected as the suspicious heterogeneous graph. Specifically, there are many sorting methods, such as the commonly used bubble method, which will not be described here.

[0131] Step S202, pruning the suspicious heterogeneous graph from the current heterogeneous graph to obtain a new heterogeneous graph, and stopping all iteration operations when the number of obtained suspicious heterogeneous graphs reaches a preset number.

[0132] In step S201, the suspicious heterogeneous graph corresponding to the current heterogeneous graph is obtained. In order to improve the accuracy of the fraudulent community discovery, a preset number of suspicious communities are generally obtained first. In this step, the suspicious community obtained in step S201 is removed from the current heterogeneous graph, thereby obtaining a new heterogeneous graph. At this time, it is necessary to determine whether the number of suspicious heterogeneous graphs reaches the preset number. If not, step S201 is iteratively executed. If the preset number is reached, all iteration operations are stopped.

[0133] After obtaining the suspicious heterogeneous graph, all network nodes in each suspicious heterogeneous graph correspond to form a suspicious community. For example, for a suspicious heterogeneous graph, only a node, a node and a node are included. Therefore, the node, the node and the node form a suspicious community.

[0134] After steps S201 and S202, a preset number of suspicious communities are obtained. However, the aforementioned suspicious community relies more on the topological relationship of the network node, and therefore lacks the characteristics of the network node itself, which may not be accurate. Therefore, the aforementioned suspicious community can be judged according to the fraudulent community judgment basis obtained in step S102.

[0135] Step S104, according to the fraudulent community judgment basis, determine whether each suspicious community is a fraudulent community.

[0136] In the determination, each suspicious community is judged according to the fraudulent community judgment basis. It can be expressed that each suspicious community corresponds to a value calculated. According to the value, all suspicious communities are sorted. According to the demand, the first or the first few sorted suspicious communities are taken as the final fraudulent community.

[0137] Specifically, the process of determining the fraudulent community can refer to Figure 5 , Figure 5 is a flowchart of the process of determining the fraudulent community of the present application.

[0138] As Figure 5 shown, the process of determining the fraudulent community can include:

[0139] Step S501, according to the model score corresponding to each network node, determine the community model score of each suspicious community.

[0140] Specifically, in step S102, the model score of all network nodes has been obtained. Therefore, the model score of the network nodes contained in the suspicious community is known. The community model score represents the model score of the entire suspicious community. Therefore, it can be the sum of the model scores of all network nodes in the suspicious community, or it can be the average value of the model scores of all network nodes in the suspicious community. The sum or average value is taken as the community model score of the suspicious community.

[0141] Step S502, determining the community concentration of each suspicious community according to the intra-class similarity between the at least two fraud community judgment features.

[0142] In this step, when determining the community concentration, it can be determined in the thought of dimension, for example, three fraud community judgment features are output in step S102 (here, the three fraud community judgment features are denoted as A, B, and C in turn), then it can be determined that the community concentration of the suspicious community is determined from the perspective of three dimensions.

[0143] Specifically, taking a certain suspicious community as an example, the intra-class similarity m of each network node in the suspicious community on A, the intra-class similarity n on B, and the intra-class similarity q on C can be calculated first. Then the intra-class similarity is taken as the coordinates of each network node, for example, there are a node, b node and c node, then the coordinates of a node are (m1, n1, q1), the coordinates of b node are (m2, n2, q2), and the coordinates of c node are (m3, n3, q3).

[0144] Then the average values (which can be denoted as m 平 , n 平 , q 平 ) of the intra-class similarity of all network nodes on A, the intra-class similarity on B, and the intra-class similarity on C are calculated respectively, and the intra-class similarity of the center point on A, the intra-class similarity on B, and the intra-class similarity on C are obtained, that is, the coordinates of the center point are (m 平 , n 平 , q 平 ).

[0145] According to the coordinates of a, b, and c nodes, the distances from the coordinates of a, b, and c nodes to the center point are calculated (the distance between two coordinates is calculated as a known technology, which is not described here), and the standard deviation and the average value of all the distance values obtained are calculated, and the final community concentration is obtained by dividing the standard deviation by the average value.

[0146] It should be noted that the community concentration of each suspicious community needs to be calculated, and the specific calculation process is the same as the process described in the specific description of step S502 above, which is not described here.

[0147] Step S503, determining the fraud community from all suspicious communities according to the community model score and the community concentration of all suspicious communities respectively.

[0148] In steps S502 and S503, each suspicious community corresponds to a community model score and a community concentration. Both parameters are in the form of specific numerical values, and thus, the community model score and the community concentration can be weighted according to preset weights to obtain the evaluation score of each suspicious community.

[0149] In a specific example, the suspicious communities can be sorted according to the evaluation scores, and the suspicious community(s) with the highest evaluation score(s) can be taken as the final fraudulent community.

[0150] In this embodiment, first, an initial heterogeneous graph is generated according to the topological relationship of the plurality of network nodes, the node parameters are input into a pre-constructed supervised model to obtain a fraudulent community evaluation basis, then the initial heterogeneous graph is pruned according to a preset pruning rule to obtain a preset number of suspicious heterogeneous graphs, the community formed by all network nodes in each suspicious heterogeneous graph is determined as a suspicious community, and finally, the fraudulent community is determined from all suspicious communities by using the fraudulent community evaluation basis. The process of obtaining the initial heterogeneous graph and the suspicious heterogeneous graph by pruning the initial heterogeneous graph according to the preset pruning rule belongs to the process of executing an unsupervised algorithm, and the fraudulent community evaluation basis output by the supervised model is obtained by using the node parameters of the network nodes. This method of combining an unsupervised algorithm and a supervised model to determine a fraudulent community can make use of the topological relationship focused on by the unsupervised algorithm and the node parameters focused on by the supervised model, and thus, the shortcomings caused by the single use of the unsupervised algorithm or the supervised model are compensated.

[0151] In addition, in order to save the calculation amount, the initial heterogeneous graph can be preprocessed before step S103 to batch-prune the network nodes with low suspicious degree. The specific process can be referred to Figure 6 , Figure 6 which is a flowchart of the process of batch-pruning the network nodes with low suspicious degree in this application.

[0152] As shown in Figure 6 , the process of batch-pruning the network nodes with low suspicious degree can include:

[0153] Step S601: determining the node suspicious degree of each network node in the initial heterogeneous graph and the initial global suspicious degree of the initial heterogeneous graph according to a preset suspicious degree determination rule.

[0154] The process of calculating the node suspicious degree of the network nodes in the initial heterogeneous graph and the initial global suspicious degree can be referred to the process illustrated in the foregoing embodiment, and thus, details are not described herein. In this embodiment, the initial global suspicious degree is taken as the average value of the node suspicious degrees of the network nodes in the initial heterogeneous graph. Figure 4

[0155] Step S602: determining a batch-pruning threshold according to the initial global suspicious degree. ​

[0156] In one specific example, the batch pruning threshold can be determined as 2 times the initial global suspiciousness, but not limited thereto.

[0157] Step S603: All network nodes in the initial heterogeneous graph whose node suspiciousness is less than the batch pruning threshold are pruned.

[0158] The pruning process can refer to the definition of pruning in the present embodiment, which will not be described here again.

[0159] In addition, after the fraudulent community is determined, the present embodiment can further optimize and train the supervised model by using the related data of the fraudulent community, so as to improve the accuracy of the supervised model.

[0160] The specific optimization process can refer to Figure 7 , Figure 7 which is a flowchart of the optimization and training of the supervised model according to the present embodiment.

[0161] As shown in Figure 7 , the process of optimizing and training the supervised model includes:

[0162] Step S701: Feature extraction is performed on the network nodes in the fraudulent community, to obtain fraudulent features.

[0163] It should be noted that the features extracted here can be node parameters directed to the fraudulent community determination features described above.

[0164] Step S702: The network nodes in the fraudulent community are labeled to obtain network nodes with fraudulent labels.

[0165] The labeling process can be a manual process, or the node suspiciousness of the network nodes weighted by the model described above can be labeled in the node parameters of each network node.

[0166] Step S703: The fraudulent features are input into the supervised model, and the supervised model is optimized and trained according to the fraudulent labels.

[0167] By using the labeled labels described above, the accuracy of the results output by the supervised model can be determined, and when the accuracy meets the preset requirements, the optimization and training is completed.

[0168] Please refer to Figure 8 , Figure 8 which is a structural diagram of a fraudulent community discovery device according to another embodiment of the present application.

[0169] As shown in Figure 8 , the device includes:

[0170] The isomorphic graph generation module 801 is configured to generate an initial isomorphic graph composed of a plurality of network nodes according to a topological relationship of the plurality of network nodes;

[0171] The acquisition module 802 is configured to input node parameters of the plurality of network nodes into a pre-constructed supervised model to acquire a fraud community judgment basis;

[0172] The pruning module 803 is configured to prune the initial isomorphic graph according to a preset pruning rule, acquire a preset number of suspicious isomorphic graphs, and determine a community composed of all network nodes in each suspicious isomorphic graph as a suspicious community;

[0173] The determination module 804 is configured to determine whether each suspicious community is a fraud community according to the fraud community judgment basis.

[0174] First, the isomorphic graph generation module 801 generates an initial isomorphic graph according to a topological relationship of a plurality of network nodes, the acquisition module 802 inputs the node parameters into a pre-constructed supervised model to obtain a fraud community judgment basis, then the pruning module 803 prunes the initial isomorphic graph according to a preset pruning rule to acquire a preset number of suspicious isomorphic graphs, and determines a community composed of all network nodes in each suspicious isomorphic graph as a suspicious community, and finally the determination module 804 determines a fraud community from all suspicious communities by using the fraud community judgment basis. The process of obtaining the initial isomorphic graph and the suspicious isomorphic graph by pruning the initial isomorphic graph according to the preset pruning rule belongs to a process of executing an unsupervised algorithm, and the fraud community judgment basis output by the supervised model is obtained by using the node parameters of the network nodes. This method of combining the unsupervised algorithm and the supervised model to determine the fraud community can make use of the topological relationship focused on by the unsupervised algorithm and the node parameters focused on by the supervised model, and make up for the shortcomings of using a single unsupervised algorithm or a supervised model.

[0175] Optionally, the pruning module comprises:

[0176] The first pruning unit is configured to perform node-by-node iterative pruning on the current isomorphic graph to acquire a suspicious isomorphic graph;

[0177] The second pruning unit is configured to prune the suspicious isomorphic graph from the current isomorphic graph to acquire a new isomorphic graph, and stop all iteration operations when the number of acquired suspicious isomorphic graphs reaches the preset number, wherein the current isomorphic graph is the initial isomorphic graph, or a new isomorphic graph acquired after pruning the suspicious isomorphic graph from the initial isomorphic graph, or a new isomorphic graph acquired again after pruning the suspicious isomorphic graph from the new isomorphic graph.

[0178] Optionally, the first pruning unit comprises:

[0179] a pruning subunit configured to prune the nth network node from the current heterogeneous graph to obtain an nth candidate suspicious heterogeneous graph, wherein n is a positive integer less than or equal to a total number of network nodes in the current heterogeneous graph, n is sequentially increased by one, and n is initially set to 1;

[0180] a first determining subunit configured to determine a global suspicious degree of the nth candidate suspicious heterogeneous graph according to a preset suspicious degree determination rule;

[0181] a second determining subunit configured to select a candidate suspicious heterogeneous graph with a maximum global suspicious degree from all candidate suspicious heterogeneous graphs and determine the candidate suspicious heterogeneous graph as a suspicious heterogeneous graph.

[0182] Optionally, the nth candidate suspicious heterogeneous graph includes a plurality of network nodes and a plurality of edges, and the plurality of network nodes are divided into at least two types;

[0183] The first determining subunit includes:

[0184] a first determining layer configured to determine a preset type network node connected with the first edge and determine a number of edges connected with the preset type network node, wherein the preset type network node is one of the at least two types of network nodes;

[0185] a second determining layer configured to determine an edge suspicious degree of the first edge according to the number of edges connected with the preset type network node, wherein the first edge is any edge in the nth candidate suspicious heterogeneous graph;

[0186] a third determining layer configured to determine a node suspicious degree of a first network node in the nth candidate suspicious heterogeneous graph according to the edge suspicious degrees of all edges connected with the first network node, wherein the first network node is any network node in the nth candidate suspicious heterogeneous graph;

[0187] a fourth determining layer configured to determine a global suspicious degree of the nth candidate suspicious heterogeneous graph according to the node suspicious degrees of all network nodes in the nth candidate suspicious heterogeneous graph.

[0188] Optionally, the fraud community evaluation basis includes a model score corresponding to each network node and at least two fraud community judgment features;

[0189] The determining module specifically includes:

[0190] a first determining unit configured to determine a community model score of each suspicious community according to the model score corresponding to each network node;

[0191] a second determining unit configured to determine a community clustering degree of each suspicious community according to an intra-class similarity between the at least two fraud community judgment features;

[0192] The third determination unit is configured to determine the fraudulent community from all the suspicious communities according to the community model scores and the community aggregation degrees of all the suspicious communities.

[0193] Optionally, the device further comprises:

[0194] The initial suspicious degree determination module is configured to determine the node suspicious degrees of the network nodes in the initial heterogeneous graph and the initial global suspicious degree of the initial heterogeneous graph according to a preset suspicious degree determination rule.

[0195] The threshold determination module is configured to determine the batch pruning threshold according to the initial global suspicious degree.

[0196] The batch pruning module is configured to prune all the network nodes in the initial heterogeneous graph whose node suspicious degrees are less than the batch pruning threshold.

[0197] Optionally, the device further comprises:

[0198] The feature extraction module is configured to perform feature extraction on the network nodes in the fraudulent community to obtain fraudulent features.

[0199] The marking module is configured to mark the network nodes in the fraudulent community to obtain network nodes with fraudulent labels.

[0200] The optimization training module is configured to input the fraudulent features into the supervised model and perform optimization training on the supervised model according to the fraudulent labels.

[0201] Please refer to Figure 9 , Figure 9 is a structural schematic diagram of a fraudulent community discovery device provided by another embodiment of the present application.

[0202] As shown in Figure 9 , the fraudulent community discovery device 900 provided by the present embodiment comprises at least one processor 901, a memory 902, at least one network interface 903 and other user interfaces 904. The various components in the fraudulent community discovery device 900 are coupled together through a bus system 905. It can be understood that the bus system 905 is used to realize the connection communication between the components. In addition to the data bus, the bus system 905 also includes power buses, control buses and state signal buses. However, in order to clearly illustrate, all kinds of buses are marked as the bus system 905 in the Figure 5 .

[0203] Among them, the user interface 904 can include a display, a keyboard or a clicking device (for example, a mouse, a trackball, a touchpad or a touch screen, etc.).

[0204] It is to be appreciated that the memory 902 in the embodiments of the present application can be a volatile memory or a nonvolatile memory, or can include both volatile and nonvolatile memory. Among them, the nonvolatile memory can be a Read-Only Memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an Electrically EPROM (EEPROM), or a flash memory. The volatile memory can be a Random Access Memory (RAM) used as an external cache. By way of example, and not limitation, many forms of RAM can be used, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced SDRAM (ESDRAM), Synch link DRAM (SLDRAM), and Direct Rambus RAM (DRRAM). The memory 902 described herein is intended to include, without being limited to, these and any other suitable types of memory.

[0205] In some embodiments, the memory 902 stores the following elements, executable units or data structures, or a subset of them, or an extended set of them: an operating system 9021 and application programs 9022.

[0206] Among them, the operating system 9021 contains various system programs, such as framework layer, core library layer, driver layer, etc., for implementing various basic services and processing hardware-based tasks. The application programs 9022 contain various application programs, such as Media Player, Browser, etc., for implementing various application services. The programs for implementing the method embodiments of the present application can be contained in the application programs 9022.

[0207] In the embodiments of the present application, by calling the programs or instructions stored in the memory 902, specifically, the programs or instructions stored in the application programs 9022, the processor 901 is used to execute the method steps provided by each method embodiment, for example, including:

[0208] generating an initial heterogeneous graph according to a topological relationship of the plurality of network nodes;

[0209] inputting node parameters of the plurality of network nodes into a pre-constructed supervised model to obtain a fraud community judgment basis;

[0210] pruning the initial heterogeneous graph according to a preset pruning rule to obtain a preset number of suspicious heterogeneous graphs, and determining a community formed by all network nodes in each suspicious heterogeneous graph as a suspicious community;

[0211] determining whether each suspicious community is a fraud community according to the fraud community judgment basis.

[0212] Optionally, the pruning the initial heterogeneous graph according to the preset pruning rule to obtain the preset number of suspicious heterogeneous graphs comprises repeatedly performing the following iteration operations:

[0213] iteratively pruning the current heterogeneous graph node by node to obtain a suspicious heterogeneous graph;

[0214] and pruning the suspicious heterogeneous graph from the current heterogeneous graph to obtain a new heterogeneous graph, until the number of obtained suspicious heterogeneous graphs reaches the preset number, and stopping all iteration operations, wherein the current heterogeneous graph is the initial heterogeneous graph, or a new heterogeneous graph obtained by pruning the suspicious heterogeneous graph from the initial heterogeneous graph, or a new heterogeneous graph obtained again by pruning the suspicious heterogeneous graph from the new heterogeneous graph.

[0215] Optionally, the iteratively pruning the current heterogeneous graph node by node to obtain a suspicious heterogeneous graph comprises:

[0216] pruning the nth network node from the current heterogeneous graph to obtain an nth candidate suspicious heterogeneous graph, wherein n is a positive integer less than or equal to the total number of network nodes in the current heterogeneous graph, n is sequentially incremented, and the initial value of n is 1;

[0217] determining a global suspicious degree of the nth candidate suspicious heterogeneous graph according to a preset suspicious degree determination rule;

[0218] selecting a candidate suspicious heterogeneous graph with the largest global suspicious degree from all candidate suspicious heterogeneous graphs to determine as the suspicious heterogeneous graph.

[0219] Optionally, the nth candidate suspicious heterogeneous graph comprises a plurality of network nodes and a plurality of edges, and the plurality of network nodes are divided into at least two types.

[0220] determining a global suspicious degree of the new nth candidate suspicious heterogeneous graph according to the preset suspicious degree determination rule, comprising:

[0221] determine the edge suspicious degree of the first edge according to the number of edges connected with the preset type network node among the at least two types of network nodes, wherein the first edge is any edge connected with the preset type network node in the nth candidate suspicious heterogeneous graph;

[0222] determine the node suspicious degree of the first network node according to the edge suspicious degrees of all edges connected with the first network node in the nth candidate suspicious heterogeneous graph, wherein the first network node is any network node in the nth candidate suspicious heterogeneous graph;

[0223] determine the global suspicious degree of the nth candidate suspicious heterogeneous graph according to the node suspicious degrees of all network nodes in the nth candidate suspicious heterogeneous graph.

[0224] Optionally, the fraud community judgment basis comprises a model score corresponding to each network node and at least two fraud community judgment features.

[0225] According to the fraud community judgment basis, the method further comprises:

[0226] According to the model score corresponding to each network node in each suspicious community, a community model score of each suspicious community is determined.

[0227] According to the intra-class similarity between the network nodes in each suspicious community in the at least two fraud community judgment features, a community clustering degree is determined.

[0228] According to the community model score and the community clustering degree of each suspicious community, a fraud community is determined from all suspicious communities.

[0229] Optionally, before the initial heterogeneous graph is pruned according to the preset pruning rule to obtain a preset number of suspicious heterogeneous graphs, the method further comprises:

[0230] According to a preset suspicious degree determination rule, a node suspicious degree of each network node in the initial heterogeneous graph and an initial global suspicious degree of the initial heterogeneous graph are determined.

[0231] According to the initial global suspicious degree, a batch pruning threshold is determined.

[0232] All network nodes with a node suspicious degree less than the batch pruning threshold in the initial heterogeneous graph are pruned.

[0233] Optionally, after it is determined whether each suspicious community is a fraud community according to the fraud community judgment basis, the method further comprises:

[0234] Feature extraction is performed on the network nodes in the fraud community to obtain fraud features.

[0235] The network nodes in the fraud community are labeled to obtain network nodes with fraud labels.

[0236] The fraud features are input into the supervised model, and the supervised model is trained by optimizing according to the fraud labels.

[0237] The method disclosed by the embodiments of the present application can be applied to the processor 901 or implemented by the processor 901. The processor 901 can be an integrated circuit chip having a processing capability of signals. In the implementation process, each step of the above method can be completed by the integrated logic circuit of hardware in the processor 901 or the instruction in the form of software. The processor 901 described above can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component. Each method, step and logic block disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or executed by a combination of hardware and software units in the decoding processor. The software unit can be located in a random memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register and other mature storage media in the art. The storage medium is located in the memory 902, and the processor 901 reads the information in the memory 902 and combines the hardware to complete the steps of the above method.

[0238] It can be understood that the embodiments described herein can be realized by hardware, software, firmware, middleware, microcode or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), general purpose processors, controllers, microcontrollers, microprocessors, other electronic units for executing the functions of the present application or a combination thereof.

[0239] For software implementation, the techniques herein can be implemented by means of a unit for executing functions herein. Software codes can be stored in memory and executed by a processor. The memory can be implemented in or outside the processor.

[0240] The embodiments of the present application further provide a storage medium (computer readable storage medium). The storage medium herein stores one or more programs. The storage medium can include a volatile memory, such as a random access memory, and / or can include a non-volatile memory, such as a read-only memory, a flash memory, a hard disk, or a solid-state disk, and / or can include a combination thereof.

[0241] When the one or more programs stored in the storage medium are executed by the one or more processors, the above-mentioned fraud community discovery method performed on the side of the fraud community discovery device is implemented.

[0242] The processor is configured to execute the production node management program stored in the memory, so as to implement the following steps of the production node management method performed on the side of the ERP management server:

[0243] generating an initial heterogeneous graph according to the topological relationship of the plurality of network nodes;

[0244] inputting the node parameters of the plurality of network nodes into a pre-constructed supervised model to obtain a fraud community judgment basis;

[0245] pruning the initial heterogeneous graph according to a preset pruning rule, obtaining a preset number of suspicious heterogeneous graphs, and determining a community formed by all network nodes in each suspicious heterogeneous graph as a suspicious community;

[0246] determining whether each suspicious community is a fraud community according to the fraud community judgment basis.

[0247] Optionally, the pruning of the initial heterogeneous graph according to the preset pruning rule to obtain the preset number of suspicious heterogeneous graphs comprises repeatedly performing the following iteration operation:

[0248] iteratively pruning the current heterogeneous graph node by node to obtain a suspicious heterogeneous graph;

[0249] and pruning the suspicious heterogeneous graph from the current heterogeneous graph to obtain a new heterogeneous graph, until the number of obtained suspicious heterogeneous graphs reaches the preset number, and stopping all iteration operations, wherein the current heterogeneous graph is the initial heterogeneous graph, or is a new heterogeneous graph obtained after the suspicious heterogeneous graph is pruned from the initial heterogeneous graph, or is a new heterogeneous graph obtained again after the suspicious heterogeneous graph is pruned from the new heterogeneous graph.

[0250] Optionally, the iteratively pruning the current heterogeneous graph node by node to obtain a suspicious heterogeneous graph comprises:

[0251] cutting the n th network node from the current heterogeneous graph to obtain an n th candidate suspicious heterogeneous graph, wherein n is a positive integer less than or equal to the total number of network nodes in the current heterogeneous graph, n is sequentially taken as a value, and the initial value is 1;

[0252] determining the global suspicious degree of the n th candidate suspicious heterogeneous graph according to the preset suspicious degree determination rule;

[0253] selecting the candidate suspicious heterogeneous graph with the largest global suspicious degree from all candidate suspicious heterogeneous graphs to determine the suspicious heterogeneous graph.

[0254] Optionally, the n th candidate suspicious heterogeneous graph includes a plurality of network nodes and a plurality of edges, and the plurality of network nodes are divided into at least two types;

[0255] determining the global suspicious degree of the new n th candidate suspicious heterogeneous graph according to the preset suspicious degree determination rule, comprising:

[0256] determining the edge suspicious degree of the first edge according to the number of edges connected to the preset type network node in the at least two types of network nodes, wherein the first edge is any edge connected to the preset type network node in the n th candidate suspicious heterogeneous graph;

[0257] determining the node suspicious degree of the first network node according to the edge suspicious degrees of all edges connected to the first network node in the n th candidate suspicious heterogeneous graph, wherein the first network node is any network node in the n th candidate suspicious heterogeneous graph;

[0258] determining the global suspicious degree of the n th candidate suspicious heterogeneous graph according to the node suspicious degrees of all network nodes in the n th candidate suspicious heterogeneous graph.

[0259] Optionally, the fraud community judgment basis includes a model score corresponding to each network node and at least two fraud community judgment features;

[0260] determining whether each suspicious community is a fraud community according to the model score corresponding to each network node in the suspicious community, comprising:

[0261] determining a community model score of each suspicious community according to the model score corresponding to each network node in the suspicious community;

[0262] determining a community clustering degree according to the intra-class similarity between the network nodes in each suspicious community in the at least two fraud community judgment features;

[0263] determining the fraud community from all suspicious communities according to the community model score and the community clustering degree of each suspicious community.

[0264] Optionally, the method further comprises, before obtaining the preset number of suspicious heterogeneous graphs by pruning the initial heterogeneous graph according to the preset pruning rule.

[0265] determine a node suspicious degree of each network node in the initial heterogeneous graph and an initial global suspicious degree of the initial heterogeneous graph according to a preset suspicious degree determination rule;

[0266] determine a batch pruning threshold according to the initial global suspicious degree;

[0267] prune all network nodes in the initial heterogeneous graph whose node suspicious degree is less than the batch pruning threshold.

[0268] Optionally, after determining whether each suspicious community is a fraudulent community according to the fraudulent community judgment basis, the method further comprises:

[0269] perform feature extraction on the network nodes in the fraudulent community to obtain fraudulent features;

[0270] label the network nodes in the fraudulent community to obtain network nodes with fraudulent labels;

[0271] input the fraudulent features into a supervised model, and perform optimization training on the supervised model according to the fraudulent labels.

[0272] Those skilled in the art will further appreciate that the functions described herein can be implemented in hardware, software, or any combination thereof. If implemented in software, the functions can be stored on or transmitted over a computer-readable medium, such as random access memory (RAM), a magnetic floppy disk, a hard disk, or any other form of non-transitory storage medium known in the art. The functions described herein can be implemented in a centralized fashion in one computer system or in a distributed fashion where different elements are spread across several computer systems. Any kind of computer system or other apparatus adapted for carrying out the functions described herein is suited. A typical combination of hardware and software can be a general-purpose computer system with a computer program that, when being loaded and executed, controls the computer system such that it carries out the functions described herein.

[0273] The steps of a method or algorithm described in connection with the embodiments disclosed herein can be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module can reside in RAM, flash memory, ROM, electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. The storage medium can be coupled to the processor such that the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium can be integral to the processor. The processor and the storage medium can reside in an application-specific integrated circuit (ASIC).

[0274] The above detailed description has further described the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above is only a specific implementation of the present application, and is not used to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for fraud community discovery, the method comprising: The method comprises: generating an initial heterogeneous graph according to a topological relationship of a plurality of network nodes; the network nodes comprise the following types: merchant network nodes and consumer network nodes; a transaction relationship between the merchant network nodes and the consumer network nodes constitutes the topological relationship; inputting node parameters of the plurality of network nodes into a pre-constructed supervised model to obtain fraud community evaluation criteria; the node parameters represent feature parameters related to node objects; the node parameters of the merchant network nodes comprise at least one of the following: transaction volume, transaction amount, shipment volume, and logistics data; the node parameters of the consumer network nodes comprise at least one of the following: purchase volume, transaction amount, commodity information, and logistics data; the fraud community evaluation criteria comprise model scores respectively corresponding to each network node and at least two fraud community determination features; wherein the supervised model determines the suspicious degree of each network node according to the feature parameters, and scores each network node according to the suspicious degree to obtain the model score of each network node; pruning the initial heterogeneous graph according to a preset pruning rule to obtain a preset number of suspicious heterogeneous graphs, and determining a suspicious community corresponding to all network nodes in each suspicious heterogeneous graph as a suspicious community; determining a fraud community from all suspicious communities according to the fraud community evaluation criteria, comprising: determining a community model score of each suspicious community according to the model scores respectively corresponding to all network nodes; determining a community clustering degree of each suspicious community according to the intra-class similarity between the at least two fraud community determination features; and determining a fraud community from all suspicious communities according to the community model scores and the community clustering degrees respectively corresponding to all suspicious communities.

2. The fraudulent community discovery method of claim 1, wherein, The pruning of the initial heterogeneous graph according to the preset pruning rule to obtain a preset number of suspicious heterogeneous graphs comprises repeatedly performing the following iteration operation: iteratively pruning the current heterogeneous graph node by node to obtain a suspicious heterogeneous graph; and pruning the suspicious heterogeneous graph from the current heterogeneous graph to obtain a new heterogeneous graph, until the number of obtained suspicious heterogeneous graphs reaches the preset number, and stopping all iteration operations, wherein the current heterogeneous graph is the initial heterogeneous graph, or a new heterogeneous graph obtained after pruning a suspicious heterogeneous graph from the initial heterogeneous graph, or a new heterogeneous graph obtained again after pruning a suspicious heterogeneous graph from the new heterogeneous graph.

3. The fraudulent community discovery method of claim 2, wherein, The iteratively pruning of the current heterogeneous graph node by node to obtain a suspicious heterogeneous graph comprises: pruning the nth network node from the current heterogeneous graph to obtain an nth candidate suspicious heterogeneous graph, wherein n is a positive integer less than or equal to the total number of network nodes in the current heterogeneous graph, n is sequentially progressive, and the initial value of n is 1; determining the global suspicious degree of the nth candidate suspicious heterogeneous graph according to a preset suspicious degree determination rule; selecting the candidate suspicious heterogeneous graph with the largest global suspicious degree from all candidate suspicious heterogeneous graphs to determine the suspicious heterogeneous graph.

4. The fraudulent community discovery method of claim 3, wherein, The nth candidate suspicious heterogeneous graph comprises a plurality of network nodes and a plurality of edges, and the plurality of network nodes are divided into at least two types. The method further comprises: determining node suspicious degrees of each network node in the initial heterogeneous graph and an initial global suspicious degree of the initial heterogeneous graph according to a preset suspicious degree determination rule; determining a batch pruning threshold according to the initial global suspicious degree; pruning all network nodes in the initial heterogeneous graph whose node suspicious degrees are less than the batch pruning threshold. After determining whether each suspicious social group is a fraudulent social group according to the fraudulent social group judgment basis, the method further comprises:

5. The fraudulent community discovery method of claim 1, wherein, extracting features of network nodes in the fraudulent social group to obtain fraudulent features; labeling network nodes in the fraudulent social group to obtain network nodes with fraudulent labels; inputting the fraudulent features into the supervised model and optimizing and training the supervised model according to the fraudulent labels. The device comprises:

6. The fraudulent community discovery method of claim 1, wherein, a heterogeneous graph generation module configured to generate an initial heterogeneous graph composed of a plurality of network nodes according to a topological relationship of the plurality of network nodes; the network nodes include the following types: merchant network nodes and consumer network nodes; a transaction relationship between the merchant network nodes and the consumer network nodes constitutes the topological relationship; an acquisition module configured to input node parameters of the plurality of network nodes into a pre-constructed supervised model to acquire a fraudulent social group judgment basis; the node parameters represent feature parameters related to node objects; the node parameters of the merchant network nodes include at least one of the following: transaction volume, transaction amount, shipment volume, and logistics data; the node parameters of the consumer network nodes include at least one of the following: purchase volume, transaction amount, commodity information, and logistics data; the fraudulent social group judgment basis includes model scores respectively corresponding to each network node and at least two fraudulent social group judgment features; wherein the supervised model judges suspicious degrees of each network node according to the feature parameters and scores each network node according to the suspicious degrees to obtain the model scores of each network node; ​ ​ 7. A fraudulent community discovery apparatus, comprising: ​ ​ ​ a pruning module configured to prune the initial heterogeneous graph according to a preset pruning rule, to obtain a preset number of suspicious heterogeneous graphs, and to determine each suspicious community corresponding to a community formed by all network nodes in each of the suspicious heterogeneous graphs; a determining module configured to determine a fraud community from all suspicious communities according to the fraud community evaluation basis, including: determining a community model score of each suspicious community according to a model score respectively corresponding to each network node; determining a community clustering degree of each suspicious community according to an intra-class similarity between the at least two fraud community judgment features; and determining a fraud community from all suspicious communities according to the community model score and the community clustering degree respectively corresponding to all suspicious communities.

8. A fraudulent community discovery device, comprising: comprising: at least one processor and a memory; the processor is configured to execute a fraud community discovery program stored in the memory to implement the fraud community discovery method of any one of claims 1-6.

9. A computer storage medium, characterized in that the computer storage medium stores one or more programs executable by the fraud community discovery device of claim 8 to implement the fraud community discovery method of any one of claims 1-6.

Images