Fraud group identification method, device, server and storage medium

Abstract

The present application provides a fraud group identification method, device, server, and storage medium. This method obtains user access data to be processed, which has multiple characteristic attributes. Based on the user access data, a bipartite graph association network and a data feature space are established between the user and the access subject. The dimension of the data feature space is consistent with the number of characteristic attributes. Finally, based on the value distribution of each characteristic attribute in the data feature space, the full user group corresponding to the bipartite graph association network is identified, thereby determining the fraud group within the full user group. This technical solution, by constructing a feature space for user access data, detects fraudulent behavior in fraudulent groups from multiple dimensions, reducing the missed detection rate and improving detection accuracy.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of Internet technology, and in particular to a fraud group identification method, device, server, and storage medium. Background Art

[0002] With the development of internet technology, major online platforms, in order to attract incremental users, often offer discounts and subsidies in exchange for market share, distributing various types of coupons to users. While this approach can benefit users, it also fosters a large number of fraudulent players, some of whom have even developed into fraudulent groups. These groups exploit vulnerabilities through technical or manual means to obtain illegal profits, resulting in a significant loss of resources and defeating the original purpose of the activity. Therefore, effectively identifying fraudulent groups online is crucial to ensuring the normal operation of online platforms.

[0003] In the existing technology, the detection method of fraud groups is mainly based on manual experience rules. By analyzing historical fraud behaviors, the accounts of fraudulent users are determined, and then the account behavior performance information and key behavioral information of fraudulent users are analyzed, and the abnormal characteristics of fraudulent users are mined and summarized. Then, reliable rule strategies are integrated to intercept more risky fraud users and realize operational monitoring of activities.

[0004] However, in the process of realizing the present invention, the inventors found that there are at least the following problems in the prior art: the fraud detection method based on artificial experience rules mainly relies on the professional level and experience accumulation of practitioners, and the detection results are greatly affected by the professional level and experience accumulation of practitioners. In the increasingly complex adversarial environment, there is a problem of low detection accuracy. Summary of the Invention

[0005] The embodiments of the present application provide a fraud group identification method, device, server and storage medium to solve the problem of low accuracy in existing fraud group detection.

[0006] In a first aspect, an embodiment of the present application provides a method for identifying fraudulent groups, comprising:

[0007] Acquire user access data to be processed, where the user access data has multiple characteristic attributes;

[0008] Based on the user access data, a bipartite graph association network and a data feature space are established between the user and the access subject, where the dimension of the data feature space is consistent with the number of the feature attributes;

[0009] According to the value distribution of each characteristic attribute in the data feature space, the entire user group corresponding to the bipartite graph association network is identified, and the fraud group in the entire user group is determined.

[0010] In a possible design of the first aspect, identifying the full user group corresponding to the bipartite graph association network based on the value distribution of each feature attribute in the data feature space, and determining the fraudulent group in the full user group, includes:

[0011] A1. Determine the value distribution of each feature attribute in the data feature space;

[0012] A2. Determine a target deletion value from each value distribution based on the value distribution of each characteristic attribute, wherein after deleting the user corresponding to the target deletion value from the full user population, the significance index of the remaining user population relative to the full user population for the characteristic attribute is maximized, and the density of the data feature space increases after deleting the target deletion value;

[0013] A3. Delete the target deletion value from the value distribution of the corresponding characteristic attribute in the data feature space, and update the data feature space;

[0014] A4. Execute steps A1 to A3 for each characteristic attribute in the data feature space until the remaining values ​​of all characteristic attributes in the data feature space meet the preset conditions, thereby obtaining the last updated data feature space;

[0015] A5. Determine the user group corresponding to the last updated data feature space as the fraud group.

[0016] Optionally, the method further includes:

[0017] According to the preset number of abnormal groups, steps A1 to A5 are executed to determine the number of fraudulent groups with the abnormal number in the bipartite graph association network.

[0018] Optionally, determining a target deletion value from each value distribution according to the value distribution of each feature attribute includes:

[0019] According to the value distribution of each feature attribute, construct the minimum heap tree corresponding to each feature attribute;

[0020] For each minimum heap tree, based on the value of each root node in the minimum heap tree, calculate the density of the data feature space when each value is deleted and the significance index of the remaining user group and the full user group on the feature attribute after deleting the user corresponding to the value from the full user group;

[0021] According to the density of the data feature space when each value is deleted and the significance index of the remaining user group and the full user group on the feature attribute after deleting the user corresponding to the value from the full user group, the value with the largest significance index and increased density is used as the target deletion value.

[0022] Exemplarily, constructing a minimum heap tree corresponding to each feature attribute according to the value distribution of each feature attribute includes:

[0023] According to the value distribution of each feature attribute, determine the value of each feature attribute and the frequency of occurrence of each value;

[0024] Based on the assumption that the frequency of occurrence of the root node attribute value is less than or equal to the frequency of occurrence of the attribute values ​​of the left and right child nodes, a minimum heap tree corresponding to each feature attribute is constructed.

[0025] In another possible design of the first aspect, the density is the average quality of all spatial blocks to be detected in the data feature space, the average quality is the ratio of the quality of all spatial blocks to be detected to the number of spatial blocks to be detected, and the quality of the spatial blocks to be detected is the frequency of interaction between the user and the access subject on each feature attribute.

[0026] In another possible design of the first aspect, establishing a bipartite graph association network and a data feature space between users and access subjects based on the user access data includes:

[0027] Analyzing the user access data to determine the association between each user and the access subject, as well as the characteristic attributes carried by each user and the characteristic attributes carried by each access subject;

[0028] Constructing the bipartite graph association network according to the association relationship between each user and the access subject;

[0029] The data feature space is generated according to the feature attributes carried by each user and the feature attributes carried by each access subject.

[0030] In a second aspect, an embodiment of the present application provides a fraud group identification device, comprising: an acquisition module, a construction module, and a processing module;

[0031] The acquisition module is used to acquire user access data to be processed, wherein the user access data has multiple characteristic attributes;

[0032] The construction module is used to establish a bipartite graph association network and a data feature space between the user and the access subject based on the user access data, wherein the dimension of the data feature space is consistent with the number of the feature attributes;

[0033] The processing module is used to identify the full user group corresponding to the bipartite graph association network according to the value distribution of each characteristic attribute in the data feature space, and determine the fraud group in the full user group.

[0034] In a possible design of the second aspect, the processing module is specifically configured to:

[0035] A1. Determine the value distribution of each feature attribute in the data feature space;

[0036] A2. Determine a target deletion value from each value distribution based on the value distribution of each characteristic attribute, wherein after deleting the user corresponding to the target deletion value from the full user population, the significance index of the remaining user population relative to the full user population for the characteristic attribute is maximized, and the density of the data feature space increases after deleting the target deletion value;

[0037] A3. Delete the target deletion value from the value distribution of the corresponding characteristic attribute in the data feature space, and update the data feature space;

[0038] A4. Execute steps A1 to A3 for each characteristic attribute in the data feature space until the remaining values ​​of all characteristic attributes in the data feature space meet the preset conditions, thereby obtaining the last updated data feature space;

[0039] A5. Determine the user group corresponding to the last updated data feature space as the fraud group.

[0040] Optionally, the processing module is further configured to execute A1 to A5 according to a preset number of abnormal groups, and determine fraud groups with the abnormal number of groups in the bipartite graph association network.

[0041] Optionally, the processing module is configured to determine a target deletion value from each value distribution according to the value distribution of each feature attribute, specifically:

[0042] The processing module is specifically used to:

[0043] According to the value distribution of each feature attribute, construct the minimum heap tree corresponding to each feature attribute;

[0044] For each minimum heap tree, based on the value of each root node in the minimum heap tree, calculate the density of the data feature space when each value is deleted and the significance index of the remaining user group and the full user group on the feature attribute after deleting the user corresponding to the value from the full user group;

[0045] According to the density of the data feature space when each value is deleted and the significance index of the remaining user group and the full user group on the feature attribute after deleting the user corresponding to the value from the full user group, the value with the largest significance index and increased density is used as the target deletion value.

[0046] Exemplarily, the processing module is used to construct a minimum heap tree corresponding to each feature attribute according to the value distribution of each feature attribute, specifically:

[0047] The processing module is specifically used to:

[0048] According to the value distribution of each feature attribute, determine the value of each feature attribute and the frequency of occurrence of each value;

[0049] Based on the assumption that the frequency of occurrence of the root node attribute value is less than or equal to the frequency of occurrence of the attribute values ​​of the left and right child nodes, a minimum heap tree corresponding to each feature attribute is constructed.

[0050] In another possible design of the second aspect, the density is the average quality of all spatial blocks to be detected in the data feature space, the average quality is the ratio of the quality of all spatial blocks to be detected to the number of spatial blocks to be detected, and the quality of the spatial blocks to be detected is the frequency of interaction between the user and the access subject on each feature attribute.

[0051] In yet another possible design of the second aspect, the building block is specifically configured to:

[0052] Analyzing the user access data to determine the association between each user and the access subject, as well as the characteristic attributes carried by each user and the characteristic attributes carried by each access subject;

[0053] Constructing the bipartite graph association network according to the association relationship between each user and the access subject;

[0054] The data feature space is generated according to the feature attributes carried by each user and the feature attributes carried by each access subject.

[0055] In a third aspect, an embodiment of the present application provides a server comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method described in the first aspect and various possible designs is implemented.

[0056] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method described in the first aspect and various possible designs above.

[0057] The fraud group identification method, device, server, and storage medium provided in the embodiments of the present application obtain user access data to be processed, which has multiple characteristic attributes. Based on the user access data, a bipartite graph association network and a data feature space are established between the user and the access subject. The dimension of the data feature space is consistent with the number of characteristic attributes. Finally, based on the value distribution of each characteristic attribute in the data feature space, the full user group corresponding to the bipartite graph association network is identified, and the fraud group within the full user group is determined. This technical solution, by constructing a feature space for user access data, detects fraudulent behavior of fraudulent groups from multiple dimensions, reducing the missed detection rate and improving the detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0059] Figure 1 A schematic diagram of a scenario of a fraud group identification method provided in an embodiment of the present application;

[0060] Figure 2 A flowchart of a first embodiment of the fraud group identification method provided in an embodiment of the present application;

[0061] Figure 3 A flowchart of a second embodiment of the fraud group identification method provided in an embodiment of the present application;

[0062] Figure 4A A schematic diagram of the values ​​of multiple characteristic attributes of users and access subjects;

[0063] Figure 4B Based on Figure 4A A schematic diagram of the data feature space composed of the value information of multiple feature attributes;

[0064] Figure 5 A comparison diagram of the two distributions after deleting a certain value of the feature attribute of the i-th dimension;

[0065] Figure 6A A flowchart of a third embodiment of the fraud group identification method provided in an embodiment of the present application;

[0066] Figure 6B This is a schematic diagram of the construction of the minimum heap tree;

[0067] Figure 7 A schematic diagram of the structure of an embodiment of a fraud group identification device provided in an embodiment of the present application;

[0068] Figure 8 A schematic diagram of the structure of a server embodiment provided in an embodiment of the present application.

[0069] The above drawings illustrate specific embodiments of the present disclosure, which will be described in more detail below. These drawings and textual descriptions are not intended to limit the scope of the present disclosure in any way, but rather to illustrate the concepts of the present disclosure to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0070] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all possible embodiments consistent with the present disclosure. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present disclosure, as detailed in the appended claims.

[0071] First, the terms involved in the embodiments of this application are explained:

[0072] Info-map algorithm: It is a community discovery algorithm based on information theory. It uses random walks as an agent for information dissemination on the network. The corresponding data stream generated by random walks on the network is measured by the average codeword length generated by one random walk. An effective encoding method is used to compress the codeword length to achieve the purpose of optimal community division.

[0073] Fraudar: A graph-based fraud detection algorithm that can be used to identify fake followers and followers on social media. This algorithm is a bipartite graph algorithm that effectively combats fake fraud.

[0074] A bipartite graph, also known as a bipartite graph, is a special model in graph theory. The nodes in a bipartite graph consist of two independent sets of nodes, and there are no direct edges between nodes of the same type.

[0075] Minimum heap tree: It is a sorted complete binary tree in which the data value of any non-root node is no greater than the value of its left and right child nodes.

[0076] KS (Kolmogorov-Smirnov): KS test, based on the cumulative distribution function, is used to test whether an empirical distribution conforms to a certain theoretical distribution or to compare whether there are significant differences between two empirical distributions.

[0077] The following is a brief introduction to the background technology of this application.

[0078] With the rise of internet platforms, major platforms, in order to capture the benefits of incremental users, often offer discounts and subsidies in exchange for market share, distributing various types of coupons to users. While these methods benefit users, they also foster a large group of fraudulent players. These fraudulent players primarily refer to gangs that use technical or manual means to exploit vulnerabilities to obtain illegal profits.

[0079] As the scale of these activities continues to expand, scattered individuals gradually develop into organized gangs, and even become large-scale professional black industries. Fraud gangs use simulators to control a large number of accounts or operate a large number of devices through group control. Through the intelligence they gather, they continuously profit from major platforms. "Yangmao Gang" is a typical type of black industry group. To quickly obtain large profits, they use simulators to modify mobile devices, register a large number of accounts, control these accounts to participate in activities, collect profit points, and then cash in through effective channels.

[0080] These types of fraudulent activities, such as those involving black market operations, can lead to a significant loss of resources in a short period of time, preventing them from achieving their original objectives. Through continuous experimentation and relying on effective tools like emulators and mobile firewalls, these groups can effectively circumvent risk control strategies, rendering them ineffective and severely impacting the normal operation of various internet platforms. Therefore, it is necessary to detect and identify fraudulent activities on internet platforms.

[0081] Currently, the existing methods for fraud group detection can be summarized into three categories:

[0082] Method 1, based on manual experience rules, obtains the behavioral performance of users in the fraud group. By conducting a specific analysis of key information on user behavior, it mines and summarizes the abnormal characteristics of users in the fraud group, integrates them into a reliable rule strategy, and then intercepts more risky fraud users to achieve operational monitoring of activities.

[0083] In this approach, the quality of detection results depends primarily on the professional expertise and accumulated experience of practitioners. In the fight against illegal activities, personal experience and risk perception are often not always timely, and responses to new risk points are often not developed until after a case has occurred. Furthermore, personal experience cannot fully cover the entire fraud chain, and relatively one-sided rules can easily lead to misjudgments. Therefore, when defining rules, personal experience cannot accurately control the threshold of the rule. Overly loose thresholds can lead to a large number of users being misjudged as fraudulent, while overly strict rules can easily lead to fraudulent users being overlooked. Therefore, in the increasingly complex adversarial environment, the detection effect of manual experience rules is often poor.

[0084] Method 2: Unsupervised machine learning algorithms. This type of algorithm is widely used in fraud group detection scenarios, such as clustering algorithms. In this scenario, it is generally assumed that abnormal users that meet a certain pattern form independent and distinguishable groups. Therefore, user anomaly indicators can be constructed from multiple dimensions. When users are clustered due to abnormal indicators, the purpose of identifying fraud groups can be achieved.

[0085] Compared to manual experience, this method doesn't rely on accumulated historical experience and can detect abnormal fraud groups within a reliable feature space. However, unsupervised methods are unstable and contain many random factors. They also require high-quality features that can serve as anomaly indicators. Not all features can be incorporated into unsupervised models; only those that can effectively distinguish between normal and abnormal users are effective. Furthermore, the existing feature space may not cover the characteristics of users newly joining the fraud group.

[0086] Method 3, graph detection algorithm based on relational network, this type of algorithm can be divided into two types of graph construction methods: homogeneous graph and heterogeneous graph.

[0087] 1) User-based isomorphic graph fraud detection methods, such as the info-map algorithm, treat users as nodes and define relationships between users as edges. The definition of edges can integrate more business rules to realize a weighted relationship network. Effective aggregation degree evaluation indicators can be used to identify communities with high aggregation.

[0088] 2) Fraud detection methods based on heterogeneous graphs of users and interacting entities, such as the Fraudar detection algorithm, use a bipartite graph as the network structure, with users and interacting entities as nodes and the information about interacting entities that users follow as edges. This algorithm uses degree (threshold) as a metric to evaluate the subgraph formed by users and interacting entities, which provides strong resistance to disguised edge relationships and improves accuracy.

[0089] In other words, graph detection methods based on relationship networks can identify clusters based on user relationships and accurately identify fraudulent groups within a user population, demonstrating good stability and high accuracy. This type of algorithm assesses group fraud risk by calculating the frequency of user behavior, but it fails to consider the user role attributes within the scenario and the distribution of user behavior characteristics. Furthermore, when deleting incidental information, it fails to consider whether this information can enhance the results. Optimizing solely for clustering can overlook the representation of the feature information space, leading to misidentification of some users.

[0090] From the above analysis, we can see that as the confrontation with fraud groups such as black industries continues to escalate, the patterns of group fraud are changing rapidly. The above methods all have low detection and identification accuracy and the risk of misidentification.

[0091] In response to the above problems, the inventors of this application have discovered in practice that, in the absence of historical label data, if the user information and scenario information in the user access data to be processed can be fully utilized, the fraud group can be identified based on the constructed feature space, thereby detecting fraudulent behavior. Therefore, the technical conception process of this application is as follows: based on the user information and scenario information carried by the user access data, a feature space can be constructed. Then, while optimizing the feature space, a significance index is introduced to adjust the optimization direction, preventing continuous optimization on the same spatial dimension while ignoring other feature dimensions. While ensuring that the output results belong to a high-density group, the output results can also be distinguished from normal users in a multi-dimensional space, thereby ensuring the effectiveness and accuracy of the recognition results.

[0092] It is understood that in the embodiment of the present application, normal users refer to all users in the groups to be analyzed except the abnormal group, whose performance in a certain feature dimension is dispersed or normal. The normal user group is a group composed of normal users.

[0093] Based on the above conceptual process, the technical solution provided by the embodiments of this application is as follows: by obtaining user access data to be processed, which has multiple characteristic attributes, a bipartite graph association network and a data feature space are established based on the user access data, between users and access entities. The dimension of this data feature space is consistent with the number of characteristic attributes. Finally, based on the value distribution of each characteristic attribute in the data feature space, the full user population corresponding to the bipartite graph association network is identified, and fraudulent groups within the full user population are determined. By constructing a feature space for user access data, this technical solution detects fraudulent behavior in fraudulent groups from multiple dimensions, reducing the missed detection rate and improving detection accuracy.

[0094] For example, Figure 1 This is a schematic diagram of a scenario of a fraud group identification method provided in an embodiment of the present application. Figure 1 As shown, the scenario may include: a server 11 and multiple terminal devices that interact with the server 11 for information. Figure 1 Three terminal devices are given as an example, namely terminal device 121, terminal device 122 and terminal device 123.

[0095] Optionally, an application client is installed on each of the above-mentioned terminal devices, and a user can access a certain subject through the application client installed on the terminal device. For example, in a marketing scenario, the application client can be an e-commerce APP, and the subject can be a marketing activity published on the e-commerce website, etc. In an entertainment scenario, the application client can be a ticketing website, and the subject can be various conferences published on the ticketing website, etc. The embodiment of the present application does not limit the form of the application client installed on the terminal device, nor does it limit the specific implementation of the subject of user interaction, which can be determined according to the actual scenario and will not be repeated here.

[0096] In an embodiment of the present application, the server 11 may be a server corresponding to the above-mentioned application client. When the user performs corresponding operations through the terminal device, some data will be generated on the server, such as order information, user behavior data, user access data, user information, subject information, etc. The server captures information within a preset time period and can extract useful information for performing fraud group detection from all the information generated on the server, such as user access data.

[0097] It is understandable that in the embodiments of the present application, a user may register multiple account information on a device through illegal means, thereby becoming a fraudulent user. A group formed by many fraudulent users is called a fraud group.

[0098] Optionally, in an embodiment of the present application, the server 11 can execute the fraud user identification method provided in the present application on the acquired user access data to identify the fraud group present in the target website. The specific implementation of this technical solution can be found in the description of the following embodiment and will not be repeated here.

[0099] The following specific embodiments describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0100] For example, Figure 2 This is a flow chart of the first embodiment of the fraud group identification method provided in the present application. Figure 1 The server in the scenario diagram is used as the execution subject for explanation. Figure 2 As shown, the method may include the following steps:

[0101] S201: Obtain user access data to be processed, where the user access data has multiple characteristic attributes.

[0102] In real-world applications, when a user logs in to an application client through a terminal device, the corresponding server typically records the subject information accessed by the user, known as user access data. Over time, the server will record a large amount of information about the subjects accessed by a large number of users through their terminal devices, representing a large amount of user access data.

[0103] In an embodiment of the present application, when it is necessary to analyze users who access certain entities and identify whether a fraud group is formed among these users, the server can obtain the user access data to be processed from the recorded data set to analyze and identify the user access data, thereby determining the fraud group.

[0104] It is understandable that since users will leave a large amount of incidental information in the process of accessing the subject, such as user personal attribute information, geographic location information, network information, activity scene information, etc., these information are all characteristic attributes of user access data. Therefore, the user access data used in this application is data with multiple characteristic attributes.

[0105] S202: Based on the above user access data, a bipartite graph association network and a data feature space between the user and the access subject are established.

[0106] The dimension of the data feature space is consistent with the number of feature attributes.

[0107] In an embodiment of the present application, when the server obtains user access data, it can first determine the user and access subject in the user access data, and then use the user and access subject as nodes and the user's access to the access subject as the edge relationship to establish a bipartite graph association network between the user and the access subject.

[0108] Exemplarily, the server processes the user access data to determine feature data corresponding to the user and feature data corresponding to the access subject, and then generates a data feature space based on the feature data corresponding to the user and the feature data corresponding to the access subject.

[0109] It can be understood that the sum of the dimensions of the user's corresponding feature data and the dimensions of the access subject's corresponding feature data is equal to the dimension of the feature attributes of the user's access data. Therefore, the dimension of the data feature space is consistent with the number of feature attributes of the user's access data.

[0110] For example, in the above embodiment, step S202 may be implemented by the following steps:

[0111] A1. Analyze user access data to determine the association between each user and the access subject, as well as the characteristic attributes carried by each user and the characteristic attributes carried by each access subject.

[0112] Optionally, the server analyzes each piece of user access data obtained to determine the association between the user and the access subject, that is, which subjects each user accessed, or which users accessed each subject.

[0113] Furthermore, by analyzing the multiple characteristic attributes carried in the user access data, it is determined which characteristic attributes are the characteristic attributes written by the user and which are the characteristic attributes carried by the access subject, thereby laying the foundation for the subsequent construction of the data feature space.

[0114] A1. Based on the association relationship between each user and the access subject, a bipartite graph association network is constructed.

[0115] Illustratively, in an embodiment of the present application, the server constructs a bipartite graph association network with users and access subjects as node sets respectively, and user access subjects as edge relationships.

[0116] A3. Generate a data feature space based on the feature attributes carried by each user and the feature attributes carried by each access subject.

[0117] In a bipartite graph association network, each feature attribute is distributed to different dimensions, and multiple feature attributes are associated in multiple dimensions to generate a data feature space.

[0118] S203. According to the value distribution of each characteristic attribute in the data feature space, the entire user group corresponding to the bipartite graph association network is identified to determine the fraud group in the entire user group.

[0119] Optionally, after constructing the data feature space corresponding to the user access data, the server can also perform statistics on the user access data to determine the value distribution of each feature attribute, for example, the value of each feature attribute and the frequency of occurrence of each value, and then determine the value distribution of each feature attribute based on the value of each feature attribute and the frequency of occurrence of each value.

[0120] Exemplarily, the server can analyze each characteristic attribute separately according to the value distribution of each characteristic attribute in the above-mentioned data feature space, determine the spatial block with the highest density in the data feature space, and then delete normal users from the full user group corresponding to the bipartite graph association network based on the impact of each value of each characteristic attribute on the data feature space, thereby determining the fraud group in the full user group.

[0121] For the specific implementation of this step, please refer to the following Figure 3 The description in the illustrated embodiment will not be repeated here.

[0122] From the above analysis, it can be seen that the technical solution of this application is mainly used to perform group detection on the data feature space constructed by user access data with multiple characteristic attributes. It not only takes into account the bipartite graph association relationship between users and access subjects, but also takes into account the accompanying effective information of users and access subjects to construct a data feature space and identify fraud groups from the dimension of spatial density and the significance difference between groups.

[0123] The fraud group identification method provided in the embodiments of the present application obtains user access data to be processed, which has multiple characteristic attributes. Based on the user access data, a bipartite graph association network and a data feature space are established between the users and the access subjects. The dimension of the data feature space is consistent with the number of characteristic attributes. Finally, based on the value distribution of each characteristic attribute in the data feature space, the full user group corresponding to the bipartite graph association network is identified, thereby determining the fraud group within the full user group. By constructing a feature space for user access data, this technical solution detects fraudulent behavior of fraudulent groups from multiple dimensions, reducing the missed detection rate and improving the detection accuracy.

[0124] For example, based on the above embodiment, Figure 3 This is a flow chart of the second embodiment of the fraud group identification method provided in the embodiment of this application. Figure 3 As shown, the above S203 can be implemented by the following steps:

[0125] S301: Determine the value distribution of each feature attribute in the data feature space.

[0126] Optionally, after constructing the data feature space corresponding to the user access data, the server performs statistics on the user access data. Once the characteristic attributes of each piece of user access data are determined, the server can then determine the value distribution of each characteristic attribute. For example, taking the user's age as an example, assuming that the values ​​of age range from 20 to 50, the specific values ​​of this attribute are: [45, 25, 40, 35, 20, 30, 25, 30, 35, 25, 40, 25, 30, 35, 25, 20, 30...]. The frequency of occurrence of each value in this attribute can be calculated. Specifically, the values ​​and frequencies are [45:1, 25:5, 40:2, 35:3, 20:2, 30:4]. Therefore, [45:1, 25:5, 40:2, 35:3, 20:2, 30:4] can be expressed as the value distribution of this attribute.

[0127] It is understandable that the method for determining the value distribution of other characteristic attributes is similar and will not be described in detail here.

[0128] S302: According to the value distribution of each characteristic attribute, determine a target deletion value from each value distribution.

[0129] Among them, after deleting the user corresponding to the target deletion value from the full user group, the significance index of the remaining user group and the full user group on the feature attribute is the largest, and the density of the data feature space increases after deleting the target deletion value.

[0130] Optionally, in an embodiment of the present application, after constructing the data feature space, the density may be set as the average quality of the data feature space, and the significance index may be set as the difference index between two groups in a certain dimension of the feature space.

[0131] Therefore, in an embodiment of the present application, the value distribution of each characteristic attribute in the data feature space can be calculated in turn, and the degree of influence of each value on the data feature space when the value is deleted can be calculated. The significance index of the remaining user group and the full user group on the characteristic attribute after deleting the user corresponding to each value in the full user group corresponding to the bipartite graph association network is calculated, and the density of the data feature space after deleting each value is calculated.

[0132] Optionally, based on the frequency of users and access entities, the abnormality of the fraud group, and the degree of fraud, the index with the largest significance index and increased density can be used as the target deletion value in the data feature space.

[0133] It can be understood that in the embodiments of the present application, the above-mentioned density can be understood as the average quality of all spatial blocks to be detected in the data feature space. The average quality is the ratio of the quality of all spatial blocks to be detected to the number of spatial blocks to be detected. The quality of the spatial blocks to be detected is the frequency of interaction between the user and the access subject on each feature attribute.

[0134] For example, after constructing the data feature space based on multiple characteristic attributes of the user access data, the space block composed of each dimension of characteristic attributes is called the space block to be detected. Figure 4A A schematic diagram of the values ​​of multiple characteristic attributes of users and access subjects. Figure 4B Based on Figure 4A Schematic diagram of the data feature space composed of the value information of multiple feature attributes.

[0135] Optional, Figure 4A It shows the relationship between the characteristic attributes of users, access subjects and devices used, and the quality represents the interaction frequency of the spatial blocks to be detected in each dimension. Figure 4A As shown, by analyzing the user access data, the space block x to be detected corresponding to user 1-access subject A-using device 1 can be determined. aThe quality of y1z1 is 2, user 2 - access subject A - uses the corresponding detected space block x of device 1 a The quality of y2z1 is 3, user 1 - access subject B - using device 1 corresponding to the detected space block x b The quality of y1z1 is 4, user 2 - access subject B - uses the corresponding detected space block x of device 1 b The quality of y2z1 is 6, user 3 - access subject C - uses the corresponding detected spatial block x of device 2 c The mass of y3z2 is 2. Therefore, based on Figure 4A The data shown in the figure, the constructed data feature space is as follows Figure 4B As shown, the x-axis represents the access subject, the y-axis represents the user, and the z-axis represents the device used.

[0136] Optional, Figure 4B The spatial block x to be detected in the data feature space shown a y1z1,x a y2z1、x b y2z1、x a The average quality of y2z1 is the sum of the quality of the spatial block to be detected / (the number of data blocks of the spatial block to be detected)=(2+4+6+3) / 4=3.75.

[0137] Alternatively, the significance index can be determined using the KS (Kolmogorov-Smirnov) test, which tests whether the data conform to a certain distribution. This test compares a frequency distribution f(x) with a theoretical distribution g(x). Because the KS test does not require knowledge of the data distribution, it is considered a nonparametric test.

[0138] In the examples of this application, a KS test is used to evaluate whether the significant difference between the distribution of the remaining feature attributes and the original distribution of the feature attributes in the i-th dimension is improved after deleting the value k of the feature attribute in the i-th dimension. If it is effectively improved, it means that after deleting the value of the feature attribute, the distribution of the remaining feature attributes is significantly different from the original distribution and behaves more abnormally, ensuring the correctness of the optimization direction.

[0139] For example, Figure 5 The following is a comparison diagram of two distributions after deleting a certain value of the feature attribute of the i-th dimension. Figure 5 As shown, assuming that the original distribution of the i-th dimension data feature is g(x), the distribution after deleting the value k is f(x). According to Figure 5 From the cumulative distribution curves of f(x) and g(x) shown, it can be seen that the maximum vertical difference between the two curves is the maximum significant difference between the two data distributions, that is, the vertical difference D between the two distributions is the significant difference.

[0140] S303: Delete the target deletion value from the value distribution of the corresponding characteristic attribute in the data feature space, and update the data feature space.

[0141] For example, after determining the target deletion value in the distribution of values ​​for each feature attribute, the server deletes the target deletion value from the data feature space. Specifically, the server deletes the user information corresponding to the target deletion value from the entire user group corresponding to the bipartite graph association network. Furthermore, updating the data feature space lays the foundation for subsequent deletion of values ​​in a feature attribute.

[0142] Furthermore, in an embodiment of the present application, after S303, steps S301 to S303 may be repeated for each characteristic attribute in the data feature space until the remaining values ​​of all characteristic attributes in the data feature space meet the preset conditions, thereby obtaining the last updated data feature space. That is, in S304, the last updated data feature space is obtained.

[0143] It can be understood that by traversing the N-dimensional features of the data feature space, the following operation is performed for each dimension of the data feature space: after deleting the records with a value equal to ai in the value distribution of the dimension feature, the density of the remaining spatial blocks to be detected is calculated, and the significance index of the remaining user group and the full user group in the feature dimension after deleting the user with a value ai is calculated. The above operation is repeated until all the values ​​in the feature attributes are traversed and no values ​​are deleted, and the data feature space is updated for the last time. Optionally, ai is any value in the value distribution of the dimension feature.

[0144] S305: Determine the user group corresponding to the last updated data feature space as a fraud group.

[0145] In an embodiment of the present application, after the operations S301 to S304 above, the server deletes unimportant values ​​in the bipartite graph association network, and correspondingly eliminates normal users from the entire user group. The remaining user group is the optimal fraud group and also the group with the highest density.

[0146] Further, such as Figure 3 As shown, if the user sets the number of abnormal groups to be identified, the method may further include the following steps:

[0147] According to the preset number of abnormal groups, return to execute the above S301, that is, loop through steps S301 to S305, so as to obtain the result of S306;

[0148] That is, S306 , determining a fraud group with an abnormal number of groups in the bipartite graph association network.

[0149] Optionally, if the number of abnormal groups is k (greater than or equal to 1), the server will execute S301 to S305 in a loop until k fraudulent groups are output.

[0150] From the above analysis, it can be seen that the embodiment of the present application combines the solutions of dense group identification and effective fraud judgment. While optimizing the data feature space, it uses the significance index to adjust the optimization direction to prevent continuous optimization in the same spatial dimension while ignoring other feature dimensions. While ensuring the high density of the output results, it also makes the output results distinguishable from normal in the multi-dimensional space, thereby ensuring the effectiveness and accuracy of the recognition results.

[0151] For example, based on the above embodiment, Figure 6A This is a flow chart of the third embodiment of the fraud group identification method provided in the embodiment of this application. Figure 6A As shown, the above S302 can be implemented by the following steps:

[0152] S601: Construct a minimum heap tree corresponding to each feature attribute according to the value distribution of each feature attribute.

[0153] In an embodiment of the present application, in order to facilitate subsequent determination of the degree of influence of each value of each feature attribute on the data feature space, the server may construct a minimum heap tree corresponding to each feature attribute after determining the value distribution of each feature attribute.

[0154] Optionally, in an embodiment of the present application, step S601 may be implemented by the following steps:

[0155] According to the value distribution of each feature attribute, determine the value of each feature attribute and the frequency of occurrence of each value;

[0156] Based on the assumption that the frequency of occurrence of the root node attribute value is less than or equal to the frequency of occurrence of the attribute values ​​of the left and right child nodes, a minimum heap tree corresponding to each feature attribute is constructed.

[0157] Specifically, for the N characteristic attributes of the user access data, N minimum heap trees need to be constructed. Optionally, the minimum heap tree is a sorted complete binary tree, where the value of each node is no greater than the value of the left and right child nodes.

[0158] Exemplarily, the value distribution of the i-th dimension characteristic attribute of the user access data is taken as an example to illustrate how to construct a minimum heap tree. The i-th dimension characteristic attribute is any one-dimensional data in the multi-dimensional characteristic attributes of the user access data. Assume that the value of the i-th dimension characteristic attribute is [45, 25, 40, 35, 20, 30, 25, 30, 35, 25, 40, 25, 30, 35, 25, 20, 30]. Correspondingly, in the value distribution corresponding to the i-th dimension characteristic attribute, the frequency of occurrence of each value in the value distribution of the characteristic attribute is counted. Specifically, the value and frequency of occurrence are [45: 1, 25: 5, 40: 2, 35: 3, 20: 2, 30: 4]. The order of constructing the minimum heap tree based on the frequency of each attribute value is as follows. Figure 6B shown.

[0159] For example, Figure 6B This is a diagram of the construction of the minimum heap tree. Figure 6B As shown, [45:1, 25:5, 40:2, 35:3, 20:2, 30:4] is allocated according to the order of values, and the minimum heap tree established is as follows Figure 6B As shown in (a), in the sub-heap trees corresponding to 25:5, 35:3 and 20:2, the frequency of 25:5 is greater than 20:2, so, Figure 6B In (b) of the figure, the positions of 25:5 and 20:2 in the heap tree are adjusted, and finally the following is obtained: Figure 6B Schematic diagram in (c).

[0160] S602. For each minimum heap tree, based on the value of each root node in the minimum heap tree, calculate the density of the data feature space when each value is deleted and the significance index of the remaining user group and the full user group on the feature attribute after deleting the user corresponding to the value from the full user group.

[0161] In an embodiment of the present application, the attribute value of the smallest root node in the minimum heap tree can first be used as the alternative deletion value on the feature attribute, that is, the density and significance index of the data feature space when each value is deleted is calculated in sequence from the alternative deletion value.

[0162] Optionally, after a certain value is deleted, first determine the density of the data feature space when the value is deleted, and then determine the remaining user group after deleting the user corresponding to the value from the full user group, and calculate the difference between the remaining user group and the full user group in the feature attribute, and use it as the significance indicator of the feature attribute.

[0163] S603. Based on the density of the data feature space when each value is deleted and the significance index of the remaining user group and the full user group on the feature attribute after deleting the user corresponding to the value from the full user group, the value with the largest significance index and increased density is selected as the target deletion value.

[0164] Optionally, in an embodiment of the present application, the feature attribute value with the greatest significance and increased density index is selected for deletion in a greedy manner, that is, the optimal option that can be deleted on the feature attribute, thereby obtaining a local optimal solution in a certain sense.

[0165] The fraud group identification method provided in the embodiment of the present application constructs a minimum heap tree and calculates the significance index and significance index when each value on each feature attribute is deleted. It can quickly and accurately determine the target deletion value, providing a basis for subsequently obtaining the fraud group.

[0166] For example, the following briefly introduces a scheme for dense group identification and effective fraud judgment for group fraud patterns in a marketing scenario. In this scenario, the access subject is an activity.

[0167] Among them, the dense group identification solution: in the group fraud model of marketing scenarios, the fraud group frequently pays attention to and visits the same activity or multiple activities, accumulating a large amount of interactive information in a short period of time. However, due to the particularity of the marketing scenario, when the activity is released, there will also be a large number of normal users' access records. Fraudulent users are mixed with normal users in large numbers, making them difficult to identify, thereby achieving the purpose of fraud.

[0168] However, fraudulent users will leave behind a large amount of incidental information during their visits, such as user personal attribute information, geographic location information, network information, activity scene information, etc. If we use this information to construct a data feature space while building a bipartite graph association network, the frequency of user interaction in activities under the same data feature space can be used as the quality of the data feature space, and the density of each spatial block to be detected in the data feature space can be calculated.

[0169] In practical applications, to ensure that the server can identify highly dense fraud groups, unimportant information items in the bipartite graph association network can be deleted from different dimensions, that is, the material of a certain characteristic attribute can be deleted to highlight the information dimension with high density. The characteristic attributes of each dimension can be traversed step by step, and the values ​​of the characteristic attributes that make the density of the data feature space the largest can be selected for deletion, thereby ensuring that the algorithm is optimized in the direction of highly concentrated fraud groups. When all information dimensions are concentrated on a certain outlier value, the dense group is output as the fraud group.

[0170] Effective Fraud Detection Solution: The dense group identification solution described above considers group identification solely based on the density of the feature space, without taking into account the degree of abnormality or fraud within the group. The optimization result may result in highly abnormal clustering along one dimension, but dispersed and normal behavior along other feature dimensions. Therefore, in practical applications, it is necessary not only to consider the density of the feature space but also the differences between the identified group and a large number of normal groups to ensure interpretability of the results.

[0171] Therefore, in the embodiments of the present application, each time an information item is selected for deletion (i.e., a value in the distribution of values ​​for a certain characteristic attribute), the significance index of the remaining user group after deletion, relative to the significance index of the entire user group on that characteristic attribute dimension, is calculated, and the information item with the largest difference is selected for deletion. This avoids the problem of dense group identification schemes continuously optimizing only on a single dimension, thereby ignoring other dimensions, while also ensuring that the ultimately identified group has both a high density and a high degree of abnormality.

[0172] As can be seen from the above analysis, the technical solution proposed in this application is a graph computation method that utilizes feature information space, capable of identifying fraudulent groups within bipartite graph association networks. This solution designs an algorithm optimization direction based on spatial density. To avoid single-dimensional optimization, horizontal comparisons are performed across multiple dimensional spaces. This allows for the detection of group fraud from multiple dimensions, reducing missed detection rates and improving accuracy. Furthermore, a significance metric is introduced. While optimizing for maximum density, the overall results are considered for abnormality and the optimization direction is adjusted. This ensures that the output is a fraud group that is significantly different from normal groups, thus ensuring the accuracy of the output results.

[0173] The following are device embodiments of the present application, which can be used to implement the method embodiments of the present application. For details not disclosed in the device embodiments of the present application, please refer to the method embodiments of the present application.

[0174] Figure 7 This is a schematic diagram of the structure of the fraud group identification device embodiment provided in the present application. Figure 7 As shown, the device may include: an acquisition module 701, a construction module 702 and a processing module 703.

[0175] The acquisition module 701 is used to acquire user access data to be processed, wherein the user access data has multiple characteristic attributes;

[0176] A construction module 702 is configured to establish a bipartite graph association network and a data feature space between the user and the access subject based on the user access data, wherein the dimension of the data feature space is consistent with the number of the feature attributes;

[0177] The processing module 703 is configured to identify the entire user group corresponding to the bipartite graph association network according to the value distribution of each characteristic attribute in the data feature space, and determine the fraudulent group in the entire user group.

[0178] In a possible design of the embodiment of the present application, the processing module 703 is specifically configured to:

[0179] A1. Determine the value distribution of each feature attribute in the data feature space;

[0180] A2. Determine a target deletion value from each value distribution based on the value distribution of each characteristic attribute, wherein after deleting the user corresponding to the target deletion value from the full user population, the significance index of the remaining user population relative to the full user population for the characteristic attribute is maximized, and the density of the data feature space increases after deleting the target deletion value;

[0181] A3. Delete the target deletion value from the value distribution of the corresponding characteristic attribute in the data feature space, and update the data feature space;

[0182] A4. Execute steps A1 to A3 for each characteristic attribute in the data feature space until the remaining values ​​of all characteristic attributes in the data feature space meet the preset conditions, thereby obtaining the last updated data feature space;

[0183] A5. Determine the user group corresponding to the last updated data feature space as the fraud group.

[0184] Exemplarily, the processing module 703 is further configured to execute A1 to A5 according to a preset number of abnormal groups, and determine fraud groups with the abnormal number of groups in the bipartite graph association network.

[0185] Optionally, the processing module 703 is configured to determine a target deletion value from each value distribution according to the value distribution of each characteristic attribute, specifically:

[0186] The processing module 703 is specifically configured to:

[0187] According to the value distribution of each feature attribute, construct the minimum heap tree corresponding to each feature attribute;

[0188] For each minimum heap tree, based on the value of each root node in the minimum heap tree, calculate the density of the data feature space when each value is deleted and the significance index of the remaining user group and the full user group on the feature attribute after deleting the user corresponding to the value from the full user group;

[0189] According to the density of the data feature space when each value is deleted and the significance index of the remaining user group and the full user group on the feature attribute after deleting the user corresponding to the value from the full user group, the value with the largest significance index and increased density is used as the target deletion value.

[0190] Optionally, the processing module 703 is configured to construct a minimum heap tree corresponding to each feature attribute according to the value distribution of each feature attribute, specifically:

[0191] The processing module 703 is specifically configured to:

[0192] According to the value distribution of each feature attribute, determine the value of each feature attribute and the frequency of occurrence of each value;

[0193] Based on the assumption that the frequency of occurrence of the root node attribute value is less than or equal to the frequency of occurrence of the attribute values ​​of the left and right child nodes, a minimum heap tree corresponding to each feature attribute is constructed.

[0194] In another possible design of an embodiment of the present application, the density is the average quality of all spatial blocks to be detected in the data feature space, the average quality is the ratio of the quality of all spatial blocks to be detected to the number of spatial blocks to be detected, and the quality of the spatial blocks to be detected is the frequency of interaction between the user and the access subject on each feature attribute.

[0195] In another possible design of the embodiment of the present application, the construction module 702 is specifically configured to:

[0196] Analyzing the user access data to determine the association between each user and the access subject, as well as the characteristic attributes carried by each user and the characteristic attributes carried by each access subject;

[0197] Constructing the bipartite graph association network according to the association relationship between each user and the access subject;

[0198] The data feature space is generated according to the feature attributes carried by each user and the feature attributes carried by each access subject.

[0199] The above-mentioned device is used to implement the technical solution in the aforementioned method embodiment. Its implementation principle and technical effects are similar and will not be repeated here.

[0200] It should be noted that it should be understood that the division of the various modules of the above device is merely a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. Moreover, these modules can all be implemented in the form of software called by a processing element; they can also all be implemented in the form of hardware; or some modules can be implemented in the form of software called by a processing element, and some modules can be implemented in the form of hardware. For example, the processing module can be a separately established processing element, or it can be integrated into a chip of the above device. In addition, it can also be stored in the memory of the above device in the form of program code, and called by a processing element of the above device to perform the functions of the above processing module. The implementation of other modules is similar. In addition, these modules can all or partly be integrated together, or they can be implemented independently. The processing element described here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each of the above modules can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.

[0201] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)).

[0202] Figure 8 This is a schematic diagram of the structure of the server embodiment provided in the embodiment of this application. Figure 8As shown, the server may include: a processor 801, a memory 802, a communication interface 803 and a system bus 804. The memory 802 and the communication interface 803 are connected to the processor 801 through the system bus 804 and complete communication with each other. The memory 802 is used to store computer execution instructions, and the communication interface 803 is used to communicate with other devices. When the processor 801 executes the computer execution instructions, the technical solution described in the method embodiment is implemented.

[0203] Optionally, in an embodiment of the present application, the server may further include a display interface 805 , which may be used to display the determined fraudulent group.

[0204] In this Figure 8 In the embodiment, the processor 801 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0205] The memory 802 may include a random access memory (RAM), a read-only memory (RAM), or a non-volatile memory (non-volatile memory), such as at least one disk storage.

[0206] The communication interface 803 is used to implement communication between the database access apparatus and other devices (such as clients, read-write libraries, and read-only libraries).

[0207] The system bus 804 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. A system bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of illustration, the figure shows only one thick line, but this does not imply that there is only one bus or only one type of bus.

[0208] Optionally, an embodiment of the present application further provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed on a computer, the computer executes the technical solution described in the above method embodiment.

[0209] Optionally, an embodiment of the present application further provides a chip for executing instructions, wherein the chip is used to execute the technical solution described in the above method embodiment.

[0210] An embodiment of the present application also provides a program product, which includes a computer program, which is stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium, and when the at least one processor executes the computer program, it can implement the technical solution described in the above method embodiment.

[0211] In this application, "at least one" means one or more, and "more" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship; in the formula, the character " / " indicates that the previous and next associated objects are in a "division" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items.

[0212] It is understood that the various numerical numbers involved in the embodiments of the present application are only for the convenience of description and are not intended to limit the scope of the embodiments of the present application. In the embodiments of the present application, the order of the sequence numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0213] Other embodiments of the present disclosure will readily occur to those skilled in the art after considering the specification and practicing the applications disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, with the true scope and spirit of the present disclosure being indicated by the following claims.

[0214] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A fraud group identification method, characterized in that: include: Acquire user access data to be processed, where the user access data has multiple characteristic attributes; Based on the user access data, a bipartite graph association network is established between the users and the access subjects, and a data feature space is generated based on the characteristic attributes carried by each user and the characteristic attributes carried by each access subject, where the dimension of the data feature space is consistent with the number of the characteristic attributes; Identifying the entire user population corresponding to the bipartite graph association network based on the value distribution of each characteristic attribute in the data feature space, and determining the fraudulent group within the entire user population; The step of identifying the entire user group corresponding to the bipartite graph association network based on the value distribution of each characteristic attribute in the data feature space and determining the fraudulent group in the entire user group includes: Determining a target deletion value from each value distribution based on the value distribution of each characteristic attribute, wherein after deleting the user corresponding to the target deletion value from the full user population, the significance index of the remaining user population and the full user population on the characteristic attribute is the largest, and the density of the data feature space after deleting the target deletion value increases; Deleting the target deletion value from the value distribution of the corresponding feature attribute in the data feature space, and updating the data feature space; For each characteristic attribute in the data feature space, the target deletion value is determined and deleted repeatedly until the remaining values ​​of all characteristic attributes in the data feature space meet the preset conditions, and the user group corresponding to the last updated data feature space is determined as the fraud group.

2. The method according to claim 1, characterized in that The method further comprises: According to a preset number of abnormal groups, fraud groups having the abnormal number of groups are determined in the bipartite graph association network.

3. The method according to claim 1, characterized in that Based on the value distribution of each feature attribute, the target deletion value is determined from each value distribution, including: According to the value distribution of each feature attribute, construct the minimum heap tree corresponding to each feature attribute; For each minimum heap tree, based on the value of each root node in the minimum heap tree, calculate the density of the data feature space when each value is deleted and the significance index of the remaining user group and the full user group on the feature attribute after deleting the user corresponding to the value from the full user group; According to the density of the data feature space when each value is deleted and the significance index of the remaining user group and the full user group on the feature attribute after deleting the user corresponding to the value from the full user group, the value with the largest significance index and increased density is used as the target deletion value.

4. The method according to claim 3, characterized in that The step of constructing a minimum heap tree corresponding to each feature attribute according to the value distribution of each feature attribute includes: According to the value distribution of each feature attribute, determine the value of each feature attribute and the frequency of occurrence of each value; Based on the assumption that the frequency of occurrence of the root node attribute value is less than or equal to the frequency of occurrence of the attribute values ​​of the left and right child nodes, a minimum heap tree corresponding to each feature attribute is constructed.

5. The method according to any one of claims 1 to 4, characterized in that The density is the average quality of all spatial blocks to be detected in the data feature space. The average quality is the ratio of the quality of all spatial blocks to be detected to the number of spatial blocks to be detected. The quality of the spatial blocks to be detected is the frequency of interaction between the user and the access subject on each feature attribute.

6. The method according to any one of claims 1 to 4, characterized in that The step of establishing a bipartite graph association network between the user and the access subject based on the user access data includes: Analyze the user access data to determine the association relationship between each user and the access subject; The bipartite graph association network is constructed according to the association relationship between each user and the access subject.

7. A fraud group identification device, characterized in that: include: Acquisition modules, construction modules, and processing modules; The acquisition module is used to acquire user access data to be processed, wherein the user access data has multiple characteristic attributes; The construction module is used to establish a bipartite graph association network and a data feature space between the user and the access subject based on the user access data, wherein the dimension of the data feature space is consistent with the number of the feature attributes; The processing module is configured to identify the entire user group corresponding to the bipartite graph association network based on the value distribution of each characteristic attribute in the data feature space, and determine the fraudulent group in the entire user group; The processing module is specifically configured to: determine a target deletion value from each value distribution based on the value distribution of each feature attribute, wherein after deleting the user corresponding to the target deletion value from the full user group, the significance index of the remaining user group and the full user group on the feature attribute is the largest, and the density of the data feature space after deleting the target deletion value increases; Deleting the target deletion value from the value distribution of the corresponding feature attribute in the data feature space, and updating the data feature space; For each characteristic attribute in the data feature space, determining and deleting the target deletion value is repeated until the remaining values ​​of all characteristic attributes in the data feature space meet the preset conditions, and the user group corresponding to the last updated data feature space is determined as the fraud group.

8. The device according to claim 7, characterized in that The processing module is further configured to determine, based on a preset number of abnormal groups, fraud groups having the abnormal number of groups in the bipartite graph association network.

9. The device according to claim 7, characterized in that The processing module is used to determine the target deletion value from each value distribution according to the value distribution of each feature attribute, specifically: The processing module is specifically used to: According to the value distribution of each feature attribute, construct the minimum heap tree corresponding to each feature attribute; For each minimum heap tree, based on the value of each root node in the minimum heap tree, calculate the density of the data feature space when each value is deleted and the significance index of the remaining user group and the full user group on the feature attribute after deleting the user corresponding to the value from the full user group; According to the density of the data feature space when each value is deleted and the significance index of the remaining user group and the full user group on the feature attribute after deleting the user corresponding to the value from the full user group, the value with the largest significance index and increased density is used as the target deletion value.

10. The device according to claim 9, characterized in that The processing module is used to construct a minimum heap tree corresponding to each feature attribute according to the value distribution of each feature attribute, specifically: The processing module is specifically used to: According to the value distribution of each feature attribute, determine the value of each feature attribute and the frequency of occurrence of each value; Based on the assumption that the frequency of occurrence of the root node attribute value is less than or equal to the frequency of occurrence of the attribute values ​​of the left and right child nodes, a minimum heap tree corresponding to each feature attribute is constructed.

11. The device according to any one of claims 7 to 10, characterized in that: The density is the average quality of all spatial blocks to be detected in the data feature space. The average quality is the ratio of the quality of all spatial blocks to be detected to the number of spatial blocks to be detected. The quality of the spatial blocks to be detected is the frequency of interaction between the user and the access subject on each feature attribute.

12. The device according to any one of claims 7 to 10, characterized in that: The building blocks are specifically used for: Analyze the user access data to determine the association relationship between each user and the access subject; The bipartite graph association network is constructed according to the association relationship between each user and the access subject.

13. A server comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 6 is implemented.

14. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

15. A computer program product, characterized in that The computer program product stores computer-executable instructions, which, when executed by a processor, are used to implement the method according to any one of claims 1 to 6.

Images