Abnormal node determination method, storage medium and program product

Abstract

This application provides an abnormal node determination method, storage medium, and program product. The abnormal node determination method includes: obtaining an initial graph network, wherein the nodes in the initial graph network include device nodes corresponding to electronic devices and account nodes corresponding to user accounts, and the edges between nodes in the initial graph network are determined based on the correspondence between electronic devices and user accounts; performing random walks using the nodes in the initial graph network as initial nodes to obtain node sequences; performing topic clustering on the node sequences according to the subgraph structures corresponding to the node sequences to obtain topic cluster groups, and determining the subgraph structures corresponding to the topic cluster groups with the highest number of node sequences as target subgraph structures; reconstructing the graph network based on the node sequences corresponding to the target subgraph structures; and determining abnormal nodes based on the reconstruction results. This embodiment saves labor and training costs while ensuring accuracy.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to an abnormal node determination method, a storage medium, and a program product. Background Art

[0002] Abnormal devices, also known as black market devices or gray market devices, refer to electronic devices used by people who make profits through improper means such as registering spam accounts on the Internet. This profit-making behavior will lead to many adverse effects. For example, it will cause merchants to invest a lot of money but fail to attract real customers. The false visits generated in the profit-making process will interfere with the merchants and further affect their decision-making.

[0003] Usually, neural network models are trained based on the behavioral characteristics of abnormal devices, and anomalies are discovered based on the trained neural network models. However, as users of abnormal devices continue to adjust their strategies, risk control personnel or other technical personnel also need to continuously add new behavioral characteristics to train the neural network model in order to discover abnormal devices, which greatly increases the training cost of the model and also makes the gain of discovering abnormal devices grow logarithmically.

[0004] In view of this, a technical problem that needs to be urgently solved in the prior art is how to provide a solution for quickly identifying abnormal devices. Summary of the invention

[0005] In view of this, an embodiment of the present application provides a solution for determining an abnormal node to at least partially solve the above problem.

[0006] According to a first aspect of an embodiment of the present application, a method for determining an abnormal node is provided, comprising: obtaining an initial graph network, wherein the nodes in the initial graph network include device nodes corresponding to electronic devices and account nodes corresponding to user accounts, and the edges between the nodes in the initial graph network are determined according to the correspondence between the electronic devices and the user accounts; taking the nodes in the initial graph network as initial nodes, performing random walks with the edges between the nodes as paths, and obtaining a node sequence corresponding to the initial nodes; subject-clustering the node sequence according to a subgraph structure corresponding to the node sequence, obtaining a corresponding plurality of subject clustering groups and a corresponding number of node sequences, and determining the subgraph structure corresponding to the subject clustering group with the number of node sequences in the front row as a target subgraph structure; reconstructing the graph network based on the node sequence corresponding to the target subgraph structure, and determining the abnormal nodes in the initial graph network according to the reconstruction result.

[0007] According to a second aspect of an embodiment of the present application, a computer storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the abnormal node determination method as described above is implemented.

[0008] According to a third aspect of an embodiment of the present application, a computer program product is provided, comprising computer instructions, wherein the computer instructions instruct a computing device to execute operations corresponding to the abnormal node determination method as described above.

[0009] According to the abnormal node determination scheme provided in the embodiment of the present application, the nodes in the acquired initial graph network include device nodes corresponding to electronic devices and account nodes corresponding to user accounts. The edges between the nodes in the initial graph network are determined according to the corresponding relationship between the electronic device and the user account. Thus, the relationship between the user account and the electronic device can be reflected through the structure in the initial graph network. Then, the node in the initial graph network is used as the initial node, and the edge between the nodes is used as the path for random walk to obtain the node sequence corresponding to the initial node; the node sequence is clustered according to the subgraph structure corresponding to the node sequence, and the corresponding multiple subject clustering groups and the corresponding number of node sequences are obtained, and the subgraph structure corresponding to the subject clustering group with the number of node sequences in the front is determined as the target subgraph structure. Since the number of people who profit from black production is small compared with ordinary users, the number of node sequences corresponding to the electronic devices and user accounts owned by people who profit from black production is also small. Therefore, the determined target subgraph structure is the target subgraph structure corresponding to ordinary users. The graph network is reconstructed based on the node sequence corresponding to the target subgraph structure, so that the subgraph structure corresponding to the person who profited from black production can be discarded as much as possible during the reconstruction process, and then the abnormal nodes in the initial graph network can be determined according to the reconstruction results. In addition, the scheme provided in the embodiment of the present application can identify abnormal nodes based on the subgraph structure of the node sequence, without the need to manually analyze the profit-making behavior, and without pre-training the graph neural network model, which greatly saves labor costs and training costs, and ensures the accuracy of identifying abnormal nodes. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0011] Figure 1A A flowchart of a method for determining an abnormal node according to Embodiment 1 of the present application;

[0012] Figure 1B for Figure 1A A schematic diagram of an example scenario in the illustrated embodiment;

[0013] Figure 2AThis is a flowchart of a method for determining an abnormal node according to Embodiment 2 of the present application;

[0014] Figure 2B for Figure 2A A schematic diagram of a neighborhood subgraph in the illustrated embodiment;

[0015] Figure 2C for Figure 2A A schematic diagram of a random walk in the illustrated embodiment;

[0016] Figure 2D for Figure 2A A schematic diagram of an anonymous random walk in the illustrated embodiment;

[0017] Figure 2E for Figure 2A A schematic diagram of a node with regular equivalence nodes in the illustrated embodiment;

[0018] Figure 2F for Figure 2A A schematic diagram of an attention structure information set corresponding to an initial node in the illustrated embodiment;

[0019] Figure 2G for Figure 2A A schematic diagram of an example scenario in the illustrated embodiment;

[0020] Figure 3 It is a structural block diagram of an abnormal node determination device according to Embodiment 3 of the present application;

[0021] Figure 4 This is a schematic diagram of the structure of an electronic device according to the fourth embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the embodiments of the present application should fall within the scope of protection of the embodiments of the present application.

[0023] The specific implementation of the embodiment of the present application is further explained below in conjunction with the accompanying drawings of the embodiment of the present application.

[0024] Figure 1A A flowchart of a method for determining an abnormal node provided in an embodiment of the present application is shown in the figure, which includes:

[0025] S101. Obtain an initial graph network.

[0026] The nodes in the initial graph network include device nodes corresponding to electronic devices and account nodes corresponding to user accounts, and the edges between the nodes in the initial graph network are determined according to the corresponding relationship between the electronic devices and the user accounts.

[0027] Generally speaking, in order to accurately identify abnormal devices, specialized technicians or risk control personnel will study the behavior of the device and determine possible black market behaviors based on the research results, and train the neural network model based on this. However, if the black market gang finds that one profit-making method cannot be executed, it will quickly switch to other profit-making methods, resulting in the need to invest a large number of specialized technicians or risk control personnel to analyze the new profit-making method and train the neural network model again based on the research results. As the profit-making methods continue to change, it is necessary to continuously invest a large amount of resources in research and continuously increase the features of the neural network model, which greatly increases the cost and difficulty of identifying abnormal devices.

[0028] However, due to the limited resources of the black market gangs, in order to improve efficiency, they usually log in a large number of accounts on abnormal devices, and then profit by switching accounts and the IP addresses of the accounts. Ordinary users generally log in a limited number of accounts and have a relatively fixed login pattern.

[0029] Since the rules for electronic devices of black market gangs to log in to user accounts are completely different from those of ordinary users, in this embodiment, an initial graph network is constructed with electronic devices and user accounts as nodes and the correspondence between electronic devices and user accounts as edges, so that the rules for electronic devices to log in to user accounts can be directly reflected through the graph structure in the initial graph network, and abnormal nodes can be identified through subsequent steps based on structural differences, and then the electronic devices corresponding to the black market gangs can be determined according to the abnormal nodes.

[0030] The initial graph network may include two types of nodes. The nodes corresponding to electronic devices are called device nodes, and corresponding device identifiers can be added to the nodes; the nodes corresponding to user accounts are called account nodes, and corresponding account identifiers can be added to the nodes.

[0031] The edges between nodes in the initial graph network are determined based on the correspondence between the electronic device and the user account. For example, if the user account is logged in on the electronic device, an edge is added between the account node corresponding to the user account and the device node corresponding to the electronic device.

[0032] S102: Taking the nodes in the initial graph network as initial nodes, and performing random walks with the edges between the nodes as paths, to obtain a node sequence corresponding to the initial nodes.

[0033] In this embodiment, the initial node is used as the starting point, and the edges between the nodes are used as the paths to perform random walks, so that the node sequence corresponding to the initial node can be obtained. An initial node can correspond to one or more node sequences, which is not limited in this embodiment.

[0034] In addition, the specific implementation method of performing random walk can refer to the relevant technology, and this embodiment will not be repeated here.

[0035] S103, the node sequence is thematically clustered according to the subgraph structure corresponding to the node sequence, a corresponding plurality of thematic clustering groups and a corresponding number of node sequences are obtained, and the subgraph structure corresponding to the thematic clustering group with the largest number of node sequences is determined as the target subgraph structure.

[0036] The subgraph structure corresponding to the node sequence may be a structure formed by the node sequence. For example, the sequence [1->2->3->1] in the node sequence [0->1->2->3->1] corresponds to a triangle structure; and the sequence [1->2->1->3->1] in the node sequence [0->1->2->1->3->1] corresponds to a tree structure.

[0037] In this embodiment, the corresponding subgraph structure can be determined according to the node sequence, and the node sequence can be clustered based on the subgraph structure to obtain multiple topic clustering groups. Specifically, clustering can be performed according to the subgraph structure of the node sequence through a trained neural network model, the input of the neural network can be the node sequence, and the output can be the topic corresponding to the node sequence. The specific method of performing topic clustering can refer to the relevant technology, and this embodiment will not be repeated here.

[0038] After obtaining multiple subject clustering groups, the subgraph structures respectively included in the multiple subject clustering groups can be determined, thereby determining the number of node sequences corresponding to the subject clustering groups, and the subgraph structure corresponding to the subject clustering group with the largest number of node sequences can be determined as the target subgraph structure.

[0039] Compared with the number of electronic devices and user accounts of ordinary users, the number of electronic devices and user accounts owned by people who profit from illegal activities is small, that is, the device nodes and account nodes corresponding to people who profit from illegal activities account for a small proportion in the initial graph network, and their number in the node sequence obtained by random walk is also small. Therefore, in this embodiment, the subgraph structure corresponding to the topic clustering group with the largest number of node sequences is determined as the target subgraph structure, which can be used as the target subgraph structure corresponding to ordinary users.

[0040] S104: Reconstruct a graph network based on a node sequence corresponding to the target subgraph structure, and determine abnormal nodes in the initial graph network according to the reconstruction result.

[0041] The graph network is reconstructed based on the node sequence corresponding to the target subgraph structure, that is, the graph network is reconstructed according to the target subgraph structure corresponding to ordinary users. Thus, the abnormal nodes corresponding to the people who profit from illegal activities in the initial graph network can be directly determined based on the reconstruction results.

[0042] Specifically, the graph network reconstruction may be performed as follows: for a node in the initial graph network that serves as an initial node, based on a node sequence that takes the node as a starting point, the partial graph network corresponding to the node that performs random walk (e.g., the neighborhood subgraph of the node) is reconstructed. Correspondingly, the reconstruction result corresponding to the node may include the reconstructed subgraph corresponding to the node (e.g., the reconstructed neighborhood subgraph of the node), or the difference between the reconstructed subgraph and the partial graph network corresponding to the node that performs random walk. Based on the difference, it can be determined whether the node is an abnormal node in the initial network. For example, if the difference between the reconstructed subgraph and the partial graph network corresponding to the node that performs random walk is greater than a preset difference, the node can be determined as an abnormal node.

[0043] Specifically, in this embodiment, a graph network sample and a reconstruction model for graph network reconstruction can be determined. In the training stage of the reconstruction model, a sample sequence can be obtained by random walk based on the graph network sample, and the sample sequence can be input into the reconstruction model, and the reconstruction model reconstructs the graph network based on the reconstruction parameters and the sample sequence, and outputs the reconstructed graph network; then, the difference between the sample graph network and the reconstructed graph network can be calculated based on the loss function, and the reconstruction parameters of the reconstruction model can be adjusted based on the difference until the difference between the sample graph network and the reconstructed graph network is less than a preset value.

[0044] During the usage phase, the node sequence corresponding to the target subgraph structure, with the node as the starting point, can be input into the reconstruction model. The reconstruction model determines the reconstructed subgraph corresponding to the node based on the reconstruction parameters, and then continues to determine the difference between the reconstructed subgraph and the partial graph network corresponding to the node that undergoes random walk, and determines whether the node is an abnormal node in the initial network based on the difference between the reconstructed subgraph and the partial graph network corresponding to the node that undergoes random walk.

[0045] Of course, the above is only an example, and other methods that can reconstruct the graph network are also within the scope of protection of this application. Other methods for reconstructing can refer to related technologies and will not be described in detail here.

[0046] The solution of the present application is exemplified below through a specific implementation scenario.

[0047] In this embodiment, information of all electronic devices that visit a preset shopping website within one day and user account information may be collected.

[0048] After that, the initial graph network can be constructed with the electronic device as the device node, the user account as the account node, and the corresponding relationship between the electronic device and the user account as the edge. The constructed graph network can be Figure 1B Of course, Figure 1B The graph network in the figure is only for illustrative purposes. In actual use, the number of nodes in the graph network may be tens of millions or hundreds of millions. Since the graph network is constructed directly based on the correspondence between electronic devices and user accounts as edges, there is no need to perform similarity calculations, which greatly reduces the amount of calculations required for the graph network construction process.

[0049] After the graph network is established, the nodes in the initial graph network can be used as initial nodes for random walks to obtain the node sequence corresponding to the initial nodes. The obtained node sequence can be Figure 1B As shown in the middle, the node sequence in each box corresponds to the same initial node.

[0050] According to the subgraph structure corresponding to the node sequence, the node sequence can be clustered by subject, and multiple subject clustering groups and the number of node sequences corresponding to the subject clustering groups can be obtained. Figure 1B As shown, a subject clustering group may include multiple ones, for example, family, friends, etc. A subject clustering group may include multiple subgraph structures, for example, a family subject clustering group may include multiple subgraph structures, and the proportion of each subgraph structure in the subject clustering group to which it belongs may also be determined.

[0051] In this embodiment, the subgraph structure corresponding to the topic clustering group with the largest number of node sequences can be determined as the target subgraph structure, such as Figure 1B As shown, the node sequence for reconstruction can be determined according to the target subgraph structure, and the graph network can be reconstructed based on the node sequence corresponding to the target subgraph structure. Thus, the graph network can be reconstructed according to the target subgraph structure corresponding to ordinary users, and the nodes where reconstruction abnormalities occur can be determined as abnormal nodes.

[0052] In the solution provided in this embodiment, the nodes in the obtained initial graph network include device nodes corresponding to electronic devices and account nodes corresponding to user accounts. The edges between the nodes in the initial graph network are determined according to the corresponding relationship between the electronic devices and the user accounts. Therefore, the relationship between the user account and the electronic device can be reflected through the structure in the initial graph network. Then, the node in the initial graph network is used as the initial node, and the edges between the nodes are used as the path for random walk to obtain the node sequence corresponding to the initial node; the node sequence is thematically clustered according to the subgraph structure corresponding to the node sequence, and the corresponding multiple topic clustering groups and the corresponding number of node sequences are obtained, and the subgraph structure corresponding to the topic clustering group with the number of node sequences in the front is determined as the target subgraph structure. Since the number of people who profit from black production is small compared with ordinary users, the number of node sequences corresponding to the electronic devices and user accounts owned by people who profit from black production is also small. Therefore, the determined target subgraph structure is the target subgraph structure corresponding to ordinary users. The graph network is reconstructed based on the node sequence corresponding to the target subgraph structure, so that the subgraph structure corresponding to the person who profited from black production can be discarded as much as possible during the reconstruction process, and then the abnormal nodes in the initial graph network can be determined according to the reconstruction results. In addition, the scheme provided in the embodiment of the present application can identify abnormal nodes based on the subgraph structure of the node sequence, without the need to pre-train the graph neural network model, and without manual analysis of the profit-making behavior, which greatly saves labor costs and ensures the accuracy of identifying abnormal nodes.

[0053] The abnormal node determination method of this embodiment can be executed by any appropriate electronic device with data processing capability, including but not limited to: a server, a mobile terminal (such as a mobile phone, a PAD, etc.) and a PC, etc.

[0054] Figure 2A A flowchart of a method for determining an abnormal node provided in an embodiment of the present application is shown in the figure, which includes:

[0055] S201. Construct an initial graph network with electronic devices as device nodes, user accounts as account nodes, and corresponding relationships between the electronic devices and user accounts as edges.

[0056] Specifically, an initial graph network G(V,E) is constructed, wherein V is a set of nodes, the nodes may include device nodes and account nodes, the device nodes may be identified by the umid of the electronic device, the account nodes may be identified by the accountid of the user account, and E is a set of edges, and edges may be included between umids and accountids having corresponding relationships.

[0057] The specific method of constructing a graph network can be referred to related technologies and will not be described in detail here.

[0058] S202: Taking a node in the initial graph as an initial node, determining a neighborhood subgraph of the initial node, performing a random walk in the neighborhood subgraph using edges between nodes as paths, and obtaining a node sequence corresponding to the initial node.

[0059] In this embodiment, random walk can be performed based on the second-order neighborhood subgraph of the initial node.

[0060] K-order proximity: refers to a function that captures the k-hop relationship between each pair of vertices. The neighborhood can include first-order neighborhood, second-order neighborhood, etc. The second-order neighborhood subgraph in this embodiment can be as follows: Figure 2B As shown, nodes v1, v2, v3, v4, and v5 are the first-order neighbors of vi, and nodes v6, v7, v8, v9, v10, v11, and v12 are the second-order neighbors of vi.

[0061] The process of random walking based on the neighborhood subgraph can be described as follows Figure 2C As shown, each arrow indicates the direction of the walk, and the number on the arrow indicates the number of steps walked. Figure 2C As shown in Figure 1, starting from the initial node vi, the first step of walking is performed until the 12th step is terminated, and a node sequence including 13 nodes can be obtained. Figure 2C Shown in brackets below.

[0062] Optionally, in this embodiment, multiple device nodes in the initial graph network may be used as initial nodes, and anonymous random walks may be performed using the edges between the nodes as paths to obtain node sequences corresponding to the multiple device nodes.

[0063] By taking the device node as the initial node, the node sequence corresponding to each device node can be determined, which greatly reduces the number of node sequences, and thus greatly reduces the amount of calculation required for subsequent topic clustering of the node sequences. In the subsequent steps, calculations can be performed directly using the device node as a unit, and abnormal nodes can be determined from the device nodes, thereby improving the accuracy of the determined abnormal nodes.

[0064] Anonymous random walks can, for example, obtain an initial node sequence through random walks. For any initial node sequence, the initial node is recorded as 0, the first node that has never appeared after the initial node is recorded as 1, the second node that has never appeared is recorded as 2, and so on, until the last node, the node sequence after anonymization can be obtained. For example, the initial node sequence [0->9->8->11->9] can be obtained through random walks, and the node sequence obtained after anonymization can be [0->1->2->3->1]. By performing anonymous random walks, the node order in the obtained node sequence can be directly compared to determine the node sequence with the same subgraph structure, which reduces the amount of calculation for the topic clustering process.

[0065] like Figure 2D As shown in the figure, after obtaining the initial node sequence through random walks, the initial node sequence can be anonymized to obtain a node sequence based on anonymous random walks. Then, the node sequence can be filtered through NMF selection to filter out the node sequence corresponding to the relatively long-tail subgraph structure. In the subsequent steps, the node sequence retained after filtering can be further clustered for topics.

[0066] S203 , calling a latent Dirichlet allocation (LDA) topic model, and performing topic clustering on the node sequence according to a subgraph structure corresponding to the node sequence to obtain a plurality of topic clustering groups.

[0067] A topic cluster group includes multiple subgraph structures belonging to the topic.

[0068] In this embodiment, through the latent Dirichlet distribution LDA topic model, a corresponding topic can be assigned to each subgraph structure first, and the probability P(subgraph structure|topic) of the subgraph structure appearing under the topic can be calculated, and the probability P(initial node|topic) corresponding to the initial node and the topic can be determined based on the topic assigned to the node sequence corresponding to each initial node. Finally, by multiplying the two probabilities, it is converted into a joint distribution of node sequence-initial node-topic.

[0069] Based on the above content, continuous iteration can be performed to assign the subgraph structure to the topic with the highest probability, that is, the label corresponding to the subgraph structure can remain stable. At the same time, the union of the subgraph structure, the initial node, and the topic can be determined.

[0070] S204. Determine the number of node sequences corresponding to the subject clustering group according to the subgraph structure included in the subject clustering group, and determine the subgraph structure corresponding to the subject clustering group with the largest number of node sequences as the target subgraph structure.

[0071] The specific implementation method of this step can refer to the above embodiment and will not be repeated here.

[0072] S205. For any initial node, determine a node sequence corresponding to the target subgraph structure from the node sequence corresponding to the initial node, reconstruct a neighborhood subgraph corresponding to the initial node according to the determined node sequence, and determine whether the initial node is an abnormal node according to the reconstructed neighborhood reconstructed subgraph.

[0073] Specifically, in this embodiment, the neighborhood subgraph corresponding to each initial node can be reconstructed according to the node sequence corresponding to the target subgraph structure to obtain a neighborhood reconstruction subgraph, and the neighborhood subgraph is a neighborhood subgraph used for random walk.

[0074] Suppose the adjacency matrix of the neighborhood subgraph of the initial node A is Y, and the node sequence set used to reconstruct the initial node A is U, where Y=Uφ, φ is the coefficient matrix.

[0075] Define Σ=Σ(YY T )=Σ(Uφφ T U T ), the process of reconstruction is hope That is, to obtain That is, the reconstructed adjacency matrix is The neighborhood reconstruction subgraph can be characterized.

[0076] For the specific reconstruction method, please refer to the relevant technology, which will not be described in detail here.

[0077] For abnormal nodes, since the node sequence corresponding to the node is not used for reconstruction, the process of reconstructing the neighborhood subgraph of the node fails. Therefore, the initial node that fails to be reconstructed can be determined as an abnormal node according to the reconstruction result.

[0078] Optionally, in this embodiment, if the difference between the neighborhood reconstructed subgraph and the neighborhood subgraph corresponding to the initial node is greater than a preset difference, the initial node is determined as an abnormal node.

[0079] Specifically, a preset difference ε can be set. If It can be determined that the reconstruction is successful, where “||||” indicates the request Compute the norm of the matrix.

[0080] Furthermore, the method further comprises: if the initial node is determined to be an abnormal node, then other initial nodes having a similar structure to the neighborhood subgraph of the initial node are determined as abnormal nodes. Thus, the number of abnormal nodes determined can be increased, and the efficiency of determining abnormal nodes is improved.

[0081] Optionally, in this embodiment, if the device node in the initial graph network is used as an initial node for random walk, and, the method further includes:

[0082] S206: Obtain a historical request sequence of the electronic device corresponding to the device node.

[0083] The historical request sequence includes historical requests of the electronic device to access a preset network address.

[0084] In this embodiment, the historical request sequence can represent the continuous actions of the electronic device to access the preset network address. By splicing the sequence, the access action of the electronic device and the vector representation of the electronic device can be combined in the subsequent steps to determine whether the node is an abnormal node from two aspects, thereby improving the recall rate of abnormal nodes.

[0085] S207 . Reconstruct a subgraph according to the neighborhood corresponding to the device node, determine a first vector representation corresponding to the device node, and concatenate the first vector representation of the device node with the historical request sequence to obtain a concatenated sequence.

[0086] Optionally, in this embodiment, multiple single historical requests included in the historical request sequence may be determined, and the first vector representation may be spliced ​​to each single historical request to obtain the spliced ​​sequence. Of course, other solutions for splicing the first vector representation with the historical request sequence are also within the protection scope of this application.

[0087] In this embodiment, in order to reduce the amount of calculation, only the historical request sequence within a preset time period may be obtained, for example, the historical request sequence within a day.

[0088] Optionally, in this embodiment, multiple single historical requests included in the historical request sequence can be determined, and the first vector representation can be spliced ​​to each single historical request to obtain a spliced ​​vector corresponding one-to-one to the multiple single historical requests; the multiple spliced ​​vectors are respectively input into the graph convolutional network model, and the graph convolutional network model outputs a second vector representation corresponding one-to-one to the single historical request, and the multiple second vector representations are combined into the spliced ​​sequence.

[0089] In this embodiment, multiple splicing vectors can be respectively input into the graph convolutional network model (GCN), so that the data features can be better captured through the graph convolutional network model. In addition, since the input into the graph convolutional network model is a splicing vector, compared with directly inputting the adjacent reconstructed subgraph, the solution provided by this embodiment reduces the dimension of data expression, making the model processing more efficient.

[0090] S208. Determine evaluation data corresponding to the device node according to the splicing sequence, where the evaluation data is used to characterize the possibility that the device node is an abnormal node.

[0091] Specifically, in this embodiment, the splicing sequence can be input into a sequence-based neural network model. The sequence-based neural network model can be any sequence-based neural network model such as a long short-term memory network model (Long Short-Term Memory, LSTM), transformer, etc., which is not limited in this embodiment.

[0092] It should also be noted that if this solution is executed in cycles, the graph convolutional network model in the above steps and the sequence-based neural network model in this step can be trained using the historical request sequences corresponding to the abnormal nodes and non-abnormal nodes determined in the previous cycle. The specific training process can refer to the relevant technology and will not be repeated here.

[0093] Optionally, in any embodiment of the present application, after reconstructing the neighborhood subgraph corresponding to the initial node according to the determined node sequence, the method further includes: for any initial node, according to the topic clustering group to which the node sequence used to reconstruct the initial node belongs, obtaining a topic structure information set corresponding to the initial node, wherein the topic structure information set includes the topic clustering group and the ratio of the number of node sequences belonging to the topic clustering group to the total number of node sequences used to reconstruct the initial node; determining any two initial nodes whose similarity in topic structure ratio information is less than a preset threshold as nodes with regular equivalence; and for abnormal nodes determined in the initial graph network, determining nodes that have regular equivalence with the determined abnormal nodes as abnormal nodes.

[0094] In this embodiment, rule equivalence refers to points in the graph that have the same function (same neighborhood subgraphs) but are not directly connected. Figure 2E As shown in the figure, node u and node v are regular equivalent nodes, and the network in the figure refers to the partial graph structure between nodes u and v in the initial graph network.

[0095] In this embodiment, since the neighborhood subgraph corresponding to the initial node is reconstructed based on the node sequence, if the neighborhood subgraphs of any two initial nodes are the same, the node sequences used to reconstruct the two initial nodes are basically the same. It can be further known that the topic structure information sets corresponding to the node sequences used to reconstruct the two initial nodes are basically the same. Therefore, in this embodiment, any two initial nodes whose similarity of topic structure ratio information is less than a preset threshold can be determined as nodes with rule equivalence.

[0096] For example, Figure 2F As shown, the topic clustering groups obtained after clustering the node sequence can correspond to: family topic, friends topic, fellows topic, etc., then the topic structure information set of the initial node X can be, for example: family topic accounts for 50%, friends topic accounts for 30%, fellows topic accounts for 10%...; that is, in the node sequence used to reconstruct the adjacent subgraph of the initial node X, the node sequence belonging to the family topic clustering group accounts for 50%, the node sequence belonging to the friends topic clustering group accounts for 30%, and the node sequence belonging to the fellows topic clustering group accounts for 10%.

[0097] See also Figure 2G The solution of this embodiment is exemplified below through a specific scenario.

[0098] For the electronic device that initiates the request, the user account that has logged into the electronic device can be determined; and the historical request sequence of the electronic device within a day can be collected. The historical request sequence includes multiple single historical requests sorted by time. The historical request sequence can be used to represent all access actions of the electronic device to access a preset website address.

[0099] Electronic devices can be distinguished by device fingerprint (umid), which is a unique ID corresponding to each electronic device. User accounts can be distinguished by accountid, which is a unique ID corresponding to each user account.

[0100] For the collected electronic devices and user accounts:

[0101] An initial graph network is constructed with electronic devices as device nodes, user accounts as account nodes, and the corresponding relationships between electronic devices and user accounts as edges.

[0102] Taking the device node as the initial node, an anonymous random walk is performed based on the second-order neighborhood subgraph of the initial node to obtain node sequences corresponding to multiple device nodes, and the subgraph structure corresponding to the node can be determined according to the node sequence.

[0103] The LDA model is called to perform topic clustering on the node sequences according to the subgraph structure corresponding to the node sequences, and multiple topic clustering groups and the number of node sequences corresponding to each topic clustering group are obtained.

[0104] The top-k topic clustering groups are selected according to the number of node sequences, and the node sequences for reconstruction are determined according to the subgraph structures corresponding to the top-k topic clustering groups.

[0105] According to the node sequence determined for reconstruction, the second-order neighborhood subgraph of the device node is reconstructed to obtain a neighborhood reconstruction subgraph. The nodes in the second-order neighborhood subgraph that fail to be reconstructed are determined as abnormal nodes.

[0106] Then, the first vector representation corresponding to the device node can be determined according to the neighborhood reconstruction subgraph.

[0107] For any electronic device:

[0108] A historical request sequence corresponding to the electronic device may be determined, and a first vector representation of a device node corresponding to the electronic device may be determined.

[0109] Then, the first vector representation may be concatenated (concat) to the end of each single historical request in the historical request sequence to obtain a concatenated vector corresponding one-to-one to the single historical request.

[0110] Then, multiple concatenated vectors can be input into the graph convolutional neural network model GCN in sequence to obtain a second vector representation that corresponds one-to-one to a single historical request.

[0111] Multiple second vector representations can be input into the LSTM as a concatenated sequence, and the LSTM outputs evaluation data corresponding to the device node, and the evaluation data is used to characterize the possibility that the device node is an abnormal node.

[0112] By splicing the first vector representation of the device node determined according to the initial graph network with the historical request sequence of the electronic device, it is possible to determine whether the device node corresponding to the electronic device is an abnormal node based on the regularity of the electronic device's login account and the electronic device's access action to the preset website address, that is, to determine whether the electronic device is a black market device, thereby improving the recall rate.

[0113] The abnormal node determination method of this embodiment can be executed by any appropriate electronic device with data processing capability, including but not limited to: a server, a mobile terminal (such as a mobile phone, a PAD, etc.) and a PC, etc.

[0114] Figure 3 A schematic diagram of the structure of an abnormal node determination device provided in an embodiment of the present application, as shown in the figure, includes:

[0115] A graph acquisition module 301 is used to acquire an initial graph network, wherein the nodes in the initial graph network include device nodes corresponding to electronic devices and account nodes corresponding to user accounts, and the edges between the nodes in the initial graph network are determined according to the corresponding relationship between the electronic devices and the user accounts;

[0116] A random walk module 302 is used to use multiple nodes in the initial graph network as initial nodes and edges between the nodes as paths to perform random walks, and obtain node sequences corresponding to the multiple initial nodes respectively;

[0117] The topic clustering module 303 is used to perform topic clustering on the node sequence according to the subgraph structure corresponding to the node sequence, obtain a plurality of corresponding topic clustering groups and a corresponding number of node sequences, and determine the subgraph structure corresponding to the topic clustering group with the largest number of node sequences as the target subgraph structure;

[0118] The abnormality determination module 304 is used to reconstruct the graph network based on the node sequence corresponding to the target subgraph structure, and determine the abnormal nodes in the initial graph network according to the reconstruction result.

[0119] The abnormal node determination device of this embodiment is used to implement the corresponding abnormal node determination method in the aforementioned multiple method embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be described in detail here. In addition, the functional implementation of each module in the abnormal node determination device of this embodiment can refer to the description of the corresponding part in the aforementioned method embodiments, which will not be described in detail here.

[0120] Reference Figure 4 , shows a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The specific embodiment of the present application does not limit the specific implementation of the electronic device.

[0121] like Figure 4 As shown, the electronic device may include: a processor (processor) 402 , a communication interface (Communications Interface) 404 , a memory (memory) 406 , and a communication bus 408 .

[0122] in:

[0123] The processor 402 , the communication interface 404 , and the memory 406 communicate with each other via a communication bus 408 .

[0124] The communication interface 404 is used to communicate with other electronic devices or servers.

[0125] The processor 402 is used to execute the program 410, and specifically can execute the relevant steps in the above-mentioned abnormal node determination method embodiment.

[0126] Specifically, the program 410 may include program codes, which include computer operation instructions.

[0127] The processor 402 may be a CPU (central processing unit), or an application specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of the present application. The one or more processors included in the smart device may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0128] The memory 406 is used to store the program 410. The memory 406 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0129] The specific implementation of each step in the program 410 can refer to the corresponding description of the corresponding steps and units in the above-mentioned abnormal node determination method embodiment, which will not be repeated here. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the above-described devices and modules can refer to the corresponding process description in the above-mentioned method embodiment, which will not be repeated here.

[0130] An embodiment of the present application further provides a computer storage medium on which a computer program is stored. When the program is executed by a processor, any abnormal node determination method in the above-mentioned multiple method embodiments is implemented.

[0131] An embodiment of the present application further provides a computer program product, including computer instructions, which instruct a computing device to execute operations corresponding to any abnormal node determination method in the above-mentioned multiple method embodiments.

[0132] It should be pointed out that, according to the needs of implementation, the various components / steps described in the embodiments of the present application can be split into more components / steps, or two or more components / steps or partial operations of components / steps can be combined into new components / steps to achieve the purpose of the embodiments of the present application.

[0133] The above-mentioned method according to the embodiment of the present application can be implemented in hardware, firmware, or implemented as software or computer code that can be stored in a recording medium (such as a CD ROM, RAM, floppy disk, hard disk or magneto-optical disk), or implemented as a computer code originally stored in a remote recording medium or a non-temporary machine-readable medium downloaded through a network and to be stored in a local recording medium, so that the method described herein can be stored in such software processing on a recording medium using a general-purpose computer, a dedicated processor or programmable or dedicated hardware (such as an ASIC or FPGA). It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component (e.g., RAM, ROM, flash memory, etc.) that can store or receive software or computer code, and when the software or computer code is accessed and executed by a computer, a processor or hardware, the abnormal node determination method described herein is implemented. In addition, when a general-purpose computer accesses the code for implementing the abnormal node determination method shown herein, the execution of the code converts the general-purpose computer into a dedicated computer for executing the abnormal node determination method shown herein.

[0134] Those of ordinary skill in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the embodiments of the present application.

[0135] The above implementation methods are only used to illustrate the embodiments of the present application, and are not limitations on the embodiments of the present application. Ordinary technicians in the relevant technical field can make various changes and modifications without departing from the spirit and scope of the embodiments of the present application. Therefore, all equivalent technical solutions also belong to the scope of the embodiments of the present application. The scope of patent protection of the embodiments of the present application should be limited by the claims.

Claims

1. A method for determining an abnormal node, comprising: Acquire an initial graph network, wherein the nodes in the initial graph network include device nodes corresponding to the electronic device and account nodes corresponding to the user account, and the edges between the nodes in the initial graph network are determined according to the corresponding relationship between the electronic device and the user account; Taking the nodes in the initial graph network as initial nodes, performing random walks with the edges between the nodes as paths, and obtaining a node sequence corresponding to the initial nodes; The node sequence is thematically clustered according to the subgraph structure corresponding to the node sequence, a plurality of corresponding topic clustering groups and corresponding numbers of node sequences are obtained, and the subgraph structure corresponding to the topic clustering group with the largest number of node sequences is determined as the target subgraph structure; A graph network is reconstructed based on a node sequence corresponding to the target subgraph structure, and abnormal nodes in the initial graph network are determined according to the reconstruction result.

2. The method according to claim 1, wherein: The subject clustering of the node sequence according to the subgraph structure corresponding to the node sequence to obtain a corresponding plurality of subject clustering groups and a corresponding number of node sequences includes: Calling a latent Dirichlet distribution (LDA) topic model, performing topic clustering on the node sequence according to the subgraph structure corresponding to the node sequence, and obtaining a plurality of topic clustering groups, wherein the topic clustering group includes a plurality of subgraph structures belonging to the topic; According to the subgraph structure included in the subject clustering group, the number of node sequences corresponding to the subject clustering group is determined.

3. The method according to any one of claims 1 to 2, wherein: The step of taking the nodes in the initial graph network as initial nodes and performing random walks with the edges between the nodes as paths to obtain a node sequence corresponding to the initial nodes includes: The device nodes in the initial graph network are used as initial nodes, and anonymous random walks are performed using the edges between the nodes as paths to obtain node sequences corresponding to the device nodes.

4. The method according to any one of claims 1 to 2, wherein: Taking the nodes in the initial graph network as initial nodes and taking the edges between the nodes as paths to perform random walks, obtaining a node sequence corresponding to the initial nodes, including: Taking a node in the initial graph as an initial node, determining a neighborhood subgraph of the initial node; Perform a random walk in the neighborhood subgraph using the edges between nodes as paths to obtain a node sequence corresponding to the initial node; The step of reconstructing a graph network based on a node sequence corresponding to the target subgraph structure and determining abnormal nodes in the initial graph network according to the reconstruction result includes: For any initial node, determine a node sequence corresponding to the target subgraph structure from the node sequence corresponding to the initial node; A neighborhood subgraph corresponding to the initial node is reconstructed according to the determined node sequence, and whether the initial node is an abnormal node is determined according to the reconstructed neighborhood reconstructed subgraph.

5. The method according to claim 4, wherein: After the neighborhood subgraph corresponding to the initial node is reconstructed according to the determined node sequence, the method further includes: For any initial node, according to the subject cluster group to which the node sequence used to reconstruct the initial node belongs, a subject structure information set corresponding to the initial node is obtained, wherein the subject structure information set includes the subject cluster group and the ratio of the number of node sequences belonging to the subject cluster group to the total number of node sequences used to reconstruct the initial node; Any two initial nodes whose similarity of topic structure ratio information is less than a preset threshold are determined as nodes with rule equivalence; For the abnormal nodes determined in the initial graph network, nodes having rule equivalence with the abnormal nodes are determined as abnormal nodes.

6. The method according to claim 4, wherein: The determining whether the initial node is an abnormal node according to the reconstructed neighborhood reconstruction subgraph includes: If the difference between the neighborhood reconstructed subgraph and the neighborhood subgraph corresponding to the initial node is greater than a preset difference, the initial node is determined as an abnormal node.

7. The method according to claim 6, wherein: The method further comprises: If the initial node is determined to be an abnormal node, other initial nodes with similar structures to the neighborhood subgraph of the initial node are determined to be abnormal nodes.

8. The method according to claim 6, wherein: If the device node in the initial graph network is used as an initial node for random walking, the method further includes: Obtaining a historical request sequence of the electronic device corresponding to the device node, wherein the historical request sequence includes historical requests of the electronic device to access a preset network address; Reconstructing a subgraph according to the neighborhood corresponding to the device node, determining a first vector representation corresponding to the device node, and splicing the first vector representation of the device node with the historical request sequence to obtain a spliced ​​sequence; Evaluation data corresponding to the device node is determined according to the splicing sequence, and the evaluation data is used to characterize the possibility that the device node is an abnormal node.

9. The method according to claim 8, wherein: The step of splicing the first vector representation of the device node with the historical request sequence to obtain a spliced ​​sequence includes: A plurality of single historical requests included in the historical request sequence is determined, and the first vector representation is spliced ​​to each single historical request to obtain the spliced ​​sequence.

10. The method according to claim 9, wherein: The determining of a plurality of single historical requests included in the historical request sequence, and splicing the first vector representation to each single historical request to obtain the spliced ​​sequence includes: Determine a plurality of single historical requests included in the historical request sequence, and splice the first vector representation to each single historical request to obtain a splicing vector corresponding to the plurality of single historical requests one by one; The multiple splicing vectors are respectively input into the graph convolutional network model, and the graph convolutional network model outputs a second vector representation corresponding one-to-one to the single historical request, and the multiple second vector representations are combined into the splicing sequence.

11. A computer storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the abnormal node determination method according to any one of claims 1 to 10 is implemented.

12. A computer program product, comprising computer instructions, wherein the computer instructions instruct a computing device to execute operations corresponding to the abnormal node determination method according to any one of claims 1 to 10.

Images