Object set identification method, device, computer equipment and storage medium

By combining heterogeneous graphs and behavior sequences in the medical insurance system, the relationship and behavior characteristics between objects and service agencies are extracted, and clustering is performed to identify abnormal medical insurance behaviors. This solves the problem of low recognition accuracy in existing technologies and achieves higher recognition accuracy.

CN114612246BActive Publication Date: 2025-09-26TENCENT DIGITAL TIANJIN
View PDF 3 Cites 0 Cited by

Patent Information

Application Number
CN202111441117.X
Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Filing Date
2021-11-30
Publication Date
2025-09-26
Estimated Expiration
2041-11-30

AI Technical Summary

Technical Problem

Existing technologies have low accuracy when identifying abnormal medical insurance behaviors and are prone to misidentification.

Method used

By obtaining the heterogeneous graph between objects and service organizations, extracting relationship features and behavioral time series features, and using graph neural networks and time series mining models for clustering, we can identify sets of objects with specified interactive behaviors.

Benefits of technology

The recognition accuracy of abnormal behavior object sets is improved, and object sets with abnormal interactive behaviors can be effectively screened out.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN114612246B_ABST
    Figure CN114612246B_ABST
Patent Text Reader

Abstract

The present application relates to a method, apparatus, computer equipment, and storage medium for identifying object sets, and relates to the field of data processing technology. The method includes: obtaining a heterogeneous graph corresponding to each object; extracting the relationship features of each object based on the heterogeneous graph; extracting the behavioral timing features of each object based on the behavioral sequence of each object; clustering each object based on the relationship features of each object and the behavioral timing features of each object to obtain at least one object set; and identifying a target object set from at least one object set. The above scheme can accurately cluster objects, thereby improving the accuracy of the object set identified from the clustering results that has a specified interactive behavior.
Need to check novelty before this filing date? Find Prior Art

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method, apparatus, computer equipment, and storage medium for identifying a set of objects. Background Art

[0002] With the continuous improvement of the medical insurance system, medical insurance has become an important part of people's lives, but as a result, abnormal medical insurance behaviors also occur from time to time. How to effectively identify abnormal medical insurance behaviors has become an urgent problem to be solved in the industry.

[0003] In related technologies, attribute features of users who have been found to have abnormal medical insurance behavior are usually extracted, and similarity calculations are performed between the attribute features of the user and the attribute features of other users. Other users with similar attribute features related to the user are regarded as users who may have abnormal medical insurance behavior, thereby achieving the purpose of screening users who may have abnormal medical insurance behavior.

[0004] However, the above solution only uses user-related attribute features to identify abnormal medical insurance users, which is prone to misidentification and results in low recognition accuracy. Summary of the Invention

[0005] The present invention provides a method, apparatus, computer device, and storage medium for identifying an object set, which can improve the accuracy of screening objects with abnormal behavior. The technical solution is as follows:

[0006] In one aspect, a method for identifying an object set is provided, the method comprising:

[0007] Obtaining a heterogeneous graph corresponding to each object, wherein the heterogeneous graph is used to indicate the relationship between each object and each service organization;

[0008] Extracting the relationship features of the respective objects based on the heterogeneous graph;

[0009] Obtaining a behavior sequence of each of the objects, wherein the behavior sequence includes behavior records of interaction between the objects and the service organization; and the behavior records in the behavior sequence are arranged in chronological order;

[0010] Extracting the behavior time series features of each object based on the behavior sequence of each object;

[0011] Clustering the objects based on their respective relationship features and their respective behavior time series features to obtain at least one object set;

[0012] A target object set is identified from the at least one object set; the target object set is an object set with a specified interactive behavior.

[0013] In another aspect, a device for identifying an object set is provided, the device comprising:

[0014] A heterogeneous graph acquisition module is used to acquire a heterogeneous graph corresponding to each object, wherein the heterogeneous graph is used to indicate the relationship between each object and each service organization;

[0015] A first feature acquisition module is used to extract the relationship features of each of the objects based on the heterogeneous graph;

[0016] A sequence acquisition module is used to acquire the behavior sequence of each of the objects, wherein the behavior sequence includes behavior records of interaction between the objects and the service agency; and the behavior records in the behavior sequence are arranged in chronological order;

[0017] A second feature acquisition module is used to extract the behavior time series features of each object based on the behavior sequence of each object;

[0018] A clustering model, configured to cluster the objects based on their respective relationship features and their respective behavior time series features, to obtain at least one object set;

[0019] The identification module is configured to identify a target object set from the at least one object set; the target object set is a set of objects with a specified interactive behavior.

[0020] In a possible implementation, the service mechanism includes a first type mechanism and a second type mechanism; the first type mechanism is used to provide the object with a target service corresponding to the interactive behavior, and the second type mechanism is used to provide resource compensation for resources required by the object to receive the target service;

[0021] The heterogeneous graph acquisition module is used to:

[0022] Acquire object information of each of the objects, organization information of each of the first-type organizations, and organization information of each of the second-type organizations;

[0023] generating the heterogeneous graph based on the object information of each of the objects, the organization information of each of the first-type organizations, and the organization information of each of the second-type organizations;

[0024] In which, the heterogeneous graph includes an object node corresponding to the object, a first type of institution node corresponding to the first type of institution, and a second type of institution node corresponding to the second type of institution; the edge between the object node and the first type of institution node is used to indicate the number of times the first type of institution provides the target service to the object; the edge between the object node and the second type of institution node is used to indicate that there is a subordinate relationship between the object and the second type of institution.

[0025] In a possible implementation, the behavior record is used to indicate behavior information of the subject accepting the target service provided by the first type of institution;

[0026] The behavior information includes: the organization identifier of the first type of organization, the occurrence time of the target service, and the number of resources corresponding to the target service.

[0027] In a possible implementation, the clustering model is used to:

[0028] Splicing the relationship features of each object with the behavior time series features of each object to obtain the cluster features of each object;

[0029] Clustering is performed based on the clustering features of the respective objects to obtain the at least one object set.

[0030] In a possible implementation, the clustering model is used to:

[0031] Obtaining a similar object set corresponding to each of the objects through a similar node acceleration library, wherein the similar object set includes n other objects with the closest similarity distance to the corresponding object; the similarity distance is used to identify the similarity between clustering features between two objects;

[0032] Clustering is performed based on the similar object sets of each of the objects and the similarity distances between each of the objects and the objects in the similar object sets to obtain the at least one object set.

[0033] In a possible implementation, the clustering model is used to:

[0034] Obtaining object attribute characteristics of each of the objects;

[0035] The relationship features of the respective objects, the behavior time series features of the respective objects, and the object attribute features of the respective objects are spliced ​​together to obtain the clustering features of the respective objects.

[0036] In a possible implementation, the second feature acquisition module is configured to:

[0037] Inputting the behavior sequence of the target object into a time series mining model to obtain the behavior time series features of the target object output by the time series mining model; the target object is any one of the objects;

[0038] The time series mining model includes at least one of a word-vector model and a converter-based bidirectional encoding representation BERT model.

[0039] In a possible implementation, the first feature acquisition module is configured to:

[0040] Inputting the heterogeneous graph into a graph neural network model to obtain the relationship features of the respective objects output by the graph neural network;

[0041] The graph neural network includes a HinSAGE model.

[0042] In one possible implementation, the graph neural network is a graph neural network based on an attention mechanism.

[0043] In a possible implementation, the identification module is configured to:

[0044] Performing anomaly detection on the at least one object set to obtain an abnormal group set in the at least one object set;

[0045] Matching the at least one object set based on a target rule to obtain a rule matching community set in the at least one object set; the target rule includes a rule satisfied by an object set having a specified interactive behavior;

[0046] The intersection of the abnormal community set and the rule matching community set is taken to obtain the target object set.

[0047] In a possible implementation, the identification module is configured to:

[0048] extracting group features of each of the at least one object set;

[0049] The community features of each of the at least one object set are input into a community detection model to obtain a community detection result of the community detection model, where the community detection result is used to indicate the target object set.

[0050] On the other hand, a computer device is provided, comprising a processor and a memory, wherein the memory stores at least one computer instruction, and the at least one computer instruction is loaded and executed by the processor to implement the above-mentioned object set recognition method.

[0051] On the other hand, a computer-readable storage medium is provided, wherein at least one computer instruction is stored in the computer-readable storage medium, and the computer instruction is loaded and executed by a processor to implement the above-mentioned object set recognition method.

[0052] In another aspect, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the object set recognition method provided in the various optional implementations described above.

[0053] The technical solution provided by this application may have the following beneficial effects:

[0054] The heterogeneous graph extracts relational features related to the relationship between objects and service organizations, and the time series of behavior records between objects and organizations extracts the time series features of the objects' behaviors. These two features are then combined to cluster the objects, and the set of objects exhibiting specified interactive behaviors is identified from the clustered set of objects. Because heterogeneous graphs can effectively integrate the connections between objects and service organizations, different object representations can be learned more effectively. At the same time, the time series of object behavior records can better reflect the behavioral similarity between objects. Therefore, the above solution, through the combination of heterogeneous graphs and behavior sequences, can accurately cluster objects, thereby improving the accuracy of identifying the set of objects exhibiting specified interactive behaviors from the clustering results. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0056] Figure 1 A flowchart of an object set recognition method according to an exemplary embodiment of the present application is shown;

[0057] Figure 2 A flowchart of an object set recognition method provided by an exemplary embodiment of the present application is shown;

[0058] Figure 3 yes Figure 2 Schematic diagram of two types of points involved in the illustrated embodiment;

[0059] Figure 4 yes Figure 2 A schematic diagram of the acceleration process involved in the illustrated embodiment;

[0060] Figure 5 yes Figure 2A schematic diagram of an object set detection framework according to the illustrated embodiment;

[0061] Figure 6 yes Figure 2 The illustrated embodiment involves a visualization clustering effect diagram;

[0062] Figure 7 A block diagram of an object set recognition device provided by an exemplary embodiment of the present application is shown;

[0063] Figure 8 It is a structural block diagram of a computer device according to an exemplary embodiment. DETAILED DESCRIPTION

[0064] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0065] It should be understood that the term "plurality" used herein refers to two or more. "And / or" describes a relationship between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can mean: A exists alone, A and B exist simultaneously, or B exists alone. The character " / " generally indicates an "or" relationship between the associated objects.

[0066] The embodiments of this application provide a method for identifying a set of target objects, which can improve the efficiency and accuracy of obtaining abnormal interactive services. The solutions shown in the various embodiments of this application can be applied to various scenarios such as cloud technology, artificial intelligence, and smart transportation. For ease of understanding, several terms used in this application are explained below.

[0067] 1) Graph Embedding

[0068] Graph embedding is a process of mapping graph data (usually high-dimensional dense matrices) into low-density vectors. It aims to represent the nodes of the graph into a low-dimensional vector space while retaining the network's topological structure and node information, so that existing machine learning algorithms can be directly used in subsequent graph analysis tasks.

[0069] 2) Heterogeneous Graph

[0070] A heterogeneous graph is one in which different types of nodes and edges exist (at least one of the nodes and edges can have multiple types). This is commonly seen in knowledge graphs. The simplest way to handle heterogeneous information is to use a one-hot encoding type information and concatenate it with the original node representation. Heterogeneous graphs are more common than homogeneous graphs in real life. Alternatively, one can think of a homogeneous graph as one in which multiple types of edges (relationships) exist between nodes. Furthermore, the different attributes of each edge influence the closeness between nodes.

[0071] The goal of learning heterogeneous graph representations is to find a meaningful vector representation for each node to facilitate subsequent applications such as link prediction, personalized recommendations, and node classification. However, this task is difficult to implement. This is because it is necessary not only to integrate information about multiple types of nodes and edges composed of heterogeneous structures, but also to consider the heterogeneous attributes and content associated with each node. Although a lot of work has been done in the areas of isomorphic graph embedding, attribute graph embedding, and graph neural networks, few have been able to effectively jointly consider heterogeneous structural (graph) information and the heterogeneous content information of each node.

[0072] 3) Artificial Intelligence (AI)

[0073] Artificial intelligence (AI) refers to the theories, methods, techniques, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, to perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that seeks to understand the essence of intelligence and produce new intelligent machines that can respond in a manner similar to human intelligence. AI also involves studying the design principles and implementation methods of various intelligent machines, enabling them to possess the capabilities of perception, reasoning, and decision-making.

[0074] Artificial intelligence (AI) technology is a comprehensive discipline encompassing a wide range of fields, encompassing both hardware and software technologies. Foundational AI technologies generally include sensors, specialized AI chips, cloud computing, distributed storage, big data processing, operating / interaction systems, and mechatronics. AI software technologies primarily encompass computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0075] 4) Machine Learning (ML)

[0076] Machine learning is a multidisciplinary field that encompasses probability theory, statistics, approximation theory, convex analysis, and algorithmic complexity theory. It specifically studies how computers can simulate or implement human learning behaviors to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is at the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications span all areas of artificial intelligence. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and learning through demonstration.

[0077] Figure 1 FIG. 1 shows a flow chart of an object set recognition method according to an exemplary embodiment of the present invention. The object set recognition method can be executed by a computer device, which can be implemented as a server or a terminal. Figure 1 As shown, the object set recognition method includes:

[0078] Step 110: Obtain a heterogeneous graph corresponding to each object. The heterogeneous graph is used to indicate the relationship between each object and each service organization.

[0079] Among them, the above-mentioned objects may refer to users, such as medical insurance users.

[0080] In an embodiment of the present application, in addition to the nodes corresponding to the objects, the above-mentioned heterogeneous graph also includes nodes corresponding to each service agency. The existence of edges between the nodes corresponding to the objects and the nodes corresponding to the service agencies can indicate that there is a certain relationship between the object and the service agency.

[0081] Step 120: extract the relationship features of each object based on the heterogeneous graph.

[0082] In the embodiment of the present application, based on the above heterogeneous graph, features related to the relationship between each object and each service agency, namely the above relationship features, can be extracted.

[0083] Step 130 : Acquire the behavior sequence of each object. The behavior sequence includes behavior records of interaction between the object and the service organization. The behavior records in the behavior sequence are arranged in chronological order.

[0084] In an embodiment of the present application, an interaction between an object and a service agency can be identified by a behavior record. The behavior records corresponding to all previous interaction behaviors between the same object and various service agencies can be arranged in chronological order to obtain the behavior sequence of the object.

[0085] Step 140 : extracting the behavior time sequence features of each object based on the behavior sequence of each object.

[0086] In the embodiment of the present application, the above-mentioned behavior timing characteristics can simultaneously characterize the interaction behaviors between the object and each service agency, as well as the time when the interaction behaviors occur.

[0087] Step 150 : clustering the objects based on their respective relationship features and their respective behavior time series features to obtain at least one object set.

[0088] Each of the above object sets may be a user group obtained by clustering.

[0089] Step 160: Identify a target object set from at least one object set; the target object set is a set of objects with a specified interactive behavior.

[0090] Among them, the above-mentioned designated interactive behaviors may be abnormal interactive behaviors. For example, taking the abnormal behavior group mining scenario in the medical insurance field as an example, the above-mentioned designated interactive behaviors may be abnormal medical insurance reimbursement behaviors, etc.

[0091] In summary, the solution shown in the embodiment of the present application extracts the relationship features related to the relationship between the object and the service agency through a heterogeneous graph, and extracts the behavioral time series features of the object through the time series sequence composed of the behavior records between the object and the agency, and then clusters each object by combining the two features, and then identifies the set of objects with specified interactive behaviors from the clustered object set. Since the heterogeneous graph can effectively integrate the connection between the object and the service agency, different object representations can be learned more effectively. At the same time, the time series sequence composed of the behavior records of the object can better reflect the behavioral similarity between the objects. Therefore, the above solution can accurately cluster objects through the combination of the heterogeneous graph and the behavior sequence, thereby improving the accuracy of the object set with specified interactive behaviors identified from the clustering results.

[0092] Among them, the solution shown in the embodiment of the present application can be applied to various recognition scenarios of object sets with abnormal behaviors.

[0093] For example, in one possible implementation, the object set identification method provided in this application can be applied to the field of medical insurance. In this field, each object is a medical insurance participant, and each service agency is an agency that provides medical insurance consumption services. The interactive behavior can be a medical treatment behavior / medical insurance consumption behavior. The object set identification method provided in this application can screen out medical insurance object sets with abnormal interactive behaviors, such as insurance fraud groups, thereby realizing the analysis and judgment of abnormal behavior groups.

[0094] For example, the solutions shown in the various embodiments of this application can also be used relatively well in the real-time supervision of electronic credentials. For example, for the real-time data of electronic credentials, the behavioral information and personal information of newly added objects can be effectively mined through the framework provided by the solutions shown in this application.

[0095] Alternatively, the object set identification method provided in the present application can also be applied to other fields involving abnormal behaviors, such as the field of online order-brushing monitoring. In this field, each object is a user with online shopping behavior, each service agency can be an online store owner, and the interactive behavior can be an online shopping behavior. The object set identification method provided in the present application can be used to screen out user groups with abnormal behaviors (such as order-brushing), thereby realizing the analysis and judgment of suspected order-brushing groups.

[0096] Figure 2 A flowchart of an object set recognition method provided by an exemplary embodiment of the present application is shown. The object set recognition method can be executed by a computer device, which can be implemented as a server or a terminal, such as Figure 2 As shown, the target object set identification method includes:

[0097] Step 210: Obtain a heterogeneous graph corresponding to each object. The heterogeneous graph is used to indicate the relationship between each object and each service organization.

[0098] In one possible implementation, the service mechanism includes a first type mechanism and a second type mechanism; the first type mechanism is used to provide the object with a target service corresponding to the interactive behavior, and the second type mechanism is used to provide resource compensation for the resources required by the object to receive the target service;

[0099] Get the heterogeneous graph corresponding to each object, including:

[0100] Obtaining object information of each object, organization information of each first-type organization, and organization information of each second-type organization;

[0101] generating a heterogeneous graph based on the object information of each object, the organization information of each first-type organization, and the organization information of each second-type organization;

[0102] Among them, the heterogeneous graph includes object nodes corresponding to the object, first type institution nodes corresponding to the first type institution, and second type institution nodes corresponding to the second type institution; the edge between the object node and the first type institution node is used to indicate the number of times the first type institution provides the target service to the object; the edge between the object node and the second type institution node is used to indicate that there is a subordinate relationship between the object and the second type institution.

[0103] Taking the scenario of mining abnormal behavior groups in the field of medical insurance as an example, in the scheme shown in the embodiment of this application, a heterogeneous graph representation is used to integrate the interaction information between individuals, hospitals / doctors and insured units, where individuals correspond to the above-mentioned objects, hospitals / doctors correspond to the above-mentioned first type of institutions, interactive behaviors correspond to medical treatment behaviors, target services correspond to diagnosis and treatment services, insured units correspond to the above-mentioned second type of institutions, and resource compensation corresponds to medical insurance reimbursement services.

[0104] In step 220, the heterogeneous graph is input into the graph neural network model to obtain the relationship features of each object output by the graph neural network model.

[0105] Taking the abnormal group identification solution in the medical insurance field as an example, since heterogeneous graph representation can more effectively integrate the connections between different types of nodes, heterogeneous graph neural networks can more effectively learn different personal representations (corresponding to the above-mentioned relationship features) on a graph with personal information, doctor information / hospital information, and institution information for subsequent group clustering.

[0106] In one possible implementation, the graph neural network includes a HinSAGE model.

[0107] In this embodiment, we use the abnormal group identification solution in the medical insurance field as an example. The heterogeneous graph is constructed as follows: First, it is divided into individual nodes, hospital nodes, and unit nodes (corresponding to the insured unit). The node attributes are personal information, hospital information, and unit information respectively; the edges between nodes are the number of visits to the hospital by the individual and the affiliation relationship between the individual and the unit.

[0108] The solution shown in the embodiment of the present application can use the HinSAGE model as a graph neural network for heterogeneous representation extraction. Similar to the GraphSAGE isomorphic graph neural network model, HinSAGE also includes two processes: sampling and feature aggregation. It utilizes vertex features (such as text information, vertex information, and vertex degree), and utilizes the topological structure of each vertex's neighbors and the distribution of vertex features in the neighbors. Finally, a function is learned that can be used to generate feature representations of vertices that have not been seen (that is, not used as training data). In addition, the HinSAGE model also trains a set of aggregation functions (aggregator functions) that can learn how to aggregate feature information from the local neighbors of a vertex. During the inference process, the model can use these aggregation functions to generate embedding representations (Embedding) for unseen vertices.

[0109] The HinSAGE model uses heterogeneous mean aggregator for feature aggregation, which is an extension of mean aggregation on heterogeneous graphs. The HinSAGE model can mainly include the following steps when performing feature aggregation:

[0110] 1) First, perform mean aggregation on different types of neighbor nodes, multiply them with different weight matrices, and transform them into the same dimension;

[0111] 2) Then sum the features of different types of nodes and calculate the average to obtain the result R1 after the neighbor feature aggregation;

[0112] 3) Multiply the feature matrix of the parent node by the corresponding weight matrix to obtain the result R2 of the parent node;

[0113] 4) Then concatenate the result R1 after aggregating neighbor features with the result R2 of the parent node as the new feature matrix of the parent node.

[0114] Through the above process, the HinSAGE model not only considers the relevant characteristics of its own node, but also considers the characteristic information of neighboring nodes and the network structure topology information.

[0115] In one possible implementation, the graph neural network is a graph neural network based on an attention mechanism.

[0116] In an embodiment of the present application, the graph neural network can also be improved through the attention mechanism so that the graph neural network can better learn the relationship between nodes.

[0117] Step 230 : Acquire the behavior sequence of each object. The behavior sequence includes behavior records of interaction between the object and the service organization. The behavior records in the behavior sequence are arranged in chronological order.

[0118] In a possible implementation, the above-mentioned behavior record is used to indicate behavior information of the subject in accepting the target service provided by the first type of institution;

[0119] The behavior information includes: the organization identifier of the first type of organization, the occurrence time of the target service, and the number of resources corresponding to the target service.

[0120] For example, taking the scenario of mining abnormal behavior object sets in the field of medical insurance as an example, a behavior record of an object may include the hospital where the object visited, the time of the visit, the amount of medical expenses, etc.

[0121] Optionally, the above-mentioned behavior information may also include other information according to the characteristics of the application scenario. For example, taking the medical insurance field as an example, a behavior record of the above-mentioned object may also include diagnosis results, department, doctor, etc.

[0122] In an embodiment of the present application, a computer device may obtain the behavior records of each object within a certain time period (such as within one year or six months), arrange them in chronological order, and obtain the above-mentioned behavior sequence.

[0123] For example, taking the scenario of mining abnormal behavior user groups in the medical insurance field as an example, computer equipment can obtain the annual diagnosis and treatment statistics of each user from medical institutions, extract the diagnosis and treatment records at different times from the annual diagnosis and treatment statistics, and organize them into behavior records at different time points, and then arrange them in chronological order to obtain the user's behavior sequence.

[0124] Step 240 : extracting the behavior time sequence features of each object based on the behavior sequence of each object.

[0125] In a possible implementation, extracting the behavior time series features of each object based on the behavior sequence of each object includes:

[0126] Input the behavior sequence of the target object into the time series mining model to obtain the behavior time series characteristics of the target object output by the time series mining model; the target object is any one of the objects;

[0127] Among them, the time series mining model includes at least one of a word-vector (word2vec) model and a bidirectional encoder representation from transformers (BERT) model.

[0128] Taking the scenario of mining user groups with abnormal behavior in the medical insurance field as an example, computer equipment can obtain users' medical behavior or personal annual statistical information, and use word2vec or BERT to model the individual's medical behavior information in time series. This method can effectively combine the time series medical information of different individuals, so as to mine individuals with similar medical behavior. For groups with abnormal behavior in the medical insurance field, similar medical behavior is a relatively important feature. Using this method, groups with abnormal behavior can be better discovered.

[0129] Taking the scenario of mining abnormal behavior user groups in the field of medical insurance as an example, for the time series information of user visits (i.e. the above-mentioned behavior sequence), the solution shown in this application can use two methods for feature mining, similar to the text processing solution. First, this solution defines the Token as psn_id: hospital_time_amount, and the sequence is the user's visit sequence. Training with a word2vec model or a BERT model is equivalent to clustering the time series visit behavior first, which helps to discover concentrated abnormal behavior information. In order to obtain an individual's time series visit sequence representation, this solution can adopt the following two methods:

[0130] 1) Representation of medical visit sequences based on word2vec:

[0131] Using word2vec to model the behavior sequence can mean treating the user's medical behavior sequence as a document, treating each behavior record in the sequence as a word in the document, and taking the co-occurrence relationship between behaviors as the context. Using the skip-gram model (a model that predicts the context words given a target word (the central word, corresponding to the behavior record in the embodiment of this application)) for training, the representation vector of the behavior record can be obtained. Finally, the embedding corresponding to the sequence of the user's behavior records is summed and averaged with the same dimension to obtain the user's representation vector (corresponding to the above-mentioned behavior time series characteristics).

[0132] 2) BERT-based representation of medical visit sequences:

[0133] Given the excellent effect of BERT on text, the solution shown in the embodiment of this application can also use BERT to model user behavior sequences.

[0134] In the solution of the embodiment of the present application, the Next Sentence loss function is removed from the BERT loss function. The Next Sentence in BERT is a task of next sentence prediction introduced in order to train a model that understands the relationship between sentences. For the user's behavior sequence in the group mining scenario of abnormal behavior, this loss function will be manifested as judging whether two behavior sequences are generated by the same user. It has little effect in the group mining scenario of abnormal behavior, so this loss function can be removed during the training process of the BERT model.

[0135] In one possible implementation, in step 240, the word2vec model and the BERT model may be used in combination. For example, the computer device fuses the features outputted by the word2vec model and the BERT model respectively for the corresponding users (e.g., concatenation or weighted summation, etc.) as the behavioral temporal features of each user.

[0136] In step 250 , the relationship features of each object are combined with the behavior time series features of each object to obtain the clustering features of each object.

[0137] In the embodiment of the present application, for any of the objects, the computer device can combine the object's relationship features with the object's behavioral temporal features to obtain the object's clustering features. The above processing is performed on each object, so that the clustering features of each object can be obtained for subsequent clustering.

[0138] In one possible implementation, the relationship features of each object are combined with the behavior time series features of each object to obtain the clustering features of each object, including:

[0139] Get the object attribute characteristics of each object;

[0140] The relationship features of each object, the behavior time series features of each object, and the object attribute features of each object are spliced ​​together to obtain the clustering features of each object.

[0141] In the embodiments of the present application, in addition to considering the relationship between objects and institutions, and the behavior sequence of objects, the personal attributes of objects can also be considered. For example, taking the scenario of mining abnormal behavior user groups in the medical insurance field as an example, the personal attributes of users may include: participating unit, personnel category (such as enterprise employees, self-employed individuals, farmers, etc.), age, gender, etc. When obtaining clustering features, the object attribute features corresponding to the personal attributes can also be spliced ​​with the user's relationship features and behavior time series features.

[0142] In another possible implementation, the above-mentioned object attribute features can also be integrated into the time series features. That is, the computer device can take the above-mentioned personal attributes as part of the personal information corresponding to each object node in the heterogeneous graph, input them into the graph neural network for processing, and obtain the relationship features of each object. At this time, the relationship features include not only the relationship between the object and the organization, but also the relevant features of the object's personal attributes.

[0143] Step 260: clustering based on the clustering features of each object to obtain at least one object set.

[0144] In the embodiment of the present application, clustering of objects by a computer device may refer to grouping multiple objects with high similarity between clustering features into an object set.

[0145] For example, computer devices can be clustered using the DBSCAN (Density-Based Spatial Clustering of Applications with Noise) clustering algorithm, which can be performed as follows:

[0146] First, we define three types of points:

[0147] 1) Core points: points with a radius of Eps exceeding MinPts;

[0148] 2) Boundary points: points whose number of points within the radius Eps is less than MinPts but fall within the neighborhood of the core point;

[0149] 3) Noise points: points that are neither core points nor boundary points.

[0150] Please refer to Figure 3 , which shows a schematic diagram of two types of points involved in the embodiment of the present application. Figure 3 As shown in the figure, the black point is the boundary point 31, because it is within the radius Eps, and the number of points in the boundary point area does not exceed MinPts. The MinPts set here can be set by the object, such as setting it to 5; and the white point in the middle is the core point 32, because the number of points in its neighborhood exceeds MinPts (5), and the points in its neighborhood are the black boundary points.

[0151] The dbscan algorithm flow is as follows:

[0152] 1) Mark all points as core points, boundary points or noise points;

[0153] 2) Delete noise points;

[0154] 3) Assign an edge between all core points within the distance of Eps;

[0155] 4) Each group of connected core points forms a cluster;

[0156] 5) Assign each boundary point to a cluster of core points associated with it (i.e., within the radius of the corresponding core point).

[0157] In a possible implementation, clustering is performed based on the clustering features of the objects to obtain at least one object set, including:

[0158] Through the similar node acceleration library, the similar object set corresponding to each object is obtained. The similar object set contains n other objects with the closest similarity distance to the corresponding object; the similarity distance is used to identify the similarity between the clustering features of two objects;

[0159] Clustering is performed based on the similar object sets of each object and the similarity distances between each object and the objects in its similar object set to obtain at least one object set.

[0160] Taking the scenario of mining abnormal behavior user groups in the medical insurance field as an example, the user data supervised by the medical insurance fund is very large. In order to accelerate the clustering algorithm, the solution shown in the embodiment of this application can use an acceleration library (such as the faiss acceleration library) to accelerate dbscan. In the process of finding core points and boundary points in dbscan, faiss can be used to speed up the search speed, and the number of results returned by the search range (range_search) can be counted.

[0161] Faiss is a clustering and similarity search library, and is a mature approximate neighbor search library. Its implementation process may include: obtaining vectors, building indexes (based on brute force, inverted indexing, product quantization, etc.), and retrieving the top K similar queries. Please refer to Figure 4 , which shows a schematic diagram of the acceleration process involved in an embodiment of the present application.

[0162] like Figure 4 As shown, on the one hand, the clustering features of the target object are used as search query words, which are processed by the distillation BERT model 41 to obtain vectorized query word information; on the other hand, the clustering features of other objects in the database are input into the distillation BERT model 42 to obtain clustering feature information of other objects; then the vectorized query word information and the clustering feature vectors of other objects are input into the faiss acceleration library 43 to construct a faiss index, and the constructed faiss index outputs the K feature vectors closest to the query word information, and then outputs the search results (that is, the K objects with the smallest similarity distance to the target object) based on the closest K feature vectors.

[0163] Step 270: Identify a target object set from at least one object set; the target object set is a set of objects with a specified interactive behavior.

[0164] In a possible implementation, the step of identifying a target object set from at least one object set includes:

[0165] Performing anomaly detection on at least one object set to obtain an abnormal group set in the at least one object set;

[0166] Matching at least one object set based on a target rule to obtain a rule matching community set in the at least one object set; the target rule includes a rule satisfied by the object set having a specified interactive behavior;

[0167] The intersection of the abnormal group set and the rule matching group set is taken to obtain the target object set.

[0168] In an embodiment of the present application, when identifying a target object set with specified interactive behavior, rule anomaly detection and anomaly detection algorithm are used to detect abnormal groups respectively. Then, when determining the target object set, the intersection group detected by the rule and anomaly algorithm is used as the target object set, so as to more accurately discover and identify the object set with abnormal behavior.

[0169] Among them, the above-mentioned target rules may include that the relevant attributes / parameters satisfied by the set of objects with specified interactive behaviors meet the parameter threshold, such as the amount of resources compensated or applied for compensation (such as annual reimbursement expenses) is greater than the resource amount threshold, etc.

[0170] For example, in the solution shown in the embodiments of the present application, the computer device first uses an anomaly detection algorithm (such as the independent forest (iForest) algorithm) and a rule-based statistical algorithm to detect a set of objects with abnormal behavior. Then, the computer device intersects the groups detected by the anomaly detection algorithm with the groups detected by the rule-based algorithm to obtain a final set of highly suspicious target objects. After obtaining the highly suspicious target object set, the object information of the detected target object set can be further submitted to the relevant department or management personnel for subsequent processing.

[0171] In a possible implementation, identifying a target object set from at least one object set includes:

[0172] extracting group features of at least one set of objects;

[0173] The community features of at least one object set are input into a community detection model to obtain a community detection result of the community detection model, and the community detection result is used to indicate the target object set.

[0174] In the solution shown in the embodiment of the present application, in terms of target object set detection, other machine learning algorithms (such as the extreme gradient boosting (eXtreme Gradient Boosting, XGB) algorithm) can also be used to identify the target object set.

[0175] Optionally, in another possible implementation, the group detection model, anomaly detection algorithm, and rule detection algorithm may be used in combination, that is, the intersection of the object sets detected by the group detection model, anomaly detection algorithm, and rule detection algorithm respectively is taken.

[0176] Please refer to Figure 5, which shows a schematic diagram of a user group detection framework involved in the embodiment of the present application. Taking the abnormal behavior user group mining scenario in the medical insurance field as an example, Figure 5 As shown, the user group detection framework includes a feature extraction component 51 , a clustering component 52 , and an identification component 53 .

[0177] The feature extraction component 51 is used to extract the embedded representation of the heterogeneous graph, the embedded representation of the user-related attributes, and the user's medical visit time series feature representation.

[0178] For example, the above-mentioned feature extraction component 51 includes feature extraction network models such as a graph neural network model, an attribute extraction model, and a time series mining model; among them, the graph neural network model is used to process heterogeneous graphs and output embedded representations of heterogeneous graphs; the attribute extraction model is used to process the attribute features of users and output embedded representations of user-related attributes; the time series mining model is used to process the user's medical visit time series sequence and output the user's medical visit time series feature representation.

[0179] The clustering component 52 is used to cluster each user based on the embedded representation of the heterogeneous graph of each user, the embedded representation of user-related attributes, and the user's medical treatment time series feature representation and other feature information to obtain clustering results, namely, several user groups (object sets).

[0180] The identification component 53 combines anomaly detection and rule judgment to identify user groups with abnormal behavior in the medical insurance field.

[0181] In an embodiment of the present application, the clustering indicators in the above clustering process can use the silhouette coefficient, CH (Calinski-Harabaz) value and BDI index (Davies-Boulding Index) to quantify the clustering effect. Taking the abnormal behavior user group mining scenario in the medical insurance field as an example, it is found through calculation that for the clustering results of personal and medical data, the schemes shown in the embodiments of the present application can obtain acceptable silhouette coefficient, CH value and BDI index scores.

[0182] The clustering results of the scheme shown in the embodiment of this application are processed by TSNE dimensionality reduction visualization, that is, after the clustering is completed, the dimensionality is reduced to three dimensions by TSNE (T-Stochastic Neighbor Embedding, T distribution - random neighbor embedding), and the clustering effect is visualized. Please refer to Figure 6 , which shows the visualization clustering effect diagram involved in the embodiment of this application. Since there are many clustered classes, in order to express them intuitively, Figure 6As shown, the embodiment of the present application visualizes cluster 61, cluster 62 and some other small samples. Through intuitive observation, it can be found that in the scheme shown in the embodiment of the present application, the clustering algorithm can effectively cluster personal or medical data.

[0183] For different target object sets, the solution shown in the embodiment of the present application can also use some word cloud methods to label the target object sets (word cloud analysis).

[0184] In the scheme shown in the embodiment of the present application, after obtaining the target object set, the target object set can be sorted from a business perspective to obtain some typical samples as groups that are highly suspected of having abnormal behavior, and then the relevant information of these groups that are highly suspected of having abnormal behavior can be submitted to the next level of processing personnel / department for further investigation / confirmation.

[0185] In summary, the solution shown in the embodiment of the present application extracts the relationship features related to the relationship between the object and the service agency through a heterogeneous graph, and extracts the behavioral time series features of the object through the time series sequence composed of the behavior records between the object and the agency, and then clusters each object by combining the two features, and then identifies the set of objects with specified interactive behaviors from the clustered object set. Since the heterogeneous graph can effectively integrate the connection between the object and the service agency, different object representations can be learned more effectively. At the same time, the time series sequence composed of the behavior records of the object can better reflect the behavioral similarity between the objects. Therefore, the above solution can accurately cluster objects through the combination of the heterogeneous graph and the behavior sequence, thereby improving the accuracy of the object set with specified interactive behaviors identified from the clustering results.

[0186] Figure 7 FIG. 1 shows a block diagram of an object set recognition device provided by an exemplary embodiment of the present application. The object set recognition device can be applied to a computer device, which can be implemented as a server or a terminal. Figure 7 As shown, the object set recognition device includes:

[0187] A heterogeneous graph acquisition module 701 is used to acquire a heterogeneous graph corresponding to each object, wherein the heterogeneous graph is used to indicate the relationship between each object and each service organization;

[0188] A first feature acquisition module 702 is configured to extract the relationship features of the objects based on the heterogeneous graph;

[0189] A sequence acquisition module 703 is configured to acquire a behavior sequence of each of the objects, wherein the behavior sequence includes behavior records of interaction between the objects and the service organization; and the behavior records in the behavior sequence are arranged in chronological order;

[0190] A second feature acquisition module 704 is configured to extract a behavior time series feature of each object based on the behavior sequence of each object;

[0191] A clustering model 705 is configured to cluster the objects based on their respective relationship features and their respective behavior time series features to obtain at least one object set;

[0192] The identification module 706 is configured to identify a target object set from the at least one object set; the target object set is a set of objects with a specified interactive behavior.

[0193] In a possible implementation, the service mechanism includes a first type mechanism and a second type mechanism; the first type mechanism is used to provide the object with a target service corresponding to the interactive behavior, and the second type mechanism is used to provide resource compensation for resources required by the object to receive the target service;

[0194] The heterogeneous graph acquisition module 701 is used to:

[0195] Acquire object information of each of the objects, organization information of each of the first-type organizations, and organization information of each of the second-type organizations;

[0196] generating the heterogeneous graph based on the object information of each of the objects, the organization information of each of the first-type organizations, and the organization information of each of the second-type organizations;

[0197] In which, the heterogeneous graph includes an object node corresponding to the object, a first type of institution node corresponding to the first type of institution, and a second type of institution node corresponding to the second type of institution; the edge between the object node and the first type of institution node is used to indicate the number of times the first type of institution provides the target service to the object; the edge between the object node and the second type of institution node is used to indicate that there is a subordinate relationship between the object and the second type of institution.

[0198] In a possible implementation, the behavior record is used to indicate behavior information of the subject accepting the target service provided by the first type of institution;

[0199] The behavior information includes: the organization identifier of the first type of organization, the occurrence time of the target service, and the number of resources corresponding to the target service.

[0200] In one possible implementation, the clustering model 705 is used to:

[0201] Splicing the relationship features of each object with the behavior time series features of each object to obtain the cluster features of each object;

[0202] Clustering is performed based on the clustering features of the respective objects to obtain the at least one object set.

[0203] In one possible implementation, the clustering model 705 is used to:

[0204] Obtaining a similar object set corresponding to each of the objects through a similar node acceleration library, wherein the similar object set includes n other objects with the closest similarity distance to the corresponding object; the similarity distance is used to identify the similarity between clustering features between two objects;

[0205] Clustering is performed based on the similar object sets of each of the objects and the similarity distances between each of the objects and the objects in the similar object sets to obtain the at least one object set.

[0206] In one possible implementation, the clustering model 705 is used to:

[0207] Obtaining object attribute characteristics of each of the objects;

[0208] The relationship features of the respective objects, the behavior time series features of the respective objects, and the object attribute features of the respective objects are spliced ​​together to obtain the clustering features of the respective objects.

[0209] In a possible implementation, the second feature acquisition module 704 is configured to:

[0210] Inputting the behavior sequence of the target object into a time series mining model to obtain the behavior time series features of the target object output by the time series mining model; the target object is any one of the objects;

[0211] The time series mining model includes at least one of a word-vector model and a converter-based bidirectional encoding representation BERT model.

[0212] In a possible implementation, the first feature acquisition module 702 is configured to:

[0213] Inputting the heterogeneous graph into a graph neural network model to obtain the relationship features of the respective objects output by the graph neural network;

[0214] The graph neural network includes a HinSAGE model.

[0215] In one possible implementation, the graph neural network is a graph neural network based on an attention mechanism.

[0216] In a possible implementation, the identification module 706 is configured to:

[0217] Performing anomaly detection on the at least one object set to obtain an abnormal group set in the at least one object set;

[0218] Matching the at least one object set based on a target rule to obtain a rule matching community set in the at least one object set; the target rule includes a rule satisfied by an object set having a specified interactive behavior;

[0219] The intersection of the abnormal community set and the rule matching community set is taken to obtain the target object set.

[0220] In a possible implementation, the identification module 706 is configured to:

[0221] extracting group features of each of the at least one object set;

[0222] The community features of each of the at least one object set are input into a community detection model to obtain a community detection result of the community detection model, where the community detection result is used to indicate the target object set.

[0223] In summary, the solution shown in the embodiment of the present application extracts the relationship features related to the relationship between the object and the service agency through a heterogeneous graph, and extracts the behavioral time series features of the object through the time series sequence composed of the behavior records between the object and the agency, and then clusters each object by combining the two features, and then identifies the set of objects with specified interactive behaviors from the clustered object set. Since the heterogeneous graph can effectively integrate the connection between the object and the service agency, different object representations can be learned more effectively. At the same time, the time series sequence composed of the behavior records of the object can better reflect the behavioral similarity between the objects. Therefore, the above solution can accurately cluster objects through the combination of the heterogeneous graph and the behavior sequence, thereby improving the accuracy of the object set with specified interactive behaviors identified from the clustering results.

[0224] Figure 8The following is a block diagram of a computer device 800 according to an exemplary embodiment of the present application. The computer device can be implemented as the server in the above-mentioned solution of the present application. The computer device 800 includes a central processing unit (CPU) 801, a system memory 804 including a random access memory (RAM) 802 and a read-only memory (ROM) 803, and a system bus 805 connecting the system memory 804 and the central processing unit 801. The computer device 800 also includes a mass storage device 806 for storing an operating system 809, application programs 810, and other program modules 811.

[0225] The mass storage device 806 is connected to the central processing unit 801 via a mass storage controller (not shown) connected to the system bus 805. The mass storage device 806 and its associated computer-readable medium provide non-volatile storage for the computer device 800. In other words, the mass storage device 806 may include a computer-readable medium (not shown) such as a hard disk or a Compact Disc Read-Only Memory (CD-ROM) drive.

[0226] Without loss of generality, the computer-readable medium may include computer storage media and communication media. Computer storage media include volatile and non-volatile, removable and non-removable media implemented by any method or technology for storing information such as computer-readable instructions, data structures, program modules or other data. Computer storage media include RAM, ROM, Erasable Programmable Read Only Memory (EPROM), Electronically Erasable Programmable Read-Only Memory (EEPROM), flash memory or other solid-state storage technology, CD-ROM, Digital Versatile Disc (DVD) or other optical storage, tape cassettes, magnetic tape, disk storage or other magnetic storage devices. Of course, those skilled in the art will appreciate that the computer storage media are not limited to the above-mentioned ones. The above-mentioned system memory 804 and mass storage device 806 can be collectively referred to as memory.

[0227] According to various embodiments of the present disclosure, the computer device 800 may also be connected to a remote computer on a network such as the Internet for operation. That is, the computer device 800 may be connected to a network 808 via a network interface unit 807 connected to the system bus 805, or the network interface unit 807 may be used to connect to other types of networks or remote computer systems (not shown).

[0228] The memory also includes at least one instruction, at least one program, code set or instruction set, and the at least one computer instruction is stored in the memory. The central processing unit 801 implements all or part of the steps in the object set recognition method shown in the above embodiments by executing the at least one computer instruction.

[0229] In an exemplary embodiment, a computer-readable storage medium is further provided, storing at least one computer instruction, which is loaded and executed by a processor to implement all or part of the steps in the above-described object set recognition method. For example, the computer-readable storage medium may be a read-only memory, a random access memory, a read-only optical disc, a magnetic tape, a floppy disk, or an optical data storage device.

[0230] In an exemplary embodiment, a computer program product or computer program is also provided. The computer program product or computer program includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform all or part of the steps of the methods described in the various embodiments above.

[0231] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0232] It should be understood that the present application is not limited to the exact structures described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for identifying an object set, characterized in that: The method comprises: Obtaining a heterogeneous graph corresponding to each object, wherein the heterogeneous graph is used to indicate the relationship between each object and each service organization; Based on the heterogeneous graph, extracting the relationship features of each of the objects; the relationship features are embedded representations of the heterogeneous graph; Obtaining a behavior sequence of each of the objects, wherein the behavior sequence includes behavior records of interaction between the objects and the service organization; and the behavior records in the behavior sequence are arranged in chronological order; Extracting the behavior time series features of each object based on the behavior sequence of each object; splicing the relationship features of the respective objects with the behavior time series features of the respective objects to obtain cluster features of the respective objects; performing clustering based on the cluster features of the respective objects to obtain at least one object set; Anomaly detection is performed on the at least one object set using an anomaly detection algorithm to obtain an abnormal group set in the at least one object set; the at least one object set is matched based on a target rule to obtain a rule-matching group set in the at least one object set; an intersection is taken between the abnormal group set and the rule-matching group set to obtain a target object set; the target object set is a set of objects that have specified interactive behaviors.

2. The method according to claim 1, characterized in that The service mechanism includes a first type mechanism and a second type mechanism; the first type mechanism is used to provide the object with a target service corresponding to the interactive behavior, and the second type mechanism is used to provide resource compensation for the resources required by the object to receive the target service; The obtaining of the heterogeneous graph corresponding to each object includes: Acquire object information of each of the objects, organization information of each of the first-type organizations, and organization information of each of the second-type organizations; generating the heterogeneous graph based on the object information of each of the objects, the organization information of each of the first-type organizations, and the organization information of each of the second-type organizations; In which, the heterogeneous graph includes an object node corresponding to the object, a first type of institution node corresponding to the first type of institution, and a second type of institution node corresponding to the second type of institution; the edge between the object node and the first type of institution node is used to indicate the number of times the first type of institution provides the target service to the object; the edge between the object node and the second type of institution node is used to indicate that there is a subordinate relationship between the object and the second type of institution.

3. The method according to claim 2, characterized in that The behavior record is used to indicate the behavior information of the subject in accepting the target service provided by the first type of institution; The behavior information includes: the organization identifier of the first type of organization, the occurrence time of the target service, and the number of resources corresponding to the target service.

4. The method according to claim 1, wherein The step of combining the relationship features of the objects with the behavior time series features of the objects to obtain cluster features of the objects includes: Obtaining object attribute characteristics of each of the objects; The relationship features of the respective objects, the behavior time series features of the respective objects, and the object attribute features of the respective objects are spliced ​​together to obtain the clustering features of the respective objects.

5. The method according to claim 1, wherein The extracting the behavior time series features of each object based on the behavior sequence of each object includes: Inputting the behavior sequence of the target object into a time series mining model to obtain the behavior time series features of the target object output by the time series mining model; the target object is any one of the objects; The time series mining model includes at least one of a word-vector model and a converter-based bidirectional encoding representation BERT model.

6. An object set recognition device, characterized in that: The device comprises: A heterogeneous graph acquisition module is used to acquire a heterogeneous graph corresponding to each object, wherein the heterogeneous graph is used to indicate the relationship between each object and each service organization; A first feature acquisition module is configured to extract, based on the heterogeneous graph, relationship features of the respective objects; the relationship features are embedded representations of the heterogeneous graph; A sequence acquisition module is used to acquire the behavior sequence of each of the objects, wherein the behavior sequence includes behavior records of interaction between the objects and the service agency; and the behavior records in the behavior sequence are arranged in chronological order; A second feature acquisition module is used to extract the behavior time series features of each object based on the behavior sequence of each object; A clustering model is used to combine the relationship features of the objects with the behavior time series features of the objects to obtain cluster features of the objects; and cluster the objects based on the cluster features to obtain at least one object set; An identification module is configured to perform anomaly detection on the at least one object set using an anomaly detection algorithm to obtain an abnormal group set in the at least one object set; match the at least one object set based on a target rule to obtain a rule-matching group set in the at least one object set; and take the intersection of the abnormal group set and the rule-matching group set to obtain a target object set; the target object set is a set of objects that have specified interactive behaviors.

7. A computer device, characterized in that: The computer device includes a processor and a memory, wherein the memory stores at least one computer instruction, and the at least one computer instruction is loaded and executed by the processor to implement the object set recognition method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores at least one computer program, and the computer program is loaded and executed by a processor to implement the object set recognition method according to any one of claims 1 to 5.

9. A computer program product, characterized in that The computer program product comprises computer instructions, and the computer instructions are executed by a processor to implement the object set recognition method according to any one of claims 1 to 5.

Citation Information

Patent Citations

  • Data processing method and device based on time sequence data and computer device

    CN110008251A

  • Medical fraud behavior detection method and system based on multi-view bi-clustering

    CN111899114A

  • Data exception identification method and device, storage medium and electronic equipment

    CN112221156A