A visual method, device and equipment for risk analysis

Abstract

The embodiments of this specification disclose a visualization method, device, and equipment for risk analysis. By obtaining the main graph data of the relationship network, wherein the main graph data includes nodes and edges connecting the nodes; dividing the main graph data into multiple sub-communities, and calculating the modularity of the main graph data after being divided into multiple sub-communities; adjusting the sub-community to which the node belongs, when the modularity is the largest, determining the community at this time as the target community; displaying the community sub-graph corresponding to the target community, wherein the community sub-graph includes multiple sub-communities. Thus, it is possible to discover suspicious risk groups with only a few steps, and at the same time visualize the results and mark them on the main graph.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to a visualization method, device and equipment for risk analysis. Background Art

[0002] With the development of the Internet, a large number of new examples of group risks have emerged, such as fraud and fake orders. Gang crimes often involve a wide range of areas and cause a lot of harm to society. In the Internet era, gang crimes often have traces to follow, and there are many connections and common features between gang members. In graph data, these connections and features are often expressed in the form of nodes and edges.

[0003] In a large data network, there are often many nodes and the relationships between them are complex, which makes it difficult or even impossible for experts to analyze. Traditional graph risk analysis methods require multiple steps to identify suspicious risk groups.

[0004] Based on this, a more convenient visualization solution for risk analysis is needed. Summary of the invention

[0005] One or more embodiments of the present specification provide a risk analysis visualization method, apparatus, device, and storage medium to solve the following technical problem: a more convenient risk analysis visualization solution is needed.

[0006] To solve the above technical problems, one or more embodiments of this specification are implemented as follows:

[0007] In a first aspect, one or more embodiments of this specification provide a risk analysis visualization method, including:

[0008] Acquire main graph data of the relationship network, wherein the main graph data includes nodes and edges connecting the nodes;

[0009] Dividing the main graph data into a plurality of sub-communities, and calculating the modularity of the main graph data after being divided into the plurality of sub-communities;

[0010] Adjust the subcommunity to which the node belongs, and when the modularity is the largest, determine the community at this time as the target community;

[0011] A community subgraph corresponding to the target community is displayed, wherein the community subgraph includes multiple subcommunities.

[0012] In a second aspect, an embodiment of the present specification provides a visualization device for risk analysis, including: an acquisition module, which acquires main graph data of a relationship network, wherein the main graph data includes nodes and edges connecting the nodes; a division module, which divides the main graph data into multiple sub-communities, and calculates the modularity of the main graph data after being divided into multiple sub-communities; a determination module, which adjusts the sub-community to which a node belongs, and when the modularity is the largest, determines that the community at this time is a target community; and a display module, which displays a community sub-graph corresponding to the target community, wherein the community sub-graph includes multiple sub-communities.

[0013] In a third aspect, an embodiment of the present specification provides an electronic device, including:

[0014] at least one processor; and,

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to the first aspect.

[0017] In a fourth aspect, an embodiment of the present specification provides a non-volatile computer storage medium storing computer executable instructions. When a computer reads the computer executable instructions in the storage medium, the instructions enable one or more processors to execute the method described in the first aspect.

[0018] At least one of the above technical solutions adopted in one or more embodiments of this specification can achieve the following beneficial effects: by obtaining the main graph data of the relationship network, wherein the main graph data includes nodes and edges connecting nodes; dividing the main graph data into multiple sub-communities, and calculating the modularity of the main graph data after being divided into multiple sub-communities; adjusting the sub-community to which the node belongs, and when the modularity is the largest, determining the community at this time as the target community; displaying the community sub-graph corresponding to the target community, wherein the community sub-graph includes multiple sub-communities. Thus, it is possible to discover suspicious risk groups with only a few steps, and at the same time visualize the results and mark them on the main graph, helping users to quickly find possible risk groups in complex large graphs and then focus on analysis, greatly improving the analysis efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0020] Figure 1 A flowchart of a visual method for risk analysis provided in an embodiment of this specification;

[0021] Figure 2a A schematic diagram of a main image data provided in an embodiment of this specification;

[0022] Figure 2b A schematic diagram of a sub-community obtained by division provided in an embodiment of this specification;

[0023] Figure 2c A schematic diagram of another subcommunity obtained by division provided in an embodiment of this specification;

[0024] Figure 2d A schematic diagram of a contour wrapping area provided in an embodiment of this specification;

[0025] Figure 3 A schematic diagram showing a core node provided in an embodiment of this specification;

[0026] Figure 4 A schematic diagram of the structure of a risk analysis visualization device provided in an embodiment of this specification;

[0027] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0028] The embodiments of this specification provide a risk analysis visualization method, device, equipment, and storage medium.

[0029] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0030] like Figure 1 As shown, Figure 1A flow chart of a visualization method for risk analysis provided in an embodiment of this specification includes the following steps:

[0031] S101: Acquire main graph data of a relationship network, wherein the main graph data includes nodes and edges connecting the nodes.

[0032] A relationship network is a data structure consisting of a set of entities (nodes) and a set of relationships (edges) between entities. In the embodiments of this specification, a node may represent a user, a device, an application client, etc., and an edge represents the interaction characteristics between nodes. Therefore, a node may also have corresponding node attributes, including location, city, transaction quantity, etc.

[0033] For example, a node may be a device identifier of a device used by a user, and a node attribute may include the city where the device is used, etc. Meanwhile, an edge may be the number of transactions generated between nodes.

[0034] The main graph data is the relationship network expressed in a visual way. Figure 2a As shown, Figure 2a A schematic diagram of a main graph data provided in an embodiment of this specification. It includes multiple nodes (node) and edges (edge) connecting the nodes. When a node is connected to another node through any edge, the two can be regarded as adjacent nodes to each other. In the main graph data, there may be multiple interconnected edges between any two nodes (indicating that there may be multiple interactions between the two nodes), or there may be no interconnected edges (indicating that there is no interaction between the two nodes).

[0035] In addition, it should be noted that in the main graph community, a number of dangerous nodes can be pre-specified based on actual experience, and higher weights can be given to the edges connecting the dangerous nodes.

[0036] S103, dividing the main graph data into a plurality of sub-communities, and calculating the modularity of the main graph data after being divided into the plurality of sub-communities.

[0037] A subcommunity is composed of some nodes and some edges in the relationship network. In other words, the data that constitutes the subcommunity is a true subset of the subgraph data. The way to divide the subcommunity can be random or cyclically adjusted based on a certain algorithm.

[0038] Modularity is used to characterize the quality of the division of subcommunities in a main graph data. In a better division method, the higher the correlation of nodes in the same subcommunity, the greater the modularity of the entire main graph data. For example, for a subcommunity, the modularity of the subcommunity can be characterized by the difference between the number of edges between nodes in the community and the number of edges in a random situation, and the modularity of the main graph data can be characterized as the sum of the modularities of each subcommunity.

[0039] For example, the modularity of a subcommunity can be calculated as follows: in, Among them, A ij represents the weight of the edge between node i and node j (by default, all edge weights are the same and can be considered as 1), k i represents the sum of the weights of the edges connected to node i, c i represents the community to which node i belongs, and m represents the sum of the weights of all edges (when the weights of all edges are the same, m represents the number of edges in the main data graph).

[0040] In this way, the nodes in the main data graph can be arbitrarily divided into a certain community, and the modularity of the main graph data after being divided into multiple sub-communities can be calculated. For a sub-community, the modularity of the sub-community can also be represented as the difference between the weight of the edge within the community and the sum of the weights of all edges connected to the community nodes.

[0041] S105, adjusting the subcommunity to which the node belongs, and when the modularity is the largest, determining the community at this time as the target community.

[0042] For example, each node can be regarded as an independent community in the initial stage, and then each node can be assigned to its adjacent nodes, thereby changing the division method of subcommunities in the main graph data. This is equivalent to community folding, and the community folding process can be cyclical, for example, the number of cyclic folding times can be set for folding.

[0043] Obviously, for any node, every time the subcommunity to which it belongs is adjusted, the sum of the weights of the edges of the current subcommunity and the adjusted subcommunity will change, thereby causing the modularity value to increase or decrease. As mentioned above, since modularity is positively correlated with the quality of the subcommunity division in the main graph data, the division method when the modularity is the largest can be the subcommunity division method to be found, so the community at this time can be determined as the target community.

[0044] S107, displaying a community subgraph corresponding to the target community, wherein the community subgraph includes a plurality of subcommunities.

[0045] As for the community sub-graph, since it is a division method of the main graph data, it can be displayed in the interface of the main graph data. However, in order to better compare with the main graph data, it can also be displayed in other interfaces adjacent to the display interface of the main graph data.

[0046] Users can select subcommunities in the community submap, so that only the subcommunities selected by the user can be displayed, so that users can conduct further in-depth analysis of the subcommunities in a targeted manner.

[0047] In addition, since the subcommunities obtained by division usually contain a certain number of nodes, the community node threshold can be pre-set to filter out those subcommunities whose number of nodes does not exceed the community node threshold. For example, subcommunities with no more than 4 nodes are considered invalid communities, so that invalid communities are not displayed in the display interface of the community subgraph to avoid invalid analysis.

[0048] By obtaining the main graph data of the relationship network, wherein the main graph data includes nodes and edges connecting nodes; dividing the main graph data into multiple sub-communities, and calculating the modularity of the main graph data after being divided into multiple sub-communities; adjusting the sub-community to which the node belongs, when the modularity is the largest, determining the community at this time as the target community; and displaying the community sub-graph corresponding to the target community, wherein the community sub-graph includes multiple sub-communities. Thus, it is possible to discover suspicious risk groups with only a few steps, and at the same time visualize the results and mark them on the main graph, helping users to quickly discover possible risk groups in complex large graphs and then focus on analysis, greatly improving the analysis efficiency.

[0049] In one embodiment, the subcommunity to which a node belongs can be adjusted in the following manner: for any node, assign it to an adjacent community; calculate the modularity change value before and after the assignment; assign the node to the adjacent community with the largest modularity change value to generate a target community.

[0050] For any node, if there is at least one other node connected to it in a community, then the community can be regarded as the neighboring community of the node.

[0051] For the main graph data containing N nodes, each node can be regarded as an initial subcommunity. Then, for any i-th node (1≤i≤N), node i is assigned to the initial subcommunity where each of its neighbor nodes is located, and the modularity change value ΔQ before and after the assignment is calculated. When ΔQ is the largest (that is, node i is assigned to the community where the neighbor node with the largest ΔQ is located), the multiple subcommunities obtained at this time are the target communities. Figure 2b As shown, Figure 2b This is a schematic diagram of a subcommunity obtained by division provided in an embodiment of this specification. In this schematic diagram, 15 nodes are divided into 3 subcommunities in total.

[0052] It should be noted that the aforementioned node adjustment process can be a repeated cycle process. By adjusting the community affiliation of any node i, ΔQ will no longer increase when any adjustment occurs, and the communities to which all nodes belong will no longer change.

[0053] Furthermore, the subcommunities after the initial division can be collapsed, that is, all nodes in the same community are compressed into a new node, the edge weights between nodes in the community are converted into the ring weights of the new node, and the edge weights between communities are converted into edge weights between new nodes. The collapsed subcommunity is regarded as a new node.

[0054] Then repeat the above adjustment process until the modularity of the entire graph no longer changes after multiple adjustments. Then the multiple subcommunities obtained at this time are the target communities.

[0055] In one embodiment, the node data and edge data in each subcommunity obtained by the division can also be displayed in the form of structured data. For example, the attributes of the nodes in each subcommunity, as well as the attributes of the edges, etc., are displayed in the form of a visual table. As shown in Table 1, Table 1 is a table diagram of community data provided in an embodiment of the present application.

[0056] Table 1

[0057]

[0058]

[0059] The community division results are displayed in a visual multi-dimensional cross-tabulation. In addition, the table can support the export and download of data, which can facilitate users to conduct intuitive analysis.

[0060] In one embodiment, after displaying the aforementioned structured data, the aforementioned structured data can also be displayed in conjunction with the main graph. Specifically, if the user selects a sub-table in the structured data (the sub-table corresponds to a sub-community), the sub-community corresponding to the sub-table (including nodes, edges in the sub-community, and the outline of the sub-community, etc.) can be highlighted in the main graph data; if the user selects a node in the structured data, the node can be highlighted in the main graph data, and other information related to the selected node can also be highlighted at the same time. For example, other information can be the outline of the sub-community to which the node belongs, or it can be other adjacent nodes that belong to the sub-community and have connecting edges with the node. In this way, the data selected by the user is displayed intuitively, which is convenient for the user to perform subsequent analysis.

[0061] In one embodiment, when assigning a node to a neighboring community and calculating the modularity change value, the attribute similarity between the node and the neighboring community may also be considered.

[0062] Specifically, for any node i, when it is assigned to an adjacent community, the attribute similarity between node i and all nodes in the adjacent community can be calculated separately, and the statistical value (including mean, median, etc.) of the attribute similarity of all nodes in the adjacent community is regarded as the similarity S between node i and the adjacent community, and the modularity S change value ΔQ is corrected by the similarity.

[0063] For example, ΔQ*S can be regarded as the change value of the corrected modularity; or, the empirical coefficient K can be set in advance, and ΔQ+K*S can be regarded as the change value of the corrected modularity value, and so on. The specific correction method can be determined based on actual needs. By calculating the similarity between the node and the adjacent community, the attributes of the community gang members such as lbs, age, amount, etc. can be measured to fit the risk analysis scenario.

[0064] For example, for node15 in Table 1 above, it is obvious that it is quite different from node1, node2 and node3 in subcommunity 1, and its similarity is low. Without considering node similarity, it is classified into community 1; while considering node similarity, it may be classified into other communities with higher similarity, such as Figure 2c As shown, Figure 2c This is a schematic diagram of another sub-community obtained by division provided in an embodiment of this specification.

[0065] In one embodiment, for the multiple sub-communities obtained by division, contours may be used to respectively wrap the regions of the multiple sub-communities (i.e., the nodes of different communities are respectively wrapped by contours), to generate contour wrapped regions corresponding to the multiple sub-communities; and the contour wrapped regions are displayed. Figure 2d As shown in Figure 2d This is a schematic diagram of an outline wrapping area provided in an embodiment of this specification. In this schematic diagram, each subcommunity is included by a colored curve frame. In this way, it is convenient for users to visually distinguish each subcommunity.

[0066] In one embodiment, after each subcommunity is outlined, each outlined area can be further colored. Specifically, the risk level of the subcommunity corresponding to the outlined area can be determined, and the outlined area can be colored according to the risk level, wherein the higher the risk level, the darker the color.

[0067] For example, the risk level of each subcommunity can be determined based on the number of known risk nodes contained in each subcommunity (in fact, there are usually a certain number of known risk nodes that have been determined to be risky in a relationship network). The more known risk nodes there are, the higher the risk level.

[0068] Furthermore, high-risk subcommunities can be colored darker. For example, high-risk areas can be colored dark blue, brown, etc., while low-risk areas can be colored orange, yellow, green, etc. Alternatively, the same color (for example, blue) can be used for each subcommunity, while high-risk subcommunities can be colored dark blue and low-risk areas can be colored light blue. In this way, the possible risk level of each subcommunity can be more intuitively indicated, and the target user can conduct subsequent analysis.

[0069] In one embodiment, before dividing the main graph data into multiple sub-communities, the main graph data may be screened in advance, that is, determining the core degree, wherein the core degree is used to characterize the degree of connection between nodes; determining the core nodes in the main graph data that meet the core degree; displaying the main graph data in the main graph interface, and displaying the core main graph data in another interface at the same time, wherein the core main graph data includes the core nodes and the edges connecting the core nodes.

[0070] For example, a configurable coreness option is provided in the interface. The user can freely input the coreness value. When the coreness is 2, the core nodes screened out are any two core nodes with 2 or more edges between them (i.e., there are 2 or more interactions between the core nodes).

[0071] like Figure 3 As shown, Figure 3 A schematic diagram for displaying a core node provided in an embodiment of this specification. In this schematic diagram, the main graph data is displayed in the main graph interface on the left, and the core main graph data is displayed in another interface on the right. In this way, you only need to configure the core degree value to extract the core nodes from the main graph data, and further perform subsequent sub-community division and analysis based on the core nodes, which truly improves the analysis efficiency in the scenario of risk analysis community gang mining.

[0072] In one embodiment, after the core node is determined, the core node and the edges connecting the core node can also be highlighted in the graph interface. The highlighting method includes enlarging the core node and bolding the edges connecting the core node; or, applying special coloring to the core node and the edges connecting the core node, etc., so that the display effect of the core node is more intuitive.

[0073] In one embodiment, when displaying the core node in another interface, the position of the core main graph data (including the core node and the edge) in the other interface can also be adjusted, for example, the position of the core node in the other interface is relatively scaled based on the position of the core node in the main graph interface. Figure 3 As shown in , the relative positions of any core nodes in the two interfaces are the same, and when the core main graph data in the other interface is enlarged, each core node can overlap with the core node in the main graph data. Thus, the layout of the core main graph data is consistent with the layout of the main graph data, so that users can quickly compare the core main graph data with the main graph data.

[0074] Based on the same idea, one or more embodiments of this specification also provide devices and apparatuses corresponding to the above methods, such as Figure 4 , Figure 5 shown.

[0075] In the second aspect, Figure 4 As shown, Figure 4 A schematic diagram of a risk analysis visualization device provided in an embodiment of this specification, the device comprising:

[0076] An acquisition module 401 acquires main graph data of a relationship network, wherein the main graph data includes nodes and edges connecting the nodes;

[0077] A division module 403 divides the main graph data into a plurality of sub-communities, and calculates the modularity of the main graph data after being divided into the plurality of sub-communities;

[0078] Determining module 405, adjusting the subcommunity to which the node belongs, and when the modularity is the largest, determining the community at this time as the target community;

[0079] The display module 407 displays the community subgraph corresponding to the target community, wherein the community subgraph includes multiple subcommunities.

[0080] Optionally, the partitioning module 403 allocates any node to an adjacent community; calculates the modularity change value before and after the allocation; and allocates the node to the adjacent community with the largest modularity change value to generate multiple subcommunities.

[0081] Optionally, the partitioning module 403 determines other nodes included in the adjacent community; calculates attribute similarity between the i-th node and the other nodes; and calculates modularity change values ​​before and after allocation based on the attribute similarity.

[0082] Optionally, the display module 407 is further configured to respectively wrap the regions of the plurality of sub-communities with outlines to generate outline-wrapped regions corresponding to the plurality of sub-communities; and display the outline-wrapped regions.

[0083] Optionally, the display module 407 determines the risk level of the subcommunity corresponding to the outline wrapped area; and renders the outline wrapped area in color according to the risk level, wherein the higher the risk level, the darker the coloring.

[0084] Optionally, the device also includes a core node determination module 409, which determines the core degree, wherein the core degree is used to characterize the degree of connection between nodes; determines the core nodes in the main graph data that meet the core degree; the display module 407 displays the main graph data in the main graph interface, and simultaneously displays the core main graph data in another interface, wherein the core main graph data includes the core nodes and the edges connecting the core nodes.

[0085] Optionally, the display module 407 determines the layout of the main image data in the main image interface; and adjusts the position of the core main image data in the other interface so that the layout of the core main image data is consistent with the layout of the main image data.

[0086] Optionally, the display module 407 highlights the core nodes and the edges connecting the core nodes in the main graph interface.

[0087] Optionally, the display module 407 displays the node data and edge data contained in the multiple sub-communities in the form of structured data.

[0088] In the third aspect, Figure 5 As shown, Figure 5 A schematic diagram of the structure of an electronic device provided for one or more embodiments of this specification, the device comprising:

[0089] at least one processor; and,

[0090] a memory communicatively connected to the at least one processor; wherein,

[0091] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to the first aspect.

[0092] In the fourth aspect. Based on the same idea, one or more embodiments of this specification also provide a non-volatile computer storage medium corresponding to the above method, storing computer executable instructions, and when a computer reads the computer executable instructions in the storage medium, the instructions enable one or more processors to execute the method as described in the first aspect.

[0093] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0094] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0095] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0096] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0097] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, the embodiments of this specification may be in the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the embodiments of this specification may be in the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0098] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0099] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0100] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0101] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0102] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0103] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0104] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0105] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0106] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, equipment, and non-volatile computer storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0107] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0108] The above description is only one or more embodiments of this specification and is not intended to limit this specification. For those skilled in the art, one or more embodiments of this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of one or more embodiments of this specification shall be included in the scope of the claims of this specification.

Claims

1. A visualization method for risk analysis, comprising: Obtaining main graph data of a relationship network, wherein the main graph data includes nodes and edges connecting the nodes, the nodes represent users, devices or application clients, and the edges represent interaction features between the nodes; Dividing the main graph data into a plurality of sub-communities, and calculating the modularity of the main graph data after being divided into the plurality of sub-communities; Adjust the subcommunity to which the node belongs, and when the modularity is the largest, determine the community at this time as the target community, including: for any node, assign it to an adjacent community; calculate the modularity change value before and after the assignment; assign the node to the adjacent community with the largest modularity change value to generate the target community, for any node i, when assigning it to the adjacent community, respectively calculate the attribute similarity of the node i and all the nodes in the adjacent community, and regard the statistical value of the attribute similarity of all the nodes in the adjacent community as the similarity S between the node i and the adjacent community, and correct the modularity change value ΔQ by the similarity S; Displaying a community subgraph corresponding to the target community, wherein the community subgraph includes multiple subcommunities for discovering risk groups; The correction is performed so that the number of edges between at least one node and its subcommunity is less than the number of edges between the node and an adjacent subcommunity; contours are used to respectively wrap the areas of the multiple subcommunities to generate contour wrapping areas corresponding to the multiple subcommunities; the contour wrapping areas are displayed; the node is used as the edge area of ​​the contour wrapping area to which it belongs to be distinguished from the adjacent subcommunity, and there are gaps between different contour wrapping areas.

2. The method according to claim 1, wherein the calculation of the modularity change value before and after the allocation further comprises: Determining other nodes included in the adjacent community; Calculate the attribute similarity between the i-th node and the other nodes; The modularity change value before and after the allocation is calculated according to the attribute similarity.

3. The method of claim 1, wherein: Display the outline wrapping area, including: Determine the risk level of the sub-community corresponding to the contour parcel area; The contour wrapped area is shaded and rendered according to the risk level, wherein the higher the risk level, the darker the coloring.

4. The method of claim 1, wherein: Before dividing the main graph data into a plurality of sub-communities, the method further includes: Determining a core degree, wherein the core degree is used to characterize the degree of connection between nodes; Determine a core node in the main graph data that satisfies the core degree; The main graph data is displayed in a main graph interface, and core main graph data is simultaneously displayed in another interface, wherein the core main graph data includes the core nodes and edges connecting the core nodes.

5. The method of claim 4, wherein: In another interface, the core main image data is displayed at the same time, including: Determining the layout of the main chart data in the main chart interface; The position of the core main image data is adjusted in the other interface so that the layout of the core main image data is consistent with the layout of the main image data.

6. The method of claim 4, wherein: The main graph data is displayed in the main graph interface, including: The core nodes and the edges connecting the core nodes are highlighted in the main graph interface.

7. The method of claim 1, further comprising: The node data and edge data contained in the plurality of sub-communities are respectively displayed in the form of structured data.

8. A visualization device for risk analysis, comprising: An acquisition module is used to acquire main graph data of a relationship network, wherein the main graph data includes nodes and edges connecting the nodes, the nodes represent users, devices or application clients, and the edges represent interaction features between the nodes; a division module, dividing the main graph data into a plurality of sub-communities, and calculating the modularity of the main graph data after being divided into the plurality of sub-communities; Determine the module, adjust the subcommunity to which the node belongs, and when the modularity is the largest, determine the community at this time as the target community, including: for any node, assign it to an adjacent community; calculate the modularity change value before and after the assignment; assign the node to the adjacent community with the largest modularity change value to generate the target community, for any node i, when assigning it to the adjacent community, respectively calculate the attribute similarity of the node i and all the nodes in the adjacent community, and regard the statistical value of the attribute similarity of all the nodes in the adjacent community as the similarity S between the node i and the adjacent community, and correct the modularity change value ΔQ by the similarity S; A display module, which displays a community subgraph corresponding to the target community, wherein the community subgraph includes multiple subcommunities for discovering risk groups; The correction is performed so that the number of edges between at least one node and its subcommunity is less than the number of edges between the node and an adjacent subcommunity; contours are used to respectively wrap the areas of the multiple subcommunities to generate contour wrapping areas corresponding to the multiple subcommunities; the contour wrapping areas are displayed; the node is used as the edge area of ​​the contour wrapping area to which it belongs to be distinguished from the adjacent subcommunity, and there are gaps between different contour wrapping areas.

9. The device as claimed in claim 8, wherein the partitioning module determines other nodes included in the adjacent community; calculates the attribute similarity between the i-th node and the other nodes; and calculates the modularity change value before and after the allocation based on the attribute similarity.

10. The device according to claim 8, wherein the display module determines the risk level of the subcommunity corresponding to the outline encapsulation area; and renders the outline encapsulation area according to the risk level, wherein: The higher the risk, the darker the color.

11. The apparatus according to claim 8, further comprising a core node determination module, which determines the core degree, wherein: The core degree is used to characterize the degree of connection between nodes; determining the core nodes in the main graph data that meet the core degree; The display module displays the main graph data in a main graph interface, and simultaneously displays core main graph data in another interface, wherein the core main graph data includes the core nodes and the edges connecting the core nodes.

12. In the device as described in claim 11, the display module determines the layout of the main image data in the main image interface; and adjusts the position of the core main image data in the other interface so that the layout of the core main image data is consistent with the layout of the main image data.

13. The device as claimed in claim 11, wherein the display module highlights the core node and the edges connecting the core node in the main graph interface.

14. The device according to claim 8, wherein the display module displays the node data and edge data contained in the plurality of sub-communities in the form of structured data.

15. An electronic device, comprising: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

Images