Abnormal group identification method, device, electronic device and storage medium

Abstract

The present invention provides an abnormal group identification method, device, electronic device and storage medium, the method comprising: obtaining an initial node relationship graph, the initial node relationship graph including multiple initial nodes and the weight of the edge between two initial nodes with a connection relationship, the multiple initial nodes respectively belonging to different communities; based on a community discovery algorithm, determining the initial nodes belonging to the same merged community, and taking the same merged community as a new node to obtain a first intermediate node relationship graph; if the weight of the edge between the two new nodes is less than the target weight, cutting off the edge between the two new nodes to obtain a second intermediate node relationship graph; iteratively executing the community discovery algorithm on the second intermediate node relationship graph and cutting off the edge with a weight less than the target weight until the second intermediate node relationship graph converges; according to the final second intermediate node relationship graph, determining multiple initial nodes belonging to an abnormal group. The present invention can improve the accuracy of abnormal group identification results.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an abnormal group identification method, device, electronic equipment and storage medium. Background Art

[0002] In the prior art, when identifying abnormal behavior, images, texts, audio and video, etc. can be detected at the content level. If the content is found to be in violation of the rules, the content will be deleted or the account will be punished. Alternatively, the account's behavior actions can be analyzed, and abnormal access, browsing, clicking, and publishing behaviors can be modeled and processed, and the violating accounts can be dealt with.

[0003] However, abnormal groups often use newly registered accounts to publish illegal information. Since new accounts have no historical behavior data, it is impossible to determine the nature of users through user behavior characteristics. In addition, content-based detection can discover and process obviously exposed violations, but its ability to discover various types of hidden anomalies is relatively weak. Summary of the invention

[0004] The embodiments of the present invention provide a method, device, electronic device and storage medium for identifying an abnormal group, so as to improve the accuracy of identifying a cheating group.

[0005] According to a first aspect of an embodiment of the present invention, a method for identifying an abnormal group is provided, comprising:

[0006] Acquire an initial node relationship graph, the initial node relationship graph including a plurality of initial nodes and weights of edges between two initial nodes having a connection relationship, the plurality of initial nodes respectively belonging to different communities;

[0007] Based on the community discovery algorithm, according to the weight of the edge between the two initial nodes, the initial nodes belonging to the same merged community are determined, and the same merged community is used as a new node to obtain a first intermediate node relationship graph corresponding to the initial node relationship graph;

[0008] If the weight of the edge between the two new nodes is less than the target weight, cutting off the edge between the two new nodes in the first intermediate node relationship graph to obtain a second intermediate node relationship graph;

[0009] Iteratively executing the community discovery algorithm on the second intermediate node relationship graph and cutting off the edge between two new nodes whose weights are less than the target weights until the second intermediate node relationship graph converges, and taking the final second intermediate node relationship graph as the target node relationship graph;

[0010] According to the target node relationship graph, multiple initial nodes belonging to the abnormal group are determined.

[0011] According to a second aspect of an embodiment of the present invention, there is provided an abnormal group identification device, comprising:

[0012] An initial relationship graph acquisition module, used to acquire an initial node relationship graph, wherein the initial node relationship graph includes a plurality of initial nodes and weights of edges between two initial nodes having a connection relationship, wherein the plurality of initial nodes belong to different communities respectively;

[0013] A community discovery module, configured to determine the initial nodes belonging to the same merged community based on the weight of the edge between the two initial nodes based on a community discovery algorithm, and use the same merged community as a new node to obtain a first intermediate node relationship graph corresponding to the initial node relationship graph;

[0014] an edge cutting module, configured to cut off the edge between the two new nodes in the first intermediate node relationship graph if the weight of the edge between the two new nodes is less than the target weight, so as to obtain a second intermediate node relationship graph;

[0015] An iterative control module, used for iteratively executing a community discovery algorithm on the second intermediate node relationship graph and cutting off edges between two new nodes whose weights are less than a target weight, until the second intermediate node relationship graph converges, and taking the final second intermediate node relationship graph as a target node relationship graph;

[0016] The abnormal group determination module is used to determine multiple initial nodes belonging to the abnormal group according to the target node relationship graph.

[0017] According to a third aspect of an embodiment of the present invention, an electronic device is provided, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, the steps of the abnormal group identification method described in the first aspect are implemented.

[0018] According to a fourth aspect of an embodiment of the present invention, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the abnormal group identification method described in the first aspect are implemented.

[0019] The abnormal group identification method, device, electronic device and storage medium provided by the embodiment of the present invention, after obtaining the initial node relationship graph, based on the community discovery algorithm, according to the weight of the edge between two initial nodes in the initial node relationship graph, determine the initial nodes belonging to the same merged community, and use the same merged community as a new node to obtain the first intermediate node relationship graph corresponding to the initial node relationship graph. If the weight of the edge between the two new nodes is less than the target weight, the edge between the two new nodes is cut off in the first intermediate node relationship graph to obtain the second intermediate node relationship graph, iteratively execute the community discovery algorithm on the second intermediate node relationship graph and cut off the edge between the two new nodes with weights less than the target weight until the second intermediate node relationship graph converges, and use the final second intermediate node relationship graph as the target node relationship graph, and determine multiple initial nodes belonging to the abnormal group according to the target node relationship graph. The abnormal group is determined based on the connection relationship between each initial node through the community discovery algorithm, and new accounts and hidden anomalies can also be more accurately identified. Moreover, by cutting off the edge between the two new nodes with weights less than the target weight, the problem of merging a large community into a small community can be solved, thereby improving the accuracy of the abnormal group identification result. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 is a flow chart of an abnormal group identification method provided by an embodiment of the present invention;

[0021] Figure 2 is a system architecture diagram of an abnormal group identification method executed in an embodiment of the present invention;

[0022] Figure 3 It is a structural block diagram of an abnormal group identification device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0023] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] Figure 1 is a flow chart of an abnormal group identification method provided by an embodiment of the present invention. The abnormal group identification method can be executed by an electronic device such as a server, such as Figure 1 As shown, the abnormal group identification method includes:

[0025] Step 110: obtaining an initial node relationship graph, wherein the initial node relationship graph includes a plurality of initial nodes and weights of edges between two initial nodes having a connection relationship, and the plurality of initial nodes respectively belong to different communities.

[0026] The initial node may include a registered account, a resource identifier, etc. The resource identifier may be, for example, a mobile phone number, a device identifier, or an instant messaging software account, etc. The registered account is an account registered by the user in the current application, and the instant messaging software account is an instant messaging software (such as WeChat, QQ, etc.) account used by the user when logging into the current application. The connection relationship between two initial nodes means that the two initial nodes use at least one of the same mobile phone number, business license code, IP address, device identifier, etc. Communities refer to some dense groups in the network. The nodes within each community are relatively tightly connected, while the connections between communities are relatively sparse.

[0027] Obtain an initial node relationship graph, wherein the initial node in the initial node relationship graph may be one of a registered account, a mobile phone number, an instant messaging software account, etc. Each initial node may use a different account, such as one initial node may be a registered account, another initial node may be a mobile phone number, another initial node may also be a QQ number, etc., so that the initial node relationship graph is a heterogeneous graph. The initial node relationship graph may be established in advance based on all initial nodes to be determined as abnormal gangs, that is, the connection relationship between two initial nodes is determined, and thus based on the connection relationship between the two initial nodes and the correspondence between the pre-set connection relationship and the weight, the weight of the edge between the two initial nodes may be determined, thereby obtaining the initial node relationship graph corresponding to all initial nodes.

[0028] Step 120, based on the community discovery algorithm, according to the weight of the edge between the two initial nodes, determine the initial nodes belonging to the same merged community, and use the same merged community as a new node to obtain a first intermediate node relationship graph corresponding to the initial node relationship graph.

[0029] The community discovery algorithm may be a community discovery algorithm based on modularity, for example, the Louvain algorithm.

[0030] Based on the community discovery algorithm, based on the modularity change of other communities when each initial node is added to other communities, the initial nodes belonging to the same merged community are determined, and the same merged community is used as a new node, and the initial node relationship graph is updated to a first intermediate node relationship graph about the new node.

[0031] In one embodiment of the present invention, determining the initial nodes belonging to the same merged community according to the weight of the edge between the two initial nodes includes: for each initial node in the initial node relationship graph, determining the modularity change of other communities when the initial node is added to other communities according to the weight of the edge between the initial node and other initial nodes; determining the merged community to which the initial node belongs based on the modularity change, and determining the initial node and the original initial nodes in the merged community to which the initial node belongs as initial nodes belonging to the same merged community.

[0032] Modularity is the difference between the number of edges connecting nodes in a community and the number of edges in a random situation. The function is defined as follows:

[0033]

[0034] Among them, A ij represents the weight of the edge between the initial node i and the initial node j, K i represents the sum of the weights of all edges connected to node i, K j represents the sum of the weights of all edges connected to node j, C i represents the community to which the initial node i belongs, C j represents the community to which the initial node j belongs, and m represents the sum of the weights of all edges in the initial node relationship graph.

[0035] The above formula is meaningful only when nodes i and j belong to the same community, so the above formula measures the closeness within a community. The simplified variation of the above formula is as follows:

[0036]

[0037] Among them, ∑in represents the sum of edge weights in community C, where community C is the community to which initial nodes i and j belong, ∑K i represents the sum of the weights of the edges connected to the initial node i in community C. The edges connected to the initial node i in community C include the edges connecting the initial node in community C to the initial node i and the edges connecting the initial node outside community C to the initial node i. ∑K j represents the sum of the weights of the edges connected to the initial node j in community C. The edges connected to the initial node j in community C include the edges connecting the initial nodes in community C and the initial nodes outside community C. ∑tot replaces ∑K i and ∑K j .

[0038] In the Louvain algorithm, there is no need to find the specific modularity of each community. It is only necessary to compare the change in modularity after adding a node to the community, so it is necessary to solve the change in modularity ΔQ. Assign the initial node i to a community, and the change in modularity of the community is:

[0039]

[0040] Among them, K i,in represents the sum of the edge weights between all initial nodes in the community and initial node i, K i Represents the sum of the weights of all edges connected to the initial node i.

[0041] For each initial node i in the initial node relationship graph, according to the weights of the edges between the initial node i and other initial nodes, determine the sum of the weights m of all edges in the initial node relationship graph, and determine the sum of the weights K of the edges connecting all initial nodes in other communities with the initial node i when the initial node i is added to other communities. i,in , and determine the sum of the weights K of all edges connected to the initial node i i , determine the sum of the weights of the edges connected to the initial nodes in the other communities ∑tot, and set m, K i,in , K i Substituting ∑tot into the above modularity change formula, we can obtain the modularity change of other communities when the initial node i is added to other communities.

[0042] Based on the change in the modularity of other communities when the initial node i is added to other communities, the merged community to which the initial node belongs can be determined, and the initial node and the original initial nodes in the merged community to which the initial node belongs are determined as initial nodes belonging to the same merged community, that is, all initial nodes in a merged community after the node belongs to the community are determined as initial nodes belonging to the same merged community, that is, the initial nodes belonging to the same merged community after the community is merged are obtained. By determining the merged community to which the initial node belongs based on the change in the modularity of other communities when the initial node is added to other communities, and then obtaining the initial nodes belonging to the same merged community, the communities can be merged more accurately.

[0043] In one embodiment of the present invention, determining the merged community to which the initial node belongs based on the modularity change includes: determining other communities with the largest modularity change as the merged community to which the initial node belongs; and if the modularity changes are all zero, keeping the community of the initial node unchanged.

[0044] If an initial node joins another community, the modularity of the other community will increase to the greatest extent, that is, the modularity change of the other community is the largest, then the initial node is added to the other community, and the other community with the largest modularity change is determined as the merged community to which the initial node belongs; if an initial node does not increase the modularity change of the other community after joining the other community, that is, the modularity change of the other community is zero, then the community of the initial node remains unchanged, that is, the initial node stays in its current community, and the current community where the initial node is located is determined as the merged community of the initial node. Determining the merged community to which the initial node belongs by the modularity change can make closely connected nodes belong to the same merged community, thereby improving the accuracy of community merging.

[0045] In one embodiment of the present invention, taking the same merged community as a new node to obtain a first intermediate node relationship graph corresponding to the initial node relationship graph includes: taking the same merged community as a new node, and determining the weight of the edge between two new nodes with a connection relationship based on the weight of the edge between two initial nodes in the initial node relationship graph, to obtain the first intermediate node relationship graph corresponding to the initial node relationship graph.

[0046] The same merged community is taken as a new node. If the initial node in one merged community has a connection relationship with the initial node in the other merged community, it is determined that the two new nodes corresponding to the two merged communities have a connection relationship; if the initial node in one merged community has only one edge with the initial node in another merged community, the weight of the edge is used as the weight of the edge between the two new nodes corresponding to the two merged communities; if there are at least two edges between the initial node in one merged community and the initial node in another merged community, the weights of the at least two edges are added and calculated, and the result is used as the weight of the edge between the two new nodes corresponding to the two merged communities; after determining the weights of the edges between all two new nodes with a connection relationship, the two new nodes with a connection relationship are connected, and the weights of the edges between the two new nodes are marked to obtain a first intermediate node relationship graph. By taking the same merged community as a new node and determining the weights of the edges between the two new nodes, the first intermediate node relationship graph is obtained, which facilitates iterative execution of the community discovery algorithm.

[0047] In one embodiment of the present invention, the weight of the edge between two new nodes having a connection relationship is determined based on the weight of the edge between two initial nodes in the initial node relationship graph, including: for two new nodes, the weights of the edges between each initial node corresponding to one of the new nodes and the initial node corresponding to the other new node are added together to obtain the weight of the edge between the two new nodes.

[0048] For two new nodes with a connection relationship, the weights of all edges between the initial nodes corresponding to one of the new nodes and the initial nodes corresponding to the other new node are added together to obtain the weight of the edge between the two new nodes. The weight of the edge between the two new nodes is determined by adding the weights, which can improve the accuracy of the determined weights.

[0049] Step 130: If the weight of the edge between the two new nodes is less than the target weight, the edge between the two new nodes in the first intermediate node relationship graph is cut off to obtain a second intermediate node relationship graph.

[0050] The target weight may be a weight value pre-set based on the initial node relationship graph, or may be a weight value determined in real time based on the first intermediate node relationship graph.

[0051] Determine two new nodes with a connection relationship in the first intermediate node relationship graph, compare the weight of the edge between the two new nodes with the target weight, if the weight of the edge between the two new nodes is less than the target weight, then cut off the edge between the two new nodes in the first intermediate node relationship graph, that is, cut off the connection relationship between the two new nodes in the first intermediate node relationship graph, and obtain a second intermediate node relationship graph.

[0052] For example, there are 4 new nodes in the first intermediate node relationship graph, namely A, B, C, and D. The weight of the edge between the new node A and the new node B is 4, the weight of the edge between the new node A and the new node C is 1, the weight of the edge between the new node A and the new node D is 1, the weight of the edge between the new node B and the new node D is 1, and the weight of the edge between the new node C and the new node D is 3. The average weight 2 of all edges is determined as the target weight, then the edges with weights less than the target weight 2 are cut off, that is, the edge between the new node A and the new node C, the edge between the new node A and the new node D, and the edge between the new node B and the new node D are cut off.

[0053] The inventors found in actual use that the existing Louvain algorithm may have the phenomenon of large communities merging small communities, which may cause small communities that are not abnormal groups to be merged into large communities that are abnormal groups, resulting in abnormal group identification errors. The embodiment of the present invention can avoid the problem of large communities merging small communities by cutting off the edge between two new nodes whose weights are less than the target weight.

[0054] Step 140 , determining whether the second intermediate node relationship graph is converged, if not, taking the second intermediate node relationship graph as a new initial node relationship graph, iteratively executing steps 120 - 140 , if yes, executing step 150 .

[0055] The amount of modularity change of other communities when adding nodes in the second intermediate node relationship graph to other communities can be determined. If there is a modularity change greater than 0, it is determined that the second intermediate node relationship graph does not converge. If there is no modularity change greater than 0 for each node in the second intermediate node relationship graph, it is determined that the second intermediate node relationship graph converges. When the second intermediate node relationship graph does not converge, the second intermediate node relationship graph can be used as a new initial node relationship graph, and steps 120 to 140 are iteratively executed until the second intermediate node relationship graph converges, and step 150 is executed.

[0056] Step 150: Use the final second intermediate node relationship graph as the target node relationship graph.

[0057] Step 160: Determine multiple initial nodes belonging to the abnormal group according to the target node relationship graph.

[0058] Each target community in the target node relationship graph is judged separately to determine whether each target community meets the condition of being an abnormal group. If so, the target community is determined to be an abnormal group, thereby obtaining a target community that is an abnormal group, and the initial nodes in the target community are determined as multiple initial nodes belonging to the abnormal group.

[0059] In one embodiment of the present invention, determining multiple initial nodes belonging to an abnormal group based on the target node relationship graph includes: determining a target community that meets a target condition in the target node relationship graph as an abnormal group; and determining multiple initial nodes within the target community that meets the target condition as multiple initial nodes belonging to the abnormal group.

[0060] The target condition is a condition for judging a target community as an abnormal group.

[0061] In the target node relationship graph, a target node is a target community composed of multiple initial nodes. For each target community in the target node relationship graph, it is determined whether the target community meets the target condition. If a target community does not meet the target condition, it is determined that the target community is not an abnormal group. If a target community meets the target condition, it is determined that the target community is an abnormal group. Multiple initial nodes in the target community that meet the target condition are determined as multiple initial nodes belonging to the abnormal group.

[0062] Wherein, the initial node includes a registration account or a resource identifier;

[0063] The target condition includes at least one of: the number of initial nodes in the target community is greater than or equal to a number threshold, the target community weight is greater than or equal to a weight threshold, and the group resource ratio is greater than or equal to a resource ratio threshold, the target community weight is the sum of the weights of the edges composed of all initial nodes in the target community, and the group resource ratio is the ratio of the number of initial nodes for registered accounts to the number of initial nodes for the same type of resource identifiers.

[0064] The registered account is the account registered by the user in the current application, and the resource identifier is the identification information of the resource used by the user, such as a mobile phone number or an instant messaging software account, etc. The same type of resource identifier is the resource identifier of the same category, such as a mobile phone number, a device identifier, a QQ number, etc.

[0065] When the target condition is the group resource ratio, for a target community, the initial number of nodes for registered accounts in the target community is determined, and the initial number of nodes for the same type of resource identifiers in the target community is determined (for example, the initial number of nodes for mobile phone numbers in the target community is determined, and the initial number of nodes for QQ numbers in the target community is determined), and the ratio of the initial number of nodes for registered accounts in the target community to the initial number of nodes for the same type of resource identifiers is determined as the group resource ratio of the target community. If at least one group resource ratio of the target community is greater than or equal to the resource ratio threshold, the target community is determined to be an abnormal group. If all group resource ratios of the target community are less than the resource ratio threshold, the target community is determined not to be an abnormal group. For example, for a target community, the initial number of nodes for registered accounts is 20, the initial number of nodes for mobile phone numbers is 5, and the initial number of nodes for QQ numbers is 10. The group resource ratio corresponding to the mobile phone numbers is 20 / 5, and the group resource ratio corresponding to the QQ numbers is 20 / 10. The resource ratio threshold is 3 / 1. It can be determined that the group resource ratio corresponding to the mobile phone numbers is greater than the resource ratio threshold, and the group resource ratio corresponding to the QQ numbers is less than the resource ratio threshold. There is a group resource ratio greater than the resource ratio threshold. In this case, the target community is determined to be an abnormal group.

[0066] Through practice, in the identification of abnormal groups, the abnormal group identification method provided by the embodiment of the present invention has an average identification accuracy of more than 70%, and the number of abnormal users recalled is increased by more than 30% compared with the original Louvain algorithm, and the identification ability of users who have not been exposed to risks is greatly improved.

[0067] The abnormal group identification method provided in this embodiment determines the initial nodes belonging to the same merged community based on the weight of the edge between two initial nodes in the initial node relationship graph after obtaining the initial node relationship graph, and uses the same merged community as a new node to obtain a first intermediate node relationship graph corresponding to the initial node relationship graph. If the weight of the edge between the two new nodes is less than the target weight, the edge between the two new nodes is cut off in the first intermediate node relationship graph to obtain a second intermediate node relationship graph, iteratively executes the community discovery algorithm on the second intermediate node relationship graph and cuts off the edge between the two new nodes with weights less than the target weight until the second intermediate node relationship graph converges, and uses the final second intermediate node relationship graph as the target node relationship graph. According to the target node relationship graph, multiple initial nodes belonging to the abnormal group are determined, and the abnormal group is determined based on the connection relationship between each initial node through the community discovery algorithm. New accounts and hidden anomalies can also be identified more accurately, and by cutting off the edge between the two new nodes with weights less than the target weight, the problem of merging a large community into a small community can be solved, thereby improving the accuracy of the abnormal group identification result.

[0068] Based on the above technical solution, if the weight of the edge between the two new nodes is less than the target weight, before cutting off the edge between the two new nodes in the first intermediate node relationship graph, it also includes: determining the target weight based on the weights of all edges in the first intermediate node relationship graph.

[0069] The sum of the weights of all edges in the first intermediate node relationship graph can be calculated, and a preset ratio of the sum of the weights can be determined as the target weight, for example, 40% or 50% (i.e., the average weight) of the sum of the weights can be determined as the target weight, or the median of the weights of all edges in the first intermediate node relationship graph can be determined as the target weight. By determining the target weight based on the weights of all edges in the first intermediate node relationship graph, the accuracy of the target weight determination can be improved, thereby more accurately disconnecting edges that are less than the target weight, and the accuracy of the abnormal group identification results can be further improved.

[0070] On the basis of the above technical solution, determining the target weight according to the weights of all edges in the first intermediate node relationship graph includes:

[0071] Determine an average weight or a median weight of all edges in the first intermediate node relationship graph, wherein an edge among all the edges is an edge between two new nodes;

[0072] The average weight or the median weight is determined as the target weight.

[0073] Calculate the average weight of all edges in the first intermediate node relationship graph; or determine the maximum weight and the minimum weight among the weights of all edges in the first intermediate node relationship graph, and determine the median weight between the maximum weight and the minimum weight; determine the average weight or the median weight as the target weight. By determining the average weight or the median weight of all edges in the first intermediate node relationship graph as the target weight, the accuracy of the target weight determination can be improved, thereby further improving the accuracy of the abnormal group identification results.

[0074] The abnormal group identification method described in the embodiment of the present invention can rely on Figure 2 The system architecture diagram shown is implemented as follows: Figure 2 As shown in the figure, the system architecture may include: data source layer, relationship construction layer, algorithm calculation layer, data output layer, and scenario application layer. The data source layer is mainly responsible for data collection and organization, using the user's multimedia data, basic data, behavior data and other feature data to establish a real-time user relationship center, and pass relevant data upward through Kafka or Hive tables. The relationship construction layer is used to construct the data of the relationship center into the relationship format and content required by the algorithm, including the construction of device relationships, resource relationships, behavior relationships, and reasoning relationships. The algorithm calculation layer mainly uses the spark computing engine to construct a graph of the relationship data constructed by the relationship construction layer, that is, to construct an initial node relationship graph, so as to execute the community discovery algorithm based on the construction of the graph and the extraction of subgraphs. The data output layer mainly stores the submitted task results. There are three main storage locations, namely, hive tables, which are used for offline queries or historical task information queries; when called using the jar package, Dataframe (data frame) will be returned to the program for developers to directly perform subsequent data processing and application; it can also be stored in Redis (Remote Dictionary Server) to ensure the user's online real-time query requirements. The scenario application layer makes efficient use of the results of community discovery, for example, for the discovery of abnormal groups and provides risk recall functions. In addition to issuing abnormal groups, it can also be used in user review and resource review, providing auditors with corresponding review clues.

[0075] Figure 3 is a structural block diagram of an abnormal group identification device provided by an embodiment of the present invention, such as Figure 3 As shown, the abnormal group identification device includes:

[0076] An initial relationship graph acquisition module 310 is used to acquire an initial node relationship graph, wherein the initial node relationship graph includes a plurality of initial nodes and weights of edges between two initial nodes having a connection relationship, wherein the plurality of initial nodes belong to different communities respectively;

[0077] A community discovery module 320 is used to determine the initial nodes belonging to the same merged community based on the weight of the edge between the two initial nodes based on the community discovery algorithm, and use the same merged community as a new node to obtain a first intermediate node relationship graph corresponding to the initial node relationship graph;

[0078] An edge cutting module 330, configured to cut off the edge between the two new nodes in the first intermediate node relationship graph if the weight of the edge between the two new nodes is less than the target weight, so as to obtain a second intermediate node relationship graph;

[0079] Iterative control module 340, used for iteratively executing the community discovery algorithm on the second intermediate node relationship graph and cutting off the edge between two new nodes whose weights are less than the target weights, until the second intermediate node relationship graph converges, and taking the final second intermediate node relationship graph as the target node relationship graph;

[0080] The abnormal group determination module 350 is used to determine a plurality of initial nodes belonging to an abnormal group according to the target node relationship graph.

[0081] Optionally, the device further comprises:

[0082] A target weight determination module is used to determine the target weight according to the weights of all edges in the first intermediate node relationship graph, wherein the edges among all the edges are edges between new nodes.

[0083] Optionally, the target weight determination module includes:

[0084] A weight statistics unit, used to determine the average weight or weight median of all edges in the first intermediate node relationship graph;

[0085] A target weight determination unit is used to determine the average weight or the median weight as the target weight.

[0086] Optionally, the abnormal group determination module is specifically used to:

[0087] Determine a target community that meets a target condition in the target node relationship graph as an abnormal group;

[0088] The multiple initial nodes in the target community that meet the target condition are determined as multiple initial nodes belonging to an abnormal group.

[0089] Optionally, the initial node includes a registration account or a resource identifier;

[0090] The target condition includes at least one of: the number of initial nodes in the target community is greater than or equal to a number threshold, the target community weight is greater than or equal to a weight threshold, and the group resource ratio is greater than or equal to a resource ratio threshold, the target community weight is the sum of the weights of the edges composed of all initial nodes in the target community, and the group resource ratio is the ratio of the number of initial nodes for registered accounts to the number of initial nodes for the same type of resource identifiers.

[0091] Optionally, the community discovery module includes:

[0092] A modularity change amount determining unit, configured to determine, for each initial node in the initial node relationship graph, a modularity change amount of other communities when the initial node is added to the other communities according to the weights of the edges between the initial node and other initial nodes;

[0093] The same community node determination unit is used to determine the merged community to which the initial node belongs based on the modularity change amount, and determine the initial node and the original initial nodes in the merged community to which the initial node belongs as initial nodes belonging to the same merged community.

[0094] Optionally, the same community node determination unit includes:

[0095] The node community determination subunit is used to determine other communities with the largest modularity changes as the merged community to which the initial node belongs; if the modularity changes are all zero, the community of the initial node remains unchanged.

[0096] Optionally, the community discovery module includes:

[0097] The intermediate relationship graph generating unit is used to take the same merged community as a new node, and determine the weight of the edge between two new nodes with a connection relationship according to the weight of the edge between the two initial nodes in the initial node relationship graph, so as to obtain a first intermediate node relationship graph corresponding to the initial node relationship graph.

[0098] Optionally, the intermediate relationship graph generating unit includes:

[0099] The weight determination subunit is used to add the weights of the edges between each initial node corresponding to one of the new nodes and the initial node corresponding to the other new node for two new nodes, so as to obtain the weight of the edge between the two new nodes.

[0100] The abnormal group identification device provided in the embodiment of the present invention is used to implement the various steps of the abnormal group identification method described in the embodiment of the present invention. The specific implementation methods of each module of the device refer to the corresponding steps and will not be repeated here.

[0101] An abnormal group identification device according to an embodiment of the present invention determines the initial nodes belonging to the same merged community based on the weight of the edge between two initial nodes in the initial node relationship graph after obtaining the initial node relationship graph, and uses the same merged community as a new node to obtain a first intermediate node relationship graph corresponding to the initial node relationship graph. If the weight of the edge between the two new nodes is less than the target weight, the edge between the two new nodes is cut off in the first intermediate node relationship graph to obtain a second intermediate node relationship graph, iteratively executes the community discovery algorithm on the second intermediate node relationship graph and cuts off the edge between the two new nodes whose weights are less than the target weight until the second intermediate node relationship graph converges, and uses the final second intermediate node relationship graph as the target node relationship graph. According to the target node relationship graph, multiple initial nodes belonging to the abnormal group are determined, and the abnormal group is determined based on the connection relationship between each initial node through the community discovery algorithm. New accounts and hidden anomalies can also be more accurately identified, and by cutting off the edge between the two new nodes whose weights are less than the target weight, the problem of merging a large community into a small community can be solved, thereby improving the accuracy of the abnormal group identification result.

[0102] Preferably, an embodiment of the present invention further provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, each process of the above-mentioned abnormal group identification method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0103] The embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above-mentioned abnormal group identification method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0104] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0105] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0106] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

[0107] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the embodiments of the present invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0108] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0109] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0110] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0111] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0112] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, ROM, RAM, magnetic disks, or optical disks.

[0113] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for identifying abnormal groups, characterized in that: include: Obtaining an initial node relationship graph, the initial node relationship graph comprising a plurality of initial nodes and the weight of an edge between two initial nodes having a connection relationship, the plurality of initial nodes respectively belonging to different communities, the communities being used to indicate dense groups in a network, the initial nodes comprising a registered account or a resource identifier, the resource identifier comprising at least a mobile phone number, a device identifier or an instant messaging software account, the registered account being an account registered by a user in a current application, the instant messaging software account being an instant messaging software account used by a user when logging into the current application, wherein obtaining the initial node relationship graph comprises: determining a connection relationship between two initial nodes based on a plurality of initial nodes to be determined as abnormal groups, and determining a weight of an edge between the two initial nodes based on the connection relationship between the two initial nodes and a pre-set correspondence between the connection relationship and the weight, and obtaining an initial node relationship graph corresponding to the initial nodes; wherein the connection relationship between the two initial nodes is used to indicate that the two initial nodes use at least one of the same mobile phone number, business license code, IP address, and the device identifier; Based on the community discovery algorithm, according to the weight of the edge between the two initial nodes, the initial nodes belonging to the same merged community are determined, and the same merged community is used as a new node to obtain a first intermediate node relationship graph corresponding to the initial node relationship graph; If the weight of the edge between the two new nodes is less than the target weight, cutting off the edge between the two new nodes in the first intermediate node relationship graph to obtain a second intermediate node relationship graph; Determine whether the second intermediate node relationship graph converges, determine the modularity change of other communities when adding nodes in the second intermediate node relationship graph to other communities, if there is no modularity change greater than zero for each node in the second intermediate node relationship graph, then determine that the second intermediate node relationship graph converges, and use the converged second intermediate node relationship graph as the target node relationship graph; for the unconverged second intermediate node relationship graph, iteratively execute the community discovery algorithm on the second intermediate node relationship graph and cut off the edges between two new nodes whose weights are less than the target weights until the second intermediate node relationship graph converges, and use the final second intermediate node relationship graph as the target node relationship graph; According to the target node relationship graph, determining a plurality of initial nodes belonging to an abnormal group includes: determining a target community that meets a target condition in the target node relationship graph as an abnormal group; determining a plurality of initial nodes in the target community that meets the target condition as a plurality of initial nodes belonging to the abnormal group; The target condition includes at least one of: the number of initial nodes in the target community is greater than or equal to a number threshold, the target community weight is greater than or equal to a weight threshold, and the group resource ratio is greater than or equal to a resource ratio threshold, the target community weight is the sum of the weights of the edges composed of all initial nodes in the target community, and the group resource ratio is the ratio of the number of initial nodes for registered accounts to the number of initial nodes for the same type of resource identifiers.

2. The method according to claim 1, characterized in that If the weight of the edge between the two new nodes is less than the target weight, before cutting off the edge between the two new nodes in the first intermediate node relationship graph, the method further includes: The target weight is determined according to weights of all edges in the first intermediate node relationship graph, wherein the edges among all the edges are edges between new nodes.

3. The method according to claim 2, characterized in that The determining the target weight according to the weights of all edges in the first intermediate node relationship graph includes: Determine the average weight or median weight of all edges in the first intermediate node relationship graph; The average weight or the median weight is determined as the target weight.

4. The method according to any one of claims 1 to 3, characterized in that: Determining the initial nodes belonging to the same merged community according to the weight of the edge between the two initial nodes includes: For each initial node in the initial node relationship graph, determining, according to the weights of the edges between the initial node and other initial nodes, a change in the modularity of other communities when the initial node is added to the other communities; The merged community to which the initial node belongs is determined based on the modularity change amount, and the initial node and the original initial nodes in the merged community to which the initial node belongs are determined as initial nodes belonging to the same merged community.

5. The method according to claim 4, characterized in that The determining, based on the modularity change amount, the merged community to which the initial node belongs includes: The other communities with the largest modularity changes are determined as the merged communities to which the initial node belongs; if the modularity changes are all zero, the community of the initial node remains unchanged.

6. The method according to any one of claims 1 to 3, characterized in that: The step of taking the same merged community as a new node to obtain a first intermediate node relationship graph corresponding to the initial node relationship graph includes: The same merged community is taken as a new node, and the weight of the edge between two new nodes having a connection relationship is determined according to the weight of the edge between the two initial nodes in the initial node relationship graph, so as to obtain a first intermediate node relationship graph corresponding to the initial node relationship graph.

7. The method according to claim 6, characterized in that Determining the weight of an edge between two new nodes having a connection relationship according to the weight of an edge between two initial nodes in the initial node relationship graph includes: For two new nodes, the weights of the edges between each initial node corresponding to one of the new nodes and the initial node corresponding to the other new node are added together to obtain the weight of the edge between the two new nodes.

8. An abnormal group identification device, characterized in that: include: An initial relationship graph acquisition module is used to acquire an initial node relationship graph, wherein the initial node relationship graph includes a plurality of initial nodes and the weight of an edge between two initial nodes having a connection relationship, wherein the plurality of initial nodes belong to different communities respectively, wherein the community is used to indicate a dense group in a network, wherein the initial node includes a registered account or a resource identifier, wherein the resource identifier includes at least a mobile phone number, a device identifier or an instant messaging software account, wherein the registered account is an account registered by a user in a current application, and the instant messaging software account is an instant messaging software account used by a user when logging into the current application; The initial relationship graph acquisition module is specifically used to determine the connection relationship between two initial nodes based on multiple initial nodes to be determined whether they are abnormal groups, and determine the weight of the edge between the two initial nodes based on the connection relationship between the two initial nodes and the correspondence between the connection relationship and the weight set in advance, and obtain the initial node relationship graph corresponding to the initial nodes; wherein the connection relationship between the two initial nodes is used to indicate that the two initial nodes use the same mobile phone number, business license code, IP address, and at least one of the device identifiers; A community discovery module, configured to determine the initial nodes belonging to the same merged community based on the weight of the edge between the two initial nodes based on a community discovery algorithm, and use the same merged community as a new node to obtain a first intermediate node relationship graph corresponding to the initial node relationship graph; an edge cutting module, configured to cut off the edge between the two new nodes in the first intermediate node relationship graph if the weight of the edge between the two new nodes is less than the target weight, so as to obtain a second intermediate node relationship graph; an iterative control module, used to determine whether the second intermediate node relationship graph has converged, determine the amount of modularity change of other communities when adding nodes in the second intermediate node relationship graph to other communities, and if there is no modularity change greater than zero for each node in the second intermediate node relationship graph, determine that the second intermediate node relationship graph has converged, and use the converged second intermediate node relationship graph as the target node relationship graph; for the unconverged second intermediate node relationship graph, iteratively execute the community discovery algorithm on the second intermediate node relationship graph and cut off the edges between two new nodes whose weights are less than the target weights until the second intermediate node relationship graph converges, and use the final second intermediate node relationship graph as the target node relationship graph; An abnormal group determination module, used to determine a plurality of initial nodes belonging to an abnormal group according to the target node relationship graph; The abnormal group determination module is specifically used to determine the target community that meets the target conditions in the target node relationship graph as an abnormal group; determine multiple initial nodes in the target community that meets the target conditions as multiple initial nodes belonging to the abnormal group; the target conditions include: the number of initial nodes in the target community is greater than or equal to the number threshold, the target community weight is greater than or equal to the weight threshold, and the group resource ratio is greater than or equal to the resource ratio threshold. At least one of the following, the target community weight is the sum of the weights of the edges composed of all the initial nodes in the target community, and the group resource ratio is the ratio of the number of initial nodes for registered accounts to the number of initial nodes identified for the same type of resources.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the abnormal group identification method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the abnormal group identification method according to any one of claims 1 to 7 are implemented.

Images