A hypergraph-based dense subgraph detection method, device and terminal equipment

Abstract

The application relates to a hypergraph-based dense subgraph detection method and device and a terminal device, which obtains feature sequences of multiple users, obtains an abnormal risk score matrix according to the feature sequences of the users, calculates an overall risk score of the abnormal risk score matrix, obtains an initial overall risk score, updates the abnormal risk score matrix, calculates an overall risk score of the updated abnormal risk score matrix, and if the new overall risk score is greater than the initial overall risk score, calculates the sum of each row of the abnormal risk score matrix, and determines that a user with a sum of 0 is a risk user, so that a risk object can be accurately obtained, misjudgment is avoided, and the recognition precision is high. Moreover, the calculation speed is fast, a greedy mode is adopted in the calculation of the dense subgraph, linear time complexity is met, the calculation has an advantage on a large amount of data, can be self-adaptive, does not require any prior knowledge and expert experience, and the scheme can automatically perform screening.

Description

Technical Field

[0001] This invention relates to a method, apparatus, and terminal device for detecting dense subgraphs based on hypergraphs. Background Technology

[0002] In the field of risk control, unsupervised anomaly detection plays a complementary role to model- and strategy-based prevention in detecting organized crime, and can identify fraud methods beyond those of models and strategies. However, existing anomaly detection methods have relatively simple data processing procedures when identifying anomalies, which can easily lead to false positives and thus low recognition accuracy. Summary of the Invention

[0003] To address the aforementioned technical problems, this invention provides a method, apparatus, and terminal device for detecting dense subgraphs based on hypergraphs.

[0004] To solve the above problems, the present invention adopts the following technical solution:

[0005] A method for detecting dense subgraphs based on hypergraphs, comprising:

[0006] Obtain feature sequences of multiple users, wherein the feature sequences include at least two feature types, and the feature types in the feature sequences of each user are the same;

[0007] Based on the frequency of occurrence of each feature and the total number of users, the abnormal risk score of each feature is obtained, thus obtaining the abnormal risk score matrix; where, if a feature appears only once, the corresponding abnormal risk score is 0.

[0008] Calculate the overall risk score of the abnormal risk score matrix to obtain the initial overall risk score;

[0009] Calculate the sum of each row in the abnormal risk score matrix, set all rows corresponding to the smallest non-zero sum to 0, and update the abnormal risk score matrix for the first time; then, set all columns in the abnormal risk score matrix after the first update that have only one non-zero value to 0, and update the abnormal risk score matrix for the second time.

[0010] Calculate the overall risk score of the abnormal risk score matrix obtained from the second update to obtain a new overall risk score. If the new overall risk score is greater than the initial overall risk score, calculate the sum of each row of the abnormal risk score matrix and determine users whose sum is not 0 as risk users.

[0011] As a specific implementation, obtaining the anomaly risk score for each feature based on the frequency of co-occurrence of each feature and the total number of users includes:

[0012] Find common features from the feature sequences of each user. The common features are those that appear at least twice. Construct hyperedges based on the common features to obtain a hyperedge matrix. The rows of the hyperedge matrix represent users, and the columns represent feature types.

[0013] Based on the frequency of each feature and the total number of users, and in conjunction with the hyperedge matrix, the abnormal risk score of each feature is obtained.

[0014] As a specific implementation method, the formula for calculating the abnormal risk score is as follows:

[0015]

[0016] Where exp() is an exponential function with the natural constant e as the base, K is a preset hyperparameter, and P is the probability of feature occurrence;

[0017] The formula for calculating the probability P of feature occurrence is as follows:

[0018]

[0019] Where N represents the number of times the feature appears, and all represents the total number of users.

[0020] As a specific implementation, the calculation of the overall risk score of the abnormal risk score matrix to obtain the initial overall risk score includes:

[0021] The formula for calculating the overall risk score is as follows:

[0022]

[0023] Where AbnormalScore represents the overall risk score, X represents the abnormal risk score matrix, sum(X) represents the sum of the elements of the abnormal risk score matrix, row represents the number of rows in the abnormal risk score matrix that are not all zero, and col represents the number of columns in the abnormal risk score matrix that are not all zero.

[0024] A dense subgraph detection device based on a hypergraph includes:

[0025] The feature sequence acquisition module is used to acquire feature sequences of multiple users, wherein the feature sequences include at least two feature types, and the feature types in the feature sequences of each user are the same.

[0026] The abnormal risk score matrix acquisition module is used to obtain the abnormal risk score of each feature based on the number of times each feature appears together and the total number of users, thereby obtaining the abnormal risk score matrix; where, if a feature appears only once, the corresponding abnormal risk score is 0.

[0027] The initial overall risk score acquisition module is used to calculate the overall risk score of the abnormal risk score matrix to obtain the initial overall risk score;

[0028] The abnormal risk score matrix update module is used to calculate the sum of each row of the abnormal risk score matrix, set all rows corresponding to the smallest non-zero sum to 0, and update the abnormal risk score matrix for the first time; then, set all columns in the abnormal risk score matrix after the first update that have only one non-zero value to 0, and update the abnormal risk score matrix for the second time.

[0029] The risk user identification module is used to calculate the overall risk score of the abnormal risk score matrix obtained in the second update, and obtain a new overall risk score. If the new overall risk score is greater than the initial overall risk score, the sum of each row of the abnormal risk score matrix is ​​calculated, and users whose sum is not 0 are identified as risk users.

[0030] A terminal device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the hypergraph-based dense subgraph detection method described above.

[0031] The beneficial effects of this invention are as follows: Based on the frequency of co-occurrence of each feature and the total number of users, anomaly risk scores for each feature are obtained, thus generating an anomaly risk score matrix. First, the overall risk score of the anomaly risk score matrix is ​​calculated to obtain an initial overall risk score for subsequent comparison. Then, using a greedy approach, based on the processing of rows and columns, the node with the smallest anomaly risk score is removed, and the updated overall risk score of the anomaly risk score matrix is ​​calculated and compared with the initial overall risk score to finally identify risky users. The hypergraph-based dense subgraph detection method provided by this invention can accurately identify risky objects, avoid misjudgments, and has high recognition accuracy. Moreover, it has a fast computation speed; in computationally dense subgraphs, the greedy approach achieves linear time complexity, offering advantages in computation with large amounts of data. It is adaptive, requiring no prior knowledge or expert experience; the scheme automatically performs the filtering. Attached Figure Description

[0032] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly described below:

[0033] Figure 1 This is a schematic diagram of the overall process of the hypergraph-based dense subgraph detection method provided in Embodiment 1 of this application;

[0034] Figure 2This is a schematic diagram of the overall structure of the hypergraph-based dense subgraph detection device provided in Embodiment 2 of this application;

[0035] Figure 3 This is a schematic diagram of the terminal device provided in Embodiment 3 of this application. Detailed Implementation

[0036] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0037] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0038] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0039] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0040] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0041] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0042] The hypergraph-based dense subgraph detection method provided in this application can be applied to terminal devices such as mobile phones, tablets, wearable devices, in-vehicle devices, augmented reality (AR) / virtual reality (VR) devices, laptops, ultra-mobile personal computers (UMPCs), netbooks, and personal digital assistants (PDAs). This application does not limit the specific type of terminal device. That is, the client carrier corresponding to the hypergraph-based dense subgraph detection method provided in this application can be any of the aforementioned terminal devices.

[0043] To illustrate the technical solution described in this application, specific embodiments will be described below.

[0044] See Figure 1 This is a flowchart of an implementation process of a hypergraph-based dense subgraph detection method provided in Embodiment 1 of this application. For ease of explanation, only the parts related to the embodiments of this application are shown.

[0045] This hypergraph-based dense subgraph detection method includes:

[0046] Step S101: Obtain feature sequences of multiple users, wherein the feature sequences include at least two feature types, and the feature types in the feature sequences of each user are the same:

[0047] Obtain feature sequences from multiple users, with at least two users (the exact number is not limited and depends on the specific application scenario). Each feature sequence must include at least two feature types (the number of feature types is not limited and depends on the specific application scenario). Furthermore, the feature types in each user's feature sequence must be the same. For example, all user feature sequences may contain features of types A, B, C, and D.

[0048] As a specific implementation method, taking the registration scenario as an example, registration involves several important factors, such as the mobile device identifier used by the user during registration, mobile phone number, ID card number, and email address. The data representation, i.e., the feature sequence, is shown in Table 1:

[0049] Table 1

[0050] user Mail Phone number ID number IP address Registered City U1 E1 P1 C1 I1 Shanghai U2 E1 P2 C2 I1 Beijing U3 E2 P1 C3 I1 Beijing U4 E2 P1 C4 I1 Beijing

[0051] Step S102: Based on the frequency of occurrence of each feature and the total number of users, obtain the anomaly risk score for each feature, thus obtaining the anomaly risk score matrix; where, if a feature appears only once, the corresponding anomaly risk score is 0.

[0052] Find common features from the feature sequences of each user. Common features are those that appear at least twice. For example, according to Table 1, among the five feature types—email, mobile phone number, ID card number, IP address, and registration city—if a feature contains two or more entities (i.e., users), then that feature is a common feature. Since email E1 appears twice, email E1 is a common feature. Construct hyperedges based on common features. In this embodiment, if a feature contains two or more users, construct a hyperedge in the form [1,1,0,0], where the length is the number of users (i.e., 4), the value corresponding to the connected users (i.e., U1 and U2) is 1, and the rest are 0. The resulting hyperedge matrix is ​​shown below:

[0053]

[0054] In this matrix, rows represent users and columns represent feature types.

[0055] After obtaining the hypergraph matrix, an anomaly score matrix needs to be constructed. An anomaly score indicates that a feature (e.g., email address E1) connects to two users (U1, U2). If this email address is an infrequently occurring medium, then the connection between the two users indicates a higher risk. However, if this feature is frequently occurring, such as a registration address in Beijing, since many users typically register in Beijing, the risk posed by this feature is relatively low. It should be understood that the above analysis is based on prior knowledge and lacks generality. This embodiment calculates the anomaly risk score for each feature based on its frequency of occurrence, the total number of users, and the hyperedge matrix.

[0056] The formula for calculating the abnormal risk score is as follows:

[0057]

[0058] Where exp() is an exponential function with the natural constant e as the base, K is a preset hyperparameter (in this embodiment, it is set to 10, which can achieve better calculation results), and P is the probability of feature occurrence.

[0059] The formula for calculating P is as follows:

[0060]

[0061] Where N represents the number of times the feature appears, and all represents the total number of users, i.e., the total number of times the corresponding feature type appears. Taking email E1 as an example, the feature type "email" appears a total of 4 times, i.e., all = 4, and email E1 appears 2 times, i.e., N = 2, so P = 0.5. Substituting the value of P into the above formula for calculating the abnormal risk score, we obtain the abnormal risk score corresponding to email E1, i.e., the abnormal risk score corresponding to the first column in matrix H. The abnormal risk score of email E1 is [0.007, 0.007, 0, 0].

[0062] It should be noted that for any given feature, if the feature appears only once, it indicates no risk, and the corresponding anomaly risk score is 0, meaning it is not calculated according to the above calculation process.

[0063] The anomaly risk score matrix for the entire hypergraph is as follows:

[0064]

[0065] The above is just an example, involving a relatively small amount of data, so the anomaly risk score is small. In real-world scenarios, such as email addresses and phone numbers, the anomaly risk score is much larger, close to 1.

[0066] Step S103: Calculate the overall risk score of the abnormal risk score matrix to obtain the initial overall risk score:

[0067] The formula for calculating the overall risk score is as follows:

[0068]

[0069] Where AbnormalScore represents the overall risk score, X represents the abnormal risk score matrix, sum(X) represents the sum of the elements in the abnormal risk score matrix, row represents the number of rows in the abnormal risk score matrix that are not all zero, and col represents the number of columns in the abnormal risk score matrix that are not all zero. In the example above, row = 4 and col = 5.

[0070] As another specific implementation method, the abnormal risk score matrix is ​​as follows:

[0071]

[0072] Since rows 1 and 2 are all 0, they are not counted, so row = 2; since column 1 is all 0, it is not counted, so col = 4.

[0073] Step S104: Calculate the sum of each row in the abnormal risk score matrix, and set all rows corresponding to the smallest non-zero sum to 0, thus updating the abnormal risk score matrix for the first time; then, set all columns in the updated abnormal risk score matrix with only one non-zero value to 0, thus updating the abnormal risk score matrix for the second time.

[0074] The idea behind this step is to use a greedy approach to remove the node with the smallest anomaly score in order to update the anomaly risk score matrix.

[0075] Calculate the sum of each row in the anomaly risk score matrix. Find the smallest non-zero sum to determine the row corresponding to that sum. Set all elements in that row to 0, and update the anomaly risk score matrix for the first time. For example, consider the following anomaly risk score matrix:

[0076]

[0077] The sum of the first and second rows is the smallest and not 0. Since these two sums are the same, they are processed as follows: the first and second rows are all assigned the value 0. The abnormal risk score matrix is ​​then transformed into:

[0078]

[0079] Then, obtain the number of non-zero values ​​in each column of the updated anomaly risk score matrix. Find a column with only one non-zero value, indicating no edge connection (an edge must connect at least two nodes). Set all elements in the column with only one non-zero value to 0, and update the anomaly risk score matrix a second time. For example, consider the following anomaly risk score matrix:

[0080]

[0081] If the second column contains only one value greater than 0, then the entire second column should be assigned the value 0.

[0082]

[0083] Step S105: Calculate the overall risk score of the abnormal risk score matrix obtained from the second update to obtain a new overall risk score. If the new overall risk score is greater than the initial overall risk score, calculate the sum of each row of the abnormal risk score matrix and determine users whose sum is not 0 as risk users.

[0084] Following step S103, the overall risk score of the abnormal risk score matrix obtained from the second update is calculated to obtain a new overall risk score. The new overall risk score is compared with the initial overall risk score. If the new overall risk score is greater than the initial overall risk score, the abnormal risk score matrix is ​​considered a risk matrix. Then, the sum of each row of the abnormal risk score matrix is ​​calculated, and users whose sum is not 0 are identified as risk users.

[0085] For example, the following abnormal risk score matrix:

[0086]

[0087] Calculate the sum of each row in the abnormal risk score matrix, find the row with a non-zero sum, and identify the corresponding users as users U3 and U4. Then, users U3 and U4 are risky users.

[0088] In this embodiment, steps S104 and S105 can be iterated multiple times. For example, if in step S105 the new overall risk score is less than or equal to the initial overall risk score, steps S104 and S105 are repeated until the new overall risk score is greater than the initial overall risk score, at which point the iteration ends. Alternatively, when the number of non-zero rows or columns in the abnormal risk score matrix is ​​less than or equal to 2 (indicating that the graph does not exist), the above iteration is stopped.

[0089] This embodiment also provides a dense subgraph detection device 200 based on a hypergraph, such as... Figure 2 As shown, it includes:

[0090] The feature sequence acquisition module 201 is used to acquire feature sequences of multiple users, wherein the feature sequences include at least two feature types, and the feature types in the feature sequences of each user are the same.

[0091] The abnormal risk score matrix acquisition module 202 is used to obtain the abnormal risk score of each feature based on the number of times each feature appears together and the total number of users, thereby obtaining the abnormal risk score matrix; wherein, if a feature appears only once, the corresponding abnormal risk score is 0.

[0092] The initial overall risk score acquisition module 203 is used to calculate the overall risk score of the abnormal risk score matrix to obtain the initial overall risk score;

[0093] The abnormal risk score matrix update module 204 is used to calculate the sum of each row of the abnormal risk score matrix, set all rows corresponding to the smallest non-zero sum to 0, and update the abnormal risk score matrix for the first time; then, set all columns in the abnormal risk score matrix after the first update that have only one non-zero value to 0, and update the abnormal risk score matrix for the second time.

[0094] The risk user determination module 205 is used to calculate the overall risk score of the abnormal risk score matrix obtained in the second update, and obtain a new overall risk score. If the new overall risk score is greater than the initial overall risk score, the sum of each row of the abnormal risk score matrix is ​​calculated, and users whose sum is not 0 are determined to be risk users.

[0095] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the hypergraph-based dense subgraph detection device 200 can be divided into different functional modules to complete all or part of the functions described above. The functional modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of each functional module can be referred to the corresponding process in the aforementioned embodiments of the hypergraph-based dense subgraph detection method, and will not be repeated here.

[0096] Figure 3 This is a schematic diagram of the terminal device provided in Embodiment 3 of this application. Figure 3 As shown, the terminal device 300 includes: a processor 302, a memory 301, and a computer program 303 stored in the memory 301 and executable on the processor 302. The number of processors 302 is at least one. Figure 3 Taking one example, when processor 302 executes computer program 303, it implements the above-mentioned implementation steps of the hypergraph-based dense subgraph detection method, namely... Figure 1 The steps are shown.

[0097] For details on the implementation of the terminal device 300, please refer to the above-described embodiment of the dense subgraph detection method based on hypergraph.

[0098] For example, computer program 303 may be divided into one or more modules / units, which are stored in memory 301 and executed by processor 302 to complete this application. The one or more modules / units may be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of computer program 303 in terminal device 300.

[0099] Terminal device 300 can be a desktop computer, laptop, handheld computer, main control unit, or other computing device, or a mobile terminal such as a mobile phone. Terminal device 300 may include, but is not limited to, a processor and memory. Those skilled in the art will understand that... Figure 3 This is merely an example of terminal device 300 and does not constitute a limitation on terminal device 300. It may include more or fewer components than shown, or combine certain components, or different components. For example, terminal device 300 may also include input / output devices, network access devices, buses, etc.

[0100] Processor 302 can be a CPU (Central Processing Unit), or other general-purpose processors, DSPs (Digital Signal Processors), ASICs (Application Specific Integrated Circuits), FPGAs (Field-Programmable Gate Arrays), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0101] The memory 301 can be an internal storage unit of the terminal device 300, such as a hard disk or RAM. The memory 301 can also be an external storage device of the terminal device 300, such as a plug-in hard disk, SMC (SmartMedia Card), SD card (Secure Digital), or Flash Card equipped on the terminal device 300. Furthermore, the memory 301 can include both internal and external storage units of the terminal device 300. The memory 301 is used to store the operating system, applications, bootloaders, data, and other programs, such as the program code of the computer program 303. The memory 301 can also be used to temporarily store data that has been output or will be output.

[0102] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps described in the embodiments of the hypergraph-based dense subgraph detection method above.

[0103] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above-described embodiments of the hypergraph-based dense subgraph detection method can be implemented by a computer program instructing related hardware. The computer program 303 can be stored in a computer-readable storage medium. When executed by the processor 302, the computer program 303 can implement the steps of the above-described hypergraph-based dense subgraph detection method embodiments. The computer program 303 includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium can include at least: any entity or device capable of carrying the computer program code to a photographing device / terminal device, a recording medium, a computer memory, ROM (Read-Only Memory), RAM (Random Access Memory), electrical carrier signals, telecommunication signals, and software distribution media, such as a USB flash drive, portable hard drive, magnetic disk, or optical disk. In some jurisdictions, computer-readable media may not be electrical carrier signals or telecommunication signals, according to legislation and patent practice.

[0104] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0105] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0106] In the embodiments provided in this application, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling or direct coupling or communication connection may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0107] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0108] The embodiments described above are only used to illustrate the technical solutions of this application, and are not intended to limit it; although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that:

[0109] It is still possible to modify the technical solutions described in the foregoing embodiments, or to make equivalent substitutions for some of the technical features.

Claims

1. A method for detecting dense subgraphs based on hypergraphs, characterized in that, include: Obtain feature sequences of multiple users, wherein the feature sequences include at least two feature types, and the feature types in the feature sequences of each user are the same; Based on the frequency of occurrence of each feature and the total number of users, the abnormal risk score of each feature is obtained, thus obtaining the abnormal risk score matrix; where, if a feature appears only once, the corresponding abnormal risk score is 0. Calculate the overall risk score of the abnormal risk score matrix to obtain the initial overall risk score; Calculate the sum of each row in the abnormal risk score matrix, set all rows corresponding to the smallest non-zero sum to 0, and update the abnormal risk score matrix for the first time; then, set all columns in the abnormal risk score matrix after the first update that have only one non-zero value to 0, and update the abnormal risk score matrix for the second time. Calculate the overall risk score of the abnormal risk score matrix obtained from the second update to obtain a new overall risk score. If the new overall risk score is greater than the initial overall risk score, calculate the sum of each row of the abnormal risk score matrix and determine users whose sum is not 0 as risk users. The process of obtaining an anomaly risk score for each feature based on the frequency of co-occurrence of each feature and the total number of users includes: Find common features from the feature sequences of each user. The common features are those that appear at least twice. Construct hyperedges based on the common features to obtain a hyperedge matrix. The rows of the hyperedge matrix represent users, and the columns represent feature types. Based on the frequency of occurrence of each feature and the total number of users, combined with the hyperedge matrix, the abnormal risk score of each feature is obtained; The formula for calculating the abnormal risk score is as follows: Where S represents the abnormal risk score, exp() is an exponential function with the natural constant e as the base, K is a preset hyperparameter, and P is the probability of feature occurrence; The formula for calculating the probability P of feature occurrence is as follows: Where N represents the number of times the feature appears, and all represents the total number of users.

2. The method for detecting dense subgraphs based on hypergraphs according to claim 1, characterized in that, The calculation of the overall risk score of the abnormal risk score matrix to obtain the initial overall risk score includes: The formula for calculating the overall risk score is as follows: in, Let X represent the overall risk score, X represent the abnormal risk score matrix, sum(X) represent the sum of the elements in the abnormal risk score matrix, row represent the number of rows in the abnormal risk score matrix that are not all zero, and col represent the number of columns in the abnormal risk score matrix that are not all zero.

3. A dense subgraph detection device based on a hypergraph, characterized in that, include: The feature sequence acquisition module is used to acquire feature sequences of multiple users, wherein the feature sequences include at least two feature types, and the feature types in the feature sequences of each user are the same. The abnormal risk score matrix acquisition module is used to obtain the abnormal risk score of each feature based on the number of times each feature appears together and the total number of users, thereby obtaining the abnormal risk score matrix; where, if a feature appears only once, the corresponding abnormal risk score is 0. The initial overall risk score acquisition module is used to calculate the overall risk score of the abnormal risk score matrix to obtain the initial overall risk score; The abnormal risk score matrix update module is used to calculate the sum of each row of the abnormal risk score matrix, set all rows corresponding to the smallest non-zero sum to 0, and update the abnormal risk score matrix for the first time; then, set all columns in the abnormal risk score matrix after the first update that have only one non-zero value to 0, and update the abnormal risk score matrix for the second time. The risk user identification module is used to calculate the overall risk score of the abnormal risk score matrix obtained in the second update, and obtain a new overall risk score. If the new overall risk score is greater than the initial overall risk score, the sum of each row of the abnormal risk score matrix is ​​calculated, and users whose sum is not 0 are identified as risk users. The process of obtaining an anomaly risk score for each feature based on the frequency of co-occurrence of each feature and the total number of users includes: Find common features from the feature sequences of each user. The common features are those that appear at least twice. Construct hyperedges based on the common features to obtain a hyperedge matrix. The rows of the hyperedge matrix represent users, and the columns represent feature types. Based on the frequency of occurrence of each feature and the total number of users, combined with the hyperedge matrix, the abnormal risk score of each feature is obtained; The formula for calculating the abnormal risk score is as follows: Where S represents the abnormal risk score, exp() is an exponential function with the natural constant e as the base, K is a preset hyperparameter, and P is the probability of feature occurrence; The formula for calculating the probability P of feature occurrence is as follows: Where N represents the number of times the feature appears, and all represents the total number of users.

4. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the hypergraph-based dense subgraph detection method as described in any one of claims 1-2.

Images