Method for slicing a device data graph and cloud computing device

Abstract

The application provides a method for splitting a device data graph and a cloud computing device. The method comprises: obtaining a device data graph and a plurality of predefined device subgraphs; performing subgraph matching on the device data graph to obtain a matching set comprising at least one matching instance, each matching instance being isomorphic to one of the plurality of predefined device subgraphs; determining a belonging relationship of a node in the device data graph according to a relationship between the node and the matching set; and obtaining a connected component of the device data graph according to the belonging relationship of the node, thereby splitting the device data graph. The method according to the example embodiment can effectively split the device data graph.

Description

Technical Field

[0001] This application relates to the fields of big data and computer technology, and more specifically, to a method for segmenting device data graphs, a method for improving the accuracy of advertising, a method for identifying risky devices, and a cloud computing device. Background Technology

[0002] Graphs are one of the most intuitive languages ​​for describing the real world. In the digital age, large-scale graph data mining has become a fundamental tool for modeling social, communication, and information networks. The rapid development of internet platforms in recent years has accumulated massive amounts of relational data, which can be stored, analyzed, and processed using graph computing techniques. For example, accurate user identification is a crucial capability for large internet entities in identifying risky devices and in advertising and marketing scenarios. This typically requires locating physical devices (or virtual devices equivalent to physical devices) for risk control, advertising, and other operations.

[0003] Therefore, it is necessary to develop new graph computation methods that can effectively process massive amounts of graph data. Summary of the Invention

[0004] This application aims to provide a method for segmenting device data graphs, a method for improving the accuracy of advertising, a method for identifying risky devices, and a cloud computing device, which achieves effective segmentation of device data graphs based on subgraph matching.

[0005] The user features and advantages of this application will become apparent from the following detailed description, or may be learned in part from practice of this application.

[0006] According to one aspect of this application, a method for segmenting a device data diagram is provided, comprising:

[0007] Obtain the device data diagram and multiple predefined device sub-diagrams;

[0008] Perform subgraph matching on the device data graph to obtain a matching set including at least one matching instance, each matching instance being isomorphic to one of the plurality of predefined device subgraphs;

[0009] The attribution relationship of a node is determined based on the relationship between the nodes in the device data graph and the matching set;

[0010] The connected components of the device data graph are obtained based on the affiliation of the nodes, thereby realizing the segmentation of the device data graph.

[0011] According to the aforementioned method, the plurality of predefined device subgraphs include multiple or all of the following structures: open triangle, closed triangle, triangular star, quadrilateral, overlapping closed triangle, single-sided closed triangle, fully connected quadrilateral, fully connected pentagon, and fully connected hexagon.

[0012] According to the aforementioned method, after obtaining at least one matching instance, the method further includes:

[0013] Merge matching instances that have an inclusion relationship to obtain an updated matching set.

[0014] According to the aforementioned method, determining the attribution relationship of a node based on the relationship between the node in the device data graph and the matching set includes:

[0015] For each node in the device data graph, a set of associated instances consisting of matching instances associated with the node is obtained. If the number of matching instances in the set of associated instances is greater than the instance threshold, the node is determined to be an abnormal node, and the edges connected to the node are deleted, making the node an isolated node.

[0016] According to the aforementioned method, determining the attribution relationship of a node based on the relationship between the node in the device data graph and the matching set further includes:

[0017] For each matching instance in the matching set, the score of the matching instance is determined based on the positive or negative correlation between the number of matching instances associated with the node in the matching instance;

[0018] For each node in the device data graph, if the number of matching instances contained in the associated instance set is not greater than the instance threshold, then the node is determined to be a normal node, and the node is assigned to the matching instance with the lowest or highest score in the associated instance set.

[0019] According to the aforementioned method, determining the attribution relationship of a node based on the relationship between the node in the device data graph and the matching set further includes:

[0020] For each node in the device data graph, if the set of associated instances is empty, then the connection edges of the node in the device graph are retained.

[0021] According to the aforementioned method, after obtaining the device data graph, the method further includes:

[0022] Perform a connected component algorithm on the device data graph to obtain connected component clustering results;

[0023] Determine the number of nodes in each connected component. If the number of nodes is less than a node threshold, exclude the connected component in subsequent operations.

[0024] According to the aforementioned method, the device data graph and the plurality of predefined device subgraphs are stored in the big data platform in the form of side tables.

[0025] According to the aforementioned method, the score of the matching instance is determined based on a positive or negative correlation with the number of matching instances associated with the node in the matching instance, including determining the score according to the following formula:

[0026]

[0027] in Represents the rating. Represents the g-th subgraph in the matching set and the plurality of predefined device subgraphs. i The j-th matching instance of subgraph isomorphism, where a represents a node, c m (a) represents the number of matching instances associated with node a.

[0028] According to another aspect of this application, a method for identifying risky devices is provided, comprising:

[0029] Generate device data diagrams based on device logs;

[0030] The connected components of the device data graph are obtained according to the aforementioned method;

[0031] Obtain the node to be detected;

[0032] If the node to be detected does not belong to any of the connected components, then the probability that the node to be detected originates from a risky device exceeds the risk threshold.

[0033] According to another aspect of this application, a method for segmenting a data graph is provided, comprising:

[0034] Determine multiple predefined feature subgraphs for a given scenario;

[0035] Obtain scene data maps for the predetermined scene;

[0036] Perform subgraph matching on the scene data graph to obtain a matching set including at least one matching instance, where each matching instance is isomorphic to one of the plurality of predefined feature subgraphs;

[0037] The attribution relationship of a node is determined based on the relationship between the nodes in the scene data graph and the matching set;

[0038] The connected components of the scene data graph are obtained based on the affiliation of the nodes, thereby realizing the segmentation of the scene data graph.

[0039] According to one aspect of this application, a method for subgraph matching is provided, comprising:

[0040] Obtain the target graph set and the subgraph set, and store the target graph set and the subgraph set in the form of an edge table in the big data platform;

[0041] The target graph set and the subgraph set are decomposed according to the same meta-structure to obtain a target graph meta-structure unit set and a subgraph meta-structure unit set, each including multiple meta-structure units;

[0042] A merging strategy for restoring to the subgraph set is determined for the subgraph primitive structural unit set;

[0043] The merging strategy is executed on the target primitive structural unit set to obtain the merging result;

[0044] The subgraph matching result is obtained based on the merging result.

[0045] According to the aforementioned method, the target graph set and the subgraph set are decomposed according to the same meta-structure, including:

[0046] Obtain the edge tables corresponding to the target graph set and the subgraph set respectively;

[0047] The edge table is decomposed into triples (3-meta-paths) such that the resulting set of meta-structural units contains all the edges of the corresponding edge table and each meta-structural unit is unique and has other meta-structural units that share at least one node.

[0048] According to the aforementioned method, the decomposition results are further iteratively optimized through the following process:

[0049] Gradually increase the number of nodes in the meta-structural unit and estimate the cost of disassembling it into a new meta-structural unit;

[0050] If the cost is not greater than the cost threshold, then the edge table is decomposed using a new meta-structural unit;

[0051] If the cost exceeds the cost threshold, the optimization process is stopped.

[0052] After obtaining the corresponding edge table according to the aforementioned method, the process also includes:

[0053] If the edge table is determined not to be a bipartite graph, then bidirectional edge storage is performed.

[0054] According to another aspect of this application, a cloud computing device is provided, comprising:

[0055] processor;

[0056] A memory, on which computer programs are stored;

[0057] The aforementioned method is implemented when the processor executes the computer program.

[0058] According to the example embodiment, the device data graph segmentation method based on subgraph matching can be applied to large device graphs of various shapes and structures, and does not rely on the assumption that the device subgraph structure has a community structure, thereby effectively realizing the segmentation of device data graphs.

[0059] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit this application. Attached Figure Description

[0060] The above and other objectives, features and advantages of this application will become more apparent from a detailed description of exemplary embodiments thereof with reference to the accompanying drawings.

[0061] Figure 1 This shows a large diagram of the equipment formed by connecting multiple different physical device data diagrams together.

[0062] Figure 2 This diagram illustrates one application scenario of the technical solution of this application.

[0063] Figure 3 A method for displaying a data graph of a splitting device according to an example embodiment of this application is provided.

[0064] Figure 4A An example of a predefined device sub-diagram according to this application is shown.

[0065] Figure 4B An example of a connected component of a device data graph obtained according to an embodiment of this application is shown.

[0066] Figure 5 A flowchart illustrating a matching instance for determining node affiliation according to an example embodiment is shown.

[0067] Figure 6 This illustrates a method for improving the accuracy of ad delivery according to an example embodiment.

[0068] Figure 7 A method for identifying risky devices according to an example embodiment is shown.

[0069] Figure 8 A method for segmenting a data graph according to an example embodiment is shown.

[0070] Figure 9 A method for subgraph matching according to an example embodiment of this application is shown.

[0071] Figure 10 The flowchart shows the process of decomposing the target graph set and the subgraph set according to the same metastructure.

[0072] Figure 11 This illustrates a method for determining a merging strategy for restoring a subgraph set based on an example embodiment.

[0073] Figure 12 A block diagram of a cloud computing device according to an example embodiment of this application is shown. Detailed Implementation

[0074] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, they are provided so that this application will be thorough and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted.

[0075] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0076] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily need to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0077] The terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or apparatuses.

[0078] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment that is mutually exclusive with other embodiments. Those skilled in the art will understand that the embodiments described herein can be combined with other embodiments.

[0079] Before describing the embodiments of this application, some terms involved in the embodiments of this application will be explained.

[0080] Subgraph matching: Finding a subgraph that is isomorphic to a given smaller graph within a given larger graph.

[0081] Equipment Data Graph: Equipment identifier nodes are connected by edges to form a device relationship network graph. A device relationship network graph with more nodes than a reasonable threshold is called a large device graph.

[0082] Device identification: In the collection logs, multiple device identifiers (device granularity, app granularity) are usually collected. Device identifiers appearing in the same log can be considered as different descriptions of the same device. Therefore, we hope to aggregate all device identifiers belonging to the same physical device to achieve device identification.

[0083] Graph partitioning: Given a graph G = (V, E), where V is the set of n vertices (nodes) and E is the set of edges, graph partitioning divides the graph G into several smaller graphs by partitioning the node set V of G into mutually exclusive groups. Graph partitioning has many applications, such as finding the shortest path and minimum cut in road networks in logistics, image matting in image processing, and distributed computing after partitioning large graphs. This application relates to the application of graph partitioning algorithms in identifying equipment in large equipment graphs.

[0084] Community Detection: Community detection aims to cluster entity sets according to the rule that "nodes in a community are closely connected, while nodes in different communities are sparsely connected".

[0085] A connected component (CC) is a maximal connected subgraph of an undirected graph G. Every connected graph has only one connected component, which is itself. A disconnected undirected graph has multiple connected components, and every node in each connected component is connected by at least one path.

[0086] A salient motif is a subgraph that repeats itself across various networks.

[0087] The inventors discovered that, assuming all connections in the device identifier (edge ​​relationships between different device identifiers) are completely reasonable, maximal connected graphs can be obtained by calculating the connected components of the device data graph generated from the device collection logs, and each connected component can be considered as a physical device. However, some unreasonable edges inevitably exist in the connection relationships. This may be due to factors such as device ranching, high-frequency installation and reset, emulator-generated fakes, and counterfeit devices creating fake IMEI / IMSIs to generate multiple device links. These abnormal behaviors such as device switching, flashing, and device ranching bring a large number of noise edges, specifically manifested as nodes generating edges with a large number of neighboring nodes, or edges connecting the device graphs of two different physical devices together to form a large device graph (e.g., ...). Figure 1 (As shown). Since these large images are unreasonable and do not reflect reality, they need to be automatically segmented to group all device identifiers belonging to the same physical device into one image, while eliminating the need for connections between different physical devices.

[0088] Figure 2 This diagram illustrates one application scenario of the technical solution of this application.

[0089] See Figure 2 In the storage system of a big data platform, massive amounts of device collection logs can be stored. These logs typically collect multiple device identifiers (device-level and app-level). Device identifiers are a crucial and fundamental concept in the mobile internet field, and many manufacturers, internet companies, and authoritative institutions have launched their own solutions. Device identifiers are primarily used to provide personalized advertising and user statistics while protecting user data privacy and security. Third-party monitoring platforms can also provide advertisers with services such as conversion attribution analysis.

[0090] Device identifiers appearing in the same log entry can be considered different descriptions of the same device. Therefore, the goal is to aggregate all device identifiers belonging to the same physical device to meet downstream requirements such as ad placement and client profiling. For example, in Figure 2 In this context, if two device diagrams within the elliptical dashed line can be aggregated into the same physical device, then the same or similar advertisements can be delivered to all clients associated with the identifiers corresponding to that same physical device, or client profiles can be created based on information from these clients.

[0091] However, the raw collected log data contains a large amount of noise. Abnormal behaviors such as device switching, flashing, device farming, and software generation introduce numerous noise edges, causing multiple physical devices to be linked together, forming a large graph. For example, Figure 2The various devices shown may unreasonably form a large graph. If the same advertisement is served to clients associated with all nodes in this large graph, it will obviously lead to inefficient and erroneous ad delivery, because the existence of the large graph itself is unreasonable and unrealistic. Therefore, an effective and stable method is needed to decompose the large graph into multiple normal physical devices.

[0092] Easy to understand Figure 2 The application scenarios and architectures shown are illustrative and are intended to help readers better understand the technical solutions of this application.

[0093] Currently, commonly used methods for device data graph segmentation in the industry include policy-based segmentation schemes and community detection algorithm-based segmentation schemes. The former performs well when connecting the device graphs of two different physical devices to form a device data graph, i.e., when edge bridging is involved. However, for more common scenarios where a central node and a large number of neighboring nodes form a large graph with edges, such as the star-shaped structure formed by device pastures, this method struggles to separate different physical devices. The latter relies on the assumption that the device subgraph structure has a community structure, which does not align with the typical scenario of device data graphs.

[0094] The inventors discovered that the generation of unreasonable device data graphs is not random or disordered, but rather a combination of multiple superfamily members through abnormal edges. That is, a device data graph can be composed of some salient patterns (motifs) and some abnormal edges, with each salient pattern corresponding to a normal physical device. Therefore, we considered extracting the salient patterns and segmenting the abnormal edges. Based on this, we propose a device data graph segmentation algorithm based on subgraph matching. This algorithm extracts predefined device subgraphs (i.e., salient patterns) and segments the abnormal edges, exhibiting good interpretability and the ability to reasonably and effectively segment the device data graph, thereby identifying normal devices within the data graph.

[0095] The technical solution and its advantages of this application will be described in detail below with reference to the embodiments.

[0096] Figure 3 A method for displaying a data graph of a splitting device according to an example embodiment of this application is provided.

[0097] See Figure 3 In S301, acquire the device data diagram and multiple predefined device sub-diagrams.

[0098] According to the example embodiment, the device data graph and multiple predefined device subgraphs are stored in the big data platform in the form of edge tables, but this application is not limited to this. The big data platform can process massive amounts of data, serving the storage / computation of massive data, analysis and modeling of big data, etc. Device data graphs can be generated by collecting device logs, etc. Taking the daily increase data of a certain service device on the network platform as an example, the number of device data graphs (with 20 or more nodes) can reach about 200,000, which affects the aggregation results of millions of devices.

[0099] The inventors discovered that device data graphs exhibit superfamily characteristics. That is, although large graphs in complex networks vary greatly, the salient patterns (motifs) of natural device units within the network are the same, as shown in formula (1): the device big cluster is formed by these motifs through several noisy connectors. By using a basic predefined device subgraph (motif library), matching these motifs in the device big graph can help segment the large graph. It is understandable that large graphs are diverse and complex; even two large graphs with the same number of nodes and subgraph structures will have structural differences.

[0100] Because the maximum number of device identifier types that can be collected per data entry in a device / application log is limited, the size of the motif is also limited. Based on statistical analysis, frequently occurring device motifs are exemplified as follows: Figure 4A However, it is easy to understand that device motifs are not limited to this. According to embodiments, multiple predefined device subgraphs may include... Figure 4A The structures in (a) to (i) include multiple or all of the following: open triangles, closed triangles, triangular stars, quadrilaterals, overlapping closed triangles, single-sided closed triangles, fully connected quadrilaterals, fully connected pentagons, and fully connected hexagons. Utilizing these high-frequency salient patterns, subsequent accurate and effective segmentation can be achieved.

[0101] According to some embodiments, after obtaining the device data graph, a connected component algorithm can be performed on the device data graph to obtain connected component clustering results. Then, the number of nodes in each connected component is determined. If the number of nodes is less than a node threshold, the connected component can be excluded in subsequent operations, that is, excluded from the device data graph to be segmented, reducing the processing pressure and improving the processing efficiency.

[0102] In S303, subgraph matching is performed on the device data graph to obtain a matching set that includes at least one matching instance. Each matching instance is isomorphic to one of a plurality of predefined device subgraphs.

[0103] According to some embodiments, existing mature subgraph matching algorithms can be used to identify matching instances in the device data graph that are isomorphic to any predefined device subgraph, and all identified matching instances constitute a matching set.

[0104] According to some embodiments, after obtaining at least one matching instance, matching instances with inclusion relationships can be merged to obtain an updated matching set. Since some large subgraphs in a normal subgraph set may contain some small subgraphs, merging and filtering the matching instances of these small subgraphs can greatly reduce the pressure on subsequent processing. Any suitable merging algorithm can be used; for example, the inclusion relationship of the node sets can be used to determine whether to remove smaller matching instances contained in larger matching instances.

[0105] In S305, the affiliation of a node is determined based on the relationship between the node in the device data diagram and the matching set.

[0106] For any node in the device data graph, it may exist in multiple matching instances in the matching set, so it is necessary to determine the node's affiliation.

[0107] According to some embodiments, for each node in the device data graph, a set of associated instances consisting of matching instances associated with the node is obtained. If the number of matching instances in the associated instance set is greater than an instance threshold, the node is determined to be an abnormal node, and the edges connected to the node are deleted, making the node an isolated node. The instance threshold can be a statistical empirical value. By judging through the instance threshold, abnormal nodes can be quickly and effectively removed. According to embodiments, by identifying and removing abnormal nodes, the segmentation becomes more efficient, and the results are more consistent with reality.

[0108] According to some embodiments, for each matching instance in the matching set, the score of the matching instance can be determined based on the positive or negative correlation between the number of matching instances associated with the node in the matching instance, so as to determine the matching instance to which each node belongs through a voting mechanism. The scoring and voting mechanism according to the embodiments is simple and direct, has high processing efficiency, and the results show that it conforms well to the actual situation.

[0109] According to some embodiments, for each node in the device data graph, if the number of matching instances contained in the associated instance set is not greater than the instance threshold, the node is determined to be a normal node and is assigned to the matching instance with the lowest or highest score in the associated instance set.

[0110] According to some embodiments, for each node in the device data graph, if the set of associated instances is empty, the edges connecting that node in the device data graph are retained. This approach preserves independent edge nodes, thus reproducing the actual scenario as closely as possible.

[0111] In S307, the connected components of the device data graph are obtained based on the node affiliation, thereby realizing the segmentation of the device data graph.

[0112] After determining the affiliation of nodes, nodes with the same affiliation can be selected to obtain the connected components of the device data graph (e.g., Figure 4B As shown in the example, this completes the segmentation of the device data graph. Each connected component can correspond to a physical device, and each node can correspond to a relevant identifier of the physical device, which can then be associated with one or more applications. Utilizing the segmentation of the device data graph can further improve the accuracy of functions such as ad delivery and risk identification.

[0113] According to some embodiments, as described in the following detailed description, performing subgraph matching on the device data graph may include: acquiring a device data graph and multiple predefined device subgraphs, wherein the device data graph and the multiple predefined device subgraphs are stored in the form of an edge table; disassembling the device data graph and the multiple predefined device subgraphs according to the same metastructure to obtain a device data graph metastructure unit set and a subgraph metastructure unit set, each including multiple metastructure units; determining a merging strategy for restoring to the multiple predefined device subgraphs for the subgraph metastructure unit set; executing the merging strategy on the device data graph metastructure unit set to obtain a merging result; and obtaining the matching set based on the merging result.

[0114] According to the example embodiment, considering the power-law distribution characteristics of device large graph services, a subgraph matching-based edge partitioning scheme, which is more suitable for handling power-law distributions, is used. Compared to the shortcomings of traditional edge partitioning schemes, such as the large number of iterations, low computational efficiency due to the need to calculate connected components in each iteration, and reliance on prior assumptions that do not conform to the actual situation in device data graphs, the partitioning method according to the embodiments of this application no longer relies on the assumption that the device subgraph structure has a community structure and is suitable for complex structures, effectively achieving the partitioning of device data graphs.

[0115] Furthermore, according to the example embodiment, the solution has the ability to identify anomalies, which can identify abnormal nodes in the device graph, thereby excluding the calculation of connected components of abnormal devices.

[0116] The technical solution of this application is interpretable. Based on the fact that the device data graph can be decomposed into a combination of salient patterns (motifs) of individual physical devices and some abnormal edges, salient physical devices are identified through subgraph matching, and then abnormal edges between individual physical devices are removed. On the one hand, based on the observation and statistics of the normal device graph structure, reasonable and normal subgraph matching instances are adaptively mined from the device data graph through subgraph matching; on the other hand, a voting mechanism is used to select the normal physical device to which each node belongs, thereby ensuring the accuracy and reasonableness of the final result.

[0117] The technical solution based on the example embodiment is reusable and can be migrated to data graph segmentation applications in other scenarios.

[0118] Figure 5 A flowchart illustrating a matching instance for determining node affiliation according to an example embodiment is shown.

[0119] See Figure 5 In S501, a score is determined for each matching instance.

[0120] According to the embodiment, based on the fact that the probability of each node a belonging to a certain matching instance is uniformly distributed and the node affiliation is independent, the score of each matching instance can be determined according to the following formula:

[0121]

[0122] in Represents the rating. Represents the g-th subgraph in the matching set that matches multiple predefined device subgraphs. i The j-th matching instance of subgraph isomorphism, where a represents a node, c m (a) represents the number of matching instances associated with node a.

[0123] In S503, determine if there are any unprocessed nodes in the device data graph. If they exist, proceed to S505; otherwise, proceed to S517.

[0124] In S505, the set of associated instances Ma' of a node is obtained by filtering the matching instances associated with the node from the matching set. This can be done through simple selection operations (e.g., via SQL) or other methods, or it can be done through parallel computation to speed up the processing.

[0125] In S506, determine whether the number of matching instances |Ma'| in the associated instance set is greater than the instance threshold. If it is greater than the instance threshold, proceed to S507; otherwise, proceed to S509. The instance threshold can be a value between 5 and 10, for example, 8 or 10.

[0126] In S507, if the number of matching instances |Ma'| is greater than the instance threshold, the node is considered an abnormal node and can be stored in the abnormal node set A. ad ={a}. This type of node is usually an abnormal node caused by cheating behaviors such as device farms or counterfeit devices. The edges connected to this node are all abnormal edges. In this case, all edges connected to this node can be deleted, making this abnormal node an isolated node.

[0127] In S509, determine if Ma' is an empty set. If it is an empty set, go to S511; otherwise, go to S513.

[0128] In S511, when Ma' is an empty set, the edge containing the node in the large cluster is retained and stored in set E.

[0129] In S513, the node can be determined to be a normal node and stored in the normal node set A. n ={a}.

[0130] In S515, the matching instance with the highest score in the set of associated instances is selected as the matching instance to which the node belongs. That is, the instance m to which node a belongs is determined according to the following formula.

[0131] m = argmax(R(m)), m ∈ Ma'

[0132] For rating R, please refer to the previous explanation.

[0133] At the same time, the corresponding edges connecting node a to nodes in the matching instance m can be added to set E.

[0134] In S517, a connected component operation is performed on set E to obtain the result of the device data graph being segmented.

[0135] Figure 6 This illustrates a method for improving the accuracy of ad delivery according to an example embodiment.

[0136] See Figure 6 In S601, a device data diagram is generated based on the device's collected logs.

[0137] Device identifiers appearing in the same log entry can be considered different descriptions of the same device. Device data graphs can be generated by collecting device logs, where device identifier nodes are connected by edges to form a device relationship network.

[0138] In S603, the connected components of the device data graph are obtained according to the aforementioned method.

[0139] The raw data collection logs contain a significant amount of noise. Abnormal behaviors such as device switching, flashing, device farming, and software generation introduce numerous noise edges, causing multiple physical devices to be linked together, forming a large graph. This makes it impossible to accurately locate users. If the same advertisement is delivered to all clients associated with nodes in this large graph, it will result in inefficient and erroneous ad delivery.

[0140] Therefore, the device data graph can be segmented using the method described above according to the embodiments of this application to obtain multiple connected components, each of which can correspond to an actual normal device.

[0141] In S605, based on the client profile obtained from one or more nodes of the same connected component, the same or similar advertisements are delivered to all nodes of the corresponding connected component.

[0142] By accurately mapping connected components to physical devices and precisely pushing ads based on client profiles, the conversion efficiency of ad delivery can be improved.

[0143] Figure 7 A method for identifying risky devices according to an example embodiment is shown.

[0144] See Figure 7 In S701, a device data graph is generated based on the device's collected logs.

[0145] Device logs typically collect multiple device identifiers, such as the International Mobile Equipment Identity (IMEI), International Mobile Subscriber Identification Number (IMSI), Universally Unique Identifier (UUID), and Mobile Equipment Identifier (MEID). Device identifiers appearing in the same log entry can be considered different descriptions of the same device. By collecting device logs, a device data graph can be generated; that is, device identifier nodes are connected to form a device relationship network.

[0146] In S703, the connected components of the device data graph are obtained according to the aforementioned method.

[0147] When all the connections in the device identifier (the edge relationships between different device identifiers) are completely reasonable, the maximal connected graphs can be obtained by calculating the connected components of the device data graph generated from the device collection logs. Each connected component can be regarded as a physical device.

[0148] However, there is a lot of noise in the raw collected log data. For example, the behavior of risky devices such as device replacement, flashing, device ranching, and software generation brings a lot of noise edges. Risky devices are connected with multiple normal physical devices to form a large graph.

[0149] Therefore, the device data graph needs to be segmented using the method described above according to the embodiments of this application to obtain multiple connected components, each of which corresponds to an actual normal device. Simultaneously, abnormal nodes can be identified, preventing the generation of connected components for risky devices, thereby eliminating risky devices.

[0150] In S705, obtain the node to be detected.

[0151] Depending on the application scenario, after obtaining node information associated with certain behaviors, it is determined whether to perform risk detection. If risk detection is performed, the node can be treated as a node to be detected.

[0152] In S707, if the node to be detected does not belong to any of the connected components, the probability that the node to be detected originates from a risky device exceeds the risk threshold.

[0153] If a node to be detected exists in the device data graph but does not belong to any of the connected components, it can be determined that the probability of the node originating from a risky device exceeds a risk threshold (e.g., 75%). It can then be marked or specially handled accordingly, and continuous monitoring or verification can be performed. This can reduce or eliminate the risks posed by related clients or lower operating costs. For example, through connected component calculation, some or all spoofed mobile terminals can be excluded, thereby reducing the commission costs of new operational transactions and eliminating operational risks. Furthermore, through connected component calculation, some or all spoofed mobile terminals exhibiting malicious behavior can be excluded, reducing system risk.

[0154] Figure 8 A method for segmenting a data graph according to an example embodiment is shown.

[0155] The technical solutions described in the foregoing embodiments are reusable and can be migrated to data graph segmentation applications in other scenarios.

[0156] See Figure 8 In step S801, multiple predefined feature sub-graphs of a predetermined scene are determined. According to the example embodiment, multiple predefined feature sub-graphs of a predetermined scene can be determined automatically or manually through statistical analysis, machine learning, manual analysis, etc.

[0157] In S802, obtain the scene data map of the predetermined scene.

[0158] According to the example embodiment, the scene data graph and multiple predefined feature subgraphs are stored in the big data platform in the form of an edge table, but this application is not limited thereto.

[0159] According to some embodiments, after acquiring the scene data graph, a connected component algorithm can be performed on the scene data graph to obtain connected component clustering results. Then, the number of nodes in each connected component is determined, and connected components with a number of nodes higher or lower than a threshold are excluded from the scene data graph to be segmented, reducing the processing pressure and improving the efficiency of subsequent processing.

[0160] In S803, subgraph matching is performed on the scene data graph to obtain a matching set that includes at least one matching instance. Each matching instance is isomorphic to one of a plurality of predefined feature subgraphs.

[0161] According to some embodiments, existing mature subgraph matching algorithms can be used to identify matching instances in the scene data graph that are isomorphic to any predefined feature subgraph, and all identified matching instances constitute a matching set.

[0162] According to some embodiments, as described above, after obtaining at least one matching instance, matching instances with inclusion relationships can be merged to obtain an updated matching set, thereby reducing the pressure of subsequent processing.

[0163] In S805, the attribution relationship of a node is determined based on the relationship between the node in the scene data graph and the matching set.

[0164] For any node in the scene data graph, it may exist in multiple matching instances in the matching set, so it is necessary to determine the node's affiliation.

[0165] According to some embodiments, the affiliation of a node can be determined based on its own attributes or its characteristics within the structure. Depending on the application objective, abnormal nodes can be excluded or retained.

[0166] According to some embodiments, for each matching instance in the matching set, the score of the matching instance can be determined based on factors such as the number of instances associated with the node, or instance attribute characteristics, or instance structure characteristics, and / or node characteristics, so as to determine the matching instance to which each node belongs through a voting mechanism.

[0167] In S807, the connected components of the scene data graph are obtained based on the node affiliation, thereby realizing the segmentation of the scene data graph.

[0168] After determining the affiliation of nodes, nodes with the same affiliation can be selected to obtain the connected components of the scene data graph (e.g., Figure 4B As shown in the example, this completes the segmentation of the scene data graph. Each connected component can correspond to a physical scene, entity, entity set, or relation set, thereby enabling targeted application processing.

[0169] Graph querying or subgraph matching is suitable for identifying valuable graph patterns and structures from graph data. In processing massive amounts of data on big data platforms, a crucial process is learning the graph structure, and subgraph matching is a core algorithmic technique for understanding graph structures. However, some current subgraph matching schemes suffer from performance issues with large-scale graph data. For example, breadth-first search-based multi-way join algorithms transform subgraph matching into multi-way set intersection operations to obtain the query result. However, this algorithm is highly dependent on the graph structure of the query graph and the efficiency of the underlying set intersection operation. Meanwhile, depth-first search-based algorithms, which construct a search tree to obtain the final query result, are only suitable for subgraph matching on small-scale datasets.

[0170] This invention proposes a scheme for subgraph matching of large-scale data, based on the same decomposition strategy and system merging strategy. The underlying logic of this scheme can be understood as follows: if a subgraph q and a target graph g are decomposed using the same decomposition strategy to obtain consistent meta-structural units, and merged using the same merging strategy to ensure consistent results at each merging step, ultimately resulting in a non-empty result set f, then q is a subgraph of g. In fact, assuming q is not a subgraph of g, i.e., at least one node a1 or one edge e1(a1,a2) in q cannot be mapped to g, and assuming node a1 or edge (a1,a2) participates in the merging at the k-th step, since the merging results are consistent, g needs to have a node and edge corresponding to q, which contradicts the assumption, and the aforementioned conclusion should hold.

[0171] The subgraph matching scheme proposed in this application can be applied to the segmentation of the aforementioned large device graph.

[0172] Figure 9 A method for subgraph matching according to an example embodiment of this application is shown.

[0173] See Figure 9 In S901, the target graph set and subgraph set are obtained.

[0174] According to the example embodiment, the target graph set and subgraph set are stored in the big data platform in the form of edge tables. For example, the device's data graph set and the subgraph set required for subgraph matching are stored in the big data platform in the form of edge tables, but this application is not limited to this. The big data platform can process massive amounts of data and serves the storage / computation of massive amounts of data, analysis and modeling of big data, etc. In some scenarios, the device's data graph can be generated as the target graph set by collecting device logs, etc.

[0175] In S903, the target graph set and the subgraph set are decomposed according to the same meta-structure, so as to obtain the target graph meta-structure unit set and the subgraph meta-structure unit set, which each include multiple meta-structure units.

[0176] According to some embodiments, during the decomposition, the corresponding edge tables of the target graph set and the subgraph set are obtained. Then, the edge tables are decomposed into triples, such that the resulting set of meta-structural units contains all the edges of the corresponding edge tables, and each meta-structural unit is unique and shares at least one node.

[0177] By unifying the edge data into suitable basic meta-structural units, such as k-meta path, the search space of subsequent merging modules can be reduced.

[0178] According to some embodiments, the number of nodes in the meta-structural unit can also be adjusted to adaptively iteratively optimize the decomposition results and improve decomposition efficiency.

[0179] According to some embodiments, after obtaining the corresponding edge table, it is determined whether the edge table is a bipartite graph. If it is not a bipartite graph, bidirectional edge storage is performed to ensure the integrity of the decomposition result.

[0180] In S905, a merging strategy for restoring to the subgraph set is determined for the subgraph metastructure unit set.

[0181] According to the example embodiment, by searching the merging strategy, the meta-structural units (k-tuples) and intersection conditions (join operations) for each round of merging when recovering the subgraph set can be determined. In addition, the merging strategy can be optimized by combining the target graph set data, thereby reducing the overall number of calculations and narrowing the search space for each round, which will be described in detail later.

[0182] In S907, a merging strategy is executed on the target primitive structural unit set to obtain the merging result.

[0183] According to the example embodiment, after obtaining the merging strategy, the intersection conditions are obtained from the merging strategy in sequence. Then, the target primitive structural unit set is merged according to the intersection conditions, and the target primitive structural unit set is updated with the obtained merging result. Then, the merging continues under the next intersection condition.

[0184] In S909, the subgraph matching result is obtained based on the aforementioned merging result. For example, the number of matches in the merging result can be counted; and / or the matched nodes can be obtained.

[0185] Figure 10 The flowchart shows the process of decomposing the target graph set and the subgraph set according to the same metastructure.

[0186] See Figure 10 In step S1001, the edge tables corresponding to the target graph set and the subgraph set are obtained respectively. As mentioned above, the target graph set and the subgraph set can be stored in the form of edge tables.

[0187] In S1003, determine whether the edge list is a bipartite graph. If it is, go to S1007; otherwise, go to S1005.

[0188] In S1005, when the edge table is not a bipartite graph, all edges are stored bidirectionally to ensure the integrity of the decomposition results.

[0189] In S1007, the edge table is decomposed into triples.

[0190] According to the scheme of this application, in order to reduce the search space of subsequent merging operations, the target graph set and the subgraph set are uniformly processed into suitable basic meta-structural units (k-tuples or k-meta paths).

[0191] In S1009, it is determined whether the obtained set of meta-structural units satisfies the following conditions: it contains all the edges of the corresponding edge table, and any meta-structural unit therein is unique and has other meta-structural units sharing at least one node. If it does not satisfy the condition, proceed to S1007 to continue decomposition; if it does satisfy the condition, increase the number of nodes of the meta-structural unit by one and proceed to S1011.

[0192] In S1011, the cost of decomposing into new meta-structural units is estimated. In research practice, the inventors found that the algorithm performs better when k=3, but this application is not limited to this. Specific meta-structural units are automatically found based on the subgraph structure. Furthermore, as described here, the algorithm can adjust the number of nodes in the meta-structural units based on k=3 to adaptively iteratively optimize the decomposition results and improve computational efficiency.

[0193] In S1013, determine whether the cost is greater than the cost threshold. If it is not greater than the cost threshold, proceed to S1007 to continue the decomposition; otherwise, stop the optimization process and output the decomposition result.

[0194] Figure 11 This illustrates a method for determining a merging strategy for restoring a subgraph set based on an example embodiment.

[0195] See Figure 11 In S1101, the first metastructure unit q is randomly selected from the set of sub-metastructure units Qs.

[0196] In S1103, the first element structure unit is removed from the set of sub-element structure units, i.e., Qs = Qs\q.

[0197] In S1105, meta-structural units with the same nodes or the same edges as the first meta-structural unit q are selected from the set of sub-graph meta-structural units Qs to form the neighbor set Nq.

[0198] In S1107, the intersection conditions between the first metastructure unit q and each metastructure unit in the neighbor set Nq are determined respectively.

[0199] In S1109, the execution cost of intersection conditions on the target primitive structural unit set Gs is estimated using the CBO algorithm.

[0200] To further reduce the number of subgraph matching iterations and shrink the solution space, it is necessary to determine the order of merging meta-structural units. Here, we can draw on the cost estimation strategy of CBO in SQL to evaluate the execution cost of each merging strategy, ultimately providing a merging strategy with the lowest execution cost to guide the rapid merging of Gs.

[0201] In S1111, select the intersection condition and the corresponding metastructure unit q' of the neighbor set that have the minimum execution cost, add the intersection condition to the merging strategy M, update the first metastructure unit q with the corresponding intersection result, and remove the corresponding metastructure unit q' of the neighbor set from the subgraph metastructure unit set Qs.

[0202] In S1113, determine whether the first primitive structural unit q contains all the edges initially present in the sub-primitive structural unit set Qs. If the result is no, proceed to S1105; otherwise, obtain the completed merging strategy.

[0203] The subgraph matching method in the example embodiment supports edge tables and can handle graph matching tasks with hundreds of billions of edges through decomposition and merging strategies. Furthermore, through adaptive decomposition and adaptive merging modules, the search space for each round can be reduced based on the query graph structure, thereby optimizing overall computational efficiency.

[0204] Figure 12 A block diagram of a cloud computing device according to an example embodiment of this application is shown.

[0205] like Figure 12 As shown, the cloud computing device 30 includes a processor 12 and a memory 14. The cloud computing device 30 may also include a bus 22, a network interface 16, and an I / O interface 18. The processor 12, memory 14, network interface 16, and I / O interface 18 can communicate with each other via the bus 22.

[0206] The processor 12 may include one or more general-purpose CPUs (Central Processing Units), microprocessors, or application-specific integrated circuits, etc., for executing relevant program instructions.

[0207] Memory 14 may include a machine system readable medium in the form of volatile memory, such as random access memory (RAM), read-only memory (ROM), and / or cache memory. Memory 14 is used to store one or more programs containing instructions, as well as data. Processor 12 may read the instructions stored in memory 14 to perform the methods described above according to embodiments of this application.

[0208] The cloud computing device 30 can also communicate with one or more networks through the network interface 16. The network interface 16 can be a wired network interface, a wireless network interface, or a virtual network interface.

[0209] The cloud computing device 30 can also communicate with one or more external devices (such as audio input devices, audio output devices, cameras, keyboards, mice, monitors, various sensors, etc.) through the input / output (I / O) interface 18.

[0210] Bus 22 may include an address bus, a data bus, a control bus, etc. Bus 22 provides a path for exchanging information between components.

[0211] It should be noted that, in specific implementations, the cloud computing device 30 may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the device described above may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.

[0212] This application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method.

[0213] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0214] Through the description of the example embodiments, those skilled in the art will readily understand that the technical solutions according to the embodiments of this application have at least one or more of the following advantages.

[0215] According to some embodiments, the device data graph segmentation method based on subgraph matching can be applied to large device graphs of various shapes and structures, and does not rely on the assumption that the device subgraph structure has a community structure, thereby effectively realizing the segmentation of device data graphs.

[0216] According to some embodiments, compared with the shortcomings of traditional edge partitioning schemes, such as the large number of iterations, the need to calculate connected components in each iteration leading to low computational efficiency, and the reliance on some prior assumptions that do not conform to the actual situation in the device data graph, the partitioning method according to the embodiments of this application no longer relies on the assumption that the device subgraph structure has a community structure, and is suitable for complex structures, and can effectively realize the partitioning of the device data graph.

[0217] According to some embodiments, abnormal nodes in the device graph can be identified, thereby excluding abnormal devices from the calculation of connected components.

[0218] According to some implementations, a voting mechanism is used to select the normal physical device to which each node belongs, thereby ensuring the accuracy and rationality of the final result.

[0219] The technical solutions according to the embodiments of this application are reusable and can be migrated to data graph segmentation applications in other scenarios.

[0220] Exemplary embodiments of this application have been specifically shown and described above. It should be understood that this application is not limited to the detailed structures, arrangements, or implementation methods described herein; rather, this application is intended to cover various modifications and equivalent arrangements contained within the spirit and scope of the appended provisions.

Claims

1. A method for segmenting equipment data diagrams, characterized in that, include: Obtain a device data graph and multiple predefined device sub-graphs, wherein the device data graph is a device relationship network graph formed by connecting device identifier nodes with edges; Perform subgraph matching on the device data graph to obtain a matching set including at least one matching instance, wherein the matching instance is isomorphic to one of the plurality of predefined device subgraphs; The attribution relationship of a node is determined based on the relationship between the nodes in the device data graph and the matching set; The connected components of the device data graph are obtained based on the node affiliation relationships, thereby enabling the segmentation of the device data graph. The process of determining the attribution relationship of a node based on the relationship between the nodes in the device data graph and the matching set includes: For each node in the device data graph, a set of associated instances consisting of matching instances associated with the node is obtained. If the number of matching instances in the set of associated instances is greater than the instance threshold, the node is determined to be an abnormal node, and the edges connected to the node are deleted, making the node an isolated node. For each matching instance in the matching set, the score of the matching instance is determined based on the positive or negative correlation of the number of matching instances associated with the node in the matching instance; for each node in the device data graph, if the number of matching instances contained in the associated instance set is not greater than the instance threshold, the node is determined to be a normal node, and the node is assigned to the matching instance with the lowest or highest score in the associated instance set.

2. The method as described in claim 1, characterized in that, The multiple predefined device sub-graphs include multiple or all of the following structures: open triangle, closed triangle, triangular star, quadrilateral, overlapping closed triangle, single-sided closed triangle, fully connected quadrilateral, fully connected pentagon, and fully connected hexagon.

3. The method as described in claim 1, characterized in that, After obtaining at least one matching instance, it also includes: Merge matching instances that have an inclusion relationship to obtain an updated matching set.

4. The method as described in claim 1, characterized in that, Determining the attribution relationship of a node based on the relationship between the nodes in the device data graph and the matching set further includes: For each node in the device data graph, if the set of associated instances is empty, then the edges connecting the node in the device data graph are retained.

5. The method as described in claim 1, characterized in that, After obtaining the device data diagram, the following is also included: Perform a connected component algorithm on the device data graph to obtain connected component clustering results; Determine the number of nodes in each connected component. If the number of nodes is less than a node threshold, exclude the connected component in subsequent operations.

6. The method as described in claim 1, characterized in that, The device data graph and the multiple predefined device sub-graphs are stored in the big data platform in the form of side tables.

7. The method as described in claim 1, characterized in that, The score of a matching instance is determined based on the number of matching instances associated with a node in that matching instance, either positively or negatively, including determining the score according to the following formula: ， in Represents the rating. Represents the first matching set in the plurality of predefined device subgraphs. g i The j-th matching instance of subgraph isomorphism, where a represents a node. This represents the number of matching instances associated with node a.

8. The method as described in claim 1, characterized in that, Performing subgraph matching on the device data graph includes: Obtain a device data diagram and multiple predefined device sub-diagrams, wherein the device data diagram and the multiple predefined device sub-diagrams are stored in the form of an edge table; The device data diagram and the multiple predefined device sub-diagrams are decomposed according to the same meta-structure to obtain a set of device data diagram meta-structure units and a set of sub-diagram meta-structure units, each including multiple meta-structure units. A merging strategy for restoring to the plurality of predefined device subgraphs is determined for the set of subgraph primitive structural units; The merging strategy is executed on the set of device data primitive structure units to obtain the merging result; The matching set is obtained based on the merging result.

9. A method for improving the accuracy of advertising delivery, characterized in that, include: Generate device data diagrams based on device logs; The connected components of the device data graph are obtained by the method according to any one of claims 1-8; Based on the client profiles obtained from one or more nodes in the same connected component, the same or similar advertisements are delivered to all nodes in the corresponding connected component.

10. A method for identifying risky devices, characterized in that, include: Generate device data diagrams based on device logs; The connected components of the device data graph are obtained by the method according to any one of claims 1-8; Obtain the node to be detected; If the node to be detected does not belong to any of the connected components, then the probability that the node to be detected originates from a risky device exceeds the risk threshold.

11. A cloud computing device, characterized in that, include: processor; A memory, on which computer programs are stored; When the processor executes the computer program, it implements the method as described in any one of claims 1-10.

Images