Method and apparatus for identifying abnormal clusters

Abstract

A method and device for identifying an abnormal cluster, a computing device and a storage medium are disclosed. The method comprises: obtaining resource transfer data of a plurality of subjects, the resource transfer data comprising resource receiving data, resource expenditure data and resource transfer media of each subject in the plurality of subjects; defining edges between different nodes based on an association relationship between the nodes, each node being a subject in the plurality of subjects, and establishing a target cluster network according to the nodes and the edges between the nodes, thereby obtaining a plurality of to-be-identified clusters, each to-be-identified cluster comprising at least one subject in the plurality of subjects, the association relationship comprising the different nodes involving a common resource transfer medium in a resource transfer process; extracting cluster features of each to-be-identified cluster according to subject information of each subject in the to-be-identified cluster; and identifying an abnormal cluster from the plurality of to-be-identified clusters based on the cluster features of each to-be-identified cluster.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a method and apparatus for identifying abnormal clusters, a computing device, a storage medium, and a computer program product. Background Technology

[0002] With the rapid development of mobile internet technology, online black and gray industries often appear in everyday resource transactions. These online black and gray industries are not only prohibited by relevant laws and regulations, but also pose security risks to the management order of computer information systems and cyberspace, requiring identification, prevention, and crackdown. Currently, the methods for identifying entities engaged in online black and gray industries mainly rely on data such as user payment information to these entities and individual information of both entities and users, using simple rules to determine whether an entity is involved in black and gray industries. However, in the process of identifying entities involved in black and gray industries, this method needs improvement in terms of accuracy and comprehensiveness. Summary of the Invention

[0003] In view of the above, this application provides a method, apparatus, computing device, storage medium and computer program product for identifying abnormal clusters, which is expected to overcome some or all of the defects of the above-mentioned related technologies and other possible defects.

[0004] According to a first aspect of this application, a method for identifying abnormal clusters is provided. The method includes: acquiring resource transfer data of multiple entities, the resource transfer data including resource receiving data, resource expenditure data, and resource transfer medium for each of the multiple entities; defining edges between different nodes based on the association relationships between the multiple entities, using each entity as a node, and establishing a target cluster network based on the nodes and the edges between the nodes, thereby obtaining the multiple clusters to be identified, each cluster to be identified including at least one entity of the multiple entities, the association relationships including the different nodes involving a common resource transfer medium during the resource transfer process; extracting cluster features of the clusters to be identified based on the entity information of each entity in each of the multiple clusters to be identified; and identifying abnormal clusters from the multiple clusters to be identified based on the cluster features of each of the multiple clusters to be identified.

[0005] According to some embodiments of this application, the resource transfer medium includes resource receiving medium involved in the resource receiving process and resource expenditure medium involved in the resource expenditure process. The definition of the edge between different nodes based on the association between each node includes: removing resource receiving mediums with a credibility higher than the credibility threshold from the resource receiving medium.

[0006] According to some embodiments of this application, establishing a target cluster network based on the nodes and the edges between the nodes includes: defining the weight of the edges based on the number of common resource transfer media involved in the resource transfer process of the different nodes, and establishing the target cluster network based on the nodes, the edges and the weights using the community detection algorithm.

[0007] According to some embodiments of this application, defining the weight of the edge based on the number of common resource transfer media involved in the resource transfer process of the different nodes includes: defining the weight as w = N1*cf1 + N2*cf2. Where w represents the weight of the edge between two different nodes, N1 represents the number of common resource transfer media involved in the resource reception process of the two different nodes, N2 represents the number of common resource transfer media involved in the resource expenditure process of the two different nodes, where cf2 and cf1 are both coefficients, and cf2 is greater than cf1.

[0008] According to some embodiments of this application, the step of establishing the target cluster network based on the nodes, edges, and weights using the community detection algorithm includes: establishing an initial cluster network based on each node to divide the multiple subjects into multiple initial clusters, and calculating the initial modularity of the initial cluster network; performing node allocation by assigning each node to the initial cluster where the adjacent nodes are located to form an updated cluster network, such that the updated modularity of the updated cluster network is greater than the initial modularity; repeating the above node allocation steps with the updated cluster network as the initial cluster network until the updated modularity of the obtained updated cluster network no longer increases, thereby obtaining the target cluster network.

[0009] According to some embodiments of this application, the step of establishing the target cluster network based on the nodes, edges, and weights using the community detection algorithm includes: establishing an initial cluster network based on each node to divide the multiple subjects into multiple initial clusters, and calculating the initial modularity of the initial cluster network; performing node allocation to form an updated cluster network by assigning each node to the initial cluster where the adjacent nodes are located, such that the updated modularity of the updated cluster network is greater than the initial modularity; repeating the above-described node allocation to form an updated cluster network using the updated cluster network as the initial cluster network until the updated modularity of the obtained updated cluster network no longer increases, thereby obtaining a desired updated cluster network, the desired updated cluster network including updated clusters; constructing an intermediate cluster network by using each updated cluster in the desired updated cluster network as an updated node, and performing the above-described node allocation to form an updated cluster network and obtaining the desired updated cluster network based on the intermediate cluster network, until the intermediate cluster network no longer changes, thereby obtaining the target cluster network.

[0010] According to some embodiments of this application, the resource transfer medium includes at least one of a public account, a mini-program, or a user.

[0011] According to some embodiments of this application, the subject information includes at least one of subject registration information, subject transaction scenarios, and subject penalty records. Extracting cluster features of the target cluster based on the subject information of each subject in each of the plurality of target clusters includes: calculating the proportion of labeled subjects in the target cluster, wherein the cluster features include the proportion of labeled subjects, which includes at least one of penalized subject proportion, suspicious subject proportion, suspicious transaction scenario proportion, and suspicious registration information proportion. The penalized subject proportion refers to the ratio of the number of subjects in the target cluster that have been penalized to the total number of subjects in the target cluster. The suspicious subject proportion refers to the ratio of the number of subjects in the target cluster with a suspiciousness level higher than a suspiciousness threshold to the total number of subjects in the target cluster. The suspicious transaction scenario proportion refers to the ratio of the number of subjects in the target cluster involved in suspicious transaction scenarios to the total number of subjects in the target cluster. The suspicious registration information proportion refers to the ratio of the number of subjects in the target cluster with suspicious registration information to the total number of subjects in the target cluster.

[0012] According to some embodiments of this application, identifying an abnormal cluster from the plurality of clusters to be identified based on the cluster features of each of the plurality of clusters to be identified includes: providing the cluster features to a cluster attribute prediction model, wherein the cluster attribute prediction model determines the abnormal cluster from the plurality of clusters to be identified based on the cluster features, wherein the cluster attribute prediction model is trained based on a training sample set, the training sample set includes training sample clusters, and each training sample cluster has a sample cluster label.

[0013] According to some embodiments of this application, the cluster attribute prediction model determines the abnormal cluster from the plurality of clusters to be identified based on the cluster characteristics, including: the cluster attribute prediction model outputs an evaluation value indicating whether the cluster to be identified is an abnormal cluster for each cluster to be identified based on the cluster characteristics; and identifies clusters to be identified with evaluation values ​​higher than the evaluation threshold as abnormal clusters.

[0014] According to some embodiments of this application, a method for identifying abnormal clusters includes obtaining the training sample set through the following steps: obtaining multiple sample clusters based on multiple sample subjects using a community detection algorithm; determining multiple first clusters from the sample clusters, wherein the proportion of a first identifier subject in each of the multiple first clusters is greater than or equal to a first proportion threshold, and the proportion of a second identifier subject in each of the multiple first clusters is greater than or equal to a second proportion threshold, wherein the proportion of the first identifier subject is selected from one of the proportion of penalized subjects, the proportion of suspicious subjects, the proportion of suspicious transaction scenarios, and the proportion of suspicious registration information, and the proportion of the second identifier subject is selected from another of the proportion of penalized subjects, the proportion of suspicious subjects, the proportion of suspicious transaction scenarios, and the proportion of suspicious registration information; assigning positive sample cluster labels to the multiple first clusters, assigning negative sample cluster labels to the remaining sample clusters in the sample clusters, and using the multiple sample clusters including the positive sample cluster labels and the negative sample cluster labels as the training sample set.

[0015] According to another aspect of this application, an apparatus for identifying abnormal clusters is provided. The apparatus includes: a resource transfer data acquisition module configured to acquire resource transfer data of multiple entities, the resource transfer data including resource receiving data, resource expenditure data, and resource transfer medium for each of the multiple entities; a cluster partitioning module configured to define edges between different nodes based on the relationships between the multiple entities, using each entity as a node, and to establish a target cluster network based on the nodes and the edges between them, thereby obtaining the multiple clusters to be identified, each cluster to be identified including at least one entity among the multiple entities, the relationships including the different nodes involving a common resource transfer medium during resource transfer; a cluster feature extraction module configured to extract cluster features of the clusters to be identified based on entity information of each entity in each of the multiple clusters to be identified; and a cluster attribute evaluation module configured to identify abnormal clusters from the multiple clusters to be identified based on the cluster features of each cluster to be identified.

[0016] According to another aspect of this application, a computing device is provided, comprising: a memory configured to store computer-executable instructions; and a processor configured to perform the method as described in any of the foregoing method embodiments when the computer-executable instructions are executed by the processor.

[0017] According to another aspect of this application, a computer-readable storage medium is provided that stores computer-executable instructions, which, when executed, perform the method described in any of the foregoing method embodiments.

[0018] According to another aspect of this application, a computer program product is provided, including a computer program that, when executed by a processor, implements the method described in any of the foregoing method embodiments.

[0019] The technical solution for identifying abnormal clusters provided in this application collects resource transfer data from various entities. This resource transfer data includes resource receiving data, resource spending data, and corresponding resource transfer media. Based on this resource transfer data (e.g., through a community detection algorithm), the entities are grouped into clusters. Therefore, the resource receiving and spending information of each entity is better integrated through the resource transfer media. The clustering strengthens the correlation between entities within each cluster to be identified, improving the accuracy of cluster division. Furthermore, it significantly reduces the number of entities with uncertain attributes in the clusters to be identified (or even completely avoids the occurrence of entities with uncertain attributes), thereby enabling the identification of more complete abnormal clusters from multiple entities. In addition, the technical solution of this application identifies abnormal clusters from multiple clusters to be identified based on the cluster characteristics of each cluster to be identified. The server or terminal device can automatically output relevant information about abnormal clusters based on the entity information of the entities in the clusters to be identified, greatly improving the efficiency of identifying abnormal clusters. Attached Figure Description

[0020] Embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings, in which: Figure 1 An example implementation environment of a method for identifying anomalous clusters according to some embodiments of this application is illustrated schematically; Figure 2 A flowchart illustrating a method for identifying anomalous clusters according to an embodiment of this application is shown schematically. Figure 3 This illustration shows an example of a malicious actor transferring resources through a resource transfer medium. Figure 4 An example of entities with an "edge" relationship is illustrated schematically; Figure 5 This schematically illustrates another example of entities with an "edge" relationship; Figure 6 The illustration schematically depicts modularity optimization and cluster aggregation in the community detection algorithm applied according to embodiments of this application; Figure 7 This paper outlines the main process of identifying anomalous clusters using a community detection algorithm and machine learning, according to embodiments of this application. Figure 8 The illustration shows the process of obtaining a training sample set for training a cluster attribute prediction model according to an embodiment of this application; Figure 9 The illustration shows an example of identifying malicious actors based solely on information about the funds received by the entity. Figure 10 The illustration shows an example of identifying malicious actors based solely on information about the actor's expenditure funds; Figure 11 The illustration shows a method for identifying abnormal clusters based on embodiments of this application. Figure 9 and Figure 10 Examples of malicious actors; Figure 12 A block diagram of an apparatus for identifying anomalous clusters according to an embodiment of this application is shown; and Figure 13 An example system is illustrated, which includes an example computing device representing one or more systems and / or devices that can implement the various technologies described herein. Detailed Implementation

[0021] The technical solutions of this application will now be clearly and completely described with reference to the accompanying drawings. The described embodiments are merely some embodiments of this application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0022] Artificial intelligence (AI) is the theory, methods, technology, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. AI studies the design principles and implementation methods of various intelligent machines, enabling them to possess the functions of perception, reasoning, and decision-making.

[0023] Artificial intelligence (AI) is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, as well as machine learning / deep learning, autonomous driving, intelligent transportation, and automatic control.

[0024] Machine learning (ML) is a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, and algorithm complexity theory. It specifically studies how computers can simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to endow computers with intelligence; its applications span all areas of artificial intelligence. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and instructional learning.

[0025] With the research and advancement of artificial intelligence (AI) technology, AI is being studied and applied in various fields, such as smart homes, smart wearable devices, virtual assistants, smart speakers, smart marketing, autonomous driving, drones, robots, smart healthcare, smart customer service, vehicle networking, and intelligent transportation. It is believed that with the development of technology, AI will be applied in more fields and play an increasingly important role.

[0026] To facilitate understanding of the embodiments of this application, several concepts will be briefly introduced below.

[0027] Resources: The resources mentioned in this article include electronic assets that can be transferred between different entities or users via the network, including but not limited to funds and virtual currencies. Virtual currencies include currencies obtained through online top-ups, game coins, and game items, such as QQ coins, QQ points, and game currency, or in-game gold and silver coins. For example, in games, electronic assets can be exchanged for various equivalent game coins, virtual items, and services. Entities: The entities mentioned in this article refer to the machines and equipment used by institutions, organizations, or individuals for the purpose of providing certain services or goods or engaging in certain operational activities to transfer resources, including but not limited to the computers, servers, or mobile devices such as mobile phones of merchants and enterprises. Furthermore, in this article, entities suspected of engaging in black and gray industries are referred to as malicious entities. Clusters mentioned in this article refer to a collection of entities including multiple entities. Users mentioned in this article refer to the machines and equipment used by individuals (who do not possess the qualifications of merchants and enterprises) who transfer resources with the aforementioned institutions, organizations, or individuals, in relation to entities. Resource transfer media mentioned in this article refer to intermediaries that bridge the gap between users and entities to achieve resource transfer. Examples of resource transfer media include but are not limited to public accounts, mini-programs, and users. For example, if an entity is linked to a mini-program, and a user follows that mini-program, the entity can send a "red envelope" (a digital gift) to the user through the mini-program. The mini-program serves as an intermediary for transferring resources from the entity to the user. The abnormal cluster mentioned in this article refers to a collection of multiple entities that include a certain number or proportion of malicious entities and are determined to be punished.

[0028] Figure 1 The illustration depicts an example implementation environment of a method for identifying anomalous clusters according to some embodiments of this application. For example... Figure 1 As shown, various types of management terminals communicate with servers via a network. Examples of management terminals include, but are not limited to, mobile phones, desktop computers, tablets, laptops, and PDAs. Servers can be, for example, independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks, and big data and artificial intelligence platforms. Management terminals can obtain resource transfer data from multiple entities from the server and, based on this data, divide these entities into clusters, thus obtaining multiple clusters to be identified. Management terminals can also extract cluster characteristics of the clusters to be identified based on the entity information of each entity in the multiple clusters to be identified, and determine abnormal clusters based on these characteristics. In other words, after obtaining resource transfer data from the server, the process of determining abnormal clusters can be completed by the management terminal, which automatically outputs relevant information about the abnormal clusters. Alternatively, the process of determining abnormal clusters can also be completed on the server, with the server sending the identified abnormal clusters to the management terminal. Or, the server and management terminal can collaborate to complete the process of determining abnormal clusters. For example, a server can obtain multiple clusters to be identified based on resource transfer data from multiple entities, and a management terminal can receive the multiple clusters to be identified from the server and output abnormal clusters based on these clusters.

[0029] Figure 2 A flowchart illustrating a method for identifying anomalous clusters according to some embodiments of this application is shown schematically. As previously described, this method can be performed, for example, by any terminal device in a cluster of terminal devices (e.g., Figure 1 The method can be executed by a tablet or mobile phone, a server, or a combination of both. For simplicity, the embodiments of this application will be described in detail below using the method for identifying abnormal clusters executed by a management terminal device as an example.

[0030] like Figure 2As shown, the method for identifying abnormal clusters provided in the embodiments of this application includes: step S210, acquiring resource transfer data of multiple entities, the resource transfer data including resource receiving data, resource expenditure data, and resource transfer medium for each of the multiple entities; step S220, defining edges between different nodes based on the association relationship between the multiple entities as nodes, and establishing a target cluster network based on the nodes and the edges between the nodes, thereby obtaining the multiple clusters to be identified, each cluster to be identified including at least one entity of the multiple entities, the association relationship including the common resource transfer medium involved by the different nodes in the resource transfer process; step S230, extracting cluster features of the clusters to be identified based on the entity information of each entity in each cluster to be identified; step S240, identifying abnormal clusters from the multiple clusters to be identified based on the cluster features of each cluster to be identified.

[0031] In step S210, the management terminal can obtain resource transfer data from multiple entities from the server. Examples of resource transfer data include, for instance, the fund receipt and expenditure status of each entity within a certain time period. Fund receipt includes funds received by the entity through normal business transactions, while fund expenditure includes fund outflows from the entity without business transactions, such as the entity sending "red envelopes," transferring money, or paying "small change" to users without any transactions. Resource transfer data also includes resource transfer media, such as various mini-programs, public accounts, etc., through which the entity completes the aforementioned fund receipt or expenditure. Resource transfer media may also include users; for example, the entity may complete fund receipt or expenditure through users. Figure 3 The illustration depicts an example of a subject transferring resources through a resource transfer medium. Figure 3 In the example, Merchant S receives funds from users through the mini-program APPID-0000; that is, users make payments to Merchant S through business transactions. Merchant S is linked to another mini-program APPID-99999 and uses APPID-99999 to make payments to one or more other users (Banker C or Player D) without any actual transactions. For example, Merchant S sends "red envelopes" or pays "small change" to the aforementioned users. Figure 3The fund receipt and expenditure information of Merchant S shown generally conforms to the fund transfer patterns of the black and gray industries, making it highly likely that Merchant S is identified as a malicious entity. Mini Program APPID-0000 and Mini Program APPID-99999 are typical examples of resource transfer media. The management terminal can periodically start and run the method for identifying abnormal clusters as needed, periodically obtaining resource transfer data of multiple entities from the server, and outputting the identified abnormal clusters at predetermined intervals. In step S220, edges between nodes can be defined based on the resource transfer data of multiple entities obtained from the server, and a target cluster network can be established based on the nodes and edges. This allows for the clustering of the multiple entities to obtain multiple clusters to be identified, each of which can be considered a set of entities. Each entity among the multiple entities can be considered a node, and edges between different nodes can be defined based on the relationships between them, including the shared resource transfer media involved in the resource transfer process. When dividing the multiple entities into clusters, the correlation between them can be distinguished based on resource transfer data. Ideally, the entities in each cluster to be identified should have a strong correlation, while the entities in different clusters should have a low or even no correlation. The entity information of each entity can be stored in a management terminal, server, or other device with storage capabilities. The entity information can be any information related to the entity's registration and operation, including but not limited to entity registration information, entity transaction scenarios, and entity penalty records. In step S230, the data related to the entity information can be processed to obtain cluster features corresponding to each cluster to be identified. In step S240, abnormal clusters can be automatically identified based on cluster features using artificial intelligence and machine learning algorithms.

[0032] Furthermore, resource transfer media include direct and indirect linkages. Direct linkages refer to intermediaries with which an entity has a direct binding relationship. For example, if an entity is linked to a mini-program or official account, that mini-program or official account is a direct linkage; this type of direct linkage is also called non-cross-account linkage. Indirect linkages refer to intermediaries where the entity is not bound to the entity, but users achieve resource transfers with the entity through guided information within the mini-program or official account. For example, if a user is directed to the entity's account by clicking a link in an official account and transfers funds to the entity, without the user needing to follow or link to that official account, that official account is an indirect linkage; this type of indirect linkage can also be called cross-account linkage. Figure 3The diagram also illustrates how different users transfer resources to an entity through direct and indirect intermediaries. For example, User A directly makes a payment to the entity via the mini-program APPID-00000 linked to the entity, while User B is directed to the merchant's mini-program APPID-00000 through information from another public account. The public account that directed User B to the mini-program APPID-00000 is the indirect intermediary. Including both direct and indirect intermediaries in the resource transfer data enhances the coverage of the collected data and reduces the probability of malicious entities being missed.

[0033] As can be seen from the above steps, the method for identifying abnormal clusters proposed in this application not only focuses on the resource receiving data of the subject (e.g., information on funds collected by the subject from users), but also comprehensively considers the resource expenditure data of the subject (e.g., information on funds paid by the subject to users) and the resource transfer medium. Therefore, the method for identifying abnormal clusters provided in this application can not only identify multiple malicious subjects in a group in an abnormal cluster manner, thereby improving the efficiency of identifying malicious subjects, but also improve the accuracy and comprehensiveness of identifying malicious subjects.

[0034] The following section provides a more detailed explanation of methods for identifying anomalous clusters through more specific examples.

[0035] As mentioned earlier, for multiple clusters to be identified obtained through cluster partitioning, the desired outcome is low correlation between entities within different clusters, but high correlation between entities within each cluster. Therefore, according to some embodiments of this application, a community detection algorithm is used to partition the multiple entities into clusters to obtain the multiple clusters to be identified. As mentioned earlier, each entity within the multiple entities can be considered a node, and edges between different nodes can be defined based on the correlation relationships between them. These correlation relationships include the different nodes sharing a common resource transfer medium during resource transfer. The community detection algorithm is then used to establish a target cluster network based on the nodes and the edges between them, thereby obtaining the multiple clusters to be identified. In other words, according to embodiments of this application, if two entities share a common resource transfer medium during resource transfer, an "edge" is established between these two entities.

[0036] Figure 4 An example illustrating three entities with an "edge" relationship is shown. Figure 4As shown, Subject 1, Subject 2, and Subject 3 are all bound to a certain WeChat Official Account, or some subjects (e.g., Subject 2 and Subject 3) are linked to this Official Account across accounts. The "cross-account association" mentioned in this article refers to a subject or user not being bound to this Official Account or other media, but transferring resources to another subject or user through relevant information (e.g., links) in this Official Account or other media. In this case, it can also be understood that the subject indirectly completed the resource transfer through this Official Account or other media. Figure 4 In the example, if Subject 1, Subject 2, and Subject 3 all completed resource transfer (e.g., fund transfer) through a common public account, then there is an "edge" relationship between each of these three subjects. According to embodiments of this application, defining the "edge" between different subjects does not restrict the resource flow direction of resource transfers achieved by each subject through a resource transfer medium (e.g., a common public account, mini-program, or user). For example, in... Figure 4 In the example, Entity 1 can be the paying merchant, meaning Entity 1 pays funds through a shared public account; Entity 2 can be the receiving merchant, meaning Entity 2 receives funds through the same public account; and Entity 3 both receives and collects funds through the same public account. Thus, by utilizing a shared resource transfer medium, the resource inflow and outflow information of the entities is connected, enabling the discovery of a more complete cluster network and laying the foundation for accurate and comprehensive identification of abnormal clusters.

[0037] Figure 5 The illustration shows another example of two entities that have an "edge" relationship. For example... Figure 5 As shown, if both Entity A and Entity B receive funds through the mini-program APPID-000, or both Entity A and Entity B make expenditures through the mini-program APPID-111 (e.g., sending "corporate cash" or "red envelopes" through the mini-program), then an "edge" is defined between Entity A and Entity B. In short, as long as two entities involve a common resource transfer medium during resource transfer, an "edge" is defined between these two nodes. Based on this, the community detection algorithm builds a target cluster network based on the edges between different nodes, greatly improving the completeness and accuracy of the obtained clusters to be identified.

[0038] It is understood that the resource transfer medium involved in the resource receiving process can be referred to as the resource receiving medium, and the resource transfer medium involved in the resource expenditure process can be referred to as the resource expenditure medium. According to some embodiments of this application, defining the edges between different nodes based on the association between each node includes removing resource receiving mediums with a credibility higher than the credibility threshold from the resource receiving mediums. Resource receiving mediums with higher credibility can be determined based on practical experience. In some embodiments, mediums that are widely used in daily payment collection can be set as resource receiving mediums with higher credibility. For example, many entities are bound to "WeChat Payment Assistant" to receive funds from users, or many users pay entities through some widely used platform-type resource transfer mediums (e.g., Meituan, etc.). Such widely used resource receiving mediums can be set as resource receiving mediums with a credibility higher than the credibility threshold. On the one hand, the fact that different entities are associated with such resource receiving mediums with higher credibility makes it difficult to indicate that there is a resource transfer between all these entities. On the other hand, removing resource receiving mediums with a credibility higher than the credibility threshold can reduce the complexity of the target cluster network and the cost of building the target cluster network.

[0039] Weights can be defined for the edges between previously defined nodes to reflect the strength of the correlation between different nodes. According to some embodiments of this application, building a target cluster network using the community detection algorithm based on the nodes and the edges between them includes: defining the weights of the edges based on the number of common resource transfer media involved in the resource transfer process between the different nodes; and building the target cluster network using the community detection algorithm based on the nodes, the edges, and the weights. In some embodiments, the more common resource transfer media involved in the resource transfer process between two nodes, the greater the weight between the two nodes. Assigning weights to the defined edges can more accurately reflect the tightness of the correlation between different nodes, which is beneficial to improving the accuracy of cluster partitioning in the constructed target cluster network.

[0040] According to some embodiments of this application, defining the edge weight based on the number of common resource transfer media involved in the resource transfer process of the different nodes includes: defining the weight as w = N1*cf1 + N2*cf2, where w represents the weight of the edge between two different nodes, N1 represents the number of common resource transfer media involved in the resource reception process of the two different nodes, N2 represents the number of common resource transfer media involved in the resource expenditure process of the two different nodes, and cf2 and cf1 are both coefficients, with cf2 being greater than cf1. In practice, during the resource expenditure (e.g., payment of funds) process of entities suspected of engaging in black and gray industries, users receiving resources often need to associate with the resource transfer media bound to the entity that disbursed the resources. For example, users are required to also follow or bind the resource transfer media bound to the entity that disbursed the resources. Therefore, compared to the resource reception media associated with the entity receiving resources during the resource reception process through normal commercial transactions, the correlation between the entity disbursing resources and the resource expenditure media during the resource expenditure process can be considered higher, and the correlation between entities associated with the common resource expenditure media is also stronger. Accordingly, by defining the weight of the edge based on the number of common resource transfer media involved in the resource transfer process of the different nodes, the resource receiving process and the resource spending process are distinguished, and the coefficient cf2 is given a larger value. This can further reasonably distinguish the strength of the correlation between different nodes, which is beneficial to optimizing the target cluster network.

[0041] In some embodiments, establishing the target cluster network based on the nodes, edges, and weights using the community detection algorithm includes the following steps: a. Establishing an initial cluster network based on each node to divide the plurality of subjects into multiple initial clusters, and calculating the initial modularity of the initial cluster network; b. Performing node allocation to form an updated cluster network by assigning each node to the initial clusters containing adjacent nodes, such that the updated modularity of the updated cluster network is greater than the initial modularity; c. Repeating step b above, using the updated cluster network as the initial cluster network, until the updated modularity of the obtained updated cluster network no longer increases, thereby obtaining the target cluster network. Each initial cluster in the initial cluster network may consist of only a single node, in which case each node constitutes an initial cluster; alternatively, the initial cluster may also consist of multiple nodes. The process of obtaining the target cluster network is essentially the process of maximizing the value of modularity. Alternatively, according to another embodiment of this application, establishing the target cluster network based on the nodes, edges, and weights using the community detection algorithm includes: a. establishing an initial cluster network based on each node to divide the plurality of subjects into multiple initial clusters, and calculating the initial modularity of the initial cluster network; b. performing node allocation to form an updated cluster network by assigning each node to the initial cluster where the adjacent nodes are located, such that the updated modularity of the updated cluster network is greater than the initial modularity; c. repeating step b above, using the updated cluster network as the initial cluster network, until the updated modularity of the obtained updated cluster network no longer increases, thereby obtaining a desired updated cluster network, the desired updated cluster network including updated clusters; d. constructing an intermediate cluster network by using each updated cluster in the desired updated cluster network as an updated node, and performing step b above, and step c above, on the node allocation to form an updated cluster network and obtaining the desired updated cluster network, based on the intermediate cluster network, until the intermediate cluster network no longer changes, thereby obtaining the target cluster network. Compared to the previous embodiment, this embodiment adds the cluster aggregation process embodied in step d, which is very meaningful when there are a large number of nodes, as it can simplify the structure of the target cluster network and improve the efficiency of cluster partitioning.

[0042] Next, we will explain in detail the process of building the target cluster network through a specific example.

[0043] The community detection algorithms mentioned above for establishing target cluster networks exist in various forms, such as the Label Propagation Algorithm (LPA) and the Fast Unfolding algorithm. The following section uses the Fast Unfolding algorithm as an example to detail the process of constructing a target cluster network to obtain the aforementioned clusters to be identified. The target cluster network established by the Fast Unfolding algorithm consists of multiple clusters to be identified. Nodes within each cluster are closely connected and have a higher correlation, while nodes between different clusters are sparsely connected and have a lower correlation. The Fast Unfolding algorithm uses modularity to measure the tightness or correlation of these connections. Modularity is a metric for evaluating the quality of cluster partitioning; a higher modularity value indicates a better result in partitioning the multiple entities into clusters, meaning that nodes within each cluster are closely connected, while nodes between different clusters are sparsely connected.

[0044] Modularity can be represented by Q and is defined as follows: in, This represents the weight between node i and node j. , K i and K j Let i and j represent the sum of the weights of node i and all its associated edges, and j and j represent the sum of the weights of node i and all its associated edges, respectively. It represents the sum of all weights and serves as a normalization function; This represents a function that returns 1 if node i and node j are in the same cluster, and 0 otherwise.

[0045] The above formula for calculating modularity can be simplified to the following form: in This represents the sum of weights within cluster c. This represents the sum of weights of nodes connected to nodes within cluster c, including both internal and external nodes. It can be seen that the basic idea behind the modularity formula for Q is the sum of the weights of edges between nodes within a cluster minus the sum of the weights of edges between nodes in different clusters. In an idealized, hypothetical situation, if a cluster is completely closed and there are no connections between clusters, then the modularity value is 1.

[0046] Therefore, the community detection algorithm based on modularity will use the maximum modularity Q as the objective function to continuously iterate and construct a cluster network structure that is dense within the cluster and sparsely connected between clusters.

[0047] As previously mentioned, in some embodiments, establishing the target cluster network using the community detection algorithm based on the nodes, edges, and weights includes the processes of establishing an initial cluster network and updating the cluster network. For the initial cluster network, each node can be considered an independent cluster. Therefore, according to some embodiments of this application, the number of nodes in the initial cluster network is the same as the number of initial clusters, and the initial modularity of the initial cluster network can be calculated based on the aforementioned modularity formula. Then, each node is assigned to the initial cluster containing its adjacent nodes to form an updated cluster network, such that the updated modularity of the updated cluster network is greater than the initial modularity. For example, the updated modularity of the updated cluster network can be calculated, and the difference between the updated modularity and the initial modularity can be calculated to obtain the change in modularity before and after node allocation. As previously mentioned, the target cluster network obtained by cluster partitioning based on the community detection algorithm uses maximizing the modularity Q as the objective function. Therefore, if the aforementioned change in modularity is positive, i.e., the updated modularity is greater than the initial modularity, the updated cluster network is accepted and retained; otherwise, the updated cluster network is discarded. Next, using the retained updated cluster network as the initial cluster network, the process of forming an updated cluster network through node allocation is repeated until the update modularity of the obtained updated cluster network no longer increases, thereby obtaining the desired updated cluster network, which includes the updated clusters. The above process of obtaining the desired updated cluster network can be called the modularity optimization process.

[0048] Figure 6 An example of the modularity optimization process is illustrated schematically. For example... Figure 6 As shown, the initial cluster network includes 16 nodes numbered 0 to 15. After modularity optimization, the desired update cluster network consists of four clusters: a cluster composed of nodes 0, 1, 2, 4, and 5; a cluster composed of nodes 3, 6, and 7; a cluster composed of nodes 11 and 13; and a cluster composed of nodes 8, 9, 10, 12, 14, and 15. That is, the 16 nodes numbered 0 to 15 are divided into the above four clusters, which are the desired update clusters. When the total number of nodes is small or the cluster partitioning accuracy requirement is high, the above desired update cluster network can be used as the target cluster network, and the above desired update clusters are the clusters to be identified.

[0049] According to other embodiments of this application, based on the obtained desired update cluster network, an intermediate cluster network can be constructed by treating each desired update cluster in the desired update cluster network as an update node. That is, nodes belonging to the same desired update cluster are aggregated into one update node to form an intermediate cluster network. The aforementioned modularity optimization process is then performed based on this intermediate cluster network until the intermediate cluster network no longer changes, thereby obtaining the target cluster network. Aggregating each node in each desired update cluster into one update node can be called cluster aggregation, such as... Figure 6 As shown, the four previously obtained desired update clusters are aggregated into four update nodes, namely update nodes 2, 4, 14, and 16 (each update node is still actually a cluster containing at least one node), forming an intermediate cluster network. Based on this intermediate cluster network, the above-described modularity optimization process is repeated to obtain the target cluster network. Figure 6 In the example, the target cluster network includes two clusters, numbered 24 and 26 respectively. In this embodiment, cluster aggregation simplifies the structure of the formed target cluster network. The embodiments of this application do not limit the number of times the above-described cluster aggregation is performed; cluster aggregation can be performed any number of times depending on the desired target cluster network.

[0050] As described above, according to embodiments of this application, the subject information includes at least one of subject registration information, subject transaction scenarios, and subject penalty records. For multiple pre-defined clusters to be identified, cluster features can be extracted based on the subject information of each subject within the cluster to be identified to depict the cluster. In some embodiments, extracting cluster features of the cluster to be identified based on the subject information of each subject in each of the multiple clusters to be identified includes calculating the proportion of labeled subjects in the cluster to be identified. The calculated proportion of labeled subjects can at least be used as part of the cluster features. Here, the proportion of labeled subjects includes at least one of penalized subject proportion, suspicious subject proportion, suspicious transaction scenario proportion, and suspicious registration information proportion. The penalized subject proportion refers to the ratio of the number of subjects in the cluster to be identified that have been penalized to the total number of subjects in the cluster to be identified. The suspicious subject proportion refers to the ratio of the number of subjects in the cluster to be identified that have a suspiciousness level higher than a suspiciousness threshold to the total number of subjects in the cluster to be identified. The suspicious transaction scenario proportion refers to the ratio of the number of subjects in the cluster to be identified that are involved in suspicious transaction scenarios to the total number of subjects in the cluster to be identified. The suspicious registration information proportion refers to the ratio of the number of subjects in the cluster to be identified that have suspicious registration information to the total number of subjects in the cluster to be identified. The "suspiciousness" mentioned in this article refers to the degree of likelihood that an entity is involved in the black and gray industries, determined based on expert experience and rules. Entities identified as highly suspicious by human intervention can be promptly flagged. Alternatively, machine learning algorithms can be used to pre-determine the suspiciousness of each entity. Suspicious transaction scenarios and suspicious registration information refer to transaction scenarios and registration information that, based on expert experience and rules, are determined to indicate that an entity is suspected of engaging in black and gray industries. In other words, if, based on relevant experience and rules, the entity's registration information suggests a high probability of malicious activity, then that registration information is designated as suspicious.

[0051] Based on the cluster features of the clusters to be identified, abnormal clusters can be intelligently identified from the plurality of clusters to be identified through machine learning. According to some embodiments of this application, identifying abnormal clusters from the plurality of clusters to be identified based on the cluster features of each cluster to be identified includes: providing the cluster features to a cluster attribute prediction model, which determines the abnormal clusters from the plurality of clusters to be identified based on the cluster features. The cluster attribute prediction model is trained on a training sample set, which includes training sample clusters, each with a sample cluster label. Embodiments of this application do not limit the specific form of the cluster attribute prediction model; the cluster attribute prediction model can be a model built based on any suitable classification algorithm or neural network algorithm. Examples of cluster attribute prediction models include, but are not limited to, XGBoost networks, Long Short-Term Memory (LSTM) networks, Gated Recurrent Units (GRUs), Time Delay Neural Networks (TDNNs), Convolutional Neural Networks (CNNs), etc. Based on the cluster features of each cluster to be identified, each cluster to be identified can be vectorized. The aforementioned percentage of labeled entities, including the percentage of penalized entities, the percentage of suspicious entities, the percentage of suspicious transaction scenarios, and the percentage of suspicious registration information, is merely an example of cluster features. Based on the entity information of each entity in each cluster to be identified, n cluster features can be extracted. In this case, each cluster to be identified can also be vectorized into an n-dimensional vector.

[0052] Since the cluster attribute prediction model is trained based on the training sample set, it can output an evaluation value indicating whether the cluster to be identified is an abnormal cluster based on the cluster characteristics of each cluster to be identified, and identify the cluster to be identified with an evaluation value higher than the evaluation threshold as an abnormal cluster.

[0053] The above example illustrates how community detection algorithms can be used to partition entities into clusters, and how machine learning can be employed to identify anomalous clusters based on these partitioning results. The main process of identifying anomalous clusters as demonstrated in this example can be summarized as follows: Figure 7 .like Figure 7As shown, the management terminal can acquire resource transfer data from multiple entities within a certain time period, such as the expenditure and receipt information of each entity. The resource transfer data includes the resource receipt data, expenditure data, and transfer medium of each entity. Based on this data, the nodes, edges, and weights required for cluster partitioning using a community detection algorithm can be defined. After receiving the node, edge, and weight information using the community detection algorithm, a target cluster network can be constructed to partition the multiple entities, thereby obtaining multiple clusters to be identified. For each cluster to be identified, n cluster features can be obtained by processing the entity information of each entity within that cluster, thus representing each cluster as an n-dimensional vector. Providing these vectorized clusters to a previously trained cluster attribute prediction model automatically yields evaluation information determining whether a cluster is an anomalous cluster. Therefore, a highly efficient method for identifying anomalous clusters from multiple entities is achieved, significantly improving the accuracy and comprehensiveness of anomalous cluster identification.

[0054] According to some embodiments of this application, such as Figure 8As shown, the training sample set for training the above-mentioned cluster attribute prediction model can be obtained through the following steps: S810, using a community detection algorithm to obtain multiple sample clusters based on multiple sample subjects; S820, determining multiple first clusters from the sample clusters, wherein the proportion of a first identifier subject in each of the multiple first clusters is greater than or equal to a first proportion threshold, and the proportion of a second identifier subject in each of the multiple first clusters is greater than or equal to a second proportion threshold, wherein the proportion of the first identifier subject is selected from one of the proportion of penalized subjects, the proportion of suspicious subjects, the proportion of suspicious transaction scenarios, and the proportion of suspicious registration information, and the proportion of the second identifier subject is selected from the other of the proportion of penalized subjects, the proportion of suspicious subjects, the proportion of suspicious transaction scenarios, and the proportion of suspicious registration information; S830, assigning positive sample cluster labels to the multiple first clusters, assigning negative sample cluster labels to the remaining sample clusters in the sample clusters, and using the multiple sample clusters including the positive sample cluster labels and the negative sample cluster labels as the training sample clusters. In step S810, multiple sample clusters can be obtained by using the above-mentioned community detection algorithm to divide multiple sample subjects into clusters. The sample entities can carry rich thematic information, such as entity registration information, entity transaction scenarios, and entity penalty records. Through a community detection algorithm, each sample entity is divided into different sample clusters. In step S820, abnormal clusters and normal clusters can be determined from the sample clusters through manual judgment. For example, a first cluster is selected from the sample clusters where the proportion of entities with a first identifier is greater than or equal to a first threshold, and the proportion of entities with a second identifier is greater than or equal to a second threshold. The proportion of entities with a first identifier is selected from one of the proportion of penalized entities, the proportion of suspicious entities, the proportion of suspicious transaction scenarios, and the proportion of suspicious registration information; the proportion of entities with a second identifier is selected from the other of the proportion of penalized entities, the proportion of suspicious entities, the proportion of suspicious transaction scenarios, and the proportion of suspicious registration information. In one example, sample clusters with a proportion of penalized entities exceeding 50% can be selected. Then, entities within these sample clusters that have not been penalized are manually identified and labeled. For example, it can be determined whether these unpenalized entities belong to suspicious entities, and the proportion of suspicious entities in the sample cluster can be calculated. If the proportion of suspicious entities exceeds 90%, the sample cluster is determined as the first cluster. In step S830, after filtering out all the first clusters from the sample clusters, these first clusters are assigned positive sample cluster labels (i.e., abnormal cluster labels), and the remaining sample clusters in the sample clusters are assigned negative sample cluster labels (i.e., normal cluster labels). Thus, the manual identification of the sample clusters is completed, and the multiple sample clusters including the positive sample cluster labels and the negative sample cluster labels are used as the training sample set.Similarly, cluster features can be extracted from each training sample cluster in the training sample set, making the training sample clusters vectorized. This vectorized training sample set can then be input into the cluster attribute prediction model for training. The trained cluster attribute prediction model can output an evaluation value reflecting the probability that each cluster to be identified is an anomalous cluster based on the newly obtained cluster features. An appropriate evaluation threshold can be selected based on practical considerations, and clusters with evaluation values ​​higher than the threshold can be identified as anomalous clusters.

[0055] According to some embodiments of this application, some entities that are obviously not malicious entities can be removed from the plurality of entities, thereby reducing noise in the node data, reducing the workload involved in running the method for identifying abnormal clusters, and reducing the consumption required for the management terminal to identify abnormal clusters.

[0056] As can be seen from the embodiments of the method for identifying abnormal clusters described above, the multiple clusters to be identified obtained by using the community detection algorithm for cluster partitioning are based on resource transfer data, including resource receiving data, resource spending data, and resource transfer mediums. Accordingly, in the process of using the community detection algorithm for cluster partitioning, both the edges defined based on the subject receiving resources (e.g., receiving payments) and the edges defined based on the subject spending resources (e.g., paying payments) are utilized, thereby enabling the discovery of more complete clusters and achieving more accurate and comprehensive identification of abnormal clusters.

[0057] As a contrasting example, Figure 9 The illustration depicts a scenario where malicious actors are identified solely based on information about the entity receiving funds. For example... Figure 9 As shown, for a group of merchants A, B, C and D that only receive funds, cluster 1 can be mined based on the common fund transfer mediums APPID1, APPID2 and APPID3. As long as some of the entities are identified as malicious entities, the other entities in cluster 1 can also be identified as malicious entities. Figure 10 Another cluster, 2, is shown where only fund expenditures occurred. Cluster 2 can be mined based on the common fund transfer mediums APPID3 and APPID4. However, without the technical solution for identifying abnormal clusters provided in this application, cluster 2 would be identified as a different cluster from cluster 1. Moreover, the entities in cluster 2 only made fund payments and did not receive funds through transactions. Whether most entities are malicious entities is unknown, making it difficult to determine the attributes of the entire cluster 2. Figure 11As shown, if the fund transfer mediums involved in cluster 1 and cluster 2 overlap, for example, if they share a common fund transfer medium APPID3, then the method for identifying abnormal clusters provided in this application embodiment can identify cluster 1 and cluster 2 as a complete cluster 3. This can effectively identify malicious entities in cluster 2 and reduce the risk of entities that have not made any transactions but have only made resource expenditures being suspected of being involved in black and gray industries and thus being overlooked.

[0058] According to another aspect of this application, an apparatus for identifying abnormal clusters is provided, such as... Figure 12 As shown, the device 1000 includes: a resource transfer data acquisition module 1000a, configured to acquire resource transfer data of multiple entities, the resource transfer data including resource receiving data, resource expenditure data, and resource transfer medium of each of the multiple entities; a cluster partitioning module 1000b, configured to partition the multiple entities into multiple clusters to be identified based on the resource transfer data, each cluster to be identified including at least one of the multiple entities; a cluster feature extraction module 1000c, configured to extract cluster features of the clusters to be identified based on the entity information of each entity in each of the multiple clusters to be identified; and a cluster attribute evaluation module 1000d, configured to identify abnormal clusters from the multiple clusters to be identified based on the cluster features of each of the multiple clusters to be identified.

[0059] Another aspect of this application provides a computing device, including: a memory configured to store computer-executable instructions; and a processor configured to perform the method for identifying anomalous clusters as described in the foregoing embodiments when the computer-executable instructions are executed by the processor.

[0060] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as a computer program. For example, embodiments of this disclosure provide a computer program product including a computer program carried on a computer-readable medium, the computer program containing program code for performing at least one step in the method embodiments of this disclosure.

[0061] In some embodiments of this disclosure, one or more computer-readable storage media are provided, having stored thereon computer-readable instructions that, when executed, implement a method for identifying anomalous clusters according to embodiments of this disclosure. The various steps of the method for identifying anomalous clusters according to embodiments of this disclosure can be programmed into computer-readable instructions and stored in the computer-readable storage medium. When such a computer-readable storage medium is read or accessed by a computing device or computer, the computer-readable instructions therein are executed by a processor on the computing device or computer to implement the method for identifying anomalous clusters according to embodiments of this disclosure.

[0062] Figure 13 An example system 1100 is illustrated, which includes an example computing device 1110 representing one or more systems and / or devices that can implement the technical solutions described in the various embodiments herein. The computing device 1110 may be, for example, a server of a service provider, a device associated with a server, a system-on-a-chip, and / or any other suitable computing device or computing system. References above... Figure 12 The described apparatus 1000 for identifying anomalous clusters can take the form of a computing device 1110. Alternatively, the apparatus 1000 for identifying anomalous clusters can be implemented as a computer program as an application 1116.

[0063] The example computing device 1110, as illustrated in Figure 13, includes a processing system 1111 communicatively coupled to each other, one or more computer-readable media 1112, and one or more I / O interfaces 1113. Although not shown, the computing device 1110 may also include a system bus or other data and command transfer system that couples the various components to each other. The system bus may include any or a combination of different bus architectures, such as a memory bus or memory controller, a peripheral bus, a universal serial bus, and / or a processor or local bus utilizing any of the various bus architectures. Various other examples, such as control and data lines, are also conceived.

[0064] Processing system 1111 represents the functionality of performing one or more operations using hardware. Therefore, processing system 1111 is illustrated as including hardware elements 1114 that can be configured as processors, function blocks, etc. This may include application-specific integrated circuits (ASICs) or other logic devices formed using one or more semiconductors in the hardware. Hardware element 1114 is not limited by the materials in which it is formed or the processing mechanism employed therein. For example, a processor may consist of semiconductors and / or transistors (e.g., integrated circuits (ICs)). In such a context, processor-executable instructions may be electronically executable instructions.

[0065] Computer-readable medium 1112 is illustrated as including memory / storage device 1115. Memory / storage device 1115 represents a memory / storage capacity associated with one or more computer-readable media. Memory / storage device 1115 may include volatile media (such as random access memory (RAM)) and / or non-volatile media (such as read-only memory (ROM), flash memory, optical disk, magnetic disk, etc.). Memory / storage device 1115 may include fixed media (e.g., RAM, ROM, fixed hard disk drive, etc.) and removable media (e.g., flash memory, removable hard disk drive, optical disk, etc.). Computer-readable medium 1112 may be configured in various other ways as further described below.

[0066] One or more I / O interfaces 1113 represent functions that allow users to input commands and information to computing device 1110 using various input devices and optionally also allow information to be presented to the user and / or other components or devices using various output devices. Examples of input devices include keyboards, cursor control devices (e.g., mice), microphones (e.g., for voice input), scanners, touch functionality (e.g., capacitive or other sensors configured to detect physical touch), cameras (e.g., capable of detecting non-touch-related motion as gestures using visible or invisible wavelengths (such as infrared frequencies), etc. Examples of output devices include display devices (e.g., monitors or projectors), speakers, printers, network interface cards, haptic-responsive devices, etc. Therefore, computing device 1110 can be configured to support user interaction in various ways as further described below.

[0067] The computing device 1110 also includes an application 1116. The application 1116 may, for example, refer to... Figure 12 The software instance of the device 1000 for identifying anomalous clusters is described, and the techniques described herein are implemented in combination with other components in the computing device 1110.

[0068] This document describes various technologies within the general context of software and hardware components or program modules. Generally, these modules include routines, programs, objects, elements, components, data structures, etc., that perform specific tasks or implement specific abstract data types. As used herein, the terms "module," "function," and "component" generally refer to software, firmware, hardware, or a combination thereof. The technologies described herein are platform-independent, meaning they can be implemented on a variety of computing platforms with various processors.

[0069] Implementations of the described modules and technologies may be stored on or transmitted across some form of computer-readable medium. The computer-readable medium may include a variety of media accessible by the computing device 1110. By way of example and not limitation, the computer-readable medium may include "computer-readable storage media" and "computer-readable signal media".

[0070] In contrast to simple signal transmission, carrier waves, or signals themselves, a "computer-readable storage medium" refers to a medium and / or device capable of persistently storing information, and / or a tangible storage device. Therefore, a computer-readable storage medium refers to a non-signal-bearing medium. Computer-readable storage media include hardware such as volatile and non-volatile, removable and non-removable media and / or storage devices implemented using methods or techniques suitable for storing information (such as computer-readable instructions, data structures, program modules, logic elements / circuits, or other data). Examples of computer-readable storage media may include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical storage devices, hard disks, cassette tapes, magnetic tapes, disk storage devices or other magnetic storage devices, or other storage devices, tangible media, or articles of art suitable for storing desired information and accessible by a computer.

[0071] "Computer-readable signal medium" refers to a signal-bearing medium configured to transmit instructions, such as via a network, to computing device 1110. A signal medium typically embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave, data signal, or other transmission mechanism. Signal media also include any information transmission medium. The term "modulated data signal" refers to a signal in which one or more of its characteristics are set or altered to encode information. By way of example and not limitation, communication media include wired media such as wired networks or direct connections, and wireless media such as acoustic, RF, infrared, and other wireless media.

[0072] As previously described, hardware element 1114 and computer-readable medium 1112 represent instructions, modules, programmable device logic, and / or fixed device logic implemented in hardware, which in some embodiments can be used to implement at least some aspects of the techniques described herein. Hardware elements may include components of integrated circuits or systems-on-a-chip, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), complex programmable logic devices (CPLDs), and other implementations or other hardware devices in silicon. In this context, hardware elements can serve as processing devices for executing program tasks defined by instructions, modules, and / or logic embodied by the hardware element, and as hardware devices for storing instructions for execution, such as the previously described computer-readable storage medium.

[0073] The foregoing combinations can also be used to implement the various techniques and modules described herein. Therefore, software, hardware, or program modules and other program modules can be implemented as one or more instructions and / or logic embodied on some form of computer-readable storage medium and / or by one or more hardware elements 1114. The computing device 1110 can be configured to implement specific instructions and / or functions corresponding to the software and / or hardware modules. Thus, for example, by using the computer-readable storage medium and / or hardware elements 1114 of a processing system, modules can be implemented at least partially in hardware as modules executable as software by the computing device 1110. Instructions and / or functions can be executable / operable by one or more articles of art (e.g., one or more computing devices 1110 and / or processing systems 1111) to implement the techniques, modules, and examples described herein.

[0074] In various embodiments, the computing device 1110 can be configured in various ways. For example, the computing device 1110 can be implemented as a computer-type device, including personal computers, desktop computers, multi-screen computers, laptop computers, netbooks, etc. The computing device 1110 can also be implemented as a mobile device, including mobile devices such as mobile phones, portable music players, portable gaming devices, tablet computers, multi-screen computers, etc. The computing device 1110 can also be implemented as a television-type device, including devices with or connected to a generally large screen in a leisure viewing environment. These devices include televisions, set-top boxes, game consoles, etc.

[0075] The techniques described herein can be supported by these various configurations of computing device 1110, and are not limited to specific examples of the techniques described herein. Functionality can also be implemented, wholly or partially, on “cloud” 1120 using distributed systems, such as platform 1122 as described below.

[0076] Cloud 1120 includes and / or represents platform 1122 for resource 1124. Platform 1122 abstracts the underlying functionality of the hardware (e.g., servers) and software resources of cloud 1120. Resource 1124 may include other applications and / or data that can be used when performing computer processing on a server located remotely from computing device 1110. Resource 1124 may also include services provided via the Internet and / or via subscriber networks such as cellular or Wi-Fi networks.

[0077] Platform 1122 can abstract resources and functions to connect computing device 1110 to other computing devices. Platform 1122 can also be used to abstract resource hierarchy to provide a corresponding level of hierarchy for any encountered needs for resource 1124 implemented via platform 1122. Therefore, in interconnect device embodiments, the implementation of the functions described herein can be distributed throughout system 1100. For example, functions can be implemented partly on computing device 1110 and partly through platform 1122, which abstracts the functions of cloud 1120.

[0078] It should be understood that, for clarity, embodiments of this disclosure have been described with reference to different functional units. However, it will be apparent that, without departing from this disclosure, the functionality of each functional unit may be implemented in a single unit, in multiple units, or as part of other functional units. For example, functionality described as being performed by a single unit may be performed by multiple different units. Therefore, references to a particular functional unit are considered merely as references to the appropriate unit used to provide the described functionality, and not as indicating a strict logical or physical structure or organization. Thus, this disclosure may be implemented in a single unit, or may be physically and functionally distributed among different units and circuits.

[0079] It will be understood that although the terms first, second, third, etc., may be used herein to describe various devices, elements, components, or parts, these devices, elements, components, or parts should not be limited by these terms. These terms are used only to distinguish one device, element, component, or part from another device, element, component, or part.

[0080] Although this disclosure has been described in conjunction with some embodiments, it is not intended to be limited to the specific forms set forth herein. Rather, the scope of this disclosure is limited only by the appended claims. Additionally, although individual features may be included in different claims, these may be advantageously combined, and inclusion in different claims does not imply that such a combination of features is not feasible and / or advantageous. The order of features in the claims does not imply that the features must be in any particular order of their operation. Furthermore, in the claims, the word "comprising" does not exclude other elements, and the terms "a" or "an" do not exclude a plurality. Reference numerals in the claims are provided only by way of explicit example and should not be construed as limiting the scope of the claims in any way.

Claims

1. A method for identifying anomalous clusters, comprising: The system acquires resource transfer data from multiple entities. The resource transfer data includes resource receiving data, resource expenditure data, and resource transfer medium for each entity relative to the user. The resource transfer medium refers to the intermediary medium that enables resource transfer between the user and the entity. The resource transfer medium includes direct association mediums and indirect association mediums. Direct association mediums refer to intermediary mediums with which the entity has a direct binding relationship. Indirect association mediums refer to intermediary mediums with which the entity is not bound, but where the user achieves resource transfer with the entity through guidance information. Using each of the multiple entities as nodes, edges between different nodes are defined based on the association relationships between the nodes, and the weights of the edges are defined based on the formula w=N1*cf1+N2*cf2. A target cluster network is then established based on the nodes, the edges between the nodes, and the weights to obtain multiple clusters to be identified. Each cluster to be identified includes at least one of the multiple entities. The association relationship refers to the common resource transfer medium involved in the resource transfer process of the different nodes. In the formula, w represents the weight of the edge between two different nodes, N1 represents the number of common resource transfer mediums involved in the resource reception process of the two different nodes, N2 represents the number of common resource transfer mediums involved in the resource expenditure process of the two different nodes, and cf2 and cf1 are both coefficients, with cf2 being greater than cf1. For each of the plurality of clusters to be identified, the subject information of each subject in the cluster to be identified is extracted and the proportion of the labeled subjects in the cluster to be identified is calculated as a cluster feature based on the subject information. The subject information includes at least one of subject registration information, subject transaction scenario, and subject penalty record. The proportion of the labeled subjects includes at least one of the following: proportion of penalized subjects, proportion of suspicious subjects, proportion of suspicious transaction scenario, and proportion of suspicious registration information. Abnormal clusters are identified from the plurality of clusters to be identified based on the cluster characteristics of each cluster to be identified.

2. The method according to claim 1, wherein the resource transfer medium includes a resource receiving medium involved in the resource receiving process and a resource expenditure medium involved in the resource expenditure process. The edges between different nodes defined based on the relationships between the nodes include: Remove resource receiving media with a credibility level higher than the credibility threshold from the resource receiving media.

3. The method according to claim 1, wherein establishing the target cluster network based on the nodes, the edges between the nodes, and the weights comprises: The target cluster network is established using a community detection algorithm based on the nodes, edges, and weights.

4. The method according to claim 3, wherein establishing the target cluster network based on the nodes, the edges, and the weights using the community detection algorithm comprises: An initial cluster network is established based on each node to divide the multiple subjects into multiple initial clusters, and the initial modularity of the initial cluster network is calculated. Node allocation is performed by assigning each node to an initial cluster containing neighboring nodes to form an updated cluster network, such that the updated modularity of the updated cluster network is greater than the initial modularity; and The steps of node allocation described above to form an updated cluster network are repeated using the updated cluster network as the initial cluster network until the update modularity of the obtained updated cluster network no longer increases, thereby obtaining the target cluster network.

5. The method according to claim 3, wherein establishing the target cluster network based on the nodes, the edges, and the weights using the community detection algorithm comprises: An initial cluster network is established based on each node to divide the multiple subjects into multiple initial clusters, and the initial modularity of the initial cluster network is calculated. Node allocation is performed by assigning each node to the initial cluster containing the adjacent nodes to form an updated cluster network, such that the updated modularity of the updated cluster network is greater than the initial modularity; The steps of node allocation described above to form an updated cluster network are repeated using the updated cluster network as the initial cluster network until the update modularity of the obtained updated cluster network no longer increases, thereby obtaining the desired updated cluster network, which includes the updated cluster. as well as The target cluster network is obtained by constructing an intermediate cluster network by treating each update cluster in the desired update cluster network as an update node, and performing the above-described steps of node allocation to form an update cluster network and obtaining the desired update cluster network based on the intermediate cluster network until the intermediate cluster network no longer changes.

6. The method according to any one of claims 1-5, wherein the resource transfer medium includes at least one of a public account, a mini-program, or a user.

7. The method according to claim 1, wherein the proportion of punished entities refers to the ratio of the number of entities that have been punished in the cluster to be identified to the total number of entities in the cluster to be identified; the proportion of suspicious entities refers to the ratio of the number of entities in the cluster to be identified with a suspicion level higher than a suspicion level threshold to the total number of entities in the cluster to be identified; the proportion of suspicious transaction scenarios refers to the ratio of the number of entities in the cluster to be identified involved in suspicious transaction scenarios to the total number of entities in the cluster to be identified; and the proportion of suspicious registration information refers to the ratio of the number of entities in the cluster to be identified with suspicious registration information to the total number of entities in the cluster to be identified.

8. The method according to claim 7, wherein identifying abnormal clusters from the plurality of clusters to be identified based on the cluster features of each of the plurality of clusters to be identified comprises: The cluster features are provided to a cluster attribute prediction model, which then determines the abnormal cluster from the plurality of clusters to be identified based on the cluster features. The cluster attribute prediction model is trained based on a training sample set, which includes training sample clusters, each with a sample cluster label.

9. The method according to claim 8, wherein the cluster attribute prediction model determines the abnormal cluster from the plurality of clusters to be identified based on the cluster features, comprising: The cluster attribute prediction model outputs an evaluation value indicating whether each cluster to be identified is an abnormal cluster based on the cluster characteristics. Clusters whose evaluation values ​​are higher than the evaluation threshold are identified as abnormal clusters.

10. The method of claim 8, further comprising obtaining the training sample set by the following steps: Community detection algorithms are used to obtain multiple sample clusters based on multiple sample subjects; Multiple first clusters are determined from the sample clusters. The proportion of a first identifier subject in each of the multiple first clusters is greater than or equal to a first proportion threshold, and the proportion of a second identifier subject in each of the first clusters is greater than or equal to a second proportion threshold. The proportion of the first identifier subject is selected from one of the proportion of the penalized subject, the proportion of the suspicious subject, the proportion of the suspicious transaction scenario, and the proportion of the suspicious registration information. The proportion of the second identifier subject is selected from the other of the proportion of the penalized subject, the proportion of the suspicious subject, the proportion of the suspicious transaction scenario, and the proportion of the suspicious registration information. Assign positive sample cluster labels to the plurality of first clusters, and negative sample cluster labels to the remaining sample clusters in the sample clusters, and use the plurality of sample clusters including the positive sample cluster labels and the negative sample cluster labels as the training sample set.

11. An apparatus for identifying anomalous clusters, comprising: The resource transfer data acquisition module is configured to acquire resource transfer data from multiple entities. The resource transfer data includes resource receiving data, resource expenditure data, and resource transfer medium for each entity relative to the user. The resource transfer medium refers to the intermediary medium that enables resource transfer between the user and the entity. The resource transfer medium includes direct association mediums and indirect association mediums. Direct association mediums refer to intermediary mediums with which the entity has a direct binding relationship. Indirect association mediums refer to intermediary mediums with which the entity is not bound, but where the user achieves resource transfer with the entity through guidance information. The cluster partitioning module is configured to use each of the multiple entities as nodes, define edges between different nodes based on the association relationships between the nodes, define the weights of the edges based on the formula w=N1*cf1+N2*cf2, and establish a target cluster network based on the nodes, the edges between the nodes, and the weights, thereby obtaining multiple clusters to be identified. Each cluster to be identified includes at least one of the multiple entities. The association relationship refers to the common resource transfer medium involved in the resource transfer process of the different nodes. In the formula, w represents the weight of the edge between two different nodes, N1 represents the number of common resource transfer mediums involved in the resource reception process of the two different nodes, N2 represents the number of common resource transfer mediums involved in the resource expenditure process of the two different nodes, and cf2 and cf1 are both coefficients, with cf2 being greater than cf1. The cluster feature extraction module is configured to extract the subject information of each subject in each of the plurality of clusters to be identified and calculate the proportion of the labeled subjects of the cluster as a cluster feature based on the subject information. The subject information includes at least one of subject registration information, subject transaction scenario, and subject penalty record. The proportion of the labeled subjects includes at least one of the following: proportion of penalized subjects, proportion of suspicious subjects, proportion of suspicious transaction scenario, and proportion of suspicious registration information. The cluster attribute evaluation module is configured to identify abnormal clusters from the plurality of clusters to be identified based on the cluster characteristics of each cluster to be identified.

12. A computing device, comprising Memory, which is configured to store computer-executable instructions; A processor configured to perform the method as described in any one of claims 1-10 when the computer-executable instructions are executed by the processor.

13. A computer-readable storage medium storing computer-executable instructions that, when executed, perform the method as described in any one of claims 1-10.

14. A computer program product comprising a computer program, wherein the computer program, when executed by a processor, implements the steps of the method according to any one of claims 1-10.

Images