Method and device for gang mining based on path rule, medium and equipment

Abstract

Embodiments of the present specification provide a method and device for gang mining based on path rules, a medium and equipment. The method comprises: determining at least one black sample pair; searching for a path instance with a first black node as a head node and a second black node as a tail node in a domain graph; determining a path rule embodying a node type and an association relationship type between nodes according to the path instance; establishing a first association graph according to whether the path instance between each node in the domain graph hits the path rule and the hit path rule; wherein the nodes in the first association graph are nodes in the domain graph that hit the path rule for the corresponding path instance, and the edges between two nodes in the first association graph represent the path rule hit by the path instance between the two nodes; and determining a black gang according to the first association graph. The present application can improve the recognition accuracy of the black gang.

Description

Technical Field

[0001] This specification relates to the field of risk governance technology, and in particular to a method, apparatus, medium, and equipment for gang detection based on path rules. Background Technology

[0002] Some internet platforms host massive transactions, social interactions, and contract signings, requiring platform operators to continuously combat various organized criminal groups. Organized crime involves groups of people congregating to engage in illicit activities. These groups exist at every stage of financial transactions, such as registration, authentication, trading, and transfers. Compared to the illegal activities of individual users, organized crimes have a wider reach, are more egregious, and pose a greater threat. Therefore, identifying and combating organized crime is of paramount importance. Summary of the Invention

[0003] This specification describes one or more embodiments of a method, apparatus, medium, and equipment for detecting criminal gangs based on path rules, which can uncover criminal gangs.

[0004] Based on the first aspect, a path rule-based gang detection method is provided, including:

[0005] Identify at least one black sample pair; wherein each black sample pair includes a first black node as the head node and a second black node as the tail node;

[0006] Search the domain graph for path instances with the first black node as the head node and the second black node as the tail node;

[0007] Based on the path instance, determine the path rules that reflect the node type and the relationship between nodes;

[0008] Based on whether the path instances between each node in the domain graph match the path rules and the matched path rules, a first association graph is established; wherein, the nodes in the first association graph are the nodes in the domain graph whose corresponding path instances match the path rules, and the edges between two nodes in the first association graph represent the path rules matched by the path instances between the two nodes.

[0009] Based on the first association diagram, the criminal gang was identified.

[0010] According to the second aspect, a path rule-based gang detection device is provided, comprising:

[0011] A sample pair determination module is used to determine at least one black sample pair; wherein each black sample pair includes a first black node as the head node and a second black node as the tail node.

[0012] The path search module is used to search for path instances in the domain graph that have the first black node as the head node and the second black node as the tail node.

[0013] The rule determination module is used to determine path rules that reflect the node type and the relationship between nodes based on the path instance;

[0014] The association graph construction module is used to build a first association graph based on whether the path instances between each node in the domain graph match the path rules and the matched path rules; wherein, the nodes in the first association graph are the nodes in the domain graph whose corresponding path instances match the path rules, and the edges between two nodes in the first association graph represent the path rules matched by the path instances between the two nodes.

[0015] The criminal gang identification module is used to identify criminal gangs based on the first association graph.

[0016] According to a third aspect, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method provided in the first aspect.

[0017] According to a fourth aspect, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method provided in the first aspect.

[0018] The path-rule-based gang detection method, apparatus, medium, and equipment provided in the embodiments of this specification have the following beneficial effects, whether individually or in combination:

[0019] (1) First, black sample pairs are identified. The head and tail nodes of a black sample pair are the identified black samples. Then, the domain graph is traversed and searched to find multiple path instances with the first black node in the black sample pair as the head node and the second black node as the tail node. Path rules are then determined based on the path instances. Path rules can reflect the node type and association type of the nodes in the path instances. The domain graph is then traversed to determine whether the path instances of each node in the domain graph match the path rules. The nodes of the path instances that match the path rules are retained to construct the first association graph. The first association graph consists of nodes and edges. Nodes are the nodes in the domain graph whose path instances match the path rules. The edges between two nodes reflect the path rules matched by the path instances between the two nodes. It can be seen that the nodes in the constructed first association graph are nodes that conform to the path rules, that is, some nodes with strong associations. Then, further filtering is performed on these nodes with strong associations to obtain black gangs with stronger associations. The above process does not require defining the gang, therefore personnel do not need a precise understanding of the gang, meaning the requirements for personnel are not high. Therefore, the method provided by this invention is easier to implement. Since the method provided by this invention is not based on the definition of a gang, it avoids discrepancies with objective facts caused by deviations in gang definitions. Therefore, this invention can improve the accuracy of identifying criminal gangs.

[0020] (2) In one embodiment, the path instances searched from the domain graph are abstracted to obtain the first path rule, and the first path rule is derived to obtain the second path rule. Through multiple iterations, the path rule is derived multiple times, making the path rule gradually more complex and better describing the relationship between nodes.

[0021] (3) In one embodiment, the sum of the weights of each path rule corresponding to an edge in the first association graph is used as the association strength of the edge, so that each edge in the first association graph has a weight value, and then the strong association gangs can be found more accurately and quickly based on the first association graph. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart illustrating a path rule-based gang detection method in one embodiment of this specification.

[0024] Figure 2 This is a schematic diagram of a domain map in one embodiment of this specification;

[0025] Figure 3 This is a schematic diagram of four first path rules abstracted from path instances searched from the domain graph in one embodiment of this specification;

[0026] Figure 4 This is one embodiment of the present specification. Figure 3 A schematic diagram of the second path rule obtained by combining rules r2 and r4 in the previous example;

[0027] Figure 5 This is a schematic diagram of the first association diagram in one embodiment of this specification;

[0028] Figure 6 This is a structural block diagram of a gang mining device based on path rules in one embodiment of this specification. Detailed Implementation

[0029] The solution provided in this specification will now be described with reference to the accompanying drawings.

[0030] As mentioned in the background section, organized crime is more heinous and harmful, making gang detection extremely important. However, the criminal gangs identified using algorithms such as classification models, anomaly detection, and similarity calculations often differ from objective reality. This is because applying these methods requires defining the gang, which necessitates a precise understanding of the group. Describing the operations of gangs of dozens or hundreds is very difficult. Furthermore, modern cybercrime can continuously combine account, technical, and equipment resources, leading to constantly changing gang structures in complex cybercrime scenarios, making accurate gang definition extremely challenging.

[0031] Therefore, according to the first aspect, embodiments of this specification provide a method for gang detection based on path rules. The method includes: firstly, determining black sample pairs; then searching for path instances corresponding to the black sample pairs in the domain graph; then determining path rules based on the path instances; then establishing a first association graph based on whether each node in the domain graph hits the path rules, where the nodes in the first association graph are nodes in the domain graph that hit the path rules, and the edges in the first association graph represent the hit path rules; and finally identifying black gangs based on the strength of the path rules between each node in the first association graph.

[0032] The specific implementation of the above concept is described below.

[0033] Figure 1This is a flowchart illustrating a path-rule-based gang detection method according to one embodiment of the present invention. It is understood that this method can be executed by any device, equipment, platform, or cluster of devices with computing and processing capabilities. See also... Figure 1 The path rule-based gang detection method includes the following steps S102 to S110:

[0034] S102. Determine at least one black sample pair; wherein each black sample pair includes a first black node as the head node and a second black node as the tail node.

[0035] S104. Search for path instances in the domain graph that have the first black node as the head node and the second black node as the tail node.

[0036] S106. Based on the path instance, determine the path rules that reflect the node type and the relationship between nodes;

[0037] S108. Based on whether the path instances between each node in the domain graph match the path rules and the matched path rules, establish a first association graph; wherein, the nodes in the first association graph are the nodes in the domain graph whose corresponding path instances match the path rules, and the edges between two nodes in the first association graph represent the path rules matched by the path instances between the two nodes.

[0038] S110. Based on the first association diagram, identify the criminal gang.

[0039] exist Figure 1The path rule-based gang detection method shown first identifies black sample pairs, where the head and tail nodes are already determined black samples. Then, a search is performed in the domain graph to find multiple path instances with the first black node in the black sample pair as the head node and the second black node as the tail node. Path rules are then determined based on these path instances, reflecting the node type and association type within each instance. The domain graph is then traversed to determine if each node's path instance matches a path rule. Nodes whose path instances match the rules are retained to construct a first association graph. This first association graph consists of nodes and edges. Nodes are the path instances in the domain graph that match the path rules, and the edges between two nodes represent the path rules matched by the path instances between those two nodes. Therefore, the nodes in the constructed first association graph conform to the path rules, indicating strong associations. Further filtering is then performed on these strongly associated nodes to identify more closely related black gangs. The above process does not require defining the gang, therefore personnel do not need a precise understanding of the gang, meaning the requirements for personnel are not high. Therefore, the method provided by this invention is easier to implement. Since the method provided by this invention is not based on the definition of a gang, it avoids discrepancies with objective facts caused by deviations in gang definitions. Therefore, this invention can improve the accuracy of identifying criminal gangs.

[0040] The following description Figure 1 The execution method of each step.

[0041] S102. Determine at least one black sample pair; wherein each black sample pair includes a first black node as the head node and a second black node as the tail node.

[0042] In real-world scenarios, two closely related black market nodes that are identified as belonging to the same criminal organization can be considered a black sample pair. For specific criminal issues, such as money laundering groups, two money laundering accounts that belong to the upstream and downstream links in the domain graph can be identified as a black sample pair.

[0043] For example, in S102, two black sample pairs are identified: (User A, User C) and (User B, User C). In the first black sample pair, User A is the first black node and User C is the second black sample node; in the second black sample pair, User B is the first black node and User C is the second black sample node. Users A, B, and C are all black nodes, and these three black nodes are also called positive samples.

[0044] S104. Search for path instances in the domain graph that have the first black node as the head node and the second black node as the tail node.

[0045] Domain graphs are essentially graph-based data structures composed of nodes and edges. Nodes describe various entities or concepts existing in the real world, while edges characterize the attributes of entities or the relationships between them. Domain graphs are geared towards specific domains, built upon industry data, and emphasize the depth of knowledge, providing services for vertical search, professionals, and more.

[0046] Understandably, a domain graph represents a graph formed by all current transaction data in a certain domain. The domain graph is updated as transaction data increases. For example, every other day, the domain graph is updated with the transaction data from the previous day.

[0047] For example, in Figure 2 The domain graph shown is used for searching, specifically searching for path instances where the first black node in a black sample pair is the head node and the second black node is the tail node. For example, searching by the black sample pair (User A, User C) will retrieve the following path instances:

[0048] User A - (transfer 300) -> User C;

[0049] User A - (transfer 10) -> User B - (transfer 400) -> User C;

[0050] User A - (transfer 300) -> User D - (transfer 500) -> User C;

[0051] User A - (access) -> Domain b < - (access) - User C;

[0052] User A - (Using device) -> Device a < - (Using device) - User C.

[0053] Similarly, searching for the black sample pair (User B, User C) yields the following path instances: User B - (transfer 400) -> User C; User B - (access) -> domain b <- (access) - User C.

[0054] Of course, there may be other path instances, but since the number of path instances may be very large, the length of the path instances can be limited, for example, the length of a path instance can be less than or equal to 3.

[0055] Furthermore, to reduce the complexity of traversal search, edges with more than a threshold number of hotspots can be randomly truncated. That is, nodes with more than a threshold number of connected edges are called hotspots, and the edges connected to each hotspot are randomly truncated. After random truncation, traversal search can be performed, which can reduce the complexity of traversal search.

[0056] Alternatively, a symmetric diffusion of n / 2 degrees between the head and tail nodes can be used for traversal and retrieval. For example, if the length of a path instance is less than or equal to 6, then n is 6. Then, three nodes are searched starting with the head node, and three nodes are searched starting with the tail node. If the third node in the path searched starting with the head node is connected to the third node in the path searched starting with the tail node, then a path instance of length 6 has been found. This method can also reduce the search complexity.

[0057] S106. Based on the path instance, determine the path rules that reflect the node type and the relationship between nodes;

[0058] In other words, based on the path instances found in S104, path rules are determined, and these rules reflect node types and relationship types. Node types can include user, domain name, device, etc., while relationship types can include transfer, access, device usage, etc.

[0059] In one embodiment, S106 may specifically include S1 to S4:

[0060] S1. The path instance is abstracted to obtain the first path rule; wherein, the nodes in the path instance are abstracted as node types, and the association relationship between the nodes in the path instance is abstracted as association relationship type;

[0061] For example, the two path instances, User A - (transfer 300) -> User C and User B - (transfer 400) -> User C, can be abstracted into the first path rule: User - (transfer) -> User.

[0062] For example, the two path instances, User A - (transfer 10) -> User B - (transfer 400) -> User C and User A - (transfer 300) -> User D - (transfer 500) -> User C, can be abstracted into the first path rule: User - (transfer) -> User - (transfer) -> User.

[0063] For example, the two path instances, User A - (access) -> Domain b <- (access) - User C and User B - (access) -> Domain b <- (access) - User C, can be abstracted into the first path rule: User - (access) -> Domain <- (access) - User.

[0064] For example, the path instance of User A - (using device) -> Device a <- (using device) - User C can be abstracted into the first path rule: User - (using) -> Device <- (using) - User.

[0065] As can be seen, by abstracting path instances, the corresponding path rules can be obtained. See also Figure 3We can abstract four first path rules: r1, r2, r3, and r4.

[0066] S2. Perform derivative processing on the first path rule to obtain the second path rule;

[0067] To enhance the ability of path rules to characterize relationships, more complex second path rules can be derived from the first path rule described above.

[0068] In one embodiment, S2 may include: adding node attributes to the nodes of the first path rule, and / or adding edge attributes to the edges of the first path rule.

[0069] For example, in the first path rule r1: User-(Transfer)->User, set a quality attribute for the first user node. The quality attribute can refer to whether the user is a risky user. For example, add the node attribute "User is a risky user" to the first user node.

[0070] For example, if both User A and User B eat at breakfast shop C, their spending can be restricted to differentiate between users who are considered risky. For instance, if User A's spending is relatively small while User B's spending is significantly higher than the normal breakfast amount, then User A is considered a normal user, while User B may pose a risk.

[0071] The two examples above illustrate how to add node and edge attributes. As can be seen, by adding node and / or edge attributes to the first path rule, a more complex second path rule is obtained. This second path rule can better characterize abnormal transactions.

[0072] In one embodiment, S2 may include: combining multiple different first path rules, and / or combining multiple identical first path rules.

[0073] For example, see Figure 4 ,Will Figure 3 Combining the first path rules r2 and r4 in the code yields a second path rule. For example, combining two first path rules r2 yields a second path rule.

[0074] As can be seen, the same first path rules can be combined, and different first path rules can be combined to obtain the second path rules.

[0075] Understandably, since the second path rule obtained from a single combination may still be relatively simple, multiple derivation processes may be required. Therefore, multiple iterations can be performed, with each iteration deriving the path rule and increasing its complexity. After multiple iterations, a more complex path rule can be obtained.

[0076] S3. Calculate the evaluation index of each path rule in the first path rule and the second path rule, and filter each path rule according to the evaluation index;

[0077] In one embodiment, the calculation of the evaluation index of each path rule in the first path rule and the second path rule in S3 may specifically include S31 to S32:

[0078] S31. For each path rule in the first path rule and the second path rule, traverse the domain graph to determine the path instance in the domain graph that matches the path rule;

[0079] S32. Based on the path instances in the domain graph that match the path rule, calculate the evaluation index of the path rule. The evaluation index includes at least one of support, coverage, confidence and partial complete hypothesis confidence.

[0080] Wherein, the support is the number of head-to-tail node pairs that are black sample pairs in each path instance that hits the path rule in the domain graph; the coverage is the ratio between the number of head-to-tail node pairs that are black sample pairs in each path instance that hits the path rule in the domain graph and the number of black sample pairs; the confidence is the ratio between the number of head-to-tail node pairs that are black sample pairs in each path instance that hits the path rule in the domain graph and the number of path instances that hit the path rule in the domain graph; the partial complete hypothesis confidence is the ratio between the number of head-to-tail node pairs that are black sample pairs in each path instance that hits the path rule in the domain graph and a first quantity, where the first quantity is the number of at least one of the head node and the tail node that are black samples in each path instance that hits the path rule in the domain graph.

[0081] In other words, before calculating each evaluation metric, the domain graph is traversed for each path rule to search for all cases that conform to that path rule. For example, for a first path rule r1, the domain graph is searched for all path instances that conform to the first path rule r1, resulting in 7 path instances, as shown in Table 1 below:

[0082] Table 1

[0083]

[0084] Understandably, in this embodiment of the invention, for the two black sample pairs determined in S102: (User A, User C) and (User B, User C), it is known that User A, User B, and User C are all positive samples. There are 7 path instances in the domain graph that match the first path rule r1. The number of path instances where the head and tail node pairs are the black sample pairs is 1, indicating that the support for the first path rule r1 is 1. Since the number of black sample pairs determined in S102 is 2, the coverage is 1 / 2 = 50%. In each path instance in the domain graph that matches the first path rule r1, the number of head and tail node pairs that are the black sample pairs is 1, and the number of path instances in the domain graph that match the first path rule r1 is 7, therefore the confidence level is 1 / 7 = 14%. The first number is 4, therefore the partial complete hypothesis confidence level is 1 / 4 = 25%.

[0085] Support reflects the number of path rules matched in head-to-tail node pairs. If a path rule has few or no corresponding path instances in the domain graph, it can be discarded. Coverage reflects the proportion of head-to-tail node pairs that match path rules, specifically the coverage of black sample pairs by the path rule. Confidence reflects the accuracy of the path rule in finding black sample pairs. The partial complete hypothesis confidence reflects the accuracy of finding black samples using the path rule. In summary, support and coverage reflect the degree of coverage, while confidence and partial complete hypothesis confidence reflect the degree of accuracy.

[0086] It is evident that the higher the support, coverage, confidence, and partial complete hypothesis confidence of a path rule, the better the path rule. A good path rule should balance accuracy and coverage. A particularly low confidence level indicates low accuracy, but if the confidence level is high while the coverage is particularly low, the path rule is not very useful because, although accurate, it will only find a limited number of results. Therefore, a balance must be struck between accuracy and coverage.

[0087] Understandably, path rules with very low accuracy or coverage can be filtered out, while path rules with moderate accuracy and coverage can be retained.

[0088] S4. Determine whether the iteration termination condition is met;

[0089] If so, then exit the iteration process;

[0090] Otherwise, the remaining path rules after filtering are used as the first path rule, and S2 is returned.

[0091] Understandably, the number of iterations can be used as the iteration termination condition; for example, the number of iterations can be set to 4. Since the aforementioned evaluation metrics of the path rule change as the iteration process progresses, the iteration can be terminated when these metrics no longer improve. Therefore, a small change in the improvement of the evaluation metric relative to the previous iteration during a single iteration can also be used as the iteration termination condition.

[0092] Understandably, if the iteration termination condition is met, the iteration process is exited, and the remaining path rules after filtering are used in subsequent steps. Otherwise, the remaining path rules after filtering are returned to S2 as the first path rules for derivation processing, that is, the next iteration process is started.

[0093] In other words, the path rules obtained by abstracting path instances are called the first path rules, and the path rules derived from the first path rules are called the second path rules. Then, the evaluation index of each path rule in the first and second path rules is calculated, and some path rules are filtered out based on the evaluation index, leaving the remaining path rules. Then, it is determined whether the iteration termination condition is met. If the iteration termination condition is met, the iteration process is terminated; otherwise, all the current path rules are treated as the first path rules, and more complex path rules are derived based on the first path rules.

[0094] S108. Based on whether the path instances between each node in the domain graph match the path rules and the matched path rules, establish a first association graph; wherein, the nodes in the first association graph are the nodes in the domain graph whose corresponding path instances match the path rules, and the edges between two nodes in the first association graph represent the path rules matched by the path instances between the two nodes.

[0095] In other words, the domain graph is traversed to determine which path instances between nodes conform to which path rule(s). If a node in the domain graph does not conform to any of the path rules, that node is removed. If a node in the domain graph conforms to one or more path rules, that node is retained. Specifically, if there are path instances between nodes A and B in the domain graph that conform to path rules r1 and r4, then nodes A and B are retained to create the first association graph, and path rules r1 and r4 are used as edges between nodes A and B in the first association graph.

[0096] For example, see Table 2 below for a table showing the path rules that match path instances between nodes in the domain graph:

[0097] Table 2

[0098]

[0099]

[0100] In Table 2 above, 0 indicates that the corresponding path rule was not matched, and 1 indicates that the corresponding path rule was matched. For example, in the domain graph, among the path instances with node A as the head node and node B as the tail node, there is one path instance that conforms to path rule r1 and one path instance that conforms to path rule r4. It can be seen that nodes A and B are retained in the first association graph, and the edge between nodes A and B reflects path rules r1 and r4.

[0101] A first association graph is constructed based on the traversal results of the domain graph. For example, the first association graph constructed based on Table 2 above can be found in [reference needed]. Figure 5 .from Figure 5 As can be seen from the diagram, the first association graph is an association graph formed by nodes with strong relationships in the domain graph.

[0102] S110. Based on the first association diagram, identify the criminal gang.

[0103] Understandably, the nodes in the first association graph are nodes with strong relationships in the domain graph. Therefore, multiple nodes with even stronger relationships can be further selected from the nodes in the first association graph as criminal gangs.

[0104] In one embodiment, S110 may specifically include:

[0105] Calculate the association strength corresponding to each edge in the first association graph; wherein, the association strength corresponding to each edge is the sum of the weights of each path rule corresponding to that edge, and each path rule has a corresponding weight;

[0106] The criminal gang is determined based on the association strength of each edge in the first association graph.

[0107] In other words, a corresponding weight is set for each path rule. The weights of each path rule can be the same. For example, for five path rules, the weight of each path rule is 0.2. At this time, the weights between nodes B and C, nodes A and D, nodes D and C, nodes D and G, and nodes G and F are all 0.2. The weight between nodes A and C is 1. The weights between nodes A and B, nodes F and E, and nodes E and G are all 0.4.

[0108] As can be seen, the weight of an edge between two nodes reflects the strength of the relationship between them, with the relationship between nodes A and C being the strongest. Therefore, the weight of an edge can be called the edge's association strength, reflecting the strength of the association between the two nodes corresponding to the edge.

[0109] Of course, the weights of each path rule can also be different, and the weights of each path rule can be determined according to the specific business scenario.

[0110] After calculating the association strength of each edge in the first association graph, we can further filter out criminal gangs based on the first association graph with weighted edges. For example, we can identify criminal gangs in the first association graph using community detection algorithms, connected graph algorithms, etc.

[0111] In one embodiment, the method provided by this invention may further include:

[0112] Output the business explanation for each black node in the black gang, including the path instances between the node and other associated black nodes.

[0113] In other words, while identifying criminal gangs, the system also provides business explanations for each criminal node within the gang. Specifically, it explains the path instances between each criminal node and other criminal nodes. This allows personnel to gain a more detailed understanding of the criminal gangs and can also serve as an auxiliary tool to determine the accuracy of criminal gang detection.

[0114] Understandably, this invention characterizes groups based on known black sample pairs, eliminating the need for experts to fully define groups. It only requires understanding the relative relationships between two nodes and leveraging the expressive power of domain graphs to mine all significant path rules from relatively comprehensive domain information. Specifically, simple path rules are first mined as a foundation to reduce search difficulty. These simple path rules are then used to derive more complex path rules that can characterize intricate relationships. Furthermore, evaluation metrics are used to filter out useful rules from a large number of path rules and eliminate duplicate rules.

[0115] Understandably, the method provided in this embodiment of the invention does not require personnel to define the gang based on expert experience, thus not consuming much manpower or time. Moreover, the method provided in this embodiment of the invention is not based on a single path rule, but on multiple path rules, i.e., a cluster of path rules, which is consistent with the situation where nodes in real black market gangs have related relationships.

[0116] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0117] According to a second aspect, embodiments of the present invention provide a gang detection device based on path rules, see [link to relevant documentation]. Figure 6 The device 200 includes:

[0118] The sample pair determination module 202 is used to determine at least one black sample pair; wherein each black sample pair includes a first black node as the head node and a second black node as the tail node.

[0119] The path search module 204 is used to search for path instances in the domain graph that have the first black node as the head node and the second black node as the tail node.

[0120] The rule determination module 206 is used to determine path rules that reflect the node type and the relationship between nodes based on the path instance;

[0121] The association graph construction module 208 is used to build a first association graph based on whether the path instances between each node in the domain graph match the path rules and the matched path rules; wherein, the nodes in the first association graph are the nodes in the domain graph whose corresponding path instances match the path rules, and the edges between two nodes in the first association graph represent the path rules matched by the path instances between the two nodes.

[0122] The criminal gang identification module 210 is used to identify criminal gangs based on the first association graph.

[0123] In one embodiment, the rule determination module includes:

[0124] An instance abstraction unit is used to execute S1, which abstracts the path instance to obtain a first path rule; wherein, the nodes in the path instance are abstracted as node types, and the association relationships between the nodes in the path instance are abstracted as association relationship types.

[0125] The rule derivation unit is used to execute S2 and perform derivation processing on the first path rule to obtain the second path rule;

[0126] The rule filtering unit is used to execute S3, calculate the evaluation index of each path rule in the first path rule and the second path rule, and filter each path rule according to the evaluation index;

[0127] The condition judgment module is used in S4 to determine whether the iteration termination condition is met; if so, the iteration process is exited; otherwise, the remaining path rules after filtering are taken as the first path rule and returned to the rule derivation unit.

[0128] In one embodiment, the rule derivation unit is specifically used to: add node attributes to the nodes of the first path rule, and / or add edge attributes to the edges of the first path rule.

[0129] In one embodiment, the rule derivation unit is specifically used to: combine multiple different first path rules, and / or combine multiple identical first path rules.

[0130] In one embodiment, the rule filtering unit includes:

[0131] The graph traversal subunit is used to traverse the domain graph for each of the first path rule and the second path rule to determine the path instance in the domain graph that matches the path rule.

[0132] The indicator calculation subunit is used to calculate the evaluation indicator of the path rule based on the path instances that hit the path rule in the domain graph. The evaluation indicator includes at least one of support, coverage, confidence and partial complete hypothesis confidence.

[0133] Wherein, the support is the number of head-to-tail node pairs that are black sample pairs in each path instance that hits the path rule in the domain graph; the coverage is the ratio between the number of head-to-tail node pairs that are black sample pairs in each path instance that hits the path rule in the domain graph and the number of black sample pairs; the confidence is the ratio between the number of head-to-tail node pairs that are black sample pairs in each path instance that hits the path rule in the domain graph and the number of path instances that hit the path rule in the domain graph; the partial complete hypothesis confidence is the ratio between the number of head-to-tail node pairs that are black sample pairs in each path instance that hits the path rule in the domain graph and a first quantity, where the first quantity is the number of at least one of the head node and the tail node that are black samples in each path instance that hits the path rule in the domain graph.

[0134] In one embodiment, the criminal gang identification module includes:

[0135] The association calculation unit is used to calculate the association strength corresponding to each edge in the first association graph; wherein, the association strength corresponding to each edge is the sum of the weights of each path rule corresponding to that edge, and each path rule has a corresponding weight;

[0136] The gang identification unit is used to identify the criminal gang based on the association strength corresponding to each edge in the first association graph.

[0137] In one embodiment, the black gang identification module is further configured to: output a business explanation corresponding to each black node in the black gang, wherein the business explanation includes path instances between the node and other associated black nodes.

[0138] It is understood that explanations, specific implementation methods, beneficial effects, examples, etc. of the contents of the apparatus provided in the embodiments of the present invention can be found in the corresponding parts of the method provided in the first aspect, and will not be repeated here.

[0139] According to a third aspect, one embodiment of this specification provides a computer-readable storage medium having a computer program stored thereon that, when executed in a computer, causes the computer to perform the methods of any embodiment of the specification.

[0140] Specifically, a system or apparatus equipped with a storage medium may be provided, on which software program code implementing the functions of any of the embodiments described above is stored, and the computer (or CPU or MPU) of the system or apparatus may read and execute the program code stored in the storage medium.

[0141] In this case, the program code read from the storage medium can itself implement the function of any of the above embodiments, and therefore the program code and the storage medium storing the program code constitute part of the present invention.

[0142] Furthermore, it should be clear that not only can the program code read by the computer be executed, but also the operating system or other components operating on the computer can be instructed based on the program code to perform some or all of the actual operations, thereby realizing the function of any of the embodiments described above.

[0143] Furthermore, it is understood that the program code read from the storage medium is written to the memory set in the expansion board inserted into the computer or to the memory set in the expansion module connected to the computer. Then, based on the instructions of the program code, the CPU or other components installed on the expansion board or expansion module execute some and all of the actual operations, thereby realizing the function of any of the above embodiments.

[0144] It is understood that explanations, specific implementation methods, beneficial effects, examples, etc. of the contents in the computer-readable medium provided in the embodiments of the present invention can be found in the corresponding parts of the method provided in the first aspect, and will not be repeated here.

[0145] According to a fourth aspect, one embodiment of this specification provides a computing device including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any embodiment of the specification.

[0146] It is understood that explanations, specific implementation methods, beneficial effects, examples, etc. of the computing device provided in the embodiments of the present invention can be found in the corresponding parts of the method provided in the first aspect, and will not be repeated here.

[0147] It is understood that the structures illustrated in the embodiments of this specification do not constitute a specific limitation on the apparatus of the embodiments of this specification. In other embodiments of the specification, the above-described apparatus may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0148] The information interaction and execution process between the modules in the above-mentioned device and system are based on the same concept as the method embodiments in this specification, and the specific details can be found in the descriptions in the method embodiments in this specification, so they will not be repeated here.

[0149] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0150] Those skilled in the art will recognize that, in one or more of the examples above, the functions described in this invention can be implemented using hardware, software, widgets, or any combination thereof. When implemented in software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium.

[0151] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for gang detection based on path rules, comprising: Identify at least one black sample pair; wherein each black sample pair includes a first black node as the head node and a second black node as the tail node; wherein the first black node and the second black node are two black nodes belonging to the same known black group; Search the domain graph for a first path instance with the first black node as the head node and the second black node as the tail node; Based on the first path instance, determine the path rules that reflect the node type of each node in the first path instance and the association relationship type between each node in the first path instance; Based on whether the path instances between each node in the domain graph match the path rules and the matched path rules, a first association graph is established; wherein, the nodes in the first association graph are the nodes in the domain graph whose corresponding path instances match the path rules, and the edges between two nodes in the first association graph represent the path rules matched by the path instances between the two nodes. Based on the first association diagram, the criminal gang was identified.

2. The method according to claim 1, wherein, The step of determining the path rules that reflect the node types of each node in the first path instance and the association types between each node in the first path instance, based on the first path instance, includes: S1. The first path instance is abstracted to obtain the first path rule; wherein, the nodes in the first path instance are abstracted as node types, and the association relationships between the nodes in the first path instance are abstracted as association relationship types. S2. Perform derivative processing on the first path rule to obtain the second path rule; S3. Calculate the evaluation index of each path rule in the first path rule and the second path rule, and filter each path rule according to the evaluation index; S4. Determine whether the iteration termination condition is met; If so, then exit the iteration process; Otherwise, the remaining path rules after filtering are used as the first path rule, and S2 is returned.

3. The method according to claim 2, wherein, The step of deriving the second path rule from the first path rule includes: Add node attributes to the nodes of the first path rule, and / or add edge attributes to the edges of the first path rule.

4. The method according to claim 2, wherein, The step of deriving the second path rule from the first path rule includes: Combining multiple different first path rules, and / or combining multiple identical first path rules.

5. The method according to claim 2, wherein, The calculation of the evaluation index for each path rule in the first path rule and the second path rule includes: For each of the first path rule and the second path rule, the domain graph is traversed to determine the path instance in the domain graph that matches the path rule; Based on the path instances in the domain graph that match the path rule, calculate the evaluation metric for the path rule. The evaluation metric includes at least one of support, coverage, confidence, and partial complete hypothesis confidence. Wherein, the support is the number of head-to-tail node pairs that are black sample pairs in each path instance that hits the path rule in the domain graph; the coverage is the ratio between the number of head-to-tail node pairs that are black sample pairs in each path instance that hits the path rule in the domain graph and the number of black sample pairs; the confidence is the ratio between the number of head-to-tail node pairs that are black sample pairs in each path instance that hits the path rule in the domain graph and the number of path instances that hit the path rule in the domain graph; the partial complete hypothesis confidence is the ratio between the number of head-to-tail node pairs that are black sample pairs in each path instance that hits the path rule in the domain graph and a first quantity, where the first quantity is the number of at least one of the head node and the tail node that are black samples in each path instance that hits the path rule in the domain graph.

6. The method according to claim 1, wherein, The step of determining the criminal gang based on the first association graph includes: Calculate the association strength corresponding to each edge in the first association graph; wherein, the association strength corresponding to each edge is the sum of the weights of each path rule corresponding to that edge, and each path rule has a corresponding weight; The criminal gang is determined based on the association strength of each edge in the first association graph.

7. The method according to claim 6, wherein, Also includes: Output the business explanation for each black node in the black gang, including the path instances between the node and other associated black nodes.

8. A gang detection device based on path rules, comprising: The sample pair determination module is used to determine at least one black sample pair; wherein each black sample pair includes a first black node as the head node and a second black node as the tail node; wherein the first black node and the second black node are two black nodes belonging to the same known black gang; The path search module is used to search for a first path instance in the domain graph that has the first black node as the head node and the second black node as the tail node. The rule determination module is used to determine, based on the first path instance, path rules that reflect the node type of each node in the first path instance and the association relationship type between each node in the first path instance. The association graph construction module is used to establish a first association graph based on whether the path instances between each node in the domain graph match the path rules and the matched path rules; wherein, the nodes in the first association graph are the nodes in the domain graph whose corresponding path instances match the path rules, and the edges between two nodes in the first association graph represent the path rules matched by the path instances between the two nodes; wherein, the domain graph is traversed to determine whether the path instances of each node in the domain graph match the path rules. The criminal gang identification module is used to identify criminal gangs based on the first association graph.

9. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method according to any one of claims 1 to 7.

10. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method according to any one of claims 1 to 7.

Images