Risk group analysis method, device and equipment

Abstract

The one or more embodiments of the specification disclose a risk group analysis method, device and equipment. The method comprises: acquiring a first risk group relationship graph corresponding to a target user group; a node in the first risk group relationship graph represents a user in the target user group, and an edge between two nodes in the first risk group relationship graph represents a connection established by the corresponding two users under a preset association logic; using a first clustering algorithm to perform density-based clustering on the first risk group relationship graph to obtain a second risk group relationship graph corresponding to the target user group; using a second clustering algorithm to perform clustering based on a connection relationship on the second risk group relationship graph to obtain a target risk group relationship graph corresponding to the target user group; and generating a risk group analysis result corresponding to the target user group based on the target risk group relationship graph.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and in particular to a method, apparatus and equipment for risk group analysis. Background Technology

[0002] Risk group analysis is a crucial step in intelligent review of suspicious transactions, effectively identifying risks during the transaction process. Therefore, how to quickly identify risk groups with higher suspicion rates is a pressing issue that needs to be addressed.

[0003] Existing risk group analysis methods typically segment data using community detection algorithms, resulting in multiple communities. Each community is then evaluated for risk group status to identify the risky groups within it. However, existing community detection algorithms segment data based on network topology characteristics, neglecting the real-world risk group dynamics in business scenarios. Consequently, the resulting community segmentation often includes numerous large communities. These large communities hinder subsequent risk group evaluation and may contain noisy nodes or relationships, making it difficult to ensure the connectivity and density of the identified risky groups, resulting in poor accuracy. Summary of the Invention

[0004] On one hand, one or more embodiments of this specification provide a risk group analysis method, comprising: obtaining a first risk group relationship graph corresponding to a target user group, wherein nodes in the first risk group relationship graph represent users in the target user group, and edges between two nodes in the first risk group relationship graph represent connections established between corresponding two users under a preset association logic; performing density-based clustering on the first risk group relationship graph using a first clustering algorithm to obtain a second risk group relationship graph corresponding to the target user group; performing connectivity-based clustering on the second risk group relationship graph using a second clustering algorithm to obtain a target risk group relationship graph corresponding to the target user group; and generating a risk group analysis result corresponding to the target user group based on the target risk group relationship graph.

[0005] On the other hand, one or more embodiments of this specification provide a risk group analysis device, including: an acquisition module, configured to acquire a first risk group relationship graph corresponding to a target user group, wherein nodes in the first risk group relationship graph represent users in the target user group, and edges between two nodes in the first risk group relationship graph represent connections established between corresponding two users under a preset association logic; a first clustering module, configured to perform density-based clustering on the first risk group relationship graph using a first clustering algorithm to obtain a second risk group relationship graph corresponding to the target user group; a second clustering module, configured to perform connectivity-based clustering on the second risk group relationship graph using a second clustering algorithm to obtain a target risk group relationship graph corresponding to the target user group; and a generation module, configured to generate risk group analysis results corresponding to the target user group based on the target risk group relationship graph.

[0006] Furthermore, one or more embodiments of this specification provide a risk group analysis device, including a processor; and a memory arranged to store computer-executable instructions, which, when executed, enable the processor to: acquire a first risk group relationship graph corresponding to a target user group, wherein nodes in the first risk group relationship graph represent users in the target user group, and edges between two nodes in the first risk group relationship graph represent connections established between corresponding two users under preset association logic; perform density-based clustering on the first risk group relationship graph using a first clustering algorithm to obtain a second risk group relationship graph corresponding to the target user group; perform connectivity-based clustering on the second risk group relationship graph using a second clustering algorithm to obtain a target risk group relationship graph corresponding to the target user group; and generate a risk group analysis result corresponding to the target user group based on the target risk group relationship graph.

[0007] Furthermore, embodiments of this specification provide a storage medium for storing computer-executable instructions. When executed by a processor, these instructions implement the following process: obtaining a first risk group relationship graph corresponding to a target user group, where nodes in the first risk group relationship graph represent users within the target user group, and edges between two nodes in the first risk group relationship graph represent connections established between the corresponding two users under a preset association logic; performing density-based clustering on the first risk group relationship graph using a first clustering algorithm to obtain a second risk group relationship graph corresponding to the target user group; performing connectivity-based clustering on the second risk group relationship graph using a second clustering algorithm to obtain a target risk group relationship graph corresponding to the target user group; and generating risk group analysis results corresponding to the target user group based on the target risk group relationship graph. Attached Figure Description

[0008] To more clearly illustrate the technical solutions in one or more embodiments of this specification or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in one or more embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0009] Figure 1 This is a schematic flowchart of a risk group analysis method according to an embodiment of this specification;

[0010] Figure 2 This is a first risk group relationship diagram according to an embodiment of this specification;

[0011] Figure 3 This is a schematic diagram of a K-core algorithm process according to an embodiment of this specification;

[0012] Figure 4 This is a target risk group relationship diagram according to an embodiment of this specification;

[0013] Figure 5 This is a schematic flowchart of a risk group analysis method according to another embodiment of this specification;

[0014] Figure 6 This is a schematic block diagram of a risk group analysis device according to an embodiment of this specification;

[0015] Figure 7 This is a schematic block diagram of a risk group analysis device according to an embodiment of this specification. Detailed Implementation

[0016] This specification provides one or more embodiments of a risk group analysis method, apparatus, and device to address the problem of poor accuracy in existing risk group analysis methods.

[0017] To enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the technical solutions in one or more embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of one or more embodiments of this specification.

[0018] Figure 1This is a schematic flowchart of a risk group analysis method according to an embodiment of this specification, such as... Figure 1 As shown, the method may include:

[0019] S102, Obtain the first risk group relationship diagram corresponding to the target user group.

[0020] In this diagram, nodes in the first risk group relationship graph represent users within the target user group, and edges between two nodes represent connections established between the corresponding two users under a preset association logic. Optionally, the target user group is a group of suspicious users, which can be a group of users who have engaged in suspicious or non-compliant behavior.

[0021] It should be understood that the embodiments in this specification do not specifically limit the network relationships presented in the risk group relationship graph. That is to say, the edges in the risk group relationship graph can represent any type of connection between users, i.e., the preset association logic can be any type of association. For example, the edges in the risk group relationship graph can represent interactive connections, business connections, geographical area connections, work connections, etc. between users.

[0022] S104, use the first clustering algorithm to perform density-based clustering on the first risk group relationship graph to obtain the second risk group relationship graph corresponding to the target user group.

[0023] The first clustering algorithm is not unique and may include one or more of the following: force-oriented algorithm, K-means clustering algorithm, density clustering algorithm, and density peak clustering algorithm. This specification does not limit the specific clustering algorithm used in the embodiments.

[0024] S106, use the second clustering algorithm to perform clustering based on connectivity on the second risk group relationship graph to obtain the target risk group relationship graph corresponding to the target user group.

[0025] The second clustering algorithm is not unique and may include the K-core algorithm, the maximum connected graph algorithm, etc. The embodiments in this specification do not limit this.

[0026] S108, Based on the target risk group relationship diagram, generate risk group analysis results corresponding to the target user group.

[0027] The risk group analysis results include all nodes in the target risk group relationship graph, that is, all users included in the target risk group relationship graph.

[0028] By employing the technical solutions of one or more embodiments of this specification, after obtaining the first risk group relationship graph corresponding to the target user group, a first clustering algorithm can be used to perform density-based clustering on the first risk group relationship graph to obtain a second risk group relationship graph corresponding to the target user group. This results in a second risk group relationship graph with better node density compared to the first risk group relationship graph. Furthermore, a second clustering algorithm is used to perform connectivity-based clustering on the second risk group relationship graph to obtain a target risk group relationship graph corresponding to the target user group. This target risk group relationship graph has better node connectivity compared to the second risk group relationship graph. Therefore, this technical solution, by performing density- and connectivity-based clustering on the initially determined risk group relationship graph (i.e., the first risk group relationship graph), can obtain a target risk group relationship graph with better node connectivity and density. Based on the target risk group relationship graph, risk group analysis results corresponding to the target user group can be generated, resulting in risk groups with better connectivity and density. Compared to directly obtaining risk group analysis results from the first risk group relationship graph, this improves the accuracy of the identified risk groups. Furthermore, since this technical solution analyzes at-risk groups through clustering, a relatively conventional method that is not limited to specific application scenarios, it is versatile and can achieve good results in analyzing at-risk groups across various application scenarios.

[0029] The risk group analysis method described in the embodiments of this specification will be described in detail below.

[0030] The scheme implemented in this specification employs a two-step clustering algorithm for risk group analysis. One step is a density-based clustering algorithm, and the other is a connectivity-based clustering algorithm. By combining the results of these two clustering methods, the final output is a risk group with better connectivity and density among members. Furthermore, compared to related techniques that extract risk groups using minimum spanning trees, this scheme has a superior member recall rate. Member recall rate refers to the number of suspicious members that can be identified given a fixed membership structure. A higher member recall rate indicates a larger number of suspicious members can be identified given a fixed membership structure; a lower member recall rate indicates a smaller number of suspicious members can be identified given a fixed membership structure.

[0031] In one embodiment, obtaining the first risk group relationship diagram corresponding to the target user group (i.e., S102) can be performed as follows: A1-A5:

[0032] Step A1: Obtain the user's user information and business information.

[0033] Optionally, the risk group analysis method provided in this specification can be applied to a business platform. Therefore, when performing step A1, user information and business information can be obtained from the business platform. Specifically, before conducting business on the business platform, the user receives an information authorization request from the platform. This request informs the user that their user information and business information on the platform will be authorized to the risk group analysis provider. After the user confirms the information authorization request, i.e., agrees to authorize the risk group analysis provider to share their user information and business information on the platform, the user can then conduct business on the platform.

[0034] Optionally, user information may include user ID (Identity Document), user's geographical location, user name, user's credit score, etc. Business information may include business type (e.g., cash flow business, commodity trading business), whether a transaction is involved, transaction amount, transaction type (e.g., catering transaction, education transaction, financial transaction), and the nature of the parties involved in the transaction (e.g., individuals, companies), etc.

[0035] Step A2: Construct a full network relationship graph based on user information and business information.

[0036] In this graph, nodes represent users, and edges between two nodes represent connections established between those two users under a predefined association logic. Optionally, nodes in the full network graph can be constructed based on user information, and edges between two nodes can be constructed using user information and business information. The predefined association logic can be of any type. For example, edges in the full network graph can represent transactional connections, business connections, geographical region connections, work connections, etc., between users.

[0037] Step A3: Filter the target nodes in the entire network relationship graph that meet the preset filtering conditions to obtain the target user group.

[0038] Optionally, filtering target nodes that meet preset filtering conditions in the entire network graph can be achieved through steps B1-B3 or steps C1-C2, as will be described in detail in the following embodiments. The target user group can be a group of suspicious users.

[0039] Step A4: Determine the target network relationship diagram based on the target user group.

[0040] Specifically, the target network relationship graph is determined based on the target user group. This means that users in the target user group are the nodes of the target network relationship graph, and the edges between nodes in the target network relationship graph are determined according to the relationship between two users, forming a target network relationship graph containing nodes and edges.

[0041] Step A5: Use the third clustering algorithm to cluster the target network relationship graph to obtain the first risk group relationship graph.

[0042] Optionally, the third clustering algorithm is not specifically limited and can be the Louvain community detection algorithm, the label propagation-based local community detection algorithm, the connected subgraph algorithm, etc. In this embodiment, the third clustering algorithm can initially cluster the target network relationship graph, thereby obtaining the relationship graph of each potential risk group in the target user group, which is the first risk group relationship graph referred to in this embodiment.

[0043] In this clustering process, the number of first-risk group relationship graphs is greater than or equal to the number of target network relationship graphs. Generally, since the target network relationship graph corresponds to the target user group, the connections between users are not very strong. Therefore, after clustering, the number of first-risk group relationship graphs will be greater than the number of target network relationship graphs. For example, one target network relationship graph may result in three first-risk group relationship graphs after clustering.

[0044] Optionally, a target network graph with n nodes can be described as a vertex-edge tuple as shown below, i.e.:

[0045]

[0046] Where G is the target network graph, N is the set of nodes in the target network graph, and node i Let be the i-th node in the target network graph, and let E be the set of edges in the target network graph. jk if node j and node k ink indicates that if the j-th node and the k-th node in the target network graph are connected, then edge jk Let j be the edge between the j-th node and the k-th node.

[0047] Optionally, the edges in the target network graph can be described as a triplet of left node, right node, and connection weight, i.e.:

[0048] edge jk =[node j node k score).

[0049] The connection weight score can be determined based on the actual business scenario. For example, in a financial business scenario, the natural logarithm of a customer's 90-day transactions can be used as the connection weight.

[0050] For example, when the third clustering algorithm is a community detection algorithm, when clustering the target network relationship graph using the community detection algorithm, the first risk group relationship graph can be obtained by repeatedly executing the following steps A51-A53 until the community to which all nodes in the graph belong no longer changes:

[0051] Step A51: Treat each node in the target network graph as a community.

[0052] Step A52: For each node in the target network graph, attempt to assign the node to the community of each adjacent node in turn, and calculate the change in modularity before and after the assignment to determine the maximum change in modularity. If the maximum change in modularity is greater than 0, then assign the node to the community corresponding to the maximum change in modularity.

[0053] Optionally, modularity is defined as follows:

[0054]

[0055] Where m is the total number of edges in the community, A ij This represents the weight of the edge between node i and node j. When the network is not a weighted graph, the weight of all edges can be considered as 1. i, j represent nodes, and k represents the weight of the edge between nodes i and j. i k represents the sum of the weights (degrees) of all edges connected to node i. j This represents the sum of the weights of all edges connected to node j. The function δ(C) i C j The value of ) is defined as follows: if node i and node j are in the same community, i.e., C i =C j If the result is positive, the value is 1; otherwise, it is 0.

[0056] Step A53: Compress all nodes in each community into a new node, convert the weights of each node within the community into the weights of the rings in the new node, and convert the weights of the edges between communities into the weights of the edges between the corresponding new nodes.

[0057] In the embodiments of this specification, user information and business information are constructed into a graph. Since the graph clearly reflects the relationships between users, it facilitates the efficient identification of risk groups in subsequent steps through graph computation. By filtering the target network relationship graph corresponding to the target user group from the constructed full network relationship graph, a data foundation is provided for the subsequent analysis of potential risk groups within the target user group. This also effectively reduces the computational load when analyzing the target user group, saving computational resources. By using a third clustering algorithm to cluster the target network relationship graph, a preliminary segmentation of the target user group can be achieved, resulting in a higher degree of connection between users in the obtained first risk group relationship graph compared to the target network relationship graph.

[0058] In one embodiment, filtering target nodes that meet preset filtering conditions in the entire network graph (i.e., step A3) can be achieved through the following steps B1-B3:

[0059] Step B1: Determine the specified node in the full network graph.

[0060] Here, a designated node refers to a designated user, who can be a suspicious user. Optionally, a user's user information and business information can be used to determine whether a user is suspicious. For example, in a financial business scenario, a user's user information includes their user ID and geographical location, while the business information includes multiple transaction amounts, all of which are investment transactions, and the payee is an individual. Since the payee for investment transactions is generally a company or institution, based on the user's user information and business information, it can be determined that the user's multiple transactions are suspicious, i.e., the user is a suspicious user.

[0061] Step B2: Search for the first node in the entire network graph that is connected to the specified node, according to the preset search depth.

[0062] The search depth can be set according to the actual business scenario, such as 1 degree, 2 degrees, 3 degrees, etc. A search depth of 1 degree means searching for nodes directly connected to the specified node in the entire network graph, which are then used as the first node; a search depth of 2 degrees means searching for intermediate nodes directly connected to the specified node in the entire network graph, as well as nodes directly connected to intermediate nodes, which are then used as the first node; and so on.

[0063] Step B3: Determine the first node obtained from the search as the target node.

[0064] In the embodiments of this specification, nodes that have an n-degree connection (n ranges from 1 to n) with a predetermined specified node are searched in the full network relationship graph and are used as first nodes. If the specified node is a suspicious user, then all the first nodes found in the search are users who are associated with the suspicious user. These users may also be suspicious users to some extent. It can be seen that this technical solution can accurately and efficiently filter out user groups that are consistent with the characteristics of the specified node (such as being suspicious users).

[0065] In one embodiment, filtering target nodes that meet preset filtering conditions in the entire network graph (i.e., step A3) can be achieved through the following steps C1-C2:

[0066] Step C1: Input the nodes in the full network graph into the pre-trained scoring model so that the scoring model scores the nodes and outputs the corresponding scores.

[0067] Optionally, during the training of the scoring model, sample users can be used as input data, and their corresponding scores as output data. The label scores of the sample users serve as supervision. The model parameters are trained by calculating the loss function between the label scores of the sample users and the model output data, until the loss function converges. Optionally, the sample users can include positive samples (e.g., suspicious users) and negative samples (e.g., normal users). Specifically, the model input data can be user information and business information.

[0068] Step C2: If the score corresponding to a node is greater than or equal to a preset score threshold, then the node is determined as the target node.

[0069] In the embodiments of this specification, since the results obtained by the model processing are highly accurate, the scoring model pre-trained can score users in the entire network relationship graph, which can more accurately determine qualitative user groups, such as identifying groups of suspicious users.

[0070] In one embodiment, after filtering target nodes that meet the preset filtering conditions in the entire network graph through steps B1-B3 or steps C1-C2, hotspot removal and / or whitelisting operations can be performed to remove nodes that are significantly different from other nodes. Hotspot removal primarily removes users with very high in-degree and out-degree ratios from all target nodes. For example, users from shopping malls, supermarkets, and banks are easily selected as target nodes because they involve a large number of users and transactions. Similarly, whitelisting removes users with known conclusions and no suspicion (such as users from shopping malls, supermarkets, and banks).

[0071] In one embodiment, the first clustering algorithm may include a force-oriented algorithm and a density-based clustering algorithm. Using the first clustering algorithm to perform density-based clustering on the first risk group relationship graph to obtain the second risk group relationship graph corresponding to the target user group (i.e., S104) can be performed as follows: steps D1-D5:

[0072] Step D1: Initialize the initial positions of the nodes in the first risk group relationship graph.

[0073] Optionally, the first risk group relationship graph can be described as the following vertex-edge tuple g = [n, e], that is:

[0074]

[0075] Where g is the relationship graph of the first risk group, n is the set of nodes in the relationship graph of the first risk group, node1 to node5 are the first to fifth nodes in the relationship graph of the first risk group, and e is the set of edges in the relationship graph of the first risk group. 12 The edge is the edge between the first node and the second node. 23 The edge is the edge between the second and third nodes. 14 The edge is the edge between the 1st node and the 4th node. 35 The edge is the edge between the 3rd node and the 5th node. 45 The edge between the 4th and 5th nodes is as follows: Figure 2 As shown.

[0076] Optionally, initialization can be randomized. For each node, the initial position can be (,y).

[0077] Step D2: For each node, calculate the resultant force of the node under the action of tension, thrust, and centripetal force. Calculate the distance the node moves under the action of the resultant force. Update the current position of the node based on the initial position and the distance moved.

[0078] Regarding the forces between nodes, the following assumptions are made: 1) There is a repulsive force (i.e., a pushing force) between any two nodes, the magnitude of which is calculated according to Coulomb's law; 2) There is an attractive force (i.e., a pulling force) between two nodes with an edge, the magnitude of which is calculated according to Hooke's law; 3) Every node experiences a centripetal force, the magnitude of which is calculated according to the law of universal gravitation. Therefore, the force f on all nodes can be defined as:

[0079]

[0080] Among them, f push Let d represent the thrust, k1 represent the Coulomb constant, and d represent the thrust. ijf represents the distance between the i-th node and the j-th node in the first risk group relationship graph. pull The edge represents the tension, k2 is a constant, and is the edge between the i-th node and the j-th node. ij When it exists, Otherwise, f pull =0. f attract Let k represent centripetal force, k3 represent the gravitational constant, and d represent the gravitational force. i_center This represents the distance between the i-th node and the center node. (Center node) `width` represents the width of the first risk group relationship graph, and `height` represents the height of the first risk group relationship graph.

[0081] For example, such as Figure 2 As shown, in the first risk group relationship diagram, the dashed line represents the thrust between nodes, the double-headed arrow represents the pull between nodes, and the single-headed arrow represents the centripetal force between nodes.

[0082] Optionally, under the above assumptions, based on Newton's second law, the distance (d) that the node moves under the action of the resultant force can be calculated. x ,d y Based on Newton's second law, the node will move in the direction of the net force. Therefore, based on the initial position and the distance moved, the current position of the node is updated, and the current position of the node can be (xd). x ,yd y ).

[0083] Step D3: Iteratively update the current position of the node until the iteration termination condition is met, and then determine the final position of the node.

[0084] Optionally, the iteration termination condition can be that the number of iterations of the force-directed algorithm described in step D2 reaches a preset threshold. The final position of a node in the first risk group relationship graph can be represented by P:

[0085] P=(X,Y)=[(x1,y1),(x2,y2)…(x n-1 ,y n-1 ),(x n ,y n )).

[0086] exist Figure 2 In the illustrated embodiment, the final positions of the five nodes in the first risk group relationship graph can be represented as follows:

[0087] P=(X,Y)=[(x1,y1),(x2,y2),(x3,y3),(x4,y4),(x5,y5)].

[0088] In the embodiments of this specification, steps D1 to D3 introduce a force-oriented algorithm, which can be described as follows: for the first risk group relationship graph g = [n, e] input to the force-oriented algorithm, a planar coordinate sequence P = (X, Y) can be obtained.

[0089] Step D4: Based on the final position of each node and the preset distance between nodes, perform density-based clustering on the first risk group relationship graph to obtain at least one cluster.

[0090] In this process, based on the planar coordinate sequence P = (X, Y) obtained in step D3, the first distance between each pair of nodes can be calculated. If the first distance is less than or equal to the preset distance between nodes, the two nodes are grouped into a cluster. The clustering process is stopped when the clusters to which all nodes belong no longer change, resulting in multiple clusters with better density.

[0091] Step D5: Based on the clustering, determine the relationship graph of the second risk group.

[0092] In this process, all nodes in the cluster and the edges between every two nodes can be used as nodes and edges in the second risk group relationship graph.

[0093] In the embodiments of this specification, steps D4 to D5 introduce a density clustering algorithm that can determine multiple second risk group relationship graphs with better density from the first risk group relationship graph, providing a data foundation for improving the density between members of the finally determined risk group.

[0094] In one embodiment, the second clustering algorithm may include the K-core algorithm and the maximum connectivity graph algorithm. Using the second clustering algorithm to perform connectivity-based clustering on the second risk group relationship graph to obtain the target risk group relationship graph corresponding to the target user group (i.e., S106) can be performed as follows: steps E1-E3:

[0095] The K-core algorithm is used to find tightly connected subgraph structures in a graph that meet a specified core degree. In the resulting subgraph, each vertex has at least K degrees, and all vertices are connected to at least K other nodes in the subgraph. The K-core algorithm is commonly used to partition a graph into subgraphs, removing unimportant vertices to expose the subgraphs that meet the expected criteria for further analysis. Due to its linear time complexity and intuitive interpretability, the K-core algorithm has numerous applications in fields such as risk control finance, social networks, and biology.

[0096] Step E1: Remove nodes with a degree less than a preset threshold from the second risk group relationship graph to obtain the first subgraph.

[0097] In this graph, the degree of a node represents the number of other nodes connected to that node in the second risk group relationship graph. For example, taking a preset threshold of 2 as an example, i.e. using the 2-core algorithm, the second risk group relationship graph is as follows: Figure 3 As shown in (a), it contains 9 nodes, by... Figure 3 In (a), nodes with a degree less than a preset threshold are removed, resulting in the first subgraph as shown below. Figure 3 As shown in (b), it contains 6 nodes.

[0098] Step E2: Remove nodes with a degree less than a preset threshold from the first subgraph to obtain the second subgraph.

[0099] Using the example from step E1, by Figure 3 In (b), nodes with a degree less than a preset threshold are removed, resulting in the second subgraph as shown. Figure 3 As shown in (c), it contains 4 nodes.

[0100] In the embodiments of this specification, steps E1 to E2 introduce a K-core algorithm that can determine a second subgraph with better density from each second risk group relationship graph, providing a data foundation for improving the density between members of the finally determined risk groups. Furthermore, it can, to a certain extent, eliminate chain-like structures in the second risk group relationship graph, which are unacceptable in some business scenarios. By eliminating such structures, the second subgraph can better meet the requirements of the business scenario.

[0101] Step E3: If all nodes in the second subgraph are connected, the second subgraph is determined as the target risk group relationship graph.

[0102] Specifically, the maximum connectivity algorithm can be used to determine whether all nodes in the second subgraph are connected. If there are disconnected nodes in the second subgraph, they are removed. If there are no disconnected nodes in the second subgraph, then all nodes in the second subgraph are considered connected. The second subgraph can be used as the target risk group relationship graph by taking all nodes in the second subgraph and the edges between every two nodes as the nodes and edges of the target risk group relationship graph.

[0103] In the embodiments of this specification, the connectivity relationship of the second subgraph clustered by the K-core algorithm is further determined by the maximum connectivity graph algorithm. If all nodes in the second subgraph are determined to be connected, the second subgraph is determined as the target risk group relationship graph, and the risk group is finally obtained. This can ensure that the members in the risk group are connected, and the connection indicates that there is a relationship between two users, thus ensuring the accuracy of the determined risk group.

[0104] In one embodiment, the risk group analysis method provided in this specification can be applied to scenarios involving risk group analysis of suspicious users on a business platform. The suspicious user group can be a group of users who have engaged in suspicious or non-compliant behavior. In related technologies, risk group analysis of suspicious users is generally based on the Louvain community detection algorithm to obtain the n communities with the highest modularity. However, these n communities are only a preliminary aggregation result, and the tightness between members usually cannot be guaranteed. Figure 4 As shown in (a), this is the risk group analysis result obtained based on the Louvain community detection algorithm. The risk group includes 11 members, indicating a relatively poor density among them. However, the risk group analysis method provided in the embodiments of this specification can further perform a two-step clustering algorithm on the aggregation results obtained from the Louvain community detection algorithm, ultimately yielding the risk group analysis result, as shown below. Figure 4 As shown in (b), there are two risk groups, one with 4 members and the other with 6 members. It can be seen that, compared to... Figure 4 Regarding (a), Figure 4 The division shown in (b) is clearly superior, with each risk group exhibiting better connectivity and tightness. Figure 5 The illustrated embodiment uses this scenario as an example for explanation.

[0105] Figure 5 This is a schematic flowchart illustrating a risk group analysis method according to another embodiment of this specification. In this embodiment, the target user group is a suspicious user group. Figure 5 As shown, risk group analysis methods may include:

[0106] S501, obtain the first risk group relationship diagram corresponding to the suspicious user group.

[0107] In the first risk group relationship graph, the nodes represent users in the suspicious user group, and the edge between two nodes in the first risk group relationship graph represents the connection established between the corresponding two users under the preset association logic.

[0108] S502, Initialize the initial positions of the nodes in the first risk group relationship graph.

[0109] S503: For each node, calculate the resultant force of the node under the action of tension, thrust and centripetal force; calculate the distance the node moves under the action of the resultant force; update the current position of the node based on the initial position and the distance moved.

[0110] S504 iteratively updates the current position of the node until the iteration termination condition is met, then determines the final position of the node.

[0111] S505, based on the final position of each node and the preset distance between nodes, perform density-based clustering on the first risk group relationship graph to obtain at least one cluster.

[0112] S506, based on clustering, determines the relationship graph of the second risk group.

[0113] S507, Remove nodes with a degree less than a preset threshold from the second risk group relationship graph to obtain the first subgraph.

[0114] In this context, the degree of a node represents the number of other nodes connected to it in the second risk group relationship graph.

[0115] S508, Remove nodes with a degree less than a preset threshold in the first subgraph to obtain the second subgraph.

[0116] S509, if all nodes in the second subgraph are connected, the second subgraph is determined as the target risk group relationship graph.

[0117] S510 generates risk group analysis results corresponding to suspicious user groups based on the target risk group relationship diagram.

[0118] The specific processes of S501-S510 described above have been explained in detail in the above embodiments and will not be repeated here.

[0119] By employing the technical solutions of one or more embodiments of this specification, after obtaining the first risk group relationship graph corresponding to the suspicious user group, a force-directed algorithm and a density clustering algorithm can be used to perform density-based clustering on the first risk group relationship graph to obtain a second risk group relationship graph corresponding to the target user group. This results in the second risk group relationship graph having better node density compared to the first risk group relationship graph. Furthermore, the K-core algorithm and the maximum connectivity algorithm are used to perform connectivity-based clustering on the second risk group relationship graph to obtain a target risk group relationship graph corresponding to the suspicious user group. This results in the target risk group relationship graph having better node connectivity compared to the second risk group relationship graph. As can be seen, this technical solution, by performing clustering based on density and connectivity on the initially determined risk group relationship graph (i.e., the first risk group relationship graph), can obtain a target risk group relationship graph with better connectivity and density between nodes. Based on the target risk group relationship graph, risk group analysis results corresponding to suspicious user groups can be generated, resulting in risk groups with better connectivity and density. Compared with the method of directly obtaining risk group analysis results from the first risk group relationship graph, this improves the accuracy of the identified risk groups.

[0120] In summary, specific embodiments of this subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing can be advantageous.

[0121] The above are risk group analysis methods provided by one or more embodiments of this specification. Based on the same idea, one or more embodiments of this specification also provide a risk group analysis device.

[0122] Figure 6 This is a schematic block diagram of a risk group analysis device according to an embodiment of this specification. Please refer to... Figure 6 The risk group analysis device may include:

[0123] The acquisition module 610 is used to acquire the first risk group relationship graph corresponding to the target user group; the nodes in the first risk group relationship graph represent users in the target user group, and the edge between two nodes in the first risk group relationship graph represents the connection established between the corresponding two users under the preset association logic;

[0124] The first clustering module 620 is used to perform density-based clustering on the first risk group relationship graph using the first clustering algorithm to obtain the second risk group relationship graph corresponding to the target user group.

[0125] The second clustering module 630 is used to perform connectivity-based clustering on the second risk group relationship graph using the second clustering algorithm to obtain the target risk group relationship graph corresponding to the target user group.

[0126] The generation module 640 is used to generate risk group analysis results corresponding to the target user group based on the target risk group relationship diagram.

[0127] In one embodiment, the first clustering module 620 includes:

[0128] An initialization unit is used to initialize the initial positions of nodes in the first risk group relationship graph;

[0129] The calculation and update unit is used to calculate the resultant force of the node under the action of tension, thrust and centripetal force for each node; calculate the distance the node moves under the action of the resultant force; and update the current position of the node based on the initial position and the distance moved.

[0130] The iterative update unit is used to iteratively update the current position of the node until the iteration termination condition is met, and then determine the final position of the node.

[0131] The first clustering unit is used to perform density-based clustering on the first risk group relationship graph based on the final position of each node and the preset distance between nodes, so as to obtain at least one cluster.

[0132] The first determining unit is used to determine the relationship diagram of the second risk group based on the clustering.

[0133] In one embodiment, the second clustering module 630 includes:

[0134] The first node processing unit is used to remove nodes with a degree less than a preset threshold in the second risk group relationship graph to obtain a first subgraph; wherein, the degree of a node represents the number of other nodes connected to the node in the second risk group relationship graph;

[0135] The second node processing unit is used to remove nodes in the first subgraph whose degree is less than a preset threshold to obtain the second subgraph.

[0136] The second determining unit is used to determine the second subgraph as a target risk group relationship graph when all nodes in the second subgraph are connected.

[0137] In one embodiment, the acquisition module 610 includes:

[0138] The acquisition unit is used to acquire user information and business information.

[0139] The relationship graph construction unit is used to construct a full network relationship graph based on user information and business information. Nodes in the full network relationship graph represent users, and the edge between two nodes in the full network relationship graph represents the connection established between the corresponding two users under the preset association logic.

[0140] The node filtering unit is used to filter target nodes that meet preset filtering conditions in the entire network relationship graph to obtain the target user group.

[0141] The third determining unit is used to determine the target network relationship diagram based on the target user group;

[0142] The second clustering unit is used to cluster the target network relationship graph using the third clustering algorithm to obtain the first risk group relationship graph.

[0143] In one embodiment, the node filtering unit is specifically used for:

[0144] Identify a specific node in the full network graph;

[0145] Search for the first node in the entire network graph that is connected to the specified node, according to the preset search depth.

[0146] The first node obtained from the search is identified as the target node.

[0147] In one embodiment, the node filtering unit is specifically used for:

[0148] The nodes in the full network graph are input into a pre-trained scoring model so that the scoring model scores the nodes and outputs the corresponding scores.

[0149] If the score corresponding to a node is greater than or equal to a preset score threshold, the node is determined as the target node.

[0150] In one embodiment, the third clustering algorithm is a community detection algorithm.

[0151] By employing the technical solutions of one or more embodiments of this specification, after obtaining the first risk group relationship graph corresponding to the target user group, a first clustering algorithm can be used to perform density-based clustering on the first risk group relationship graph to obtain a second risk group relationship graph corresponding to the target user group. This results in a second risk group relationship graph with better node density compared to the first risk group relationship graph. Furthermore, a second clustering algorithm is used to perform connectivity-based clustering on the second risk group relationship graph to obtain a target risk group relationship graph corresponding to the target user group. This target risk group relationship graph has better node connectivity compared to the second risk group relationship graph. Therefore, this technical solution, by performing density- and connectivity-based clustering on the initially determined risk group relationship graph (i.e., the first risk group relationship graph), can obtain a target risk group relationship graph with better node connectivity and density. Based on the target risk group relationship graph, risk group analysis results corresponding to the target user group can be generated, resulting in risk groups with better connectivity and density. Compared to directly obtaining risk group analysis results from the first risk group relationship graph, this improves the accuracy of the identified risk groups. Furthermore, since this technical solution analyzes at-risk groups through clustering, a relatively conventional method that is not limited to specific application scenarios, it is versatile and can achieve good results in analyzing at-risk groups across various application scenarios.

[0152] Those skilled in the art will understand that the above-described risk group analysis device can be used to implement the risk group analysis method described above. The detailed description therein should be similar to the description in the method section above, and will not be repeated here to avoid being cumbersome.

[0153] Based on the same idea, one or more embodiments of this specification also provide a risk group analysis device, such as... Figure 7As shown. Risk group analysis devices can vary considerably due to differences in configuration or performance, and may include one or more processors 701 and memory 702. Memory 702 may store one or more application programs or data. Memory 702 may be temporary or persistent storage. The application programs stored in memory 702 may include one or more modules (not shown), each module including a series of computer-executable instructions for the risk group analysis device. Furthermore, processor 701 may be configured to communicate with memory 702 and execute the series of computer-executable instructions in memory 702 on the risk group analysis device. The risk group analysis device may also include one or more power supplies 703, one or more wired or wireless network interfaces 704, one or more input / output interfaces 705, and one or more keyboards 706.

[0154] Specifically, in this embodiment, the risk group analysis device includes a memory and one or more programs, wherein one or more programs are stored in the memory, and one or more programs may include one or more modules, and each module may include a series of computer-executable instructions for the risk group analysis device, and is configured to be executed by one or more processors. The one or more programs include computer-executable instructions for performing the following:

[0155] Obtain the first risk group relationship graph corresponding to the target user group; the nodes in the first risk group relationship graph represent users in the target user group, and the edge between two nodes in the first risk group relationship graph represents the connection established between the two users under the preset association logic;

[0156] The first clustering algorithm is used to perform density-based clustering on the first risk group relationship graph to obtain the second risk group relationship graph corresponding to the target user group;

[0157] The second clustering algorithm is used to perform connectivity-based clustering on the second risk group relationship graph to obtain the target risk group relationship graph corresponding to the target user group;

[0158] Based on the target risk group relationship diagram, generate risk group analysis results corresponding to the target user group.

[0159] By employing the technical solutions of one or more embodiments of this specification, after obtaining the first risk group relationship graph corresponding to the target user group, a first clustering algorithm can be used to perform density-based clustering on the first risk group relationship graph to obtain a second risk group relationship graph corresponding to the target user group. This results in a second risk group relationship graph with better node density compared to the first risk group relationship graph. Furthermore, a second clustering algorithm is used to perform connectivity-based clustering on the second risk group relationship graph to obtain a target risk group relationship graph corresponding to the target user group. This target risk group relationship graph has better node connectivity compared to the second risk group relationship graph. Therefore, this technical solution, by performing density- and connectivity-based clustering on the initially determined risk group relationship graph (i.e., the first risk group relationship graph), can obtain a target risk group relationship graph with better node connectivity and density. Based on the target risk group relationship graph, risk group analysis results corresponding to the target user group can be generated, resulting in risk groups with better connectivity and density. Compared to directly obtaining risk group analysis results from the first risk group relationship graph, this improves the accuracy of the identified risk groups. Furthermore, since this technical solution analyzes at-risk groups through clustering, a relatively conventional method that is not limited to specific application scenarios, it is versatile and can achieve good results in analyzing at-risk groups across various application scenarios.

[0160] One or more embodiments of this specification also provide a storage medium storing one or more computer programs, the one or more computer programs including instructions that, when executed by an electronic device including multiple applications, enable the electronic device to perform various processes of the above-described risk group analysis method embodiments, and specifically for performing:

[0161] Obtain the first risk group relationship graph corresponding to the target user group; the nodes in the first risk group relationship graph represent users in the target user group, and the edge between two nodes in the first risk group relationship graph represents the connection established between the two users under the preset association logic;

[0162] The first clustering algorithm is used to perform density-based clustering on the first risk group relationship graph to obtain the second risk group relationship graph corresponding to the target user group;

[0163] The second clustering algorithm is used to perform connectivity-based clustering on the second risk group relationship graph to obtain the target risk group relationship graph corresponding to the target user group;

[0164] Based on the target risk group relationship diagram, generate risk group analysis results corresponding to the target user group.

[0165] By employing the technical solutions of one or more embodiments of this specification, after obtaining the first risk group relationship graph corresponding to the target user group, a first clustering algorithm can be used to perform density-based clustering on the first risk group relationship graph to obtain a second risk group relationship graph corresponding to the target user group. This results in a second risk group relationship graph with better node density compared to the first risk group relationship graph. Furthermore, a second clustering algorithm is used to perform connectivity-based clustering on the second risk group relationship graph to obtain a target risk group relationship graph corresponding to the target user group. This target risk group relationship graph has better node connectivity compared to the second risk group relationship graph. Therefore, this technical solution, by performing density- and connectivity-based clustering on the initially determined risk group relationship graph (i.e., the first risk group relationship graph), can obtain a target risk group relationship graph with better node connectivity and density. Based on the target risk group relationship graph, risk group analysis results corresponding to the target user group can be generated, resulting in risk groups with better connectivity and density. Compared to directly obtaining risk group analysis results from the first risk group relationship graph, this improves the accuracy of the identified risk groups. Furthermore, since this technical solution analyzes at-risk groups through clustering, a relatively conventional method that is not limited to specific application scenarios, it is versatile and can achieve good results in analyzing at-risk groups across various application scenarios.

[0166] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0167] For ease of description, the above apparatus is described by dividing it into various functional units. Of course, when implementing one or more embodiments of this specification, the functions of each unit can be implemented in one or more software and / or hardware.

[0168] Those skilled in the art will understand that one or more embodiments of this specification can be provided as a method, system, or computer program product. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0169] This specification describes one or more embodiments of methods, apparatus (systems), and computer program products according to embodiments of this specification with reference to flowchart illustrations and / or block diagrams. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, produce a machine for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0170] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0171] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0172] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0173] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0174] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0175] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0176] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. This specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0177] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0178] The above description is merely one or more embodiments of this specification and is not intended to limit this application. Various modifications and variations can be made to the one or more embodiments of this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of one or more embodiments of this specification should be included within the scope of the claims of one or more embodiments of this specification.

Claims

1. A method for analyzing risk groups, comprising: Obtain the relationship diagram of the first risk group corresponding to the target user group; The nodes in the first risk group relationship graph represent users in the target user group, and the edge between two nodes in the first risk group relationship graph represents the connection established between the two users under the preset association logic. The first risk group relationship graph is obtained by clustering the target network relationship graph. The first clustering algorithm is used to perform density-based clustering on the first risk group relationship graph to obtain the second risk group relationship graph corresponding to the target user group. The first clustering algorithm includes a force-oriented algorithm and a density clustering algorithm. The second clustering algorithm is used to perform connectivity-based clustering on the second risk group relationship graph to obtain the target risk group relationship graph corresponding to the target user group. The second clustering algorithm includes the K-core algorithm and the maximum connectivity graph algorithm. The maximum connectivity graph algorithm is used to determine whether all nodes in the second subgraph are connected. The second subgraph is obtained by processing the second risk group relationship graph using the K-core algorithm. Based on the target risk group relationship diagram, risk group analysis results corresponding to the target user group are generated.

2. The method according to claim 1, wherein the step of using a first clustering algorithm to perform density-based clustering on the first risk group relationship graph to obtain a second risk group relationship graph corresponding to the target user group comprises: Initialize the initial positions of the nodes in the first risk group relationship graph; For each node, calculate the resultant force of the node under the action of tension, thrust and centripetal force; Calculate the distance the node moves under the action of the resultant force; Update the current position of the node based on the initial position and the moving distance; The current position of the node is iteratively updated until the iteration termination condition is met, at which point the final position of the node is determined. Based on the final position of each node and the preset distance between nodes, density-based clustering is performed on the first risk group relationship graph to obtain at least one cluster. Based on the clusters, the relationship graph of the second risk group is determined.

3. The method according to claim 1, wherein the step of using a second clustering algorithm to perform connectivity-based clustering on the second risk group relationship graph to obtain the target risk group relationship graph corresponding to the target user group includes: Remove nodes with a degree less than a preset threshold from the second risk group relationship graph to obtain a first subgraph; wherein, the degree of a node represents the number of other nodes connected to the node in the second risk group relationship graph; Remove nodes with a degree less than a preset threshold from the first subgraph to obtain the second subgraph; If all nodes in the second subgraph are connected, the second subgraph is determined as the target risk group relationship graph.

4. The method according to claim 1, wherein obtaining the first risk group relationship diagram corresponding to the target user group includes: Obtain user information and business information; Based on the user information and the business information, a full network relationship graph is constructed; The nodes in the full network graph represent the users, and the edges between two nodes in the full network graph represent the connections established between the corresponding two users under the preset association logic. By filtering the target nodes in the full network graph that meet the preset filtering conditions, the target user group is obtained; Based on the target user group, determine the target network relationship graph; The target network relationship graph is clustered using a third clustering algorithm to obtain the first risk group relationship graph.

5. The method according to claim 4, wherein filtering target nodes that meet preset filtering conditions in the full network graph includes: Determine a specific node in the full network graph; According to the preset search depth, search for the first node in the full network graph that is connected to the specified node; The first node obtained from the search is determined as the target node.

6. The method according to claim 4, wherein filtering target nodes that meet preset filtering conditions in the full network graph includes: The nodes in the full network graph are input into a pre-trained scoring model so that the scoring model scores the nodes and outputs the corresponding scores for the nodes. If the score corresponding to the node is greater than or equal to a preset score threshold, the node is determined to be the target node.

7. The method according to claim 4, wherein the third clustering algorithm is a community detection algorithm.

8. A risk group analysis device, comprising: The acquisition module is used to obtain the first risk group relationship diagram corresponding to the target user group; The nodes in the first risk group relationship graph represent users in the target user group, and the edge between two nodes in the first risk group relationship graph represents the connection established between the two users under the preset association logic. The first risk group relationship graph is obtained by clustering the target network relationship graph. The first clustering module is used to perform density-based clustering on the first risk group relationship graph using a first clustering algorithm to obtain a second risk group relationship graph corresponding to the target user group. The first clustering algorithm includes a force-oriented algorithm and a density clustering algorithm. The second clustering module is used to perform connectivity-based clustering on the second risk group relationship graph using a second clustering algorithm to obtain the target risk group relationship graph corresponding to the target user group. The second clustering algorithm includes the K-core algorithm and the maximum connectivity algorithm. The maximum connectivity algorithm is used to determine whether all nodes in the second subgraph are connected. The second subgraph is obtained by processing the second risk group relationship graph using the K-core algorithm. The generation module is used to generate risk group analysis results corresponding to the target user group based on the target risk group relationship diagram.

9. A risk group analysis device, comprising: processor; as well as A memory configured to store computer-executable instructions, which, when executed, enable the processor to: Obtain the first risk group relationship graph corresponding to the target user group; the nodes in the first risk group relationship graph represent users in the target user group, the edge between two nodes in the first risk group relationship graph represents the connection established between the two users under the preset association logic, and the first risk group relationship graph is obtained by clustering the target network relationship graph; The first clustering algorithm is used to perform density-based clustering on the first risk group relationship graph to obtain the second risk group relationship graph corresponding to the target user group. The first clustering algorithm includes a force-oriented algorithm and a density clustering algorithm. The second clustering algorithm is used to perform connectivity-based clustering on the second risk group relationship graph to obtain the target risk group relationship graph corresponding to the target user group. The second clustering algorithm includes the K-core algorithm and the maximum connectivity graph algorithm. The maximum connectivity graph algorithm is used to determine whether all nodes in the second subgraph are connected. The second subgraph is obtained by processing the second risk group relationship graph using the K-core algorithm. Based on the target risk group relationship diagram, risk group analysis results corresponding to the target user group are generated.

10. A storage medium for storing computer-executable instructions, which, when executed by a processor, perform the following process: Obtain the first risk group relationship graph corresponding to the target user group; the nodes in the first risk group relationship graph represent users in the target user group, the edge between two nodes in the first risk group relationship graph represents the connection established between the two users under the preset association logic, and the first risk group relationship graph is obtained by clustering the target network relationship graph; The first clustering algorithm is used to perform density-based clustering on the first risk group relationship graph to obtain the second risk group relationship graph corresponding to the target user group. The first clustering algorithm includes a force-oriented algorithm and a density clustering algorithm. The second clustering algorithm is used to perform connectivity-based clustering on the second risk group relationship graph to obtain the target risk group relationship graph corresponding to the target user group. The second clustering algorithm includes the K-core algorithm and the maximum connectivity graph algorithm. The maximum connectivity graph algorithm is used to determine whether all nodes in the second subgraph are connected. The second subgraph is obtained by processing the second risk group relationship graph using the K-core algorithm. Based on the target risk group relationship diagram, risk group analysis results corresponding to the target user group are generated.

Images