Abnormal object identification methods, devices, computing equipment, and storage media

Abstract

An abnormal object identification method, apparatus, computing device, and storage medium are provided. The method may include: determining interaction-related objects associated with pre-labeled abnormal objects based on interaction data within a first preset time period; constructing an object network graph based on interaction data within a second preset time period and using the abnormal objects and interaction-related objects, wherein the duration of the second preset time period is the same as or different from the duration of the first preset time period; dividing the object network graph into communities to obtain at least one network subgraph, wherein each network subgraph corresponds to a divided object community; and using a graph neural network model to predict the object category corresponding to a node in the at least one network subgraph to identify unlabeled abnormal objects. Embodiments of this disclosure can be used in fields such as intelligent transportation, cybersecurity, and third-party payment.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and more specifically, to a method, apparatus, computing device, and computer-readable storage medium for identifying abnormal objects. Background Technology

[0002] In recent years, with the development of computer technology, the third-party payment market has maintained a high-speed growth trend. At the same time, various illegal transactions aimed at illicit profit have also begun to emerge in large numbers, gradually becoming more complex and large-scale, greatly affecting the stability of the third-party payment environment. Furthermore, in other scenarios involving object interaction, some abnormal objects may exist, causing the interaction between objects to fail to achieve its intended purpose.

[0003] Identifying risky and anomalous objects in multi-object interaction scenarios is a significant challenge for enterprises. Deep learning / machine learning models can be trained on interaction data, and these trained models can then be used to detect anomalous interactions. However, because the interaction data between objects is non-Euclidean data without a fixed topological structure and lacks translation invariance, the structure surrounding each node is unique. This significantly limits the application of existing deep learning / machine learning models.

[0004] Therefore, there is a need to provide an efficient and accurate method for identifying abnormal objects. Summary of the Invention

[0005] According to one aspect of this disclosure, a method for identifying anomalous objects is provided. The method may include: determining interaction-related objects associated with the anomalous objects based on interaction data within a first preset time period, wherein the anomalous objects are pre-labeled; constructing an object network graph based on interaction data within a second preset time period and using the anomalous objects and the interaction-related objects, wherein each node in the object network graph represents an object, each edge represents the correlation between two objects corresponding to its two endpoints, and the weight of each edge represents the degree of correlation between the two objects corresponding to its two endpoints, the duration of the second preset time period being the same as or different from the duration of the first preset time period; performing community partitioning on the object network graph to obtain at least one network subgraph, wherein each network subgraph corresponds to a partitioned object community; and using a graph neural network model to predict the object category corresponding to the nodes in the at least one network subgraph to identify unlabeled anomalous objects.

[0006] According to another aspect of this disclosure, an apparatus for identifying anomalous objects is also provided. The apparatus includes: a determination module, configured to determine interaction-related objects associated with the anomalous objects based on interaction data within a first preset time period, wherein the anomalous objects are pre-labeled; a network construction module, configured to construct an object network graph based on interaction data within a second preset time period and using the anomalous objects and interaction-related objects, wherein each node in the object network graph represents an object, each edge represents the correlation between the two objects corresponding to its two endpoints, and the weight of each edge represents the degree of correlation between the two objects corresponding to its two endpoints, and the duration of the second preset time period may be the same as or different from the duration of the first preset time period; a partitioning module, configured to partition the object network graph into communities to obtain at least one network subgraph, wherein each network subgraph corresponds to a partitioned object community; and an identification module, configured to predict the object category corresponding to a node in the at least one network subgraph using a graph neural network model to identify the anomalous objects.

[0007] According to another aspect of this disclosure, a computing device is also provided, comprising: a processor; and a memory. The memory stores a computer program that, when executed by the processor, causes the one or more processing units to perform the following method: determining interaction-related objects associated with anomalies based on interaction data within a first preset time period, wherein the anomalies are pre-labeled; constructing an object network graph based on interaction data within a second preset time period and using the anomalies and the interaction-related objects, wherein each node in the object network graph represents an object, each edge represents the correlation between two objects corresponding to its two endpoints, and the weight of each edge represents the degree of correlation between the two objects corresponding to its two endpoints, the duration of the second preset time period being the same as or different from the duration of the first preset time period; performing community partitioning on the object network graph to obtain at least one network subgraph, wherein each network subgraph corresponds to a partitioned object community; and using a graph neural network model to predict the object category corresponding to a node in the at least one network subgraph to identify anomalies.

[0008] According to another aspect of this disclosure, a computer-readable storage medium is also provided, storing a computer program that, when executed by a processor, causes the processor to perform the steps of the method for identifying abnormal objects as described above.

[0009] According to another aspect of this disclosure, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of the method for identifying abnormal objects as described above.

[0010] In the method for identifying anomalous objects disclosed herein, by providing each divided object community to a graph neural network model to identify the category of the node corresponding to the object, manual costs can be reduced. Furthermore, when using a graph neural network to evaluate the category of an object, the object's own attributes and information about its neighboring object nodes are utilized, which can improve the accuracy of identification. Attached Figure Description

[0011] Figure 1A Exemplary application scenarios in which the technical solutions according to embodiments of this disclosure can be implemented are shown.

[0012] Figure 1B A flowchart illustrating the process of identifying anomalous objects based on a community discovery method is shown.

[0013] Figure 2 A flowchart illustrating a method for identifying anomalous objects according to an embodiment of this disclosure is shown.

[0014] Figure 3 It shows Figure 2 A flowchart illustrating the sub-steps of the process of constructing an object network graph.

[0015] Figure 4 A flowchart illustrating the process of community partitioning based on modularity is shown.

[0016] Figures 5A-5B It shows Figure 2 The process of identifying abnormal objects in [the context of the text].

[0017] Figure 6 A flowchart illustrating the method for training a graph neural network model is shown.

[0018] Figures 7A-7B A structural block diagram of an apparatus for identifying abnormal objects according to an embodiment of the present disclosure is shown.

[0019] Figure 8 A structural block diagram of a computing device according to an embodiment of the present disclosure is shown. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this disclosure more apparent, exemplary embodiments according to this disclosure will now be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this disclosure, and not all embodiments of this disclosure. It should be understood that this disclosure is not limited to the exemplary embodiments described herein.

[0021] In this specification and accompanying drawings, steps and elements that are substantially the same or similar are indicated by the same or similar reference numerals, and repeated descriptions of these steps and elements are omitted. Furthermore, in the description of this disclosure, the terms "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance or order.

[0022] Machine learning is a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, and algorithm complexity theory. It specifically studies how computers can simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of AI and the fundamental approach to enabling computing devices to possess intelligence. Deep learning, on the other hand, is a technique that utilizes deep neural network systems for machine learning. Machine learning / deep learning typically includes various techniques such as artificial neural networks, reinforcement learning (RL), supervised learning, and unsupervised learning.

[0023] Before describing the contents of this disclosure in detail, the following explanations and descriptions are provided for some of the terms that may be used in this document.

[0024] Graph structure: A data structure consisting of several nodes and edges connecting them. Each node can be considered as or corresponds to a sample, and can be represented by an adjacency matrix A, where the elements a in adjacency matrix A are... i,j This represents the connection relationship between node i and node j. For an unweighted graph, a i,j For a weighted graph, a is either 0 or 1. i,j Generally, it's a weight value between 0 and 1. Different values ​​represent the correlation between samples corresponding to two nodes, with 0 indicating no edge between the two nodes. Adjacency matrices are divided into directed graph adjacency matrices and undirected graph adjacency matrices (this article uses undirected graphs as an example). For undirected graphs (undirected simple graphs), the adjacency matrix is ​​always symmetric, and its diagonal is always zero. In this article, graph structure can also be expressed as graph structure data, graph structure information, graph, network, graph network, and similar expressions.

[0025] Graph neural networks (GNNs) model the relationships between nodes in a graph structure. Their input can be understood as the graph structure (represented by the features and topological information of each node). After various operations (e.g., convolution, updates) across multiple GNN layers, the final result is a feature representation of each node (e.g., a high-dimensional feature vector, also known as output features or embeddings), which facilitates tasks such as node classification and graph and subgraph generation. Specific examples include Graph Convolutional Networks (GCNs), Graph Attention Networks (GATs), GraphSAGE networks, Node2vec, and DeepWalk networks.

[0026] Fast Unfolding: A community detection algorithm. Modularity is an important criterion for measuring the quality of community partitioning. The higher the modularity value of the partitioned network, the better the community partitioning effect. The Fast Unfolding algorithm is a community partitioning algorithm based on modularity. Its main goal is to continuously partition communities so that the modularity of the entire partitioned network increases continuously until it no longer changes, thus obtaining the optimal partitioning method.

[0027] Figure 1A An exemplary application scenario 100 in which the technical solutions according to embodiments of this disclosure can be implemented is illustrated. For example... Figure 1A As shown, the application scenario 100 includes a server 110, terminals 120 and 130, and a network 140. Terminals 120 and 130 are communicatively coupled to the server 110 via the network 140. As an example, each object can interact with the server 110 via the network 140 through an application or client on its respective terminal (interaction between objects is not shown in the figure). For example, in a payment scenario, the object could be a buyer object, a merchant object, etc., or it could be a regular user object in other application scenarios. The interaction could be, for example, video interaction, audio interaction, graphic interaction, transaction payment, etc. Figure 1A The document illustrates multiple objects in a payment scenario, including multiple merchant objects and buyer objects.

[0028] As an example, server 110 can collect interaction data between various objects (e.g., multiple merchant objects and buyer objects) on various terminals. Server 110 can then construct an object network graph for a specific type of target object (e.g., a merchant object) involved in the interaction data, according to a specific method. The object network graph includes multiple nodes corresponding to that type of target object and edges connecting the nodes. The node category corresponds to the object category (e.g., whether each target object is a normal object or an abnormal object), and each edge has a weight to represent the degree of correlation between the target objects corresponding to the two nodes connected by each edge. The degree of correlation can be determined, for example, based on the number of other interactive counterparts shared by the two target objects.

[0029] Server 110 can identify the categories of objects in the constructed object network graph by analyzing the graph. Embodiments of this disclosure relate to identifying anomalous objects within the same category of objects (e.g., merchant objects only); therefore, in the following text, the term "object" will refer only to objects of a specific kind (e.g., merchant objects).

[0030] Identifying object categories can begin by using existing models on server 110 to determine a subset of anomalous objects. Then, community detection methods are employed to divide the object's network graph into communities. Communities with a high number of anomalous objects are then submitted to human reviewers, as detailed below. Figure 1B This is described in detail. Alternatively, each of the identified communities can be fed into a graph neural network model to obtain the recognition results, as referenced later. Figure 2-6 As described in detail.

[0031] Optionally, server 110 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The aforementioned terminals 120 and 130 can include, but are not limited to, at least one of the following: mobile phones, tablets, laptops, desktop PCs, digital televisions, and other terminals capable of displaying content. The network 140 can be, for example, a wide area network (WAN), a local area network (LAN), a wireless network, a public telephone network, an intranet, or any other type of network well known to those skilled in the art.

[0032] It should also be noted that, in one or more embodiments of this disclosure, for ease of understanding, the merchant object is used as the object, and the transaction data between the merchant and the counterparty (buyer) is used as the interaction data in a detailed description. However, it should be understood that other scenarios involving interaction, such as social networks and intelligent transportation, can also employ the abnormal object identification method of this disclosure.

[0033] It is understood that, in the context of this disclosure, data related to user information (e.g., interaction data, such as transaction data of merchants or buyers) requires user permission or consent when the embodiments of this disclosure are applied to specific products or technologies, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0034] As mentioned earlier, efficiently and accurately identifying anomalous objects in multi-object interaction scenarios is a crucial foundation for ensuring normal interaction. One approach is to identify anomalous objects based on community detection methods, such as the FastUnfolding algorithm or the InfoMap algorithm.

[0035] Figure 1B A schematic diagram of the process for identifying anomalous objects based on a community detection method is shown. At least a portion of this process is... Figure 1A The server 110 in the middle is executing.

[0036] First, information about known anomalous objects can be obtained. For example, information about known anomalous objects can be obtained over a period of time through existing anomaly detection models (e.g., XGBoost model, Logistic model, decision tree, gambling model, fraud model, etc.) identifying them from interaction data, user reports and approvals, notifications from relevant departments, etc.

[0037] Then, an object network is constructed based on the common interactions between all objects, including abnormal and normal objects.

[0038] Next, the object network is divided into communities using a community detection algorithm to obtain multiple object communities.

[0039] Finally, since the information of anomalous objects is known, objects that are highly related to anomalous objects may also be anomalous objects but have not been labeled. Therefore, for each object community, the number or proportion of labeled anomalous objects within that object community can be determined. When the number or proportion of labeled anomalous objects in one or more anomalous object communities is too large, it indicates that these object communities are highly suspicious. Therefore, these object communities can be pushed to the reviewers, who will conduct anomaly reviews on the objects within them to determine whether there are other unlabeled anomalous objects in these object communities, thus identifying the anomalous objects.

[0040] The above-mentioned method for identifying abnormal users based on community detection algorithms can identify some abnormal objects. Further combining this method with manual review can improve the accuracy of abnormal object identification.

[0041] However, the process of identifying anomalous users based on community detection algorithms requires manual intervention. Considering the cost of manual labor, some communities with a small number or low proportion of labeled anomalous users are not manually reviewed, potentially missing some anomalous users. Furthermore, this method relies solely on interaction data (e.g., transaction data in payment scenarios such as the identifiers of transacting parties, transaction amount, number of transactions, and transaction time) to exclude some communities. It does not consider the attributes of the users themselves (e.g., whether the merchant is certified, their level, registration duration, transaction region, transaction scenario, etc.), which can lead to inaccurate identification results. Therefore, the accuracy of identifying anomalous users needs further improvement.

[0042] Based on this, this disclosure proposes a method for identifying anomalous objects based on a graph neural network model. After dividing the object into communities, the node topology information between the nodes corresponding to the objects in each community is obtained. The node features (representing the object's attributes) and node topology information corresponding to the objects in each community are then provided to the graph neural network model. This ensures that the object's attributes and information from other nodes are considered when identifying the category of each object, resulting in more accurate identification results.

[0043] The following combination Figure 2-6 This describes a method for identifying anomalous objects according to embodiments of the present disclosure.

[0044] Figure 2 A flowchart illustrating a method for identifying anomalous objects according to an embodiment of this disclosure is shown. At least a portion of this process is comprised of... Figure 1A The server 110 in the middle is executing.

[0045] In the context of this disclosure, an anomalous object to be identified may refer to an object that is not marked as an anomalous object but is actually an anomalous object among all the objects to be identified, such as identifying unmarked merchants that are actually anomalous merchants among multiple merchants.

[0046] like Figure 2 As shown, in step S210, interaction-related objects related to abnormal objects are determined based on interaction data within a first preset time period, wherein the abnormal objects are pre-labeled.

[0047] Optionally, the interaction-related object associated with each annotated anomalous object can be an object that shares a common interaction partner with that anomalous object. For example, the interaction-related object associated with each annotated anomalous merchant can be a merchant that shares a common transaction buyer with that anomalous merchant. In the context of this disclosure, two objects being related can mean that these two objects share a common interaction partner.

[0048] For example, for each labeled anomalous object, based on the interaction data within a first preset time period, the interaction counterparts that interacted with the anomalous object within that first preset time period can be identified. Furthermore, for each identified interaction counterpart, other objects that interacted with that counterpart can be identified; these other objects are then considered as interaction-related objects associated with the anomalous object. By identifying the interaction-related objects for each anomalous object, and using the anomalous object and its associated interaction-related objects for subsequent object network graph construction, a suitable framework can be established.

[0049] Optionally, the first preset time period can be a month, a week, or any preset duration.

[0050] In addition, the labeled abnormal objects can be obtained and labeled by existing abnormal identification models (e.g., XGBoost model, Logistic model, decision tree, gambling model, fraud model, etc.) based on the interaction data within the first preset time period, user reports and approvals, notifications from relevant departments, etc.

[0051] Optionally, interaction data may include the identifiers of the interacting parties, the number of interactions, the interaction time, etc., without involving too many attribute characteristics of the objects. For example, interaction data can be transaction data, including the identifiers of the merchant and the other party (buyer), the interaction amount, the number of interactions, the interaction time, etc.

[0052] In step S220, an object network graph is constructed based on the interaction data within the second preset time period and using all abnormal objects and all interaction-related objects. In the object network graph, each node represents an object, each edge represents the relationship between the two objects corresponding to its two end nodes, and the weight of each edge represents the degree of relationship between the two objects corresponding to its two end nodes.

[0053] The duration of the second preset time period may be the same as or different from the duration of the first preset time period. For example, the first preset time period may be one month, used to determine which objects to use to construct the object network graph, as described in step S210; the second preset time period may be half a year or one week, based on the interaction data within the second preset time period to obtain the interaction relationships of the users determined to be used to construct the object network graph, and to determine whether there are edges and the weights of the edges between the nodes in the object network graph.

[0054] The constructed object network graph is a topology structure with multiple nodes, each node corresponding to an object (e.g., a merchant). If any two objects interact with each other within a second preset time period, there will be a direct edge connecting the two nodes corresponding to those two objects, and this edge can have a weight based on the number of objects interacting with each other. The relationships between the nodes (which can also be expressed as node topology information) can be represented by an adjacency matrix.

[0055] In addition, the node features of each node are feature vectors obtained by encoding the attributes of the object corresponding to that node. For example, the node features of the corresponding node can be obtained by encoding based on whether the merchant is certified, the amount of interaction, the level, the registration time, etc.

[0056] The specific steps for constructing an object network graph will be combined with Figure 3 Provide a detailed description.

[0057] In step S230, the object network graph is divided into communities to obtain at least one network subgraph, wherein each network subgraph corresponds to an object community obtained from the division.

[0058] Alternatively, community detection algorithms can be used to partition the constructed object network graph into communities. For example, a community partitioning method based on modularity can be used, which will be discussed later. Figure 4 This explanation uses the Fast unfolding method as an example. Of course, other methods based on modularity for community division can also be used.

[0059] In step S240, a graph neural network model is used to predict the category of the object corresponding to the node in the at least one subgraph of the network in order to identify unlabeled abnormal objects.

[0060] An alternative to manually reviewing only selected communities, as mentioned above. Figure 1B As described, the scheme proposed in the embodiments of this disclosure provides the network subgraph corresponding to each object community to the graph neural network model to identify the category of the nodes corresponding to at least a portion of the objects in the object community (the category of the nodes corresponding to the labeled abnormal objects may not need to be identified again).

[0061] The input to a graph neural network model can include the node features of each node in each subgraph and the node topology information of that subgraph, where the node topology information indicates whether an edge exists between any two nodes in the subgraph and the weight of that edge. A graph neural network model is a trained model; for example, as a classification model, it can process input data to obtain the corresponding object category.

[0062] Optionally, for each network subgraph, a feature matrix is ​​constructed from the node features of all nodes in it as input, and the node topology information can be the sum of the adjacency matrix and the identity matrix of the network subgraph, which is also a matrix. The adjacency matrix can indicate whether there is an edge between any two nodes in the network subgraph and the weight of the edge, and the identity matrix can indicate whether there is a self-connecting edge between the nodes in the network subgraph (the starting point and the ending point of the edge are the same node).

[0063] The specific identification process will be discussed in detail later. Figures 5A-5B describe.

[0064] Reference Figure 2 The described method for identifying anomalous objects reduces manual costs by providing each divided object community to a graph neural network model to identify the category of the node corresponding to the object. Furthermore, when evaluating the category of an object using a graph neural network, the accuracy of identification can be improved by utilizing the object's own attributes and information from its neighboring object nodes.

[0065] To more clearly describe the solutions of the embodiments of this disclosure, reference is made below. Figure 3 Describe the process of constructing the object network graph (S220), refer to Figure 4 To describe the process of community division (step S230), and refer to Figures 5A-5B To describe the process of object category recognition (step S240).

[0066] like Figure 3 As shown, in sub-step S220-1, all abnormal objects and any two objects among all interaction-related objects are matched to obtain multiple object matching pairs.

[0067] For example, assuming the total number of objects, including all exception objects and their associated interaction-related objects, is S, then we can obtain... A number of object matching pairs.

[0068] In sub-step S220-2, for each object pair, the interaction partners and common interaction partners of the two objects in the object pair are determined based on the interaction data within the second preset time period.

[0069] For example, regarding the above Based on the interaction data for each object in the interaction data within the second preset time period, object A1 has s1 interaction partners and object B1 has s2 interaction partners. The common interaction partners of object A1 and object B1 are s.

[0070] In step S230-3, for each object pair where the number of mutual interactions is not zero, the weight of the edge between the nodes corresponding to the two objects is determined based on the number of mutual interactions of each of the two objects in the object pair and the number of mutual interactions.

[0071] For example, still for the object matching pair (A1, B1), the proportion of mutual interactions = (2 * number of mutual interactions) / (number of mutual interactions between object A1 + number of mutual interactions between object B1) = 2s / (s1 + s2). This proportion is used as the weight of the edge between the two nodes corresponding to object A1 and object B1. For example, if object A1 has 2 mutual interactions and object B1 has 3 mutual interactions, and the two objects have 2 mutual interactions, then the proportion of mutual interactions between the two objects is (2 + 2) / (3 + 2) = 4 / 5.

[0072] Of course, if two objects do not interact with each other, i.e., s=0, and there is no direct edge between the nodes corresponding to the two objects, the edge weight can also be considered to be zero.

[0073] In step S220-4, the object network graph is constructed based on all nodes corresponding to all abnormal objects and all interaction-related objects, as well as the weight of each edge as determined.

[0074] For example, the topology of an object network graph includes multiple nodes, and multiple pairs of nodes are connected by edges with defined weights. The node topology information of the object network graph can indicate whether an edge exists between any two nodes and the weight of that edge.

[0075] pass Figure 3 The method for constructing object network graphs can determine whether there are common interactors and their number between any two objects based on the interaction data within a second preset time period. It is simple to operate and requires little computation.

[0076] then, Figure 4 A flowchart illustrating the process of community partitioning based on modularity is shown, with the Fast unfolding method used as an example.

[0077] The goal of community segmentation is to make the connections within the segmented communities relatively tight, while the connections between communities are relatively sparse. Modularity can indicate the quality of community segmentation, with higher modularity indicating better community segmentation.

[0078] Modularity can be characterized by the following formula:

[0079]

[0080] Where Q is the modularity value, and A i,j k represents the weight of the edge between any two nodes (node ​​i and node j) in the object network graph constructed in the previous step. i k represents the sum of the weights of all edges connected to node i. j c represents the sum of the weights of all edges connected to node j. i δ(c) represents the community to which a node is assigned. i ,c j This function is used to determine whether node i and node j are in the same community. If they are, it returns 1; otherwise, it returns 0.

[0081] More specifically, the process of dividing communities based on modularity can be achieved through the following steps.

[0082] Community partitioning algorithms can include two phases.

[0083] Phase 1 (Modularity Optimization Phase): Each node iterates through all its neighboring nodes, attempting to place itself into a neighboring node's community. Since a node can have multiple neighboring nodes, there are multiple possible communities. The community with the largest increase in modularity is selected as the community to be updated for that node. This process is repeated for each node until the modularity can no longer be increased by changing the community to which the node is placed.

[0084] The second stage (community aggregation stage): Each community is merged into a new super node. The edge weight between super nodes is the sum of the weights of all edges between the corresponding two original communities (one end of each edge is a node of one original community, and the other end of the edge is a node of the other original community), forming a new network.

[0085] The two stages described above are repeated iteratively until the modularity no longer increases.

[0086] Figure 4The diagram illustrates an iteration of these two phases. Assuming there are currently 16 nodes (the machine may have already undergone multiple iterations), after the first phase (modularity optimization phase), these 16 nodes are divided into 4 communities. In the second phase (community aggregation phase), the 4 communities are aggregated into 4 super nodes, and the edge weights are updated. Then, the next iteration begins, ultimately resulting in communities where the modularity value no longer changes. Each node in the final community is actually a set of multiple original nodes, thus achieving modularity-based community partitioning.

[0087] In other words, the object network graph can be divided into multiple network subgraphs by modularity. There are fewer connections between network subgraphs, and the connections between nodes within a network subgraph are more compact. Each network subgraph corresponds to an object community and can include at least one node corresponding to an object.

[0088] By reference Figure 4 The described community partitioning method can quickly and easily divide the object network graph constructed in step S220 into at least one network subgraph (each corresponding to an object community), so that the graph neural network model can identify the object category corresponding to the node.

[0089] also, Figures 5A-5B This illustrates more details about the process by which the graph neural network model identifies the object category corresponding to the node of each resulting subgraph of the network.

[0090] like Figure 5A As shown, as an example, suppose in Figure 4 After obtaining the four communities, the modularity no longer increases, that is... Figure 4 The partitioning method is the optimal community partitioning method. In this way, four network subgraphs (1-4) are obtained. These four network subgraphs are provided to the graph neural network model, and the object category corresponding to the node in each network subgraph can be obtained (identification can be performed on only unlabeled nodes or on all nodes).

[0091] Furthermore, such as Figure 5B As shown, step S240 for identifying the category can specifically include the following sub-steps.

[0092] In substep S240-1, initial node features for each node are generated based on the attributes of the object corresponding to each node in the network subgraph.

[0093] For example, the network subgraph includes N1 nodes (some of which are labeled nodes corresponding to anomalous objects, and the rest are unlabeled nodes). For each node, initial node features are generated. Here, as described later, when generating the output features of each node at each layer, it is necessary to aggregate the node features of nodes with connecting edges, so the node features of all nodes need to be obtained.

[0094] In sub-step S240-2, using a graph neural network model, based on the initial node features of each node and the node topology information of the network subgraph, the object category corresponding to each unlabeled node is obtained.

[0095] Optionally, the prediction can be performed only for the object categories corresponding to the unlabeled nodes of the network subgraph, or the prediction can be performed for the object categories corresponding to all nodes of the network subgraph.

[0096] Optionally, the graph neural network model includes at least one graph neural network layer, wherein, in each graph neural network layer, the output features of the current layer for each node are updated based on the initial node features of each node or the output features of the previous layer for each node, the node topology information of the network subgraph, and the parameters of the current layer.

[0097] As an example and not a limitation, each graph neural network layer may include an aggregation sublayer and an update sublayer. For example, the aggregation sublayer may aggregate the output features of the neighboring nodes (directly connected nodes) of each node in the previous layer based on the node topology information of the network subgraph, and the update sublayer may be used to obtain the output features of the current node based on the output features of each node in the previous layer, the aggregated features of the output features of the neighboring nodes of each node, and the parameters of the current layer.

[0098] For example, the data transmission method at each layer can be described as follows:

[0099]

[0100] Where σ() is the activation function; Let A be the node topology information, A be the adjacency matrix of the network subgraph (undirected graph), and I be the node topology information. N It is an identity matrix, which can represent that each node has a self-connection. for The degree matrix is ​​a diagonal matrix. And H represents the sum of the weights of the edges between node i and other nodes j in the network subgraph. (l) W is the output matrix of the l-th layer (including the output features of all nodes); (l) Let be the model parameter matrix for the l-th layer.

[0101] For example, suppose node A is directly connected to B and C, while B and C are not connected (this can be represented in the node topology information). In the process of representing the node features of node A (and similarly for other nodes), at the first layer, the first layer outputs the features for node A. Includes the initial node features of node A (with label). and the initial node characteristics of adjacent nodes B and C and In the second layer, the output features of node A This aggregates the node features from the first layer output of node A (which has a label). The node features of neighboring nodes B and C (unlabeled) in the first layer output and The initial feature vectors of the three nodes can be... Combined into a feature matrix H (0) And the output matrix of the first layer can be derived from... Composition of H (1) The output matrix of the second layer can be Composition of H (2) .

[0102] Optionally, each layer of the graph neural network model processes only first-order neighborhood information (features of directly connected nodes are aggregated), but information transfer across multiple neighborhoods can be achieved by stacking several layers. In the embodiments of this disclosure, a single graph neural network layer can be used to achieve good recognition results and improve computational efficiency.

[0103] Optionally, the process of predicting the object category corresponding to each unlabeled node (which can also be similar to the object category corresponding to labeled nodes) may include: inputting the output features of the last layer for each unlabeled node into an output control function, determining the prediction probability of each unlabeled node being predicted as a different object category, and determining the object category corresponding to that unlabeled node based on the prediction probability of each unlabeled node being predicted as a different object category. Optionally, the object category may include abnormal object categories and normal object categories. Of course, it may also have more subdivided categories based on the actual labels during training.

[0104] Optionally, as mentioned above, the object category for all nodes can be predicted.

[0105] For example, the output control function can be a softmax function. Inputting the output representation (output features, output embedding) of each node into this function will yield values ​​between (0,1) for different categories, which will be used as the predicted probabilities for different categories (e.g., normal or abnormal objects).

[0106] The category of the object with the highest predicted probability can be determined as the category of the object corresponding to that node.

[0107] Alternatively, different follow-up processing can be applied only to the predicted probability of each node being identified as an anomalous object. For example, tiered control can be implemented based on the predicted probability value. For each node, if its predicted probability of being identified as an anomalous object is within a first threshold range (a higher value range), the object corresponding to that node can be determined as an anomalous object, and therefore the payment permission for that object can be directly revoked. If it is within a second threshold range (a middle value range), it can be pushed for manual verification. And if it is within a third threshold range (a lower value range), the object corresponding to that node is determined as a normal object, and therefore no processing is performed. For example, the first, second, and third threshold ranges are preset and increase sequentially, for example, corresponding to three consecutive non-overlapping ranges in [0,1], respectively.

[0108] Alternatively, the graph neural network model can be a graph convolutional neural network (GCN) model, a GraphSage model, or a Node2vec model, etc.

[0109] By reference Figure 2 The method for identifying anomalous objects described in section -5 reduces manual labor costs by feeding each divided object community into a graph neural network model to identify the category of the node corresponding to the object. Furthermore, when evaluating the category of an object using a graph neural network, it utilizes the object's own attributes and information from its neighboring object nodes, thus improving the accuracy of identification. In addition, different post-processing is applied to each node based on the predicted probability of it being an anomalous user, combining manual and graph neural network model predictions to simultaneously improve efficiency and identification accuracy.

[0110] Furthermore, the graph neural network model needs to be trained to perform the aforementioned recognition process. In the embodiments of this disclosure, the training method of the graph neural network can be referred to, by way of example and not limitation. Figure 6 It shall be carried out in the manner described.

[0111] like Figure 6 As shown, in step S610, information about the sample graph structure is obtained, including: node features of all sample nodes in the sample graph structure and object labels of at least some sample nodes, as well as sample node topology information of the sample graph structure.

[0112] Similarly, the sample node topology information indicates whether there is an edge between any two nodes in the sample graph structure and the weight of the edge. The sample node topology information can be the sum of the adjacency matrix and the identity matrix, and is also a matrix.

[0113] Object tags can also be for abnormal objects and normal objects.

[0114] In step S620, the graph neural network model is trained in a supervised or semi-supervised manner based on the information of the sample graph structure and the loss function.

[0115] Optionally, if the labels of all sample nodes in the sample graph structure are known, or the labels of some sample nodes are known (including labels for both abnormal and normal objects, i.e., positive and negative samples), then supervised training can be performed using the known labeled sample nodes. In supervised training, a graph neural network model is used to obtain the predicted probability of a sample node being a normal or abnormal object based on the node features and topological information of each known labeled sample node. Furthermore, based on the predicted probability of each known labeled sample node for each object category, a loss function is used to calculate the loss value. The model parameters are adjusted by minimizing the loss value until the model parameters converge.

[0116] Alternatively, the loss function can be the cross-entropy function. The cross-entropy function is shown in the following equation:

[0117]

[0118] Where N is the number of sample nodes, C is the number of classification categories (e.g., 2 if both abnormal and normal objects are included), and p ki q is the true value (1 or 0) of node k belonging to category i. ki It is the probability that the model predicts that node k belongs to category i.

[0119] Optionally, if only some of the sample nodes in the sample graph structure have known labels, that is, the complete set of sample nodes in the sample graph structure can include a first set of labeled sample nodes and a second set of unlabeled sample nodes, and it is desired to use other unlabeled sample nodes for semi-supervised training, then a self-training method can be used.

[0120] First, the graph neural network model is trained in a supervised manner using the first set of sample nodes to obtain the first model. The supervised training method is similar to that described above.

[0121] Then, the following operations are performed iteratively until the number of nodes in the training sample node set used to train the first model reaches a preset number and the model parameters of the first model converge.

[0122] Operation i involves using the first model to predict the unlabeled sample nodes in the second sample node set, selecting an expanded sample node set from the unlabeled sample nodes in the second sample node set based on the prediction results, and updating the second sample node set (i.e., the second sample node set no longer includes the sample nodes in the expanded sample node set selected this time).

[0123] Optionally, the first model is used to predict the unlabeled nodes in the second sample node set to obtain the predicted label and corresponding confidence level of each unlabeled node in the second sample node set; and based on the confidence level corresponding to the predicted label of each unlabeled sample node in the second sample node set, sample nodes whose confidence levels meet the preset conditions are selected from the second sample node set to obtain the expanded sample node set.

[0124] For example, for each category of labels, select the M sample nodes with the highest confidence from the sample nodes with predicted labels for that category, and obtain an expanded node set based on the M sample nodes and the labels for that category.

[0125] Operation ii: Use the first sample node set and the expanded sample node set as the training sample node set, and use the training sample nodes to train the first model to update the model parameters of the first model.

[0126] By reference Figure 6 The training method for the graph neural network model described herein can produce a model for identifying object categories, and can be selected for supervised or semi-supervised training depending on whether unlabeled sample nodes in the sample graph structure are needed.

[0127] According to another aspect of this disclosure, an apparatus for identifying abnormal objects is also provided.

[0128] Figures 7A-7B A structural block diagram of an apparatus for identifying abnormal objects according to an embodiment of the present disclosure is shown.

[0129] like Figure 7A As shown, the device 700 includes a determination module 710, a network construction module 720, a partitioning module 730, and an identification module 740.

[0130] The determination module 710 is used to determine the interaction-related objects associated with the abnormal objects based on the interaction data within a first preset time period, wherein the abnormal objects are pre-labeled.

[0131] Optionally, the determining module 710 is configured to, when determining the interaction-related objects, determine the interaction counterpart of each abnormal object and other interaction objects of each interaction counterpart within the first preset time period based on the interaction data within the first preset time period, wherein the other interaction objects of the interaction counterpart of each abnormal object are regarded as interaction-related objects related to the abnormal object.

[0132] The network construction module 720 is used to construct an object network graph based on the interaction data within a second preset time period and using the abnormal object and the interaction-related object. In the object network graph, each node represents an object, each edge represents the relationship between the two objects corresponding to its two end nodes, and the weight of each edge represents the degree of relationship between the two objects corresponding to its two end nodes. The duration of the second preset time period is the same as or different from the duration of the first preset time period.

[0133] Optionally, the object network graph constructed by the network construction module 720 is a topology structure including multiple nodes, each node corresponding to an object. If any two objects interact with each other during a second preset time period, there will be a direct edge connecting the two nodes corresponding to those two objects, and this edge can have a weight based on the number of objects interacting with each other. The relationships between the nodes (which can also be expressed as node topology information) can be represented by an adjacency matrix.

[0134] The partitioning module 730 is used to partition the object network graph into communities to obtain at least one network subgraph, wherein each network subgraph corresponds to an object community obtained by partitioning.

[0135] Alternatively, community detection algorithms can be used to partition the constructed object network graph into communities. For example, a modularity-based community partitioning method, such as the Fast unfolding algorithm, can be used.

[0136] The identification module 740 is used to predict the object category corresponding to the node in the at least one network subgraph using a graph neural network model, so as to identify abnormal objects.

[0137] The input to a graph neural network model can include the node features of each node in each subgraph and the node topology information of that subgraph, where the node topology information indicates whether an edge exists between any two nodes in the subgraph and the weight of that edge. A graph neural network model is a trained model; for example, as a classification model, it can process input data to obtain the corresponding object category.

[0138] Optionally, the device 700 may further include a training module for training a graph neural network model. However, in other embodiments, the training module may be external to the device 700, and the device 700 obtains the trained graph neural network model from the training module for use in the process of identifying abnormal objects.

[0139] For example, the training module can be configured to acquire information about the sample graph structure, wherein the information about the sample graph structure includes: node features of all sample nodes in the sample graph structure and object labels of at least a portion of the sample nodes, as well as topological information of the sample nodes in the sample graph structure; and to perform supervised or semi-supervised training on the graph neural network model based on the information about the sample graph structure and a loss function.

[0140] The specific details of supervised or semi-supervised training have been described above, so they will not be repeated here.

[0141] It should be noted that the device 700 is divided into multiple modules according to the operations performed, and further subdivided into sub-modules as described below. However, those skilled in the art will understand that the device 700 may include more or fewer modules, and each module may include more or fewer sub-modules, depending on the method used. This disclosure does not limit this, as long as the various functions described can be implemented.

[0142] Furthermore, such as Figure 7B As shown, the network construction module 720 may include a matching submodule 720-1, a statistics submodule 720-2, a weight determination submodule 720-3, and a construction submodule 720-4.

[0143] The matching submodule 720-1 is used to match any two objects among all abnormal objects and all interaction-related objects to obtain multiple object matching pairs.

[0144] The statistics submodule 720-2 is used to determine, for each object pair, the respective interaction partners and common interaction partners of the two objects in the object pair based on the interaction data within the second preset time period.

[0145] The weight determination submodule 720-3 is used to determine the weight of the edge between the nodes corresponding to the two objects for each object matching pair where the number of mutual interaction partners is not zero, based on the number of mutual interaction partners of each of the two objects in the object matching pair and the number of mutual interaction partners.

[0146] The construction submodule 720-4 is used to construct an object network graph based on all nodes corresponding to all abnormal objects and all interaction-related objects, as well as the weight of each edge as determined.

[0147] More operational details for the various sub-modules in Network Module 720 have been referenced in the previous text. Figure 3 The details of that section are not described in detail here, so they will not be repeated here.

[0148] In addition, such as Figure 7B As shown, the recognition module 740 for predicting the object category corresponding to a node in at least one network subgraph may include a feature generation submodule 740-1 and a recognition submodule 740-2.

[0149] The feature generation submodule 740-1 is used to generate initial node features for each node based on the attributes of the object corresponding to each node in the network subgraph.

[0150] For example, the network subgraph includes N1 nodes (some of which are labeled nodes corresponding to anomalous objects, and the rest are unlabeled nodes). For each node, initial node features are generated. Here, as described later, when generating the output features of each node at each layer, it is necessary to aggregate the node features of nodes with connecting edges, so the node features of all nodes need to be obtained.

[0151] The identification submodule 740-2 is used to obtain the object category corresponding to each unlabeled node for each network subgraph by using the graph neural network model based on the initial node features of each node and the node topology information of the network subgraph. The node topology information indicates whether there is an edge between any two nodes in the network subgraph and the weight of the edge.

[0152] Optionally, the prediction can be performed only for the object categories corresponding to the unlabeled nodes of the network subgraph, or the prediction can be performed for the object categories corresponding to all nodes of the network subgraph.

[0153] Optionally, the graph neural network model includes at least one graph neural network layer, wherein, in each graph neural network layer, the output features of the current layer for each node are updated based on the initial node features of each node or the output features of the previous layer for each node, the node topology information of the network subgraph, and the parameters of the current layer.

[0154] As an example and not a limitation, each graph neural network layer may include an aggregation sublayer and an update sublayer. For example, the aggregation sublayer may aggregate the output features of the neighboring nodes (directly connected nodes) of each node in the previous layer based on the node topology information of the network subgraph, and the update sublayer may be used to obtain the output features of the current node based on the output features of each node in the previous layer, the aggregated features of the output features of the neighboring nodes of each node, and the parameters of the current layer.

[0155] In addition, the operation of the identification submodule 740-2 in predicting the category of the object corresponding to each unlabeled node (which can also be similar to the category of the object corresponding to labeled nodes) may include: inputting the output features of the last layer for each unlabeled node into the output control function, determining the prediction probability of each unlabeled node being predicted as a different object category, and determining the object category corresponding to the unlabeled node based on the prediction probability of each unlabeled node being predicted as a different object category.

[0156] Optionally, object categories can include abnormal object categories and normal object categories. Of course, more subdivided categories can also be included based on the actual labels used during training.

[0157] Optionally, as mentioned above, the object category for all nodes can be predicted.

[0158] For example, the output control function can be a softmax function. Inputting the output representation (output features, output embedding) of each node into this function will yield values ​​between (0,1) for different categories, which will be used as the predicted probabilities for different categories (e.g., normal or abnormal objects).

[0159] The category of the object with the highest predicted probability can be determined as the category of the object corresponding to that node.

[0160] Alternatively, different follow-up processing can be applied only to the predicted probability of each node being identified as an anomalous object. For example, tiered control can be implemented based on the predicted probability value. For each node, if its predicted probability of being identified as an anomalous object is within a first threshold range (a higher value range), the object corresponding to that node can be determined as an anomalous object, and therefore the payment permission for that object can be directly revoked. If it is within a second threshold range (a middle value range), it can be pushed for manual verification. And if it is within a third threshold range (a lower value range), the object corresponding to that node is determined as a normal object, and therefore no processing is performed. For example, the first, second, and third threshold ranges are preset and increase sequentially, for example, corresponding to three consecutive non-overlapping ranges in [0,1], respectively.

[0161] More operational details for the various sub-modules in Network Module 720 have been referenced in the previous text. Figure 3 The details of that section are not described in detail here, so they will not be repeated here.

[0162] By reference Figures 7A-7BThe described apparatus for identifying anomalous objects provides each object community, divided by a segmentation module, to an identification module. The identification module utilizes a graph neural network model to classify the nodes corresponding to each object, reducing manual labor costs. Furthermore, by using the graph neural network to evaluate an object's category, it leverages the object's own attributes and information from its neighboring object nodes, improving identification accuracy. Additionally, different post-processing steps are performed based on the predicted probability that each node represents an anomalous user. This combination of manual and graph neural network model predictions improves both efficiency and identification accuracy.

[0163] According to another aspect of this disclosure, a computing device is also disclosed.

[0164] Figure 8 A schematic block diagram of a computing device 800 according to an embodiment of the present disclosure is shown.

[0165] like Figure 8 As shown, the computing device 800 includes a processor, memory, network interface, input device, and display screen connected via a system bus. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and may also store a computer program that, when executed by the processor, causes the processor to perform the various operations described in the steps of the method for identifying abnormal objects. The internal memory may also store a computer program that, when executed by the processor, causes the processor to perform the same various operations described in the steps of the method for identifying abnormal objects.

[0166] For example, the method for identifying anomalous objects may include: determining interaction-related objects associated with the anomalous objects based on interaction data within a first preset time period, wherein the anomalous objects are pre-labeled; constructing an object network graph based on interaction data within a second preset time period and using the anomalous objects and interaction-related objects, wherein each node in the object network graph represents an object, each edge represents the relationship between the two objects corresponding to its two endpoints, and the weight of each edge represents the degree of correlation between the two objects corresponding to its two endpoints, and the duration of the second preset time period may be the same as or different from the duration of the first preset time period; performing community partitioning on the object network graph to obtain at least one network subgraph, wherein each network subgraph corresponds to a partitioned object community; and using a graph neural network model to predict the object category corresponding to the nodes in the at least one network subgraph to identify the anomalous objects. Further details of each step have been described in detail above and will not be repeated here.

[0167] The processor can be an integrated circuit chip with signal processing capabilities. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this disclosure. The general-purpose processor can be a microprocessor or any conventional processor, and can be based on an x84 architecture or an ARM architecture.

[0168] Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. It should be noted that the memory used in the methods described in this disclosure is intended to include, but is not limited to, these and any other suitable categories of memory.

[0169] The display screen of a computing device can be an LCD screen or an e-ink screen. The input device of a computing device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the terminal casing, or external keyboards, touchpads, or mice, etc.

[0170] The computing device can be a terminal or a server. The terminal may include, but is not limited to, smartphones, tablets, laptops, desktop computers, smart TVs, etc.; various clients (apps) can run on the terminal, such as multimedia playback clients, social media clients, browser clients, news feed clients, educational clients, etc. The server can be a reference... Figure 1A The described server can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0171] According to another aspect of this disclosure, a computer-readable storage medium is also provided, storing a computer program that, when executed by a processor, causes the processor to perform the steps of the method for identifying abnormal objects as described above.

[0172] According to another aspect of this disclosure, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of the method for identifying abnormal objects as described above.

[0173] It should be noted that the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of the methods and apparatus according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing at least one executable instruction for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0174] The exemplary embodiments of this disclosure described in detail above are merely illustrative and not restrictive. Those skilled in the art will understand that various modifications and combinations can be made to these embodiments or their features without departing from the principles and spirit of this disclosure, and such modifications should fall within the scope of this disclosure.

Claims

1. A method for identifying anomalous objects, comprising: Based on the interaction data within a first preset time period, determine the interaction-related objects associated with the abnormal objects, wherein the abnormal objects are pre-labeled; Based on the interaction data within the second preset time period and using the abnormal objects and the interaction-related objects, an object network graph is constructed. In the object network graph, each node represents an object, each edge represents two objects corresponding to its two end nodes that have a common interaction partner, and the weight of each edge represents the number of common interaction partners of the two objects corresponding to its two end nodes. The duration of the second preset time period is the same as or different from the duration of the first preset time period. The object network graph is partitioned into communities to obtain at least one network subgraph, wherein each network subgraph corresponds to an object community obtained from the partitioning; and Using a graph neural network model, the object category corresponding to the node in at least one subgraph of the network is predicted to identify unlabeled abnormal objects. Among them, the interaction-related objects identified based on the interaction data within the first preset time period include: Based on the interaction data within the first preset time period, the interaction counterpart of each abnormal object and other interaction objects of each interaction counterpart are determined, wherein the other interaction objects of the interaction counterpart of each abnormal object are regarded as interaction-related objects related to the abnormal object.

2. The method of claim 1, wherein, Based on the interaction data within a second preset time period and utilizing the abnormal objects and the interaction-related objects, an object network graph is constructed, including: Match any two objects from all abnormal objects and all interaction-related objects to obtain multiple object matching pairs; For each object pair, the interaction partners and common interaction partners of the two objects in the object pair are determined based on the interaction data within the second preset time period. For each object pair where the number of mutually interacting counterparts is not zero, the weight of the edge between the nodes corresponding to the two objects is determined based on the number of mutually interacting counterparts for each of the two objects in the object pair and the number of mutually interacting counterparts; and The object network graph is constructed based on all nodes corresponding to all abnormal objects and all interaction-related objects, as well as the weight of each edge as determined.

3. The method of claim 2, wherein, The network graph of the object is divided into communities to obtain at least one network subgraph, including: Based on modularity, the object network graph is divided into communities to obtain at least one network subgraph. The modularity value is used to indicate the quality of the community partitioning of the object network graph, and is related to the weight of each edge in the object network graph, the weight of all edges connected to each node, and whether any two nodes are currently partitioned into the same object community.

4. The method of claim 1, wherein, Using a graph neural network model, predicting the object category corresponding to a node in at least one subgraph of the network includes: for each subgraph of the network, Initial node features are generated for each node based on the attributes of the object corresponding to each node in the network subgraph; and Using the graph neural network model, based on the initial node features of each node and the node topology information of the network subgraph, the object category corresponding to each unlabeled node is predicted. The node topology information indicates whether there is an edge between any two nodes in the network subgraph and the weight of the edge.

5. The method of claim 4, wherein, The graph neural network model includes at least one graph neural network layer. In each graph neural network layer, the output features of the current layer for each node are updated based on the initial node features of each node or the output features of the previous layer for each node, the node topology information of the network subgraph, and the parameters of the current layer.

6. The method of claim 5, wherein, Using the graph neural network model, predicting the object category corresponding to a node in the at least one subgraph of the network further includes: The output features of the last layer for each unlabeled node are provided to the output control function to determine the prediction probability of each unlabeled node being predicted as a different object category; and The object category corresponding to the unlabeled node is determined based on the predicted probability that each unlabeled node is predicted to be a different object category.

7. The method of claim 6, wherein, Determining the object category corresponding to the unlabeled node based on the predicted probability that each unlabeled node is predicted to be a different object category includes: If the predicted probability of the unlabeled node being an anomalous object category is within the first threshold range, the object corresponding to the unlabeled node is determined to be an anomalous object. If the predicted probability of the unlabeled node belonging to the abnormal object category is within the second threshold range, the unlabeled node will be pushed for anomaly verification; and If the predicted probability of an unlabeled node belonging to the abnormal object category is within the third threshold range, the object corresponding to the unlabeled node is determined to be a normal object. Among them, the first threshold range, the second threshold range, and the third threshold range do not overlap, and increase sequentially.

8. The method according to any one of claims 5-7, wherein, The node topology information of the network subgraph is the sum of the adjacency matrix and the identity matrix of the network subgraph.

9. The method of claim 1, wherein, The graph neural network model was obtained in the following way: Obtain information about the sample graph structure, wherein the information includes: node features of all sample nodes in the sample graph structure and object labels of at least a portion of the sample nodes, as well as the topological information of the sample nodes in the sample graph structure; and Based on the information of the sample graph structure and the loss function, the graph neural network model is subjected to supervised or semi-supervised training.

10. An apparatus for identifying abnormal objects, comprising: The determination module is used to determine the interaction-related objects associated with the abnormal objects based on the interaction data within a first preset time period, wherein the abnormal objects are pre-labeled; The network construction module is used to construct an object network graph based on the interaction data within a second preset time period and using the abnormal objects and the interaction-related objects. In the object network graph, each node represents an object, each edge represents that the two objects corresponding to its two end nodes have a common interaction partner, and the weight of each edge represents the number of common interaction partners between the two objects corresponding to its two end nodes. The duration of the second preset time period is the same as or different from the duration of the first preset time period. A partitioning module is used to partition the object network graph into communities, obtaining at least one network subgraph, wherein each network subgraph corresponds to an object community obtained from the partitioning; and The identification module is used to predict the object category corresponding to a node in at least one subgraph of the network using a graph neural network model, so as to identify abnormal objects. The determining module is configured to: Based on the interaction data within the first preset time period, the interaction counterpart of each abnormal object within the first preset time period and other interaction objects of each interaction counterpart are determined, wherein the other interaction objects of the interaction counterpart of each abnormal object are regarded as interaction-related objects related to the abnormal object.

11. The apparatus of claim 10, wherein, The network construction module includes: The matching submodule is used to match any two objects among all abnormal objects and all interaction-related objects to obtain multiple object matching pairs; The statistics submodule is used to determine, for each object pair, the respective interaction partners and common interaction partners of the two objects in the object pair based on the interaction data within the second preset time period. The weight determination submodule is used to determine the weight of the edge between the nodes corresponding to the two objects for each object pair where the number of mutually interacting objects is not zero, based on the number of interacting objects for each object pair and the number of mutually interacting objects; and The construction submodule is used to construct the object network graph based on all nodes corresponding to all abnormal objects and all interaction-related objects, as well as the determined weight of each edge.

12. The apparatus of claim 10, wherein, The identification module includes: The feature generation submodule is used to generate initial node features for each node in each network subgraph based on the attributes of the object corresponding to each node in the network subgraph; and The identification submodule is used to, for each network subgraph, utilize the graph neural network model to obtain the object category corresponding to each unlabeled node based on the initial node features of each node and the node topology information of the network subgraph. The node topology information indicates whether there is an edge between any two nodes in the network subgraph and the weight of the edge.

13. A computing device, comprising: processor; as well as A memory having a computer program stored thereon, which, when executed by the processor, causes the one or more processing units to perform the steps of the method as described in any one of claims 1-9.

14. A computer-readable storage medium storing a computer program that, when executed by a processor, causes the processor to perform the steps of the method as described in any one of claims 1-9.

Images