A fraud prevention method for a communication network based on graph structure clustering

Abstract

The application discloses a communication network fraud-preventing method and system based on graph structure clustering. The method comprises the following steps: constructing a network structure according to users and call relations, and converting the network structure into a graph model and storing the graph model in a CSR structure; constructing a network structure according to users and call relations, and converting the network structure into a graph model and storing the graph model in a CSR structure; generating a non-repeated edge table based on a degree direction and an edge table index based on a CSR structure of graph data; transmitting data of the graph model to a computing system, and executing a structure clustering method of the graph by the computing system to output a structure clustering result; and the application can help law enforcement agencies to quickly locate possible active areas of criminals from a huge communication network, detect possible fraud gangs and cheated objects, and reduce the observation range and improve the law enforcement efficiency.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of big data and data mining, and particularly relates to a communication network fraud prevention method based on graph structure clustering. BACKGROUND

[0002] The graph formed by the communication network structure is very large in the current big data era, and a graph structure formed by the communication data of a city with several million people may have hundreds of millions of edges. Since the fight against fraud emphasizes timeliness, how to mine important hierarchical structure information in a short time has been a hot spot and problem in technical development. In recent years, several classic community search methods defined according to the cohesion of subgraphs have been proposed, such as k-core, k-truss, k-clique and k-ECC. These methods can find cohesive and connected subgraphs as communities. However, these methods either have incomplete conditions leading to poor cohesion of the found subgraph communities, such as k-core, or have too strict conditions leading to a small amount of communities defined in the graph and too much time consumption in searching, such as k-truss and k-clique. Therefore, these methods are not suitable for clustering search of most communication network graphs. The graph structure clustering method for discovering cohesive subgraphs in the network can well solve this problem. The clusters formed by the graph structure clustering have good clustering effects and high performance. Therefore, the graph structure clustering can be better applied to large-scale communication networks.

[0003] For traditional graph structure clustering, a method conducive to CPU serial execution is often used for structure clustering. The above method has a big problem: it can only achieve good performance in small and medium-sized graphs with no more than one million relationships, and it performs very poorly in the case of high frequency and large graph data size. For example, in a large social network graph such as the current twitter network and microblog network with tens of billions of relationships, it is difficult for traditional methods to find cohesive subgraphs, because it takes several hours to calculate the clusters, which does not meet the current real application of anti-fraud in the big data era. SUMMARY

[0004] In order to solve the above technical defects in the prior art, the present application proposes a communication network fraud prevention method based on graph structure clustering.

[0005] The technical scheme for achieving the object of the present application is as follows: a communication network fraud prevention method based on graph structure clustering, comprising the following steps:

[0006] The communication operator platform collects all users communicated in the communication network and all call records of the users in a set time period in a timely manner;

[0007] According to the user and the call relationship, a network structure is constructed, the network structure is converted into a graph model and stored in a CSR structure;

[0008] Based on the CSR structure of the graph data, a degree-oriented non-repeated edge table and an edge table index are generated;

[0009] The data of the graph model is transmitted to a computing system, the computing system performs a structure clustering method of the graph, and outputs a structure clustering result;

[0010] The structure clustering result is analyzed, and the analysis result is displayed, and suspicious objects are listed.

[0011] Preferably, the specific method of converting the network structure into a graph model is:

[0012] The user is a point in the graph, and the user information data is modeled as an attribute of the point;

[0013] The communication between the users is an edge of the graph, and the communication data is modeled as an attribute of the edge.

[0014] Preferably, the specific method of storing the graph model in a CSR structure is:

[0015] The degree (the number of edges connected to the point) of the point is recorded in order of the point Id in the graph to form a degree array, and the neighbor points of each point are also stored in order of the Id to form an adjacency array Adj. Then, an array Rptr representing the starting position of the neighbor point set of each point in the adjacency array Adj is obtained according to the prefix sum of the degree array of the point; Rptr and Adj constitute the CSR structure of the graph.

[0016] Preferably, the specific method of generating a degree-oriented non-repeated edge table and an edge table index based on the CSR structure of the graph data is:

[0017] The set of neighbor points of each point u whose degree is greater than or equal to the degree of u and whose Id is greater than u is set as N + (u), and auxiliary arrays upptr and his are created to record whether each neighbor point v of each point u belongs to the N + (u) and the size of N + (u);

[0018] The exclusive prefix sum on his is calculated to obtain the writing position in the degree-oriented edge list Degree-orientedEdge List of the edge with u as the source point;

[0019] Each element in the adj array is traversed in a two-level loop, and the position of v∈N(u) is recorded as O uv When processing the point v∈N + (u), elptr(u) is added to Ouv the relative offset amount upptr(u) of the starting position of the edge e(u,v) into the mapping eid(O uv ), and assigning e(u,v) to the edge table, otherwise, calling a binary search on N(v) to locate O vu , and creating a mapping eid(O uv ) through the edge using v as the source point.

[0020] Preferably, the computing system performs a structure clustering method of the graph, and the specific process of outputting a structure clustering result is as follows:

[0021] Inputting parameters of clustering, initializing the cluster Id to which each point belongs, and the determination degree and the effective degree of all points;

[0022] Determining the similarity of some edges and the clustering role of some objects by using a pruning strategy and input parameters, to eliminate redundant calculation;

[0023] Calculating the similarity of each edge, and determining whether each point is a core point by the similarity of the edge related to the point;

[0024] Preliminarily clustering the core points by using a union-find set, and expanding the preliminary cluster to form a final cluster;

[0025] Classifying the points outside the cluster into pivot points or outlier points according to whether the points are connected to different clusters;

[0026] Obtaining the clustering situation of all points in the graph, and returning the user group division situation corresponding to the clustering situation to the platform.

[0027] Preferably, the determination degree of each point is initialized by GPU multi-threading in parallel, and the determination degree is initialized as 0; the effective degree of each point is initialized by GPU multi-threading in parallel, and the effective degree is the number of neighbor points of each point, if the effective degree is less than μ-1, the point is classified as a non-core point in advance.

[0028] Preferably, the specific process of determining the similarity of some edges and the clustering role of some objects by using a pruning strategy and input parameters to eliminate redundant calculation is as follows:

[0029] According to the generated non-repeating edge table based on the degree direction, each warp of the GPU selects an edge (u,v) from the edge table in order to process, if the edge satisfies |N[u]|<ε 2 ·|N[v]|, it can be directly determined that (u,v) is not similar, and the effective degree of points u and v is reduced by 1, if the effective degree of the two points is less than μ-1, the point is classified as a non-core point in advance. Wherein N[u] represents the set of point u itself and its neighbor points, and |N[u]| represents the number of elements of the set, which is equal to the degree of u plus one.

[0030] Preferably, the similarity of each edge is calculated, and the specific method for determining whether it is a core point by the similarity of the edge related to each point is as follows:

[0031] The similarity of each edge (u, v) is calculated according to the following formula:

[0032]

[0033] According to the attribute matching of two points u and v, the similarity is updated, which can be specifically divided into: considering the address attribute corresponding to the points, if the address attributes of the two points are the same, the similarity is increased by a certain weight value; considering the communication time attribute corresponding to the edge (u, v), if the communication time represented by the edge is greater than a set value, the similarity of u and v is increased by a certain weight value;

[0034] If σ (u, v) < ε, then it is not similar, and the validity of u and v is updated, and their validity is reduced by one; if σ (u, v) ≥ ε, then it is similar, and the certainty of u and v is updated, and their certainty is increased by one; if the validity is thus less than μ-1, the point is classified as a non-core point; if the certainty is thus greater than μ-1, the point is classified as a core point.

[0035] Preferably, the core points are preliminarily clustered by using the union-find set, and the specific method for expanding the formed preliminary cluster to form the final cluster is as follows:

[0036] Each core point is initialized as a single-element tree set, and the point serves as the tree root of the tree set, and the number Id of the set is the tree root Id;

[0037] First, the core points are clustered, the first step is that each warp of the GPU processes a core point u in parallel, the threads in the warp traverse the neighbors of u in parallel, if the neighbor v of the point u is also a core point, then the position of the edge (u, v) in the edge table is found out from the already generated edge table index, and the similarity recorded by the edge (u, v) is found according to the position, if the similarity of (u, v) is unknown, then it is skipped, if it is similar, then the root node R of the set in which the points u and v are located is found upwards through the Find operation of the union-find set u and R v , if R u and R v are different, that is, they are not in the same set, then the two sets are merged by using the union operation of the union-find set; the second step is similar to the first step, and the similarity between all core points u and their neighbor core points v is also checked in parallel, if the similarity is unknown, then the similarity is calculated by using the above similarity calculation method, if it is similar, then the two sets in which u and v are located are merged by using the method of the first step;

[0038] Then, the non-core point clustering GPU checks each core point in parallel with each warp, and each thread in the warp finds the non-core point neighbor v of u, and according to the edge table index and the edge table, the similarity of (u, v) is found, and in the case of (u, v) similarity, the non-core point is added to the cluster, that is, the cluster id of v is assigned to the cluster id of the core point u.

[0039] Compared with the prior art, the present application has the following advantages: on the one hand, the present application can help law enforcement agencies to quickly locate the possible active areas of criminals from a huge communication network, detect possible fraud gangs and fraud objects, narrow the observation range and improve the law enforcement efficiency; on the other hand, the structure clustering of the graph is accelerated by the high-concurrency computing framework CUDA of the Nvidia GPU, and the structure clustering of large graph data with a level of ten million edges can be completed within hundreds of milliseconds, and the most optimal similarity calculation strategy and union-find clustering strategy under the GPU parallel are proposed, which greatly improves the calculation speed, so that the present application has the advantages of low delay, fast response and good robustness.

[0040] Other features and advantages of the present application will be set forth in the following description, and in part will become apparent to those skilled in the art from the description, or can be learned by practice of the present application. The objects and other advantages of the present application will be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings. BRIEF DESCRIPTION OF DRAWINGS

[0041] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the principles of the application. In the drawings:

[0042] Figure 1 is a system architecture diagram of an embodiment of the present application.

[0043] Figure 2 is a flowchart of an embodiment of the present application.

[0044] Figure 3 is a data structure diagram of the graph structure clustering method of the present application.

[0045] Figure 4 is a GPU parallel computing graph of the graph structure clustering method of the present application.

[0046] Figure 5 is a result graph of the present application implemented in a communication network. DETAILED DESCRIPTION

[0047] It is easy to understand that, according to the technical solutions of the present application, the general skilled in the art can imagine various embodiments of the present application without changing the essential spirit of the present application. Therefore, the following specific embodiments and drawings are only exemplary descriptions of the technical solutions of the present application, and should not be considered as the whole or as a limitation or restriction on the technical solutions of the present application. On the contrary, the purpose of providing these embodiments is to make the skilled in the art more thoroughly understand the present application. The preferred embodiments of the present application are described in detail below in conjunction with the drawings, which form a part of the present application and are used to illustrate the innovative ideas of the present application together with the embodiments of the present application.

[0048] In order to make the purpose, technical solutions of the present application more clear, the technical solutions of the present application are described in detail below in conjunction with the drawings and examples.

[0049] The system structure of the present application is shown in Figure 1 . Figure 1 is the system architecture diagram of the embodiment of the present application, which belongs to a distributed architecture and includes a communication network, a front-end platform, a data analysis layer and a computing module. The communication network can be a telephone network or a mobile Internet network operated and maintained by major communication operators. The front-end platform is a server on which a front-end interface is deployed, and all operations including search range setting, timing task setting, parameter input and result display are in this platform. The data analysis layer is a back-end server cluster that receives parameter transmission from the front-end platform and collects communication network data, is responsible for structuring the collected communication data into graph data and transmitting it to the computing module for processing, and receives the results of the computing module and analyzes them to return them to the front-end platform for display. The computing module is a server cluster equipped with a graphics processor, and the computing method is a structure clustering method based on graph data. The powerful parallel computing capability of the graphics processor can greatly improve its efficiency.

[0050] In order to realize the function of the system of the present application, it is necessary to determine the unique id (such as telephone number) of each user in the communication network and to obtain the feature information of each user in the use process. It is also necessary to divide the communication network by area, i.e. to identify the communication id used by the user in the target area. An index table of users is maintained in the data analysis layer, which records the users identified by the server in the responsible area within the current time period. Each user in the index table corresponds to a communication object table, which stores the people who have communicated with the user. Each time communication occurs, the communication network obtains the information of the two parties and transmits it to the data analysis layer to check whether the two users are already in the index table. If not, they are added; if they already exist, no addition is needed. Then it is checked whether their adjacency table has already recorded the communication object, and if not, it is added.

[0051] When using the above method to collect communication information, attribute mapping tables corresponding to users and communication partners can also be generated. When obtaining the user ID, if the operator's communication network is capable, user attribute information can also be obtained, such as the user's physical address and call duration based on the base station or IP address. After determining the user information, it can be added to the attribute mapping table corresponding to each user in the index table, while communication information can be added to the attribute mapping table corresponding to the communication partner table. These attributes can be modeled as vertex and edge attributes in the graph in the future, providing more reference for similarity calculations and improving accuracy.

[0052] The structures of the index table, communication object table, and attribute table can be shown in Table 1:

[0053] Table 1

[0054]

[0055] In Table 1, user identities are represented by numerical numbers, and user attributes are represented by physical addresses. The attributes of the communication objects are represented by call duration. The example users in the table all have two communication objects, but in practice, this number is unlimited, and the formats of the index table, communication object table, and attribute table are not limited to Table 1.

[0056] The data tables collected by the data analysis layer can be stored in an in-memory database to improve writing speed. When a task request is received from the front-end platform, this data is modeled into a graph. Users are considered nodes in the graph, and user information data is modeled as node attributes. Communications between users are considered edges in the graph, and the attributes of the communication objects are modeled as edge attributes, forming a logical network graph structure. This structure is then converted to generate the CSR structure of the graph. See [1]. Figure 3 , Figure 3 The left part of the diagram shows a storage structure diagram of an embodiment of the present invention. The network in the diagram has four points, including v1, v2, v3, and v4, as well as edges between these points. The degrees of the points (the number of edges connected to the points) are recorded in the order of the point IDs in the diagram to form a degree array. The neighboring points of each point are also stored in the order of the IDs to form an adjacency array Adj. The array Rptr representing the starting position of the adjacent point set of each point in the adjacency array Adj is then obtained based on the prefix sum of the degree array of the point; Rptr and Adj constitute the CSR structure of the graph.

[0057] After the structure is structured, the CSR structure is transmitted to the computing module, and in order to perform similarity calculation and GPU parallel task allocation, the computing module needs to regenerate the Degree-oriented EdgeList edge table of all edges of the non-repeated record graph and map the Adj to the index Eid of the edge table. Each edge of the graph, i.e., the point pair structure composed of its two endpoints, is sequentially stored in the edge table. Referring to Figure 3 , Figure 3 The Edge List in the above-mentioned

[0058] Referring to Figure 3 The right part, the process of generating the Degree-oriented Edge List edge table and the index Eid is specifically shown as follows: first, the set of neighbor points of each point u whose degree is greater than or equal to the degree of u is set as N + (u), and auxiliary arrays upptr and his are created to record whether each neighbor point v of each point u belongs to the first element in N + (u) and the size of N + (u). Second, the exclusive prefix sum on his is calculated to obtain the writing position in the edge list Degree-oriented Edge List (denoted by elptr) of the edge with u as the source point. Third, each element in the adj array is traversed in a two-level loop, and the position of v∈N uv (u) is recorded as O + When processing point v∈N uv (u), the mapping eid(O uv ) is created from the relative offset upptr(u) of the starting position of elptr(u), and e(u,v) is assigned to the edge table. Otherwise, the binary search on N(v) is called to locate O vu , and the mapping eid(O uv ) is created by using the edge with v as the source point.

[0059] The process of generating auxiliary arrays upptr and his from the CSR can be accelerated by CPU multi-thread parallelism, and the process of constructing Degree-oriented Edge List and Eid from elptr can also be effectively parallelized. Therefore, this process can be greatly accelerated by parallelization, and it only takes a few seconds to complete in a large graph data of hundreds of millions.

[0060] After the construction of the data structure, the parameters of clustering, ε and μ, are inputted and the parameters and the structure mentioned above are transferred from the memory of the device to the GPU memory. The determination degree and the effective degree of each point are initialized in parallel using the multi-thread of GPU. The determination degree is initialized as 0, while the effective degree is initialized as the number of the neighbor points of the point. The determination degree and the effective degree are used to determine whether the point is a core point while calculating the similarity of the edges in the graph. Once the degree of the point is less than μ-1, the point can be determined as a non-core point in advance during the initialization process.

[0061] In order to avoid redundant calculation, the pruning strategy is needed before the next similarity calculation step. According to the formula derivation, if |N[u]|<ε 2 ·|N[v]| (without loss of generality, assuming |N[u]|<|N[v]|), then (u, v) must be dissimilar, where N[u] represents the set of point u itself and its neighbor points, and |N[u]| represents the number of elements in this set, which is equal to the degree of u plus one. Thus, there is no need to calculate the common neighbors of u and v to directly determine that they are dissimilar. And due to empirical derivation, most of the edges of the real-world graph are dissimilar, so this pruning strategy works well.

[0062] Therefore, according to the generated non-repeated edge table based on the degree direction, each warp of the GPU selects an edge (u, v) from the edge table in order to process, if the edge satisfies |N[u]|<ε 2 ·|N[v]|, then (u, v) can be directly determined as dissimilar in advance, and the effective degrees of points u and v are reduced by one, if it results in the effective degrees of these two points being less than μ-1, then the point is classified as a non-core point in advance.

[0063] After the initial preparation is completed, the similarity is calculated and clustered, and the similarity calculation formula of (u, v) is as follows:

[0064]

[0065] where N[u] is the structural neighbor of point u, i.e., the set composed of the neighbor points of u plus itself, when σ(u, v)≥ε, then (u, v) is considered to be similar.

[0066] The similarity calculation process is as follows: according to the generated non-repeated edge table based on the degree direction, each warp of the GPU selects an edge (u, v) from the edge table in sequence to process, first checks whether the u point and the v point have been determined as core points or non-core points, if both have been determined, skips the similarity calculation of the edge (u, v), and the similarity remains unknown, if at least one of u or v is not determined, 32 threads in each warp work together to calculate the common neighbor number of the two points u and v of the selected edge (u, v), the structure neighbor number of u and v is the common neighbor number of u and v plus two, that is, |N[u]∩N[v]|; the degrees of u and v are directly obtained from the CSR structure, the degree of the point u plus one is |N[u]|, and the degree of the point v plus one is N[v], and then the similarity σ(u, v) is calculated according to the formula. If σ(u, v) < ε, then it is not similar, and the effective degrees of u and v are updated, and their effective degrees are reduced by one, if σ(u, v) ≥ ε, then it is similar, and the determination degrees of u and v are updated, and their determination degrees are increased by one, if the effective degree is thus less than μ-1, the point is classified as a non-core point, if the determination degree is thus greater than μ-1, the point is classified as a core point.

[0067] The calculation process of the method mainly adopts a binary search strategy under GPU parallel, see Figure 3 . Figure 3 A sample graph is shown in the embodiment process of this step in Figure 3 . The work distribution of the warp and the binary search process of calculating the common neighbors of (v1, v0) are shown. Parts a and b of the figure show that the edges (v1, v0), (v2, v0) and (v2, v1) in adjacent positions are processed by the warps W i , W i+1 and W i+2 . Taking the edge (v1, v0) processed by W i as an example. In order to calculate the similarity, first, the adjacent points of v1 and v0 are obtained from the CSR structure. Then, since the degree of v1 is smaller, the threads t0, t1, t2 and t3 in Wx are responsible for matching the neighbor points v0, v2, v4 and v7 respectively. Figure 3 Parts c and d of the figure show these processes.

[0068] In the process of calculation, the threads put their corresponding points into the neighbor array of v0, and match them by binary search, as shown in part e of the figure. According to the binary search tree, in the first iteration, the four threads compare their target points with v4, and thread 2 successfully hits and ends the task. Due to the rules of binary search, the points of thread 0 and thread 1 are smaller than v4, and search to the left branch of the binary tree, while thread 3 is greater than v4, and searches to the right branch. The next few rounds of iterations are the same, and finally it is found that there are three common neighbors, which is consistent with the intuitive embodiment of the example figure. The number of common neighbors found is used to calculate the similarity, and after calculation, if the result is not similar, the properties of the points and the properties of the edges converted by the communication data can be used to further optimize the calculation of the similarity. Specifically, the address properties corresponding to the points are considered, and if two points are in the same region, the similarity is increased by a certain weight; the communication time properties corresponding to the edges are considered, and if the communication time represented by the edge is long enough, the similarity of the two end points of the edge is increased by a certain weight. After considering the properties, the similarity of the edge may increase beyond the threshold value ε and become a similar edge, but this helps the method to fit the actual situation. After the similarity is determined, the validity and the certainty of the two points are updated according to the result, and then it is determined whether they are core points.

[0069] The clustering process is to cluster the core points together after all the core points are determined, and then extend to form the final cluster. The first step is to connect the similar core points with edges in the same cluster. The second step is to add the similar neighbors of the core points to the cluster formed by the core points.

[0070] The clustering process is as follows: each core point is initialized as a single-element tree set, and the point is taken as the tree root of the tree set, and the set number Id is the tree root Id; first, the core points are clustered, and the first step is that each warp of the GPU processes a core point u in parallel, and the threads in the warp traverse the neighbors of u in parallel. If point u is also a core point, then find the position of edge (u, v) in the edge table from the already generated edge table index, find the similarity of edge (u, v) according to the position, if (u, v) is unknown, skip, if similar, find the root node R of the set where u and v are located by the Find operation of the union-find set u and R v , if R u and R vIf different, i.e. they are not in one set, then merge the two sets using the union operation of the union-find set; the second step is similar to the first step, and also parallel check the similarity between all core points u and its neighbor core points v, if the similarity is unknown, then calculate the similarity using the method described above, if they are similar, then merge the two sets where u and v are using the method of the first step; then for each non-core point, the GPU warp parallel checks each core point, each thread in the warp finds the non-core neighbor v of u, and also finds the similarity of (u, v) according to the edge table index and the edge table, in the case of (u, v) similar, the non-core point is added to the cluster, i.e. the cluster id of v is assigned to the cluster id of the core point u. In summary, all the structural clusters in the graph extended by the core points can be found.

[0071] The clustering process also uses GPU parallel acceleration, and uses parallelized union-find set clustering. While one thread is unioning the clusters to which two points belong (i.e. pointing the root node of one cluster to another cluster), another thread is operating on the same node, which will cause thread insecurity caused by access conflicts. Therefore, mutual access of these critical resources needs to be ensured, and the atomic operation atomicCAS in CUDA is used to ensure mutual access of multiple threads operating on the same node data.

[0072] After the method of the present application obtains the structural clusters of the graph as the searched communities, it will also classify the points that are not in the clusters, and further mine the structural information of the graph. Among them, the points that are directly or indirectly connected to the same cluster are marked as outliers. The characteristics of these points are that all their neighbors belong to the same cluster or are also outliers. Other points that are connected to different clusters are marked as pivot points, which are the pivots connecting different clusters. The specific method is that each GPU warp corresponds to the classification of a non-cluster point, and the default value of these points is an outlier. A warp first checks whether the point is connected to a point in the cluster; if so, the 32 threads in the warp simultaneously find whether there is a neighbor that is not in the same cluster; if found, the point is classified as a pivot point, otherwise its default value is not changed.

[0073] The result of the calculation module is returned to the data analysis layer, and the layer analyzes the suspected criminal gang according to the result. The corresponding point set of clustering actually means a group of users, and the internal communication is close, and the criminal gang is more likely to appear in the cluster. The outlier points connected with the edge of the cluster are more likely to be fraud victims. The pivot points connected with different clusters are most likely to be superiors connecting multiple gangs. In order to make the analysis more accurate, a deep learning method such as a multilayer perception or a generative adversarial network can be introduced. A feasible method is: input the feature information of the users in the cluster corresponding to the cluster (whether in the cluster, the size of the cluster, the number of edges connected with other users and the attributes of the edges, etc.) and the identity data verified by the public security organ to train. The introduction of artificial intelligence can further improve the accuracy and assist law enforcement personnel in judgment.

[0074] The result of the data analysis layer is transmitted to the front-end platform for display, and law enforcement personnel can quickly locate the suspected criminal gang according to the result, reduce the scope of investigation, and effectively crack down on telecom fraud.

[0075] The effect of the application can be further illustrated by the following simulation experiment:

[0076] Simulation conditions

[0077] In order to verify the effect of the application, the data set of the simulation experiment adopts 8 real-world large-scale graphs commonly used for testing and evaluating the performance of graph algorithms. They are soc-LiveJournal, Enwiki-2022, com-orkut, Hollywood-2011, tech-p2p, UK-2002, soc-Twitter and Yahoo songs. These data sets are obtained from the famous graph data set website SNAPNets, Network Repository and Laboratory for Web Algorithmics. Among them, the smallest graph soc-Journal has ten million relationship numbers, and the largest graph Yahoo songs has seven hundred million relationships. The simulation experiment and the related comparison test are carried out under the Ubuntu 16.04 operating system, the programming language environment is C++11 and CUDA10.1, and the hardware uses Nvidia Tesla v100 computing card. The experimental data is the average value of three execution times

[0078] The evaluation index adopted by the application is the time (unit: s) consumed by the clustering search. In order to prove the effectiveness of the application, several widely used comparison methods are also implemented for comparison, which are:

[0079] (1)SCAN: This method realizes the basic method of graph structure clustering, which uses CPU serial calculation, similarity calculation method is merge sort, and clustering uses breadth-first search.

[0080] (2)GPUSCAN: This model uses GPU to accelerate SCAN, similarity calculation method is parallel merge sort, and clustering uses parallel connected subgraph generation strategy.

[0081] Analysis of simulation experiment results

[0082] Table 2 is the simulation experiment result of the method and other comparative methods in eight data sets under the commonly used parameters ε = 0.6, μ = 6. From the experimental results, we can see that our results have the best effect in eight different data sets, which reflects the universality of our method. Among them, GPUSCAN is the first method to use parallel acceleration, and it can be seen that it has good performance improvement compared with the ordinary structure clustering method SCAN. However, since the similarity calculation method used by GPUSCAN has poor parallel degree and large workload, and the method used in the clustering step is not very ideal when the similarity relationship is more. Therefore, its performance is still far inferior to the method of the application, and the average performance of the method of the application is more than ten times that of GPUSCAN.

[0083] Table 3 is the simulation experiment result of the method and other comparative methods under the parameters ε = 0.6, μ = 16. It can be seen that when the parameter μ changes, the performance of the application and other comparative methods remains basically unchanged, and the method of the application still maintains a performance leading of more than ten times.

[0084] Table 4 is the simulation experiment result of the method and other comparative methods under the parameters ε = 0.2, μ = 6. It can be seen that when the parameter ε is small, the graph similarity relationship increases, and the parallel connected subgraph generation strategy used by GPUSCAN greatly increases the iteration times in the case of increasing similarity relationship, so the performance decreases. However, the application basically maintains the same speed as the comparison, which reflects the robustness of the method of the application.

[0085] In order to further reflect the effect of the method, the results of graph structure clustering on the communication network are visualized, as shown in Figures 1 to 8. Figure 5Exhibition. The communication record data of ten thousand people in a certain area in one day. In this dataset, each vertex represents a telephone user, and the edge from u to v represents the communication between the user represented by u and the user represented by v. The dataset is clustered using the method of the present application. The parameter values and results are shown in the figure, in which the part circled by the gray line is all the clusters found by the structural clustering algorithm (the clusters with cluster ids C1 and C2 in the figure are taken as examples), the users in the same cluster are represented by the same color, and the users outside the community are represented by light gray. Among them, there are three clusters with large size and tight cohesion, which are suspected gangs. The other two are clusters with only 2 and 5 members respectively, and the size is small, which is less likely to be a gang. For outliers, they are labeled as Outliers, and u and v are taken as examples, they have communication with the users in the cluster, so they are likely to be deceived objects. The users marked in dark gray are classified as hubs because they communicate with different suspected gangs, and are marked as Hubs, which are suspected superiors of the criminal gangs.

[0086] Table 2

[0087]

[0088] Table 3

[0089]

[0090]

[0091] Table 4

[0092]

[0093] The above describes only the preferred specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be covered within the protection scope of the present application.

[0094] It should be understood that, in order to simplify the present application and help those skilled in the art to understand various aspects of the present application, in the above description of the exemplary embodiments of the present application, various features of the present application are sometimes described in a single embodiment, or described with reference to a single figure. However, the present application should not be interpreted as the features included in the exemplary embodiments being necessary technical features of the patent claims of the present application.

[0095] It should be understood that the modules, units, components, etc. included in the device of one embodiment of the present application can be adaptively changed to be arranged in a device different from the embodiment. Different modules, units or components included in the device of the embodiment can be combined into one module, unit or component, or divided into multiple sub-modules, sub-units or sub-components.

Claims

1. A communication network anti-fraud method based on graph structure clustering, characterized in that: The following steps are involved: The communication operator platform regularly collects all users who have communicated with the communication network within a set time period and the call records of all users; Build a network structure based on users and call relationships, convert the network structure into a graph model and store it in a CSR structure; Based on the CSR structure of graph data, a non-repeated edge table and edge table index based on degree pointing are generated; The data of the graph model is transmitted to the computing system, which executes the structural clustering method of the graph and outputs the structural clustering results. The specific process is as follows: Input clustering parameters, initialize the cluster ID of each point and the certainty and validity of all points; Use pruning strategies and input parameters to determine the similarity of some edges and the clustering roles of some objects to eliminate redundant calculations; Calculate the similarity of each edge and determine whether it is a core point based on the similarity of the edges related to each point; Use union-find to preliminarily cluster the core points, and then expand outward from the preliminary clusters to form the final clusters; Classify out-of-class points into hubs or outliers based on whether they are connected to different clusters; Get the clustering of all points in the entire graph and return the user group division corresponding to these clustering situations to the platform; Analyze the structural clustering results, display the analysis results, and list suspicious objects.

2. The communication network anti-fraud method based on graph structure clustering according to claim 1 is characterized in that: The specific method of converting the network structure into a graph model is: Users are regarded as points in the graph, and user information data is modeled as attributes of the points; The communications between users are regarded as edges of the graph, and the communication data are modeled as attributes of the edges.

3. The communication network anti-fraud method based on graph structure clustering according to claim 1 is characterized in that: The specific method of storing the graph model in CSR structure is: The degrees of the points are recorded in the order of their IDs to form a degree array, and the neighboring points of each point are stored in the order of their IDs to form an adjacency array Adj. The array Rptr representing the starting position of the adjacent point set of each point in the adjacency array Adj is obtained based on the prefix sum of the degree array of the point. Rptr and Adj constitute the CSR structure of the graph.

4. The communication network anti-fraud method based on graph structure clustering according to claim 1 is characterized in that: Based on the CSR structure of graph data, the specific method for generating a non-repeated edge table and edge table index based on degree pointing is: Set N to the set of neighboring points of each point u whose degree is greater than or equal to that of u and whose ID is greater than u. + (u), create auxiliary arrays upptr and his to record whether the neighbor point v of each point u belongs to N + The number of elements in (u) and N + (u) size; Calculate the exclusive prefix sum on his to obtain the write position in the Degree-oriented EdgeList of the edge with u as its source point; Traverse each element in the adj array in a two-level loop and record the position of v∈N(u) as O uv , when processing point v∈N + (u), by adding elptr(u) to O uv The relative offset of the starting position upptr (u) is used to create the mapping eid (O uv ), and assign e(u,v) to the edge table, otherwise, call binary search on N(v) to locate O vu , and create a mapping eid(O by using v as the edge of the source uv ).

5. The communication network anti-fraud method based on graph structure clustering according to claim 1 is characterized in that: GPU multi-threaded parallel initialization of each point's certainty, the certainty is initialized to 0; GPU multi-threaded parallel initialization of each point's validity, the validity is the number of neighboring points of each point, if the validity is less than μ-1, the point is classified as a non-core point in advance.

6. The communication network anti-fraud method based on graph structure clustering according to claim 1 is characterized in that: The specific process of eliminating redundant calculations by using pruning strategies and input parameters to determine the similarity of some edges and the clustering roles of some objects is as follows: According to the generated non-repeated edge table based on degree pointing, each warp of the GPU selects an edge (u, v) from the edge table in order to process. If the edge satisfies |N[u]|<ε 2 |N[v]|, we can directly determine in advance that (u, v) is dissimilar, and reduce the effectiveness of points u and v by one. If this causes the effectiveness of these two points to be less than μ-1, point u is classified as a non-core point in advance, where N[u] represents the set of point u itself and its neighboring points, and |N[u]| represents the number of elements in this set, which is equal to the degree of u plus one.

7. The communication network anti-fraud method based on graph structure clustering according to claim 1 is characterized in that: The specific method of calculating the similarity of each edge and determining whether it is a core point by the similarity of the edges related to each point is as follows: According to the generated non-repeating edge table based on degree pointing, each warp of the GPU selects an edge (u, v) from the edge table in order to process it. First, check whether points u and v have been determined as core points or non-core points. If both have been determined, skip the similarity calculation of the edge (u, v), and its similarity remains unknown; if at least one of u or v is not determined, the 32 threads in the warp together calculate the number of common neighbors of the two points u and v on the selected edge (u, v). The number of common neighbors of u and v plus two is the number of structural neighbors of u and v, expressed as |N[u]∩N[v]|; the degrees of u and v are directly obtained from the CSR structure. The degree of point u plus one is |N[u]|, and the degree of point v plus one is N[v]. The similarity of each edge (u, v) is calculated according to the following formula: Based on the matching of the attributes of two points u and v, the similarity is updated. Specifically, the following steps are taken: taking into account the address attributes corresponding to the points, if the two points have the same address attributes, the similarity is increased according to a certain weight; taking into account the communication time attribute corresponding to the edge (u, v), if the communication time represented by the edge is greater than the set value, the similarity between u and v is increased according to a certain weight; If σ(u,v)<ε, they are not similar, and the validity of u and v is updated, and their validity is reduced by one. If σ(u,v)≥ε, they are similar, and the certainty of u and v is updated, and their certainty is increased by one. If the validity is therefore less than μ-1, point u is classified as a non-core point. If the certainty is therefore greater than μ-1, point u is classified as a core point.

8. The communication network anti-fraud method based on graph structure clustering according to claim 7 is characterized in that: The specific method of using union-find to preliminarily cluster the core points and expand outward from the formed preliminary clusters to form the final clusters is as follows: Each core point is initialized into a single-element tree set. The point serves as the root of the tree set, and the set ID is the root ID. First, the core points are clustered. The first step is that each warp of the GPU processes a core point u in parallel. The threads in the warp traverse the neighbors of u in parallel. If the neighbor v of point u is also a core point, then the position of the edge (u, v) in the edge table is found by the generated edge table index. The similarity of the edge (u, v) records is found based on the position. If the similarity is unknown, it is skipped. If it is similar, the root node R of the set where point u and point v are located is found upward through the Find operation of the union-find set. u and R v , if R u and R v Different, that is, they are not in the same set, then the two sets are merged using the union operation of the union-find set. The second step is to check the similarity between all core points u and their neighbor core points v in parallel. If the similarity is unknown, the similarity calculation method is used to calculate the similarity. If they are similar, the method of the first step is used to merge the two sets where u and v are located. Next, each warp of the GPU that clusters non-core points checks each core point in parallel. Each thread in the warp searches for u's non-core point neighbor v, and similarly finds the (u, v) similarity based on the edge table index and the edge table. If similar, the non-core point is added to the cluster, that is, the cluster ID of v is assigned to the cluster ID of the core point u; if the similarity is unknown, the similarity is calculated first, and if it is similar, the non-core point is added to the cluster.

Images