Methods, apparatuses, electronic devices, and media for identifying key anomalous users

Abstract

Provided are a method and device for identifying key abnormal users, electronic equipment and a medium, which can be applied in the fields of big data technology, artificial intelligence technology and information security technology. The method comprises: obtaining a first abnormal user network; analyzing the first abnormal user network to obtain a structural feature of the first abnormal user network; removing part of the nodes and edges from the first abnormal user network to obtain a second abnormal user network, the structural feature of the second abnormal user network being consistent with the structural feature of the first abnormal user network; and analyzing the second abnormal user network by using an influence maximization algorithm to obtain a set of key abnormal users. By simplifying the scale of the original abnormal user network, the nodes with low influence in the network are filtered, but the overall structural feature of the network is not affected, so that the time complexity of the influence maximization algorithm is reduced and the computing power resources are saved while ensuring the accuracy of the identification of key abnormal users.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of big data, the technical field of artificial intelligence and the technical field of information security, and more particularly to a method and device for identifying key abnormal users, an electronic device and a medium. BACKGROUND

[0002] An abnormal user group network can be regarded as a kind of social network. Social networks have different characteristics due to different topological structures. The influence diffusion in a social network mainly depends on the network model constructed, relying on the relationship network between user nodes to fix the user in the network. Social networks make the users in the network more closely connected, which can make the user node influence spread and diffuse quickly in a small range and high-density user group, and achieve deep interaction between users.

[0003] At present, on the one hand, abnormal user influence analysis mainly analyzes the abnormal user itself and the association relationship between users, and rarely focuses on the network structure characteristics of the entire abnormal user group association, which makes it difficult to mine a lot of hidden information between abnormal groups, and is not conducive to accurate protection of abnormalities, i.e., the accuracy of identifying key abnormal users is low. On the other hand, in actual life, an abnormal user network is usually large and has many nodes and edges. It is relatively complex to analyze the user influence of nodes in such a network using an influence maximization algorithm, and the time complexity of the algorithm is high, which leads to a great challenge in computation. SUMMARY

[0004] In view of the above problems, according to a first aspect of the present application, embodiments of the present application provide a method for identifying key abnormal users, the method comprising: obtaining a first abnormal user network, wherein the first abnormal user network comprises m1 nodes and n1 edges, each node represents an abnormal user, each edge represents an association relationship between abnormal users, m1 and n1 are both positive integers greater than or equal to 3; analyzing the first abnormal user network to obtain the structural characteristics of the first abnormal user network; removing m3 nodes and n3 edges from the first abnormal user network to obtain a second abnormal user network, wherein the second abnormal user network comprises m2 nodes and n2 edges, the structural characteristics of the second abnormal user network are consistent with the structural characteristics of the first abnormal user network, m2 and n2 are both positive integers greater than or equal to 2, m3 and n3 are both positive integers greater than or equal to 1, m2 and m3 are both less than m1, and n2 and n3 are both less than n1; analyzing the second abnormal user network using an influence maximization algorithm to obtain a set of key abnormal users, wherein the set of key abnormal users comprises k abnormal users, the k abnormal users are the top k nodes in the second abnormal user network in descending order of influence, k is a positive integer greater than or equal to 1, and k is less than m2.

[0005] According to some example embodiments, the analyzing the first abnormal user network to obtain the structural features of the first abnormal user network specifically comprises: analyzing the first abnormal user network to obtain a global structural feature value and a local structural feature value of the first abnormal user network; determining a type of the first abnormal user network according to the global structural feature value and the local structural feature value of the first abnormal user network; and determining the structural features of the first abnormal user network according to the type, the global structural feature value and the local structural feature value of the first abnormal user network.

[0006] According to some example embodiments, the global structural feature value of the first abnormal user network comprises a degree of each node, a betweenness of each edge, a clustering coefficient and an average path length of the first abnormal user network; and / or, the local structural feature value of the first abnormal user network comprises a degree correlation and a betweenness correlation.

[0007] According to some example embodiments, the removing m3 nodes and n3 edges from the first abnormal user network to obtain a second abnormal user network specifically comprises: a network simplification sub-step of determining a degree threshold and a betweenness threshold according to a degree distribution and a betweenness distribution of the first abnormal user network; removing nodes with a degree less than the degree threshold from the first abnormal user network, and removing edges with a betweenness less than the betweenness threshold from the first abnormal user network to obtain an intermediate abnormal user network.

[0008] According to some example embodiments, the removing m3 nodes and n3 edges from the first abnormal user network to obtain a second abnormal user network further specifically comprises: analyzing the intermediate abnormal user network to obtain structural features of the intermediate abnormal user network; comparing the structural features of the intermediate abnormal user network with the structural features of the first abnormal user network; if the structural features of the intermediate abnormal user network are inconsistent with the structural features of the first abnormal user network, adjusting the degree threshold and the betweenness threshold, repeating the network simplification sub-step until the structural features of the intermediate abnormal user network are consistent with the structural features of the first abnormal user network; and taking the intermediate abnormal user network with the structural features consistent with the structural features of the first abnormal user network as the second abnormal user network.

[0009] According to some example embodiments, the analyzing the second abnormal user network by using the influence maximization algorithm to obtain the set of key abnormal users specifically comprises: for each node v in the second abnormal user network, a directed acyclic graph is constructed to obtain m2 directed acyclic graphs, wherein each node v is distributed in multiple directed acyclic graphs; the influence of each node in each directed acyclic graph is calculated respectively within the scope of each directed acyclic graph; for each node v in the second abnormal user network, multiple influences of the node v in the distributed multiple directed acyclic graphs are obtained, and the multiple influences of the node v are superimposed to obtain the total influence of the node v in the second abnormal user network.

[0010] According to some example embodiments, the analyzing the second abnormal user network by using the influence maximization algorithm to obtain the set of key abnormal users further specifically comprises: the total influences of each node in the second abnormal user network are sorted in descending order; k nodes with the top k total influences are selected to obtain k key abnormal users to form the set of key abnormal users, wherein the value of k is pre-set.

[0011] According to some example embodiments, the constructing the directed acyclic graph for each node v in the second abnormal user network specifically comprises: the influences of other nodes in the second abnormal user network on the node v are calculated; q nodes are selected from the other nodes, wherein the influence of each of the q nodes on the node v is greater than a pre-set influence threshold, q is a positive integer greater than or equal to 1, and q is less than m2; the directed acyclic graph of the node v is constructed according to the node v, the q nodes, and corresponding edges.

[0012] According to some example embodiments, the method further comprises: analyzing the second abnormal user network to obtain an overall structural characteristic value and a local structural characteristic value of the second abnormal user network; determining the type of the second abnormal user network according to the overall structural characteristic value and the local structural characteristic value of the second abnormal user network; and determining the structural characteristics of the second abnormal user network according to the type, the overall structural characteristic value, and the local structural characteristic value of the second abnormal user network.

[0013] According to some example embodiments, the type of the first abnormal user network is a scale-free network, the structural characteristics of the first abnormal user network include that the distribution of the degrees of the nodes of the first abnormal user network conforms to a power-law distribution, and the structural characteristics of the second abnormal user network include that the distribution of the degrees of the nodes of the second abnormal user network conforms to a power-law distribution.

[0014] According to some example embodiments, the structure feature of the second abnormal user network being consistent with the structure feature of the first abnormal user network comprises: a ratio of a power index in a power-law distribution of degrees of nodes of the second abnormal user network to a power index in a power-law distribution of degrees of nodes of the first abnormal user network being between 0.8 and 1.2.

[0015] According to some example embodiments, the adjusting the degree threshold and the betweenness threshold comprises: adjusting the degree threshold and the betweenness threshold according to a Bayesian optimization method.

[0016] According to a second aspect of the present application, there is also provided an apparatus for identifying key abnormal users, the apparatus comprising: a first abnormal user network obtaining module configured to obtain a first abnormal user network, wherein the first abnormal user network comprises m1 nodes and n1 edges, each node representing an abnormal user, and each edge representing an association relationship between abnormal users, m1 and n1 are both positive integers greater than or equal to 3; a first abnormal user network analyzing module configured to analyze the first abnormal user network to obtain a structure feature of the first abnormal user network; a second abnormal user network obtaining module configured to remove m3 nodes and n3 edges from the first abnormal user network to obtain a second abnormal user network, wherein the second abnormal user network comprises m2 nodes and n2 edges, the structure feature of the second abnormal user network being consistent with the structure feature of the first abnormal user network, m2 and n2 are both positive integers greater than or equal to 2, m3 and n3 are both positive integers greater than or equal to 1, m2 and m3 are both less than m1, and n2 and n3 are both less than n1; and a key abnormal user set obtaining module configured to analyze the second abnormal user network using an influence maximization algorithm to obtain a set of key abnormal users, wherein the set of key abnormal users comprises k abnormal users, the k abnormal users being the top k nodes in the second abnormal user network in descending order of influence, k is a positive integer greater than or equal to 1, and k is less than m2.

[0017] According to a third aspect of the present application, there is provided an electronic device, comprising: one or more processors; and a storage device storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the method described above.

[0018] According to a fourth aspect of the present application, there is provided a computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the method described above.

[0019] According to a fifth aspect of the present application, there is provided a computer program product comprising a computer program that, when executed by a processor, implements the method described above.

[0020] The one or more embodiments described above have the advantages or benefits that by simplifying the scale of the original abnormal user network, the nodes with low influence in the network are filtered, but the overall structural features of the network are not affected, so that the time complexity of the influence maximization algorithm is reduced, and the computing resource is saved, while ensuring the accuracy of the identification of key abnormal users is not affected. BRIEF DESCRIPTION OF DRAWINGS

[0021] The above and other objects, features and advantages of the present application will become more apparent from the following description of embodiments of the present application, taken in conjunction with the accompanying drawings, in which:

[0022] Figure 1 An application scenario diagram of a method, device, electronic equipment and medium for identifying key abnormal users according to an embodiment of the present application is schematically shown.

[0023] Figure 2 A flowchart of a method for identifying key abnormal users according to an embodiment of the present application is schematically shown.

[0024] Figure 3 A schematic diagram of a first abnormal user network according to an embodiment of the present application is schematically shown.

[0025] Figure 4 A flowchart of obtaining structural features of a first abnormal user network according to an embodiment of the present application is schematically shown.

[0026] Figure 5 A flowchart of a network simplification step according to an embodiment of the present application is schematically shown.

[0027] Figure 6 A schematic diagram of a second abnormal user network according to an embodiment of the present application is schematically shown.

[0028] Figure 7A A network size / node number-time consumption curve diagram of an influence maximization algorithm according to an embodiment of the present application and other influence maximization algorithms is schematically shown. Figure 7B A network size / node number-influence propagation range curve diagram of an influence maximization algorithm according to an embodiment of the present application and other influence maximization algorithms is schematically shown.

[0029] Figure 8 A flowchart of analyzing a second abnormal user network by an influence maximization algorithm according to an embodiment of the present application is schematically shown.

[0030] Figure 9 A structural block diagram of a device for identifying key abnormal users according to an embodiment of the present application is schematically shown.

[0031] Figure 10 A block diagram of an electronic device suitable for implementing a method of identifying a critical abnormal user according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0032] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. It should be understood, however, that the description which follows is merely illustrative and is not intended to limit the scope of the present application. In the following detailed description of embodiments of the present application, numerous specific details are set forth in order to provide a thorough understanding of the present application. However, it will be apparent to one skilled in the art that one or more embodiments of the present application can be practiced without these specific details. In other instances, well-known structures and functions have not been described in detail in order to avoid obscuring aspects of the present application.

[0033] The terms used herein are merely used to describe specific embodiments and are not intended to limit the present application. The terms "include" and "have" and the like used herein indicate the presence of the described features, steps, operations, and / or components but do not preclude the presence or addition of one or more other features, steps, operations, or components.

[0034] All terms used herein, including technical and scientific terms, have the same meanings as those generally understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having meanings that are consistent with the context of the present description, and should not be interpreted in an idealized or overly formal way.

[0035] In the case of using expressions similar to "at least one of A, B, and C, etc.", it should generally be interpreted to include at least one of A, B, or C, or a combination thereof, unless otherwise defined. For example, "a system having at least one of A, B, and C" should be interpreted to include a system having at least one of A, B, or C, or a combination thereof, etc.

[0036] In the technical solutions of the present application, the acquisition, storage, and application of user personal information involved comply with relevant laws and regulations, necessary security measures are taken, and do not violate public order and good customs.

[0037] First, the technical terms described herein are explained and described as follows.

[0038] Complex network: As understood by one skilled in the art, a large number of complex systems existing in nature can be described by various networks. A typical network is composed of a number of nodes and edges between nodes, where a node represents a different individual in a real system, and an edge represents a relationship between individuals, often a certain relationship between two nodes is connected by an edge, and vice versa, two nodes connected by an edge are considered adjacent in the network. For example, the nervous system can be regarded as a network formed by a large number of nerve cells connected to each other by nerve fibers; a computer network can be regarded as a network formed by autonomous computers connected to each other through communication media such as optical cables, twisted pairs, coaxial cables, etc. Similar to power networks, social networks, transportation networks, scheduling networks, etc.

[0039] Scale-free network: A special network structure in which the distribution of the degree of nodes follows a power-law distribution. That is, there are a small number of nodes with very high degrees in the network, while most nodes have low degrees. A notable feature of this network is that it does not have a typical scale to describe the linking between nodes, hence the name scale-free network. Various real-world network structures exhibit scale-free characteristics, such as the Internet, social networks, biological networks, etc.

[0040] Random network: A network formed by randomly connecting any two nodes in a graph composed of N nodes with a probability P, i.e. whether there is an edge between nodes is uncertain and determined by the probability P. Its characteristics are that it has no clustering property but has a small average path length.

[0041] Small-world network (WS network): A new network constructed by removing the original edges in a regular network with a very small probability P and randomly connecting a new endpoint. Its characteristics are a small average path length and a large clustering coefficient.

[0042] Abnormal user network: A complex network formed by various users distributed in an abnormal industrial chain, in which nodes represent abnormal users and edges represent the association between abnormal users.

[0043] Degree of node: Also referred to as "degree", the degree of a node represents the total number of edges between the node and other nodes in the network.

[0044] Betweenness: In a broad sense, betweenness is divided into node betweenness and edge betweenness. Node betweenness refers to the proportion of the number of shortest paths passing through the node to the total number of shortest paths in the network. Edge betweenness refers to the proportion of the number of shortest paths passing through the edge to the total number of shortest paths in the network. It should be noted that in this document, unless otherwise specified, betweenness refers to edge betweenness.

[0045] Clustering coefficient: a measure of how clustered the nodes in a network are. It represents how many of the neighbors of a node are connected to each other, i.e., how many triangles exist around this node. The higher the clustering coefficient, the more likely it is that nodes in the network will form tightly connected groups.

[0046] Average path length of a network: defined as the average of the distances between any two nodes.

[0047] Degree correlation: describes the relationship between nodes with high degrees and nodes with low degrees in a network. If nodes with high degrees tend to connect to nodes with high degrees, the network is positively correlated in degree, or called homophilic; otherwise, if nodes with high degrees tend to connect to nodes with low degrees, the network is negatively correlated in degree, or called heterophilic.

[0048] Betweenness correlation: similar to degree correlation, it describes the relationship between edges with high betweenness and edges with low betweenness in a network. If edges with high betweenness tend to connect to edges with high betweenness, the network is positively correlated in betweenness, or called homophilic; otherwise, if edges with high betweenness tend to connect to edges with low betweenness, the network is negatively correlated in betweenness, or called heterophilic.

[0049] With the rapid development of external abnormal industries, the number of abnormal practitioners in the abnormal market has increased dramatically, causing significant economic losses to some enterprises and leading to the leakage of a large amount of personal information. The current abnormal user influence analysis mainly analyzes the abnormal users themselves and the association relationship between the users, and rarely focuses on the network structure characteristics of the entire abnormal user group association, making it difficult to mine a lot of hidden information between abnormal groups and not conducive to precise protection against abnormalities.

[0050] Based on this, the embodiment of the present application provides a method for identifying key abnormal users, the method comprising: obtaining a first abnormal user network, wherein the first abnormal user network comprises m1 nodes and n1 edges, each node represents an abnormal user, and each edge represents an association relationship between abnormal users, m1 and n1 are both positive integers greater than or equal to 3; analyzing the first abnormal user network to obtain a structural feature of the first abnormal user network; removing m3 nodes and n3 edges from the first abnormal user network to obtain a second abnormal user network, wherein the second abnormal user network comprises m2 nodes and n2 edges, the structural feature of the second abnormal user network is consistent with the structural feature of the first abnormal user network, m2 and n2 are both positive integers greater than or equal to 2, m3 and n3 are both positive integers greater than or equal to 1, m2 and m3 are both less than m1, and n2 and n3 are both less than n1; and analyzing the second abnormal user network by using an influence maximization algorithm to obtain a set of key abnormal users, wherein the set of key abnormal users comprises k abnormal users, the k abnormal users are nodes with the top k influence from large to small in the second abnormal user network, k is a positive integer greater than or equal to 1, and k is less than m2. In the method according to the embodiment of the present application, by simplifying the size of the original abnormal user network, the nodes with low influence in the network are filtered, but the overall structural feature of the network is not affected, so that the time complexity of the influence maximization algorithm is reduced, and the computing resource is saved, while ensuring the accuracy of the identification of key abnormal users is not affected.

[0051] It should be noted that the method and device for identifying key abnormal users determined by the present application can be used in the fields of big data technology, artificial intelligence technology and information security technology.

[0052] Figure 1 An application scenario diagram of the method, device, equipment and medium for identifying key abnormal users according to the embodiment of the present application is schematically shown.

[0053] As Figure 1 shown, the application scenario 100 according to the embodiment can comprise terminal equipment 101, 102 and 103, a network 104 and a server 105. The network 104 is a medium for providing a communication link between the terminal equipment 101, 102 and 103 and the server 105. The network 104 can comprise various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0054] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0055] Terminal devices 101, 102, and 103 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0056] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using terminal devices 101, 102, and 103 (for example only). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0057] It should be noted that the method for identifying key abnormal users provided in the embodiments of the present invention can generally be executed by server 105. Correspondingly, the device for identifying key abnormal users provided in the embodiments of the present invention can generally be located in server 105. The method for identifying key abnormal users provided in the embodiments of the present invention can also be executed by a server or server cluster that is different from server 105 and capable of communicating with terminal devices 101, 102, 103 and / or server 105. Correspondingly, the device for identifying key abnormal users provided in the embodiments of the present invention can also be located in a server or server cluster that is different from server 105 and capable of communicating with terminal devices 101, 102, 103 and / or server 105.

[0058] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0059] The following will be based on Figure 1 The described scene, through Figures 2-8 The method for identifying key abnormal users provided by embodiments of the present invention will be described in detail.

[0060] Figure 2 A flowchart illustrating a method for identifying key abnormal users according to an embodiment of the present invention is shown.

[0061] like Figure 2 As shown, the method 200 for identifying key abnormal users in this embodiment may include operations S210 to S240.

[0062] In operation S210, a first abnormal user network is acquired, wherein the first abnormal user network includes m1 nodes and n1 edges, each node represents an abnormal user, each edge represents an association relationship between abnormal users, and m1 and n1 are positive integers greater than or equal to 3.

[0063] In an embodiment of the present application, the acquisition of the first abnormal user network specifically includes: collecting relevant data of abnormal users from an original data set; performing data processing on the relevant data; and constructing a network model with abnormal users as nodes and certain association relationships between abnormal users as edges.

[0064] In an embodiment of the present application, relevant data information of abnormal users can be acquired from multiple aspects to obtain an original data set, for example: personal information, including user ID, avatar, personal profile, etc.; geographic location information, including location information of abnormal users recorded through geographic location tags, check-in, etc. At the same time, the association relationship between abnormal users can be acquired, for example: friend relationship, i.e. the friend relationship established by abnormal users with other users in a social network; social dynamic contact, including social dynamic contact established between abnormal users and other users through commenting, forwarding, or being commented, being forwarded, etc.; group relationship, i.e. the group relationship formed by abnormal users and other users participating in a social network group together, etc.

[0065] In an embodiment of the present application, after collecting relevant data of abnormal users from the original data set, the relevant data can be further preprocessed, such as data format arrangement, cleaning, screening, etc., to meet the needs of model construction.

[0066] In an embodiment of the present application, in order to acquire the network model of the first abnormal user network, a NetworkX toolkit based on Python can be used. For example, an empty undirected graph can be created by using the NetworkX toolkit, m1 nodes and n1 edges are added to the network model according to the user IDs in the original data set and the association relationships between them, and thus a complete network model is constructed.

[0067] It should be noted that NetworkX is a graph theory and complex network modeling toolkit developed in Python language, which provides functions for creating, operating and analyzing complex networks, allowing users to easily interact with Python programming and a large number of data structures and graph algorithms. NetworkX supports different types of graph structures, such as undirected graphs, directed graphs and multigraphs, as well as weights, attributes and other additional information, which enables NetworkX to meet the modeling requirements of various complex network scenarios. NetworkX also contains many commonly used graph algorithms and network analysis functions, which can provide functions such as analyzing network structure, designing new network algorithms, and network plotting.

[0068] Figure 3 A schematic diagram of a first abnormal user network according to an embodiment of the application is shown schematically.

[0069] In an embodiment of the application, as shown in Figure 3 The nodes represented by circles and the edges represented by line segments in the first abnormal user network, i.e., the circles represent individual abnormal users, and the line segments represent the association between individual abnormal users. Among them, in the first abnormal user network, the degree of the node presents a power-law distribution, which means that only a few nodes (for example, node 1) have a higher degree, while the degrees of most nodes are lower (for example, nodes 2 and 3).

[0070] In operation S220, the first abnormal user network is analyzed to obtain the structural characteristics of the first abnormal user network.

[0071] Figure 4 A flowchart for obtaining the structural characteristics of the first abnormal user network according to an embodiment of the application is shown schematically.

[0072] In an embodiment of the application, the analysis of the first abnormal user network to obtain the structural characteristics of the first abnormal user network can include operations S310-S330.

[0073] In operation S310, the first abnormal user network is analyzed to obtain the overall structural characteristic value and the local structural characteristic value of the first abnormal user network.

[0074] In an embodiment of the application, the overall structural characteristic value of the first abnormal user network includes the degree of each node of the first abnormal user network, the betweenness of each edge, the clustering coefficient and the average path length of the first abnormal user network; the local structural characteristic value of the first abnormal user network includes the degree correlation and the betweenness correlation.

[0075] According to the above, based on the network model established according to the abnormal user data, the following calculations and analyses can be performed by using the built-in functions of NetworkX: calculating the degree of each node in the first abnormal user network, and analyzing the connection density and possible central nodes of the nodes in the network according to the distribution of the degree; calculating the betweenness centrality of each node in the first abnormal user network, for reflecting the importance of the node in the network; calculating the clustering coefficient of the first abnormal user network, to analyze the aggregation degree of the nodes in the first abnormal user network; and calculating the average path length of the first abnormal user network, to analyze the contact distance between the abnormal users. Further, the following calculations and analyses can be performed: degree correlation calculation and analysis, to determine whether there are preferential edges between homogenous nodes and heterogeneous nodes; betweenness correlation calculation and analysis, to analyze the potential correlation characteristics.

[0076] In operation S320, the type of the first abnormal user network is determined according to the global structure characteristic value and the local structure characteristic value of the first abnormal user network.

[0077] In the embodiments of the present application, the type of the first abnormal user network can include a scale-free network, a random network, or a small-world network, etc. It should be noted that the types listed here are only exemplary, and are not intended to limit the type of the abnormal user network in the embodiments of the present application, i.e., the abnormal user network in the embodiments of the present application can also include other types of networks.

[0078] In the embodiments of the present application, based on the global structure characteristic value and the local structure characteristic value of the network, the network type can be more accurately determined, while ensuring a smaller amount of calculation, which is beneficial to achieve a balance between the saving of computing resources and the accuracy of calculation.

[0079] In operation S330, the structure characteristics of the first abnormal user network are determined according to the type, the global structure characteristic value, and the local structure characteristic value of the first abnormal user network.

[0080] It should be noted that in real life, many external factors will affect the structural properties of the real network, thereby affecting the shape of the degree distribution. Therefore, for the verification of the properties of the empirical network, the power-law distribution or the exponential distribution is generally used to simulate the network structure, and the simulation results are used to determine whether the network meets certain model properties, so as to obtain the overall structural characteristics of the model. The purpose of the overall structural characteristic analysis of the network model is to obtain a macroscopic grasp of the network structure. However, the generation and interaction of the association relationship between users are also the focus of the research, and further analysis of the network needs to involve the property analysis of the edges and nodes. Therefore, it is necessary to analyze the local structural characteristics of the network. At the same time, according to the network type, the overall characteristics, and the local characteristics, the structural characteristics of the network are determined, so that the determined structural characteristics are more accurate. The structural characteristics of the first abnormal user network determined by the above overall structural analysis and local structural analysis method can be used to analyze the network model established by the abnormal user in depth, and reveal the key nodes in the network and the contact mode between users.

[0081] Referring back to Figure 2 In operation S230, m3 nodes and n3 edges are removed from the first abnormal user network to obtain a second abnormal user network, wherein the second abnormal user network includes m2 nodes and n2 edges, the structural characteristics of the second abnormal user network are consistent with the structural characteristics of the first abnormal user network, m2 and n2 are positive integers greater than or equal to 2, m3 and n3 are positive integers greater than or equal to 1, m2 and m3 are less than m1, and n2 and n3 are less than n1.

[0082] In the embodiment of the application, the above operation filters the user nodes with less influence in the first abnormal user network, while not affecting the structural characteristics of the first abnormal user network, thereby reducing the calculation amount, so it can be called a network simplification step, and the network simplification step specifically includes operation S410~operation S460.

[0083] Figure 5 A flowchart of the network simplification step according to the embodiment of the application is schematically shown.

[0084] In operation S410, a degree threshold and an intermediate threshold are determined according to the degree distribution and the intermediate distribution of the first abnormal user network.

[0085] In operation S420, nodes with a degree less than the degree threshold are removed from the first abnormal user network, and edges with an intermediate less than the intermediate threshold are removed from the first abnormal user network to obtain an intermediate abnormal user network.

[0086] The process of operation S420 is also called a network simplification sub-step, which realizes filtering of nodes with a degree and a betweenness less than a preset threshold, and the calculation amount of the step itself is small. Through the simplification step, the network of the first abnormal user is simplified, thereby facilitating reduction of the calculation complexity of the influence maximization algorithm in analyzing the abnormal user network, and the overall calculation amount is reduced.

[0087] In operation S430, the intermediate abnormal user network is analyzed to obtain a structural feature of the intermediate abnormal user network.

[0088] In operation S440, the structural feature of the intermediate abnormal user network is compared with the structural feature of the first abnormal user network.

[0089] In operation S450, if the structural feature of the intermediate abnormal user network is inconsistent with the structural feature of the first abnormal user network, the degree threshold and the betweenness threshold are adjusted, and operation S420 is repeatedly performed until the structural feature of the intermediate abnormal user network is consistent with the structural feature of the first abnormal user network.

[0090] In an embodiment of the present application, the adjustment of the degree threshold and the betweenness threshold comprises adjusting the degree threshold and the betweenness threshold according to a Bayesian optimization parameter adjustment method.

[0091] It should be noted that Bayesian optimization is a method for machine learning parameter adjustment, and its main idea is that, given an optimization objective function (a generalized function, only the input and output need to be specified, without knowing the internal structure and mathematical properties), the posterior distribution (Gaussian process) of the objective function is updated by constantly adding sample points until the posterior distribution basically fits the true distribution.

[0092] In operation S460, the intermediate abnormal user network consistent with the structural feature of the first abnormal user network is taken as the second abnormal user network.

[0093] In the embodiments of the present application, in order to determine whether the structural feature of the second abnormal user network is consistent with the structural feature of the first abnormal user network, the method for identifying a key abnormal user further comprises obtaining a second abnormal user network structural feature, specifically comprising: analyzing the second abnormal user network to obtain an overall structural feature value and a local structural feature value of the second abnormal user network; determining the type of the second abnormal user network according to the overall structural feature value and the local structural feature value of the second abnormal user network; and determining the structural feature of the second abnormal user network according to the type, the overall structural feature value and the local structural feature value of the second abnormal user network. The specific steps of obtaining the second abnormal user network structural feature are similar to those of obtaining the first abnormal user network structural feature, and will not be repeated here. That is, in step S430, obtaining the structural feature of the intermediate abnormal user network can comprise: analyzing the intermediate abnormal user network to obtain an overall structural feature value and a local structural feature value of the intermediate abnormal user network; determining the type of the intermediate abnormal user network according to the overall structural feature value and the local structural feature value of the intermediate abnormal user network; and determining the structural feature of the intermediate abnormal user network according to the type, the overall structural feature value and the local structural feature value of the intermediate abnormal user network. The specific steps of obtaining the intermediate abnormal user network structural feature are similar to those of obtaining the first abnormal user network structural feature, and will not be repeated here.

[0094] In the embodiments of the present application, the type of the first abnormal user network is a scale-free network, and the structural feature of the first abnormal user network comprises that the distribution of the degree of the nodes of the first abnormal user network conforms to a power-law distribution; and the structural feature of the second abnormal user network comprises that the distribution of the degree of the nodes of the second abnormal user network conforms to a power-law distribution.

[0095] In the embodiments of the present application, the structural feature of the second abnormal user network being consistent with the structural feature of the first abnormal user network comprises that the ratio of the power index in the power-law distribution of the degree of the nodes of the second abnormal user network to the power index in the power-law distribution of the degree of the nodes of the first abnormal user network is substantially consistent, specifically, the ratio is between 0.8 and 1.2.

[0096] Figure 6 A schematic diagram of a second abnormal user network according to an embodiment of the present application is schematically shown.

[0097] In the embodiments of the present application, as shown in Figure 6 The second abnormal user network deletes the original node 2 and node 3 (in Figure 6The power exponent in the power-law distribution of the degrees of the nodes of the second abnormal user network is substantially consistent with the power exponent in the power-law distribution of the degrees of the nodes of the first abnormal user network, specifically, the ratio of the power exponents is about 0.9.

[0098] According to the embodiment of the present application, after the simplification operation on the first abnormal user network, the structure characteristics of the network are ensured not to change while the network is simplified through steps S430-S460, so as to ensure the accuracy of subsequent analysis. In operation S240, the second abnormal user network is analyzed by using the influence maximization algorithm to obtain a set of key abnormal users, wherein the set of key abnormal users includes k abnormal users, the k abnormal users are nodes with the top k influence from large to small in the second abnormal user network, and k is a positive integer greater than or equal to 1, and k is less than m2.

[0099] In the embodiment of the present application, the influence maximization algorithm can be used to analyze the second abnormal user network.

[0100] It should be noted that the influence maximization algorithm is an algorithm for selecting some seed nodes in a social network, so that the information propagation initiated from these nodes can cover as many other nodes as possible. In the embodiment of the present application, the influence maximization algorithm LDAG is preferably used. The LDAG algorithm is an influence maximization algorithm based on a linear threshold model, which uses the local directed acyclic graph constructed for the network nodes to calculate the propagation of influence in the network.

[0101] Figure 7A The network size / node number-consumption time curve of the influence maximization algorithm proposed in the embodiment of the present application and other influence maximization algorithms is schematically shown; Figure 7B The network size / node number-influence propagation range curve of the influence maximization algorithm proposed in the embodiment of the present application and other influence maximization algorithms is schematically shown.

[0102] From Figure 7A and Figure 7B It can be seen that, under the same network size / node number, the influence propagation range of the influence maximization algorithm proposed in the embodiment of the present application is weaker than that of the greedy algorithm, but the consumption time is less than that of the greedy algorithm.

[0103] From Figure 7A and Figure 7B It can be seen that, under the same network size / node number, the consumption time of the influence maximization algorithm proposed in the embodiment of the present application is higher than that of the degree discount algorithm, but the influence propagation range is stronger than that of the degree discount algorithm.

[0104] Based on the comparison result, considering time and propagation range, the influence maximization algorithm proposed in the embodiment of the application reduces the running time while ensuring the stability of the influence propagation range. Therefore, the influence maximization algorithm proposed in the embodiment of the application has higher efficiency and accuracy compared with other influence maximization algorithms.

[0105] Figure 8 A flowchart of the influence maximization algorithm proposed in the embodiment of the application for analyzing the second abnormal user network is schematically shown.

[0106] In the embodiment of the application, the influence maximization algorithm proposed in the embodiment of the application for analyzing the second abnormal user network to obtain the set of key abnormal users can include operations S510-S550.

[0107] In operation S510, for each node v in the second abnormal user network, a directed acyclic graph is constructed to obtain m2 directed acyclic graphs, wherein each node v is distributed in multiple directed acyclic graphs.

[0108] In the embodiment of the application, when constructing the directed acyclic graph for node v, the nodes in the entire network that have an influence on node v are calculated. Too many nodes will cause the algorithm to have a low calculation efficiency. Therefore, when constructing the local directed acyclic graph for node v, a part of nodes that have a small influence on node v are filtered out to improve the calculation efficiency and accuracy.

[0109] Based on the above content, in the embodiment of the application, the construction of the directed acyclic graph for each node v in the second abnormal user network can further include: calculating the influence of other nodes in the second abnormal user network on node v except node v; selecting q nodes from the other nodes, wherein the influence of each node in the q nodes on node v is greater than a pre-set influence threshold, q is a positive integer greater than or equal to 1, and q is less than m2; and constructing a directed acyclic graph for node v according to node v, the q nodes and corresponding edges.

[0110] In operation S520, the influence of each node in each directed acyclic graph in the m2 directed acyclic graphs is calculated respectively within the range of the directed acyclic graph.

[0111] In operation S530, for each node v in the second abnormal user network, multiple influences of the node v in the multiple directed acyclic graphs in which the node v is distributed are obtained, and the multiple influences of the node v are superimposed to obtain the total influence of the node v in the second abnormal user network.

[0112] At operation S540, total influence of each node in the second abnormal user network is sorted in descending order.

[0113] At operation S550, k nodes with top-k total influence are selected to obtain k key abnormal users to form a set of key abnormal users, wherein the value of k is pre-configured.

[0114] Through operations S540-S550, the key abnormal users can be obtained by using a simple sorting method, which is beneficial to save computing resources.

[0115] The method for identifying key abnormal users according to the embodiments of the present application can mine hidden key abnormal user nodes in the network, accurately protect the abnormal users with large hidden influence, and effectively improve the security protection efficiency. Specifically, the advantages of the embodiments of the present application are as follows: from the overall and structural analysis of the abnormal user group network structure characteristics, the influence of the abnormal user nodes in the network is analyzed to mine the complex hidden relationship between the abnormal users and more accurately identify the key abnormal users; and the calculation amount of the influence maximization algorithm is reduced, the present application simplifies the network scale, filters the nodes with low influence in the network, but does not affect the overall structural characteristics of the network, greatly reduces the complexity of the influence maximization algorithm, and has great use value.

[0116] Figure 9 A structural block diagram of the device for identifying key abnormal users according to the embodiments of the present application is schematically shown.

[0117] As shown in Figure 9 The device 700 for identifying key abnormal users according to the embodiments includes a first abnormal user network obtaining module 710, a first abnormal user network analysis module 720, a second abnormal user network obtaining module 730, and a key abnormal user set obtaining module 740.

[0118] The first abnormal user network obtaining module 710 can be used to obtain a first abnormal user network, wherein the first abnormal user network includes m1 nodes and n1 edges, each node represents each abnormal user, each edge represents the association relationship between each abnormal user, and m1 and n1 are both positive integers greater than or equal to 3. In an embodiment, the first abnormal user network obtaining module 710 can be used to perform the operation S210 described above, and details are not repeated here.

[0119] The first abnormal user network analysis module 720 can be used to analyze the first abnormal user network to obtain the structural characteristics of the first abnormal user network. In an embodiment, the first abnormal user network analysis module 720 can be used to perform the operation S220 described above, and details are not repeated here.

[0120] The second abnormal user network obtaining module 730 can be configured to remove m3 nodes and n3 edges from the first abnormal user network to obtain a second abnormal user network, where the second abnormal user network includes m2 nodes and n2 edges, the structure feature of the second abnormal user network is consistent with the structure feature of the first abnormal user network, m2 and n2 are positive integers greater than or equal to 2, m3 and n3 are positive integers greater than or equal to 1, m2 and m3 are less than m1, and n2 and n3 are less than n1. In an embodiment, the second abnormal user network obtaining module 730 can be configured to perform the operation S230 described above, and details are not repeated here.

[0121] The key abnormal user set obtaining module 740 can be configured to analyze the second abnormal user network by using an influence maximization algorithm to obtain a set of key abnormal users, where the set of key abnormal users includes k abnormal users, the k abnormal users are nodes with top k influence from large to small in the second abnormal user network, k is a positive integer greater than or equal to 1, and k is less than m2. In an embodiment, the key abnormal user set obtaining module 740 can be configured to perform the operation S240 described above, and details are not repeated here.

[0122] According to an embodiment of the present application, the first abnormal user network analysis module 720 includes a first structure feature analysis unit, a first network type determination unit, and a first network structure feature determination unit.

[0123] The first structure feature analysis unit is configured to analyze the first abnormal user network to obtain an overall structure feature value and a local structure feature value of the first abnormal user network. In an embodiment, the first structure feature analysis unit can be configured to perform the operation S310 described above, and details are not repeated here.

[0124] The first network type determination unit is configured to determine the type of the first abnormal user network according to the overall structure feature value and the local structure feature value of the first abnormal user network. In an embodiment, the first network type determination unit can be configured to perform the operation S320 described above, and details are not repeated here.

[0125] The first network structure feature determination unit is configured to determine the structure feature of the first abnormal user network according to the type, the overall structure feature value, and the local structure feature value of the first abnormal user network. In an embodiment, the first network structure feature determination unit can be configured to perform the operation S330 described above, and details are not repeated here.

[0126] According to an embodiment of the present application, the first abnormal user network analysis module 720 further comprises a second structure feature analysis unit, configured to analyze the second abnormal user network to obtain an overall structure feature value and a local structure feature value of the second abnormal user network; a second network type determination unit, configured to determine a type of the second abnormal user network according to the overall structure feature value and the local structure feature value of the second abnormal user network; and a second network structure feature determination unit, configured to determine a structure feature of the second abnormal user network according to the type, the overall structure feature value and the local structure feature value of the second abnormal user network.

[0127] According to an embodiment of the present application, the second abnormal user network obtaining module 730 comprises a network simplification sub-unit, an intermediate abnormal user network structure feature analysis unit, a comparison unit, an adjustment unit and a second abnormal user network determination unit.

[0128] The network simplification sub-unit is configured to determine a degree threshold value and a betweenness threshold value according to the degree distribution and the betweenness distribution of the first abnormal user network, remove nodes with a degree less than the degree threshold value from the first abnormal user network, and remove edges with a betweenness less than the betweenness threshold value from the first abnormal user network, to obtain an intermediate abnormal user network. In an embodiment, the network simplification sub-unit can be configured to perform the operations S410-S420 described above, and details are not repeated here.

[0129] The intermediate abnormal user network structure feature analysis unit is configured to analyze the intermediate abnormal user network to obtain a structure feature of the intermediate abnormal user network. In an embodiment, the intermediate abnormal user network structure feature analysis unit can be configured to perform the operation S430 described above, and details are not repeated here.

[0130] The comparison unit is configured to compare the structure feature of the intermediate abnormal user network with the structure feature of the first abnormal user network. In an embodiment, the comparison unit can be configured to perform the operation S440 described above, and details are not repeated here.

[0131] When the structure feature of the intermediate abnormal user network is inconsistent with the structure feature of the first abnormal user network, the adjustment unit is configured to adjust the degree threshold value and the betweenness threshold value, repeatedly perform the network simplification sub-unit until the structure feature of the intermediate abnormal user network is consistent with the structure feature of the first abnormal user network. In an embodiment, the adjustment unit can be configured to perform the operation S450 described above, and details are not repeated here.

[0132] The second abnormal user network determining unit is configured to determine an intermediate abnormal user network consistent with the structural features of the first abnormal user network as the second abnormal user network. In an embodiment, the second abnormal user network determining unit can be configured to perform operation S460 described above, and thus repeated details are not provided herein.

[0133] According to an embodiment of the present application, the key abnormal user set obtaining module 740 comprises a directed acyclic graph constructing module, a first influence force calculating unit, a total influence force obtaining unit, a ranking unit and a key abnormal user determining unit.

[0134] The directed acyclic graph constructing module is configured to construct a directed acyclic graph for each node v in the second abnormal user network, to obtain m2 directed acyclic graphs, wherein each node v is distributed in multiple directed acyclic graphs. In an embodiment, the directed acyclic graph constructing module can be configured to perform operation S510 described above, and thus repeated details are not provided herein.

[0135] The first influence force calculating unit is configured to calculate the influence force of each node in each directed acyclic graph in the m2 directed acyclic graphs, respectively. In an embodiment, the first influence force calculating unit can be configured to perform operation S520 described above, and thus repeated details are not provided herein.

[0136] The total influence force obtaining unit is configured to obtain the multiple influence forces of each node v in the second abnormal user network in the multiple directed acyclic graphs in which the node v is distributed, and superimpose the multiple influence forces of the node v to obtain the total influence force of the node v in the second abnormal user network. In an embodiment, the total influence force obtaining unit can be configured to perform operation S530 described above, and thus repeated details are not provided herein.

[0137] The ranking unit is configured to rank the total influence forces of each node in the second abnormal user network in descending order. In an embodiment, the ranking unit can be configured to perform operation S540 described above, and thus repeated details are not provided herein.

[0138] The key abnormal user determining unit is configured to select k nodes with the top k total influence forces, to obtain k key abnormal users, to form a key abnormal user set, wherein the value of k is pre-set. In an embodiment, the key abnormal user determining unit can be configured to perform operation S550 described above, and thus repeated details are not provided herein.

[0139] According to an embodiment of the present application, the directed acyclic graph constructing module further comprises: a second influence calculation unit, configured to calculate the influence of each of the other nodes in the second abnormal user network on node v; a screening unit, configured to screen q nodes from the other nodes, wherein the influence of each of the q nodes on node v is greater than a preset influence threshold, q is a positive integer greater than or equal to 1, and q is less than m2; and a directed acyclic graph obtaining module, configured to construct the directed acyclic graph of node v according to node v, the q nodes and the corresponding edges.

[0140] Figure 10 A block diagram of an electronic device suitable for implementing the method of identifying key abnormal users according to an embodiment of the present application is shown schematically.

[0141] As shown in Figure 10 The electronic device 800 according to an embodiment of the present application includes a processor 801, which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 802 or loaded into a random access memory (RAM) 803 from a storage section 808. The processor 801 can include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor, and / or a related chipset, and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), and / or the like. The processor 801 can also include an on-board memory for cache use. The processor 801 can include a single processing unit or multiple processing units for executing different actions of the method processes according to embodiments of the present application.

[0142] In the RAM 803, various programs and data required for the operation of the electronic device 800 are stored. The processor 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. The processor 801 performs various operations of the method processes according to embodiments of the present application by executing programs in the ROM 802 and / or the RAM 803. It should be noted that the programs can also be stored in one or more memories other than the ROM 802 and the RAM 803. The processor 801 can also perform various operations of the method processes according to embodiments of the present application by executing programs stored in the one or more memories.

[0143] According to an embodiment of the present application, the electronic device 800 can further include an input / output (I / O) interface 808 also connected to the bus 804. The electronic device 800 can further include one or more of the following components connected to the I / O interface 808: an input part 808 including a keyboard, a mouse, etc.; an output part 808 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage part 808 including a hard disk, etc.; and a communication part 808 including a network interface card such as a LAN card, a modem, etc. The communication part 808 performs communication processing via a network such as the Internet. A drive 810 is also connected to the I / O interface 808 as necessary. A removable medium 811 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is mounted on the drive 810 as necessary, so that a computer program read out therefrom is installed in the storage part 808 as necessary.

[0144] The present application also provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments, or can exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of the present application.

[0145] According to an embodiment of the present application, the computer readable storage medium can be a non-volatile computer readable storage medium, which can include, but is not limited to, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present application, the computer readable storage medium can be any tangible medium that contains or stores a program, which can be used by or in connection with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present application, the computer readable storage medium can include the ROM 802 and / or the RAM 803 described above, and / or one or more memories other than the ROM 802 and the RAM 803.

[0146] The embodiments of the present application also include a computer program product, which includes a computer program containing program codes for executing the methods shown in the flowcharts. When the computer program product is run in a computer system, the program codes are used to make the computer system implement the methods provided by the embodiments of the present application.

[0147] The above-described functions of the system / device defined in the system / apparatus of the embodiments of the present application are performed when the computer program is executed by the processor 801. According to the embodiments of the present application, the system, apparatus, module, unit, etc. described above can be implemented by the computer program modules.

[0148] In one embodiment, the computer program can be stored in a tangible storage medium, such as an optical, magnetic, or other memory on a hard disk or solid state drive. In another embodiment, the computer program can be transmitted over a network via a modulated signal, and downloaded and installed by the communication portion 808, and / or installed from the removable medium 811. The program code embodied in the computer program can be transmitted using any appropriate medium, including but not limited to wireless, wired, optical fiber cable, or any suitable combination of the foregoing.

[0149] In such an embodiment, the computer program can be downloaded and installed from the network via the communication portion 808, and / or installed from the removable medium 811. When the computer program is executed by the processor 801, the above-described functions of the system defined in the embodiments of the present application are performed. According to the embodiments of the present application, the system, apparatus, device, module, unit, etc. described above can be implemented by the computer program modules.

[0150] According to the embodiments of the present application, the program code for carrying out the embodiments of the present application can be written in any combination of one or more programming languages, and specifically, can be implemented using high-level procedural and / or object-oriented programming language, and / or assembly / machine language. The programming language includes, but is not limited to, such as Java, C++, python, "C" language, or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In the case involving a remote computing device, the remote computing device can be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, connected to the Internet through an Internet service provider).

[0151] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0152] The embodiments of the present invention have been described above. However, these embodiments are merely illustrative and not intended to limit the scope of the invention. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of the invention, and all such substitutions and modifications should fall within the scope of the invention.

Claims

1. A method of identifying key anomalous users, the method comprising: The method comprises: obtaining a first abnormal user network, wherein the first abnormal user network comprises m1 nodes and n1 edges, each node represents an abnormal user, each edge represents an association relationship between abnormal users, m1 and n1 are positive integers greater than or equal to 3; analyzing the first abnormal user network to obtain a structural feature of the first abnormal user network; removing m3 nodes and n3 edges from the first abnormal user network to obtain a second abnormal user network, wherein the second abnormal user network comprises m2 nodes and n2 edges, the structural feature of the second abnormal user network is consistent with the structural feature of the first abnormal user network, m2 and n2 are positive integers greater than or equal to 2, m3 and n3 are positive integers greater than or equal to 1, m2 and m3 are less than m1, and n2 and n3 are less than n1; and analyzing the second abnormal user network by using an influence maximization algorithm to obtain a set of key abnormal users, wherein the influence maximization algorithm comprises an LDAG algorithm, the set of key abnormal users comprises k abnormal users, the k abnormal users are nodes ranked in the top k positions from large to small in terms of influence in the second abnormal user network, k is a positive integer greater than or equal to 1, and k is less than m2; the analysis of the first abnormal user network to obtain the structural feature of the first abnormal user network specifically comprises: analyzing the first abnormal user network to obtain a global structural feature value and a local structural feature value of the first abnormal user network; determining the type of the first abnormal user network according to the global structural feature value and the local structural feature value of the first abnormal user network; and determining the structural feature of the first abnormal user network according to the type, the global structural feature value and the local structural feature value of the first abnormal user network; the global structural feature value of the first abnormal user network comprises the degree of each node, the betweenness of each edge, the clustering coefficient and the average path length of the first abnormal user network; and / or the local structural feature value of the first abnormal user network comprises the degree correlation and the betweenness correlation; the removal of m3 nodes and n3 edges from the first abnormal user network to obtain a second abnormal user network specifically comprises: a network simplification sub-step: determining a degree threshold and a betweenness threshold according to the degree distribution and the betweenness distribution of the first abnormal user network; removing nodes with a degree less than the degree threshold from the first abnormal user network, and removing edges with a betweenness less than the betweenness threshold from the first abnormal user network to obtain an intermediate abnormal user network; the removal of m3 nodes and n3 edges from the first abnormal user network to obtain a second abnormal user network further specifically comprises: analyzing the intermediate abnormal user network to obtain a structural feature of the intermediate abnormal user network; comparing the structural feature of the intermediate abnormal user network with the structural feature of the first abnormal user network; if the structural feature of the intermediate abnormal user network is inconsistent with the structural feature of the first abnormal user network, adjusting the degree threshold and the intermediate threshold according to a Bayesian optimization parameter adjustment method, repeatedly performing the network simplification sub-step until the structural feature of the intermediate abnormal user network is consistent with the structural feature of the first abnormal user network; and taking the intermediate abnormal user network consistent with the structural feature of the first abnormal user network as the second abnormal user network.

2. The method of claim 1, wherein, The second abnormal user network is analyzed by using an influence maximization algorithm to obtain a set of key abnormal users, specifically including: For each node v in the second abnormal user network, a directed acyclic graph is constructed to obtain m2 directed acyclic graphs, wherein each node v is distributed in multiple directed acyclic graphs; In the range of each directed acyclic graph in the m2 directed acyclic graphs, the influence of each node in the directed acyclic graph is calculated respectively; For each node v in the second abnormal user network, the multiple influences of the node v in the distributed multiple directed acyclic graphs are obtained, and the multiple influences of the node v are superimposed to obtain the total influence of the node v in the second abnormal user network.

3. The method of claim 2, wherein, The second abnormal user network is analyzed by using an influence maximization algorithm to obtain a set of key abnormal users, specifically including: The total influences of the nodes in the second abnormal user network are sorted in descending order; and k key abnormal users are selected from the nodes with the top k total influences to form a set of key abnormal users, wherein the value of k is pre-set.

4. The method of claim 2, wherein, The construction of the directed acyclic graph for each node v in the second abnormal user network specifically includes: The influence of the other nodes in the second abnormal user network on node v is calculated; From the other nodes, q nodes are selected, wherein the influence of each node in the q nodes on node v is greater than a pre-set influence threshold, q is a positive integer greater than or equal to 1, and q is less than m2; According to node v, the q nodes and the corresponding edges, a directed acyclic graph of node v is constructed.

5. The method of claim 1, wherein, The method further includes: analyzing the second abnormal user network to obtain an overall structural feature value and a local structural feature value of the second abnormal user network; determining the type of the second abnormal user network according to the overall structural feature value and the local structural feature value of the second abnormal user network; and determining the structural feature of the second abnormal user network according to the type, the overall structural feature value and the local structural feature value of the second abnormal user network.

6. The method of claim 1, wherein, The type of the first abnormal user network is a scale-free network, and the structural feature of the first abnormal user network includes that the distribution of the degrees of the nodes of the first abnormal user network conforms to a power-law distribution; the structural feature of the second abnormal user network includes that the distribution of the degrees of the nodes of the second abnormal user network conforms to a power-law distribution.

7. The method of claim 6, wherein, The structural feature of the second abnormal user network is consistent with the structural feature of the first abnormal user network includes that: A ratio of a power exponent in a power-law distribution of degrees of nodes of the second abnormal user network to a power exponent in a power-law distribution of degrees of nodes of the first abnormal user network is between 0.8 and 1.

2.

8. An apparatus for identifying key anomalous users, the apparatus comprising: An apparatus for performing the method of any one of claims 1-7, the apparatus comprising: a first abnormal user network obtaining module configured to obtain a first abnormal user network, wherein the first abnormal user network includes m1 nodes and n1 edges, each node represents an abnormal user, and each edge represents an association relationship between abnormal users, m1 and n1 are positive integers greater than or equal to 3; a first abnormal user network analyzing module configured to analyze the first abnormal user network to obtain a structural feature of the first abnormal user network; a second abnormal user network obtaining module configured to remove m3 nodes and n3 edges from the first abnormal user network to obtain a second abnormal user network, wherein the second abnormal user network includes m2 nodes and n2 edges, the structural feature of the second abnormal user network is consistent with the structural feature of the first abnormal user network, m2 and n2 are positive integers greater than or equal to 2, m3 and n3 are positive integers greater than or equal to 1, m2 and m3 are both less than m1, and n2 and n3 are both less than n1; and a key abnormal user set obtaining module configured to analyze the second abnormal user network using an influence maximization algorithm to obtain a set of key abnormal users, wherein the set of key abnormal users includes k abnormal users, the k abnormal users are nodes with the top k influence from large to small in the second abnormal user network, k is a positive integer greater than or equal to 1, and k is less than m2. 9.An electronic device, comprising: one or more processors; a storage device for storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the method of any one of claims 1-7. 10.A computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the method of any one of claims 1-7. 11.A computer program product, comprising a computer program that, when executed by a processor, implements the method of any one of claims 1-7.

Images