Method and apparatus for visualizing interaction of data accounts

Abstract

The present specification provides a data account interaction relationship visualization method and device, wherein the data account interaction relationship visualization method comprises: taking each data account to be analyzed as a root node, taking the opposite end of the data account as a leaf node, then merging a target leaf node connected with only one root node with the corresponding root node to obtain a first layer clustering result; then, dividing each node in the first layer clustering result, further merging the nodes with the same connection relationship in each to-be-analyzed region obtained by the division to obtain a second layer clustering result; then, further grouping each node in the second layer clustering result based on the relationship matrix of each node in the second layer clustering result, and merging the nodes in the same group to obtain a third layer clustering result for visualization. In this way, the related nodes are merged in a multi-layer clustering manner, the visualization image is optimized, and the analysis and troubleshooting of large-scale data accounts are suitable.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and in particular to a method for visualizing the interaction relationships of data accounts. This specification also relates to a device for visualizing the interaction relationships of data accounts, a computing device, and a computer-readable storage medium. Background Technology

[0002] With the rapid development of computer technology, internet technology, and artificial intelligence technology, more and more users are interacting with data online. The data interaction flow between different data accounts can reflect the interaction between data accounts. In many fields, it is necessary to analyze the data interaction between different data accounts. Therefore, the interaction relationship between different data accounts can be visualized to meet the data account analysis needs of different fields.

[0003] In existing technologies, the process often involves acquiring the various data accounts that need to be analyzed, treating each data account as a node, connecting the corresponding nodes based on the connection relationships between the various data accounts, generating a corresponding visualization image, and using this visualization image to show the interaction relationships between the various data accounts.

[0004] However, with the significant increase in data volume, the number of nodes in the visualized images has increased dramatically, the connection relationships have become increasingly complex, the visualization effect is poor, which is not conducive to the analysis and investigation of the corresponding data accounts, leading to the omission of important information. Summary of the Invention

[0005] In view of this, embodiments of this specification provide a method for visualizing the interaction relationships of data accounts. This specification also relates to a data account interaction relationship visualization device, a computing device, and a computer-readable storage medium, to address the technical deficiencies existing in the prior art.

[0006] According to a first aspect of the embodiments of this specification, a method for visualizing the interaction relationships of data accounts is provided, comprising:

[0007] The data account to be analyzed is taken as the root node, and the root node is merged with the connected target leaf node to obtain the first-level clustering result. The target leaf node is the peer account that only has data interaction with the corresponding data account.

[0008] Each node in the first-layer clustering result is divided into at least two regions to be analyzed, wherein there is no connection between different regions to be analyzed;

[0009] Nodes with the same connection relationship in the target analysis region are merged to obtain the second-level clustering result, wherein the target analysis region is any one of the various regions to be analyzed obtained by partitioning;

[0010] determine a degree relation matrix of each node in the second layer clustering result, group each node in the second layer clustering result according to the degree relation matrix, merge nodes in the same group to obtain a third layer clustering result, and generate a corresponding visual image, wherein the degree relation matrix is used to indicate distances between nodes.

[0011] According to a second aspect of an embodiment of the present specification, a data account interaction relationship visualization device is provided, comprising:

[0012] a first merging module configured to take a data account to be analyzed as a root node, and merge the root node and a target leaf node connected to the root node to obtain a first layer clustering result, wherein the target leaf node is a counterpart account that only has data interaction with the corresponding data account;

[0013] a division module configured to divide each node in the first layer clustering result into at least two analysis regions, wherein there is no connection relationship between different analysis regions;

[0014] a second merging module configured to merge nodes having the same connection relationship in a target analysis region to obtain a second layer clustering result, wherein the target analysis region is any one of the analysis regions obtained by division;

[0015] a third merging module configured to determine a degree relation matrix of each node in the second layer clustering result, group each node in the second layer clustering result according to the degree relation matrix, merge nodes in the same group to obtain a third layer clustering result, and generate a corresponding visual image, wherein the degree relation matrix is used to indicate distances between nodes.

[0016] According to a third aspect of an embodiment of the present specification, a computing device is provided, comprising:

[0017] a memory and a processor;

[0018] The memory is configured to store computer executable instructions, and the processor is configured to execute the computer executable instructions to implement the steps of the data account interaction relationship visualization method described above.

[0019] According to a fourth aspect of an embodiment of the present specification, a computer readable storage medium is provided, which stores computer executable instructions, and the instructions are executed by a processor to implement the steps of the data account interaction relationship visualization method.

[0020] The data account interaction relationship visualization method provided by the embodiment of the present specification can take the data account to be analyzed as a root node, combine the root node with a target leaf node connected thereto, and obtain a first layer clustering result, wherein the target leaf node is a counterpart account having data interaction with the data account; divide each node in the first layer clustering result into at least two analysis regions, wherein there is no connection relationship between different analysis regions; combine nodes having the same connection relationship in a target analysis region to obtain a second layer clustering result, wherein the target analysis region is any one of the analysis regions obtained by division; determine a degree relationship matrix of each node in the second layer clustering result, group each node in the second layer clustering result according to the degree relationship matrix, combine nodes in the same group to obtain a third layer clustering result, and generate a corresponding visualization image, wherein the degree relationship matrix is used to indicate the distance between nodes.

[0021] In this case, each data account to be analyzed can be taken as a root node, and the counterpart of the data account can be taken as a leaf node. Then, a target leaf node connected to only one root node can be combined with the corresponding root node to obtain a first layer clustering result. Then, each node in the first layer clustering result can be divided, and nodes having the same connection relationship in each analysis region obtained by division can be further combined to obtain a second layer clustering result. Then, each node in the second layer clustering result can be further grouped based on a relationship matrix of each node in the second layer clustering result, and nodes in the same group can be combined to obtain a third layer clustering result for visualization. In this way, related nodes are combined in multiple layers of clustering, the visualization image of each data account to be analyzed is optimized, the analysis and troubleshooting of large-scale data accounts are applicable, the number of nodes in the visualization image is greatly reduced, the connection relationship is simplified, and thus the visualization effect of each data account to be analyzed is improved, the interaction of the corresponding data account is facilitated to be analyzed and troubleshooted, and important information is avoided to be missed. BRIEF DESCRIPTION OF DRAWINGS

[0022] Figure 1 FIG. 1 is a flowchart of a data account interaction relationship visualization method according to an embodiment of the present specification;

[0023] Figure 2a FIG. 2 is a schematic diagram of a first layer clustering result according to an embodiment of the present specification;

[0024] Figure 2b FIG. 4 is a schematic diagram of a fourth layer clustering result according to an embodiment of the present specification;

[0025] Figure 2c FIG. 5 is a schematic diagram of an analysis region according to an embodiment of the present specification;

[0026] Figure 2d is a schematic diagram of a second layer clustering result provided by an embodiment of the present specification;

[0027] Figure 2e is a schematic diagram of a degree relationship matrix provided by an embodiment of the present specification;

[0028] Figure 2f is a schematic diagram of a third layer clustering result provided by an embodiment of the present specification;

[0029] Figure 2g is a schematic diagram of a fifth layer clustering result provided by an embodiment of the present specification;

[0030] Figure 2h is a flowchart of a data account visual analysis process provided by an embodiment of the present specification;

[0031] Figure 3 is a processing flowchart of a data account interaction relationship visualization method applied to a transaction flow analysis scenario provided by an embodiment of the present specification;

[0032] Figure 4 is a structural schematic diagram of a data account interaction relationship visualization device provided by an embodiment of the present specification;

[0033] Figure 5 is a structural block diagram of a computing device provided by an embodiment of the present specification. DETAILED DESCRIPTION

[0034] In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present specification. However, the present specification can be practiced without the specific details, other than in the examples, and it is understood that the scope of the present specification is not limited to the details below.

[0035] The terminology used in one or more embodiments of the present specification is for the purpose of describing particular embodiments only and is not intended to be limiting of one or more embodiments of the present specification. As used in one or more embodiments of the present specification and the accompanying claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in one or more embodiments of the present specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0036] It should be understood that, although the terms first, second, etc. can be employed in describing various information in one or more embodiments of the present specification, the information should not be limited to such terms. These terms are only used to differentiate one piece of information from another piece of information of the same type. For example, without departing from the scope of one or more embodiments of the present specification, first can also be referred to as second, and similarly, second can also be referred to as first. Depending on the context, the word "if' as used herein can be interpreted as meaning "when" or "upon" or "in response to determining".

[0037] First, the noun terms related to one or more embodiments of the present specification are explained.

[0038] PCA (Principal component analysis): that is, principal component analysis, is a non-supervised machine learning algorithm, a technique for exploring the structure of high-dimensional data, mainly used for dimensionality reduction of data, through dimensionality reduction, more convenient features for human understanding can be found, and the processing speed of valuable information of samples can be accelerated, in addition, it can also be applied to visualization (reduced to two dimensions) and denoising. The generation of the cluster points in the embodiments of the present specification.

[0039] PCA is a statistical method, and its core idea is to project high-dimensional data onto a low-dimensional space through linear transformation. The transformed variables are called principal components. The projection idea is to find the projection method that best represents the original data. The dimensions discarded by PCA are only those noise or redundant data. De-redundancy means removing linearly dependent vectors that can be represented by other vectors. This part of information is redundant. De-noising means removing the eigenvectors corresponding to the small eigenvalues. The size of the eigenvalue reflects the amplitude of the transformation in the direction of the eigenvector. The larger the amplitude, the greater the difference between the elements in this direction, which should be retained. Diagonalize the matrix, find the maximum linearly independent group, retain the larger eigenvalues, and remove the smaller eigenvalues to form a projection matrix. Project the original sample matrix to get the new sample matrix after dimensionality reduction.

[0040] The key to completing PCA is the covariance matrix. The covariance matrix can represent the correlation between different dimensions and the variance of each dimension. The covariance matrix measures the relationship between dimensions, not between samples. Diagonalization is because the elements on the off-diagonal are all 0 after diagonalization, achieving the purpose of de-noising. The smaller new variances on the diagonal of the diagonalized covariance matrix correspond to those dimensions that should be removed. Therefore, we only take those dimensions with larger energy (eigenvalues), and the rest are discarded, that is, de-redundancy.

[0041] K-means clustering: a partitioning clustering algorithm, the basic logic is given a set of data points and the number of clusters k, k is specified by the user, k-means algorithm repeatedly divides the data into k clusters according to a certain distance function. Specifically, the K-means clustering algorithm is an iterative solution of clustering analysis algorithm, the steps are, the data is divided into K groups, then randomly select K objects as the initial cluster center, then calculate the distance between each object and each seed cluster center, assign each object to the nearest cluster center, the cluster center and the objects assigned to them represent a cluster. Each assignment of a sample, the cluster centers of the cluster will be recalculated according to the existing objects in the cluster. This process will be repeated until a certain termination condition is met, the termination condition can be that no (or minimum number) of objects are reassigned to different clusters, no (or minimum number) of cluster centers change, local minimum of error sum of squares. The embodiment of the present specification is used for generating cluster points.

[0042] Cluster: a data set containing a set of nodes or sub-clusters, which can refer to a collection of data accounts, peer accounts and sub-clusters in the embodiment of the present specification.

[0043] Point: the smallest storage target, which refers to a data account or a peer account involved in a data interaction in the embodiment of the present specification.

[0044] Community detection algorithm: an algorithm used to discover community structure in complex networks, which can also be regarded as a clustering algorithm. The embodiment of the present specification is mainly used to discover the largest connected region.

[0045] It should be noted that, taking the data account to be analyzed as a bank card as an example, in many fields, it is necessary to analyze the bank card flow to best display the relevant bank card fund flow to the staff and transmit the transaction network structure to obtain the analysis and investigation work of the staff on the flow details features, which is of great significance. The relevant transaction flow visualization system emerges as the times require.

[0046] However, with the development and popularity of the Internet and online electronic payment technology, the amount of data has increased explosively. A case may involve millions of bank cards and three-party accounts, and the number of transaction records may reach tens of millions. If these data are directly visualized without processing, it is almost impossible to display the nodes and connections on the existing computer hardware. Even if it is possible, the excessive and complex point-line structure in the visualization canvas is not conducive to manual investigation, and important information is often missed. Therefore, if there is a computer technology that can simplify the massive flow node and transaction relationship connection under the premise of ensuring that information is not lost, highlight important areas, optimize the final visualization effect, and greatly reduce the case handling time and improve the case handling efficiency and accuracy.

[0047] In one possible implementation, structured, semi-structured and unstructured data can be converted into graphs to provide analysts with an intuitive entity relationship diagram and provide rich visualization analysis algorithms and analysis tools to help analysts quickly find relevant clues and valuable intelligence, improve work efficiency and help identify, predict and prevent illegal activities. This scheme focuses more on direct data visualization, but has little to do with further optimization and analysis of data, and the data import speed is relatively slow.

[0048] In another possible implementation, efficient data extraction and multi-dimensional intelligent analysis can be integrated to quickly process and refine key clue elements such as people, objects, events, places, organizations and virtual identifiers from mobile forensics data, and provide rich battle analysis and case models in combination with business to help staff quickly realize depth analysis and auxiliary research and judgment such as expanding people, expanding lines and expanding cases. This scheme can realize visual analysis of person association, but the effect on fund flow data is general.

[0049] In another possible implementation, multiple analysis methods are provided, automatic hierarchical analysis can quickly give the level, number of people and position of a specific person in the network; regional analysis hot map can depict the regional distribution of personnel from a macro perspective; chart overview can help analysts view various "small groups" within the organization. This scheme can support fund flow data and perform some processing on data layout, but the effect is still far from the customer's expected goal, and does not contain business meaning, which needs to be manually added by the user one by one.

[0050] More importantly, the data volume that can be supported by the above-mentioned methods is generally not more than 100,000, which is obviously lagging behind the current large-scale million data research and judgment needs.

[0051] Thus, the embodiment of the present specification provides a data account interaction relationship visualization method, each bank card to be analyzed is taken as a root node, a counterpart of the bank card is taken as a leaf node, then the root node and the connected leaf node are combined to obtain a first layer clustering result; then, each node in the first layer clustering result is divided, and for each to-be-analyzed region obtained by the division, the nodes with the same connection relationship in the to-be-analyzed region can be further combined to obtain a second layer clustering result; then, based on the relationship matrix of each node in the second layer clustering result, each node in the second layer clustering result can be further grouped, and nodes in the same group are combined to obtain a third layer clustering result for visualization. In this way, the related nodes are combined in a multi-layer clustering manner, the visualization image of each bank card to be analyzed is optimized, the analysis and troubleshooting of large-scale bank cards are suitable, the number of nodes in the visualization image is greatly reduced, the connection relationship is simplified, and thus the visualization effect of each bank card to be analyzed is improved, the corresponding bank card transaction flow is facilitated to be analyzed and troubleshooted, and important information is avoided to be missed.

[0052] In the present specification, a data account interaction relationship visualization method is provided, and the present specification also relates to a data account interaction relationship visualization device, a computing device, and a computer readable storage medium, which are described in detail one by one in the following embodiments.

[0053] Figure 1 A flowchart of a data account interaction relationship visualization method provided by an embodiment of the present specification is shown, and specifically includes the following steps 102-108:

[0054] Step 102: taking a data account to be analyzed as a root node, and combining the root node and a target leaf node connected thereto to obtain a first layer clustering result, wherein the target leaf node is a counterpart account that only has data interaction with the corresponding data account.

[0055] Specifically, the data account refers to an account that can perform data input, output and other data interactions, such as a bank card, an application account and the like. The counterpart account is an account that has data interaction with the data account to be analyzed. Taking the data account to be analyzed as a bank card as an example, the counterpart account is an account that has fund flow with the bank card, which can also be a bank card, or can also be other types of accounts, that is, the data account to be analyzed is a single card, and the counterpart account is a single card counterpart, wherein the single refers to retrieving the corresponding transaction flow, and the card refers to a bank card account.

[0056] It should be noted that the data account to be analyzed can be taken as a root node, and then the opposite end account existing data interaction with the data account to be analyzed is determined, each opposite end account is taken as a leaf node, and the node only connected with one root node in each leaf node is a target leaf node. For each root node, the target leaf node connected therewith can be combined to obtain a corresponding first layer clustering result, and the root node and the target leaf node after combination can be taken as a cluster point.

[0057] In the embodiment of the application, the root node and the target leaf node connected therewith can be combined to obtain a first layer clustering result, so that the data account and the opposite end account existing data interaction are combined as a cluster point, that is, combined as a node display, and a first layer clustering result is obtained. In business, the first layer clustering result can well reflect the subordinate relationship between the data account to be analyzed and the opposite end account, reduce the number of nodes, and facilitate optimization of the visual image of each data account to be analyzed.

[0058] In an optional embodiment of the embodiment, the data flow direction of the data account to be analyzed can be analyzed to determine the target leaf node connected with the root node, that is, the root node and the target leaf node connected therewith are combined to obtain a first layer clustering result, and the specific implementation process can be as follows:

[0059] According to the data flow direction of the data account to be analyzed, the corresponding opposite end account is determined;

[0060] The account only connected with the first root node in each opposite end account is taken as the target leaf node of the first root node, wherein the first root node is any one of each root node;

[0061] Each root node and the target leaf node connected therewith are combined respectively to obtain the first layer clustering result.

[0062] In actual application, the interaction information of each data account to be analyzed can be obtained, the data flow direction, that is, the source and destination of data, is determined according to the interaction information, so that the opposite end account is determined. Then, the account only connected with a certain root node in each opposite end account is taken as the target leaf node of the root node, and each root node and the target leaf node connected therewith are combined, so that the first layer clustering result is obtained.

[0063] In an example, Figure 2ais a schematic diagram of a first layer clustering result provided by an embodiment of the present specification, assuming that bank card X1, bank card X2 and bank card X3 are data accounts to be analyzed, and taking bank card X1, bank card X2 and bank card X3 as root nodes. Bank card X1 transfers funds to bank card Y1 and bank card Y2, and receives funds transferred by bank card Y3, at this time, bank card Y1, bank card Y2 and bank card Y3 are opposite accounts of bank card X1, and bank card Y1, bank card Y2 and bank card Y3 are connected to root node bank card X1 as leaf nodes. Bank card X2 transfers funds to bank card Y3 and bank card Y4, and receives funds transferred by bank card Y5, at this time, bank card Y3, bank card Y4 and bank card Y5 are opposite accounts of bank card X2, and bank card Y3, bank card Y4 and bank card Y5 are connected to root node bank card X2 as leaf nodes. Bank card X3 transfers funds to bank card X2, bank card Y6 and bank card Y7, and receives funds transferred by bank card Y8, at this time, bank card X2, bank card Y6, bank card Y7 and bank card Y8 are opposite accounts of bank card X3, root node bank card X2 is connected to root node bank card X1, and bank card Y6, bank card Y7 and bank card Y8 are connected to root node bank card X3 as leaf nodes, as shown in Figure 2a .

[0064] As can be seen from Figure 2a , bank card Y1 and bank card Y2 are connected only to bank card X1, and thus bank card Y1 and bank card Y2 are determined to be target leaf nodes of bank card X1, and bank card Y1 and bank card Y2 are combined with bank card X1 as a first layer clustering point C101. Bank card Y4 and bank card Y5 are connected only to bank card X2, and thus bank card Y4 and bank card Y5 are determined to be target leaf nodes of bank card X2, and bank card Y4 and bank card Y5 are combined with bank card X2 as a first layer clustering point C102. Bank card Y6, bank card Y7 and bank card Y8 are connected only to bank card X3, and thus bank card Y6, bank card Y7 and bank card Y8 are determined to be target leaf nodes of bank card X3, and bank card Y6, bank card Y7 and bank card Y8 are combined with bank card X3 as a first layer clustering point C103, to obtain a first layer clustering result as shown in Figure 2a .

[0065] It should be noted that the leaf nodes can be divided into two categories, one category is a target leaf node connected to only one root node, and the other category is connected to at least two root nodes. The target leaf node connected to only one root node can be merged with the root node to obtain a first layer clustering result. In this way, the data account and the peer account that exist data interaction can be merged as a cluster point, that is, merged as a node display, to obtain a first layer clustering result. In business, the first layer clustering result can well reflect the affiliation relationship between the data account to be analyzed and the peer account, reduce the number of nodes, and facilitate the optimization of the visual image of each data account to be analyzed.

[0066] In an optional embodiment of the present embodiment, the leaf node connected to at least two root nodes can be used as an intermediate node, that is, after determining the corresponding peer account according to the data flow direction of the data account to be analyzed, the method can further include:

[0067] Taking the account connected to at least two root nodes in each peer account as an intermediate node.

[0068] In practical applications, each node can be divided into three categories based on node attributes: root node, target leaf node, and intermediate node. The root node is the data account to be analyzed, the leaf node is the account that exists data interaction with the data account to be analyzed, the target leaf node is the leaf node connected to only one root node, and the intermediate node is the leaf node connected to at least two root nodes.

[0069] It should be noted that the intermediate node is a special leaf node, which is connected to at least two root nodes and cannot be merged with a certain root node. Therefore, the at least two root nodes connected to the intermediate node can be taken as a separate intermediate node, that is, a bridge node, which can be connected to at least two root nodes and can participate in the community discovery algorithm later, facilitating the analysis of the connection relationship between each node.

[0070] In an optional embodiment of the present embodiment, before the data account to be analyzed is taken as a root node for analysis, the data account to be analyzed can be obtained first, that is, before the obtained target account node is taken as a root node, the method can further include:

[0071] Obtaining an initial data account;

[0072] Determining an abnormal data account in the initial data account that does not meet a set analysis condition according to attribute information of the initial data account;

[0073] Taking the data account in the initial data account except the abnormal data account as the data account to be analyzed, and taking the data account to be analyzed as the root node.

[0074] Specifically, the initial data accounts are each data account involved in the interaction flow pulled from the data platform and requiring account interaction analysis. Attribute information of the initial data accounts is used to indicate compliance of the data accounts, and the attribute information can include an identification field, a type, a source platform, and the like of the account. In addition, the set analysis condition can be a rule set in advance for judging whether the data account is a normal compliant account, such as the platform indicated by the field identification not being a third-party payment platform or a public service, not being an error account or a duplicate account, and the like, so as to filter out abnormal data accounts that can have ambiguity.

[0075] It should be noted that after the initial data accounts are obtained, the initial data accounts can be cleaned and screened based on the attribute information of the initial data accounts. The cleaning includes unification of data formats and numerical ranges, and the screening includes screening out abnormal data accounts in the initial data accounts that do not meet the set analysis condition, such as account information of a third-party payment platform, a public service, an error account, and a duplicate account that cannot be independently parsed in the flow data.

[0076] In the embodiments of the present application, abnormal data accounts in the initial data accounts that do not meet the set analysis condition can be screened out, that is, account information that can have ambiguity is screened out, and these abnormal data accounts are uniformly classified according to the type and placed in a separate cluster, and do not participate in the subsequent node cluster merging process, thereby reducing the amount of data to be analyzed, avoiding analysis of useless account information that can have ambiguity, and greatly saving the amount of calculation.

[0077] In an optional implementation of the present embodiment, after the root node and the connected target leaf node are merged to obtain the first layer cluster result, the leaf nodes in the first layer cluster result can be further merged, that is, after the root node and the connected leaf node are merged to obtain the first layer cluster result, the method can further include:

[0078] Determining data amounts of each leaf node connected to the target root node, wherein the target root node is any one of the root nodes;

[0079] Merging the leaf nodes in the same data amount range to obtain the fourth layer cluster result.

[0080] Specifically, the data amount refers to the size of data interacted between the leaf node and the root node. Taking a transaction flow analysis scenario as an example, the data amount can refer to the amount of funds between the leaf node and the root node. In addition, the data amount range refers to a range configured in advance for grouping different leaf nodes, such as 0-1000, 1001-10000, 10001-100000, and 100000 or more.

[0081] In an example, Figure 2bis a schematic diagram of a fourth layer clustering result provided by an embodiment of the present specification, for Figure 2b The first layer clustering point C104 shown in the figure includes a root node X4, a leaf node Y9, a leaf node Y10, a leaf node Y11, a leaf node Y12, and a leaf node Y13. It is assumed that the leaf node Y9, the leaf node Y10, and the leaf node Y11 belong to a number range 1, and the leaf node Y12 and the leaf node Y13 belong to a number range 2. At this time, the leaf node Y9, the leaf node Y10, and the leaf node Y11 can be merged into a fourth layer clustering point C401, and the leaf node Y12 and the leaf node Y13 can be merged into a fourth layer clustering point C402, as shown in Figure 2b

[0082] In the embodiment of the present application, for the first layer clustering result, the leaf nodes connected to each root node can be grouped according to the interaction data amount, and the leaf nodes in the same data amount range can be merged as fourth layer clustering points to obtain the fourth layer clustering result, so as to better display the peer account grouping under different amount distributions, and at the same time, the number of nodes displayed intuitively in the visualization image can be further reduced.

[0083] In addition, the connection between the root node and the leaf node can be provided with a connection direction in addition to the connection line, and the connection direction can represent the flow direction of the data. In terms of business, adding the fourth layer clustering can help users to find the maximum data collection and the maximum data source in each data account to be analyzed more quickly.

[0084] Step 104: dividing each node in the first layer clustering result into at least two analysis regions, wherein there is no connection relationship between different analysis regions.

[0085] It should be noted that the first layer clustering result includes the first layer clustering points obtained by merging the root nodes and the leaf nodes, and the intermediate nodes. Each node in the first layer clustering result can be analyzed and divided into at least two analysis regions, and there is no connection relationship between different analysis regions, so that the data accounts to be analyzed are classified into multiple regions independently in terms of connectivity, and there is no data interaction between different regions, which facilitates further clustering processing of each analysis region.

[0086] In an optional implementation of the embodiment, the region division can be performed based on the connection relationship between each node, that is, each node in the first layer clustering result is divided into at least two analysis regions. The specific implementation process can be as follows:

[0087] determining the connection relationship between the root nodes and the intermediate nodes in the first layer clustering result;

[0088] ​Based on the connection relationship, each node in the first layer clustering result is divided into at least two regions to be analyzed.

[0089] It should be noted that the first-level cluster points and intermediate nodes in the first-level clustering results can be imported into the community detection algorithm. The community detection algorithm is an iterative process. By continuously classifying and merging each node, each node will be independently classified into multiple regions based on connectivity, and there is no connection between each region. The at least two regions to be analyzed obtained from the division can be used as hidden layer clusters.

[0090] Example, Figure 2c This is a schematic diagram of an area to be analyzed provided in one embodiment of this specification, such as... Figure 2c As shown, the first-layer clustering result includes first-layer clustering points C105-C124 and intermediate nodes Y13-Y24. The first-layer clustering result is input into the community detection algorithm, which analyzes the connection relationships between each first-layer clustering point and each intermediate node, dividing the data into two regions to be analyzed, as shown below. Figure 2c As shown, there is no connection between region 1 and region 2 to be analyzed.

[0091] In this embodiment, the first-layer clustering result includes the first-layer clustering point obtained by merging the root node and leaf nodes, as well as intermediate nodes. The connection relationship between each node in the first-layer clustering result can be analyzed by the community detection algorithm. Nodes without connection relationship are divided into different regions to be analyzed. That is, there is a connection relationship between nodes in the same region to be analyzed, while there is no connection relationship between nodes in different regions to be analyzed. Thus, the data accounts to be analyzed are independently classified into multiple regions based on connectivity. There is no interaction between different regions. In terms of business, dividing each node in the first-layer clustering result into different regions, i.e., hidden layer clustering, can help distinguish irrelevant data account nodes and divide related data account nodes into sub-regions, which facilitates further clustering processing for each sub-region separately.

[0092] Step 106: Merge nodes with the same connection relationship in the target analysis region to obtain the second-level clustering result, where the target analysis region is any one of the various regions to be analyzed obtained by partitioning.

[0093] It should be noted that for any region to be analyzed, nodes with the same connection relationship can be further merged to obtain a second-level clustering result, thereby further reducing the number of nodes and optimizing the visualization of each data account to be analyzed.

[0094] In an optional implementation of the embodiment, the same connection relationship can be considered as the same connection relationship by connecting the same root node, the intermediate nodes can be merged, and the target intermediate nodes with the same connection relationship in the target analysis area can be merged to obtain the second layer clustering result. The specific implementation process can be as follows:

[0095] Determine the target intermediate nodes connecting the same root nodes in the target analysis area.

[0096] Merge the target intermediate nodes to obtain the second layer clustering result.

[0097] It should be noted that the intermediate node refers to a leaf node connecting at least two root nodes. If multiple intermediate nodes connect the same root node, it means that the interaction accounts of these intermediate nodes are completely consistent. In the visualization analysis, it can be regarded as one node. Therefore, the target intermediate nodes connecting the same root nodes in the analysis area can be merged as the second layer clustering point to obtain the corresponding second layer clustering result.

[0098] In actual application, the root node and the leaf node connected only thereto in the target analysis area can be merged as the first layer clustering point, and the intermediate node connecting the first layer clustering point is connected to the root node of the clustering point. Therefore, the target intermediate nodes connecting the same root nodes in the target analysis area refer to the target intermediate nodes connecting the same first layer clustering points.

[0099] As shown in the above example, it is assumed that the analysis area 1 is the target analysis area, and the target analysis area includes intermediate nodes Y13-Y18. The intermediate nodes Y14, Y15 and Y16 are connected to the first layer clustering points C107 and C108, which means that the intermediate nodes Y14, Y15 and Y16 have the same connection relationship. Therefore, the intermediate nodes Y14, Y15 and Y16 can be merged as a second layer clustering point C201, as shown in the following figure. Figure 2c Figure 2d The following figure is a schematic diagram of a second layer clustering result provided by an embodiment of the present specification. Figure 2d

[0100] In the embodiment of the present application, the target intermediate nodes connecting the same root nodes in each analysis area can be determined, that is, the target intermediate nodes connecting the same first layer clustering points. The target intermediate nodes have the same connection relationship, that is, the same data interaction relationship. Therefore, the target intermediate nodes can be further merged as a second layer clustering point to obtain the corresponding second layer clustering result, so as to further reduce the number of nodes and optimize the visualization image of each data account to be analyzed. In addition, the second layer clustering result can help users find the common data sources, destinations and data interaction channels of the target nodes in business.

[0101] ​​In step 108, a degree relationship matrix of each node in the second layer clustering result is determined, each node in the second layer clustering result is grouped according to the degree relationship matrix, nodes in the same group are combined to obtain a third layer clustering result, and a corresponding visual image is generated, wherein the degree relationship matrix is used to indicate the distance between nodes.

[0102] It should be noted that the degree relationship matrix can represent the distance relationship between nodes. By analyzing the degree relationship matrix, each node in the second layer clustering result can be further grouped, so that nodes in the same group can be further combined to obtain the third layer clustering result, so as to further reduce the nodes in the visual image, facilitate user analysis and troubleshooting of corresponding information.

[0103] In an optional embodiment of the present embodiment, the degree relationship matrix can be generated based on the shortest distance between nodes, that is, the degree relationship matrix of each node in the second layer clustering result is determined, and the specific implementation process can be as follows:

[0104] The shortest distance between the target node and other nodes is determined, wherein the target node is any node in the target analysis region.

[0105] The degree relationship matrix is generated according to the shortest distance between each node in the target analysis region and other nodes.

[0106] In practical applications, the degree relationship matrix between each node in the second layer clustering result can be obtained by a recursive algorithm. Specifically, for a target node A in the target analysis region, the degree of the node relative to node B is the shortest distance between nodes AB plus 1, and the positive and negative of the degree is whether the relationship between A and B is output or input. In addition, considering that a large number of nodes are involved, in order to simplify the degree relationship matrix, when the shortest distance between two nodes exceeds a distance threshold, it is no longer calculated, that is, it is regarded as not connected. The distance threshold is pre-configured, for example, the distance threshold can be 2. Then, according to the shortest distance between each node and other nodes and the interaction direction, a corresponding lightweight sparse degree relationship matrix can be generated, and the other each analysis region can be sequentially taken as the target analysis region for clustering processing.

[0107] In practical implementation, the shortest distance between nodes A and B refers to the number of nodes they pass through. For example, if A and B are directly connected, the shortest distance between them is 0. If A outputs data to B, the degree is 1; if B outputs data to A, the degree is -1. If A is connected to B via C, the shortest distance between them is 1. If A outputs data to B, the degree is 2; if B outputs data to A, the degree is -2, and so on. Furthermore, when simplifying the degree relation matrix, if the shortest distance between two nodes exceeds 2, it is no longer calculated, i.e., they are considered unconnected, and the degree of the two nodes can be set to 0. Additionally, the degree of each node relative to itself can also be set to 0 to generate the corresponding degree relation matrix.

[0108] Continuing with the previous example, such as Figure 2d As shown, the target analysis area contains 10 nodes. Nodes with a shortest distance greater than 2 are considered disconnected, with their degree set to 0. Data is transmitted sequentially from node to node: C105, Y13, C107, C106, C201, C108, Y17, C120, C109, Y18. For node C105, its shortest distances relative to the other nodes are: 0, 1, 2, 2, 3, 4, 5, 5, 6. Therefore, the degree of node C105 relative to the other nodes is: 1, 2, 0, 0, 0, 0, 0, 0. Similarly, for node Y13, its shortest distances relative to the other nodes are: 0, 0, 1, 1, 2, 3, 4, 4, 5. Therefore, the degree of node Y13 relative to the other nodes is: -1, 1, 2, 2, 0, 0, 0, 0. By following this logic, the degree of each node relative to other nodes can be obtained. Setting the degree of each node relative to itself to 0 also generates a result like... Figure 2e The degree relation matrix shown represents C105, Y13, C107, C106, C201, C108, Y17, C120, C109, and Y18, respectively, horizontally and vertically. Figure 2e This is a schematic diagram of a degree relationship matrix provided in one embodiment of this specification.

[0109] In the embodiments of this specification, a degree relationship matrix can be generated based on the shortest distance between each node. The generated degree relationship matrix can represent the distance between each node in the second-level clustering result, which facilitates the subsequent direct analysis of the degree relationship matrix, further clustering of each node, and optimization of the visualization image of each data account to be analyzed, making it easier for staff to analyze and investigate the data.

[0110] In an optional implementation of the embodiment, after obtaining the degree relation matrix, dimension reduction can be further performed on the degree relation matrix, and then feature grouping is performed, that is, grouping is performed on each node in the second layer clustering result according to the degree relation matrix. The specific implementation process can be as follows:

[0111] Dimension reduction is performed on the degree relation matrix to obtain a node topology structure feature matrix.

[0112] Clustering is performed on the node topology structure feature matrix to obtain a grouping result of each node in the second layer clustering result.

[0113] It should be noted that the PCA principal component analysis algorithm can be used to perform dimension reduction processing on the degree relation matrix to obtain the node topology structure feature matrix. The core idea of the PCA algorithm is to map m-dimensional features to n-dimensional (n < m), and the n-dimensional principal components are orthogonal features that can best represent the original data.

[0114] In actual application, sample centering operation can be first performed on each element in the degree relation matrix. The centering operation does not change the overall data distribution shape, but only aligns the overall data to the origin of the coordinate system. Then, the covariance matrix of the centered degree relation matrix can be calculated, and the eigenvalues and eigenvectors of the covariance matrix are calculated. Since the eigenvector with the largest eigenvalue represents the main part of the degree relation matrix, each eigenvalue obtained by calculation can be sorted, and then the components with small eigenvalues that are not very important are ignored. That is, after the eigenvalues and eigenvectors are calculated, the largest preset number of them can be selected as the main part, and the remaining part is discarded, so as to perform dimension reduction on the degree relation matrix to obtain the node topology structure feature matrix.

[0115] It should be noted that the obtained node topology structure feature matrix can represent the topology structure between each node, so clustering can be directly performed on the node topology structure feature matrix to obtain the grouping result of each node in the second layer clustering result, which facilitates subsequent merging of nodes in the same group.

[0116] In actual implementation, the mapping relationship function can be established according to experience, and the number of clusters K required by the K-means clustering algorithm is determined based on the mapping relationship function, so as to ensure that the visual effect of the third layer clustering result is optimal. After the number of clusters K is determined, the K-means clustering algorithm can be used to cluster the node topology structure feature matrix to obtain the grouping result of each node. Specifically, each feature in the node topology structure feature matrix can be divided into K groups, and then the distance between each feature and each cluster center is calculated, each feature is assigned to the nearest cluster center, and the cluster center and the features assigned to it represent a cluster. Each feature is assigned, and the cluster center of the cluster is recalculated according to the existing features in the cluster. This process will be repeated until a certain termination condition is met, which can be that no (or a minimum number of) features are reassigned to different clusters, no (or a minimum number of) cluster centers change, the error sum of squares is locally minimized, etc.

[0117] In the above example, for the second layer clustering result shown in FIG. 6, each node can be further grouped by using the PCA algorithm and the K-means clustering algorithm. It is assumed that nodes C106, C107, and C108 are divided into a group to obtain a third layer clustering point C301, and nodes C109, C120, Y17, and Y18 are divided into a group to obtain a third layer clustering point C302. At this time, the third layer clustering result shown in FIG. 7 can be obtained. Figure 2d Figure 2f In the above example, for the second layer clustering result shown in FIG. 6, each node can be further grouped by using the PCA algorithm and the K-means clustering algorithm. It is assumed that nodes C106, C107, and C108 are divided into a group to obtain a third layer clustering point C301, and nodes C109, C120, Y17, and Y18 are divided into a group to obtain a third layer clustering point C302. At this time, the third layer clustering result shown in FIG. 7 can be obtained. Figure 2f FIG. 7 is a schematic diagram of a third layer clustering result, according to an embodiment of the present specification.

[0118] In the embodiments of the present specification, the degree relationship matrix between each node in the second layer clustering result can be obtained by using a recursive algorithm, and then the PCA principal component analysis algorithm improved for lightweight sparse degree relationship matrix can be used to obtain the dimension-reduced node topology structure feature matrix. Subsequently, the K-means clustering algorithm can be used to cluster and analyze the node topology structure feature matrix, so as to obtain the grouping result of each node in the second layer clustering result, thereby merging nodes in the same group to obtain the third layer clustering result. That is, the node clustering by using the unsupervised method further merges nodes with similar topology structures to further reduce the number of nodes and optimize the visual image of each data account to be analyzed. From a business point of view, the third layer clustering result can well reflect the main structure of the entire data account to be analyzed, which is convenient for staff to analyze and troubleshoot information.

[0119] In an optional implementation of the present embodiment, after the third layer clustering result is obtained, each node in the third layer clustering result can be further merged according to data, that is, after the nodes in the same group are merged to obtain the third layer clustering result, the third layer clustering result can further include:​

[0120] determining the data amount of each node in the third layer clustering result;

[0121] merging nodes in the same data amount range to obtain the fifth layer clustering result.

[0122] It should be noted that the unsupervised method only reflects similar topological structures, and the number of nodes included under each third layer clustering point in the third layer clustering result after grouping may be too large, resulting in too many nodes when the third layer clustering point is expanded and displayed, and poor visual effect. Therefore, the data amount distribution of the clustering can be further used to group each node in the third layer clustering result. Specifically, the nodes included under each third layer clustering point can be further grouped, which can not only reduce the number of nodes displayed directly under the canvas when the third layer clustering point is visualized and expanded, but also facilitate users to better find the largest data amount aggregation and the largest data amount source in the data account to be analyzed.

[0123] In actual applications, the specific implementation process of merging nodes in the same data amount range according to the data amount of each node in the third layer clustering result is similar to the implementation process of further merging leaf nodes in the first layer clustering result according to the data amount of the leaf nodes in the first layer clustering result, which will not be described herein again.

[0124] An example of Figure 2g is a schematic diagram of a fifth layer clustering result provided by an embodiment of the present specification, which is used for Figure 2g The third layer clustering point C303 shown in FIG. 3C includes nodes 1-10, wherein each node can be an initial node, i.e., a data account to be analyzed, or a clustering point after clustering. Assuming that nodes 1-5 belong to the amount range 1, nodes 6-8 belong to the amount range 2, and nodes 9-10 belong to the amount range 3, nodes 1-5 can be merged into a fifth layer clustering point C501, nodes 6-8 can be merged into a fifth layer clustering point C502, and nodes 9-10 can be merged into a fifth layer clustering point C503, as shown in FIG. 3D. Figure 2g

[0125] In an optional implementation of the present embodiment, different clustering layers can also be merged, that is, after obtaining the third layer clustering result by merging nodes in the same group, the third layer clustering result can further include:

[0126] determining the number of lower layer sub-clusters or sub-nodes of each clustering layer, and determining a target clustering layer whose number of lower layer sub-clusters or sub-nodes is less than a set threshold;

[0127] ​The lower layer sub-cluster or sub-node of the target cluster layer is promoted.

[0128] Specifically, the threshold value can be a pre-set value for determining whether to promote the cluster layer, such as 1, 2, or other small values.

[0129] It should be noted that if the number of lower layer sub-clusters or sub-nodes included in a cluster layer is too small, the number of lower level nodes expanded by clicking the cluster point is too small, and the significance of excessive division of levels is not great, and thus the lower layer sub-clusters or sub-nodes included in the cluster layer can be promoted.

[0130] In practical applications, the number of lower level clusters or sub-nodes of each cluster point in each layer cluster result can be determined, and for a target cluster point including only one sub-cluster or sub-node, the lower level cluster or sub-node of the target cluster point is used as the cluster level corresponding to the target cluster point.

[0131] For example, assuming that the third layer cluster point C304 includes only one node M, the node M can be directly used as the third layer cluster point C304 to participate in subsequent visualization display.

[0132] It should be noted that after obtaining the five-layer cluster result, the five-layer cluster result is integrated and analyzed to determine the number of different types of accounts involved in each cluster, such as aggregation accounts, connected accounts, and source accounts, for account analysis and investigation. In addition, the cluster point containing only one lower layer sub-cluster or node can be promoted to obtain a complete five-layer cluster structure visualization image that can be used for a million-level node large graph.

[0133] In practical applications, in the corresponding visualization product, only the number of expanded cluster points needs to be limited, so that the overall structure between each data account to be analyzed can be visualized while ensuring product performance, and the visualization effect is good.

[0134] It should be noted that after obtaining the five-layer cluster result, the five-layer cluster result is integrated and analyzed to determine the number of different types of accounts involved in each cluster, such as aggregation accounts, connected accounts, and source accounts, for account analysis and investigation. In addition, the cluster point containing only one lower layer sub-cluster or node can be promoted to obtain a complete five-layer cluster structure visualization image that can be used for a million-level node large graph.

[0135] As an example, Figure 2h is a flowchart of a data account visualization analysis provided by an embodiment of the present specification, as shown in Figure 2hAs shown, initially, all data accounts can be displayed first, and then all data is divided into data accounts to be analyzed and abnormal data accounts, that is, the super node search, and the searched abnormal data accounts are taken as super nodes and do not participate in the subsequent clustering; for the data accounts to be analyzed, the community discovery algorithm can be used to divide them into at least two analysis areas, and the hidden layer clustering result is displayed. Then, for each analysis area, the third layer clustering result can be displayed, and the third layer clustering result is the node clustering of the unsupervised method based on the PCA principal component analysis algorithm and the K-means clustering algorithm; for the third layer clustering result, the fifth layer clustering result can be further displayed, and the fifth layer clustering result is obtained by further dividing each clustering point based on the data, that is, the clustering merging based on the clustering characteristics; for the fifth layer clustering result, the second layer clustering result can be further displayed, and the second layer clustering result is obtained by merging the intermediate nodes with the same connection relationship, that is, the node merging based on the opposite end; for the second layer clustering result, the fourth layer clustering result can be further displayed, and the fourth layer clustering result is obtained by merging the leaf nodes of the root node based on the data, that is, the leaf node merging based on the data; for the fourth layer clustering result, the intermediate node and the first layer clustering result can be further displayed, and the first layer clustering result is obtained by merging the root node and the target leaf node, that is, the leaf-root-intermediate node grouping based on the node characteristics; for the first layer clustering result, the root node and the target leaf node connected only with the root node can be further displayed.

[0136] The data account interaction visualization method provided by the embodiments of the present specification can take each data account to be analyzed as a root node, take the opposite end of the data account as a leaf node, then merge the target leaf node connected only with one root node with the corresponding root node to obtain the first layer clustering result; then, each node in the first layer clustering result is divided, and for each analysis area obtained by the division, the nodes with the same connection relationship can be further merged to obtain the second layer clustering result; then, based on the relationship matrix of each node in the second layer clustering result, each node in the second layer clustering result can be further grouped, and the nodes in the same group are merged to obtain the third layer clustering result for visualization. In this way, the related nodes are merged in multiple layers of clustering, the visualization image of each data account to be analyzed is optimized, which is suitable for large-scale data account analysis and troubleshooting, greatly reduces the number of nodes in the visualization image, simplifies the connection relationship, thereby improving the visualization effect of each data account to be analyzed, facilitating the analysis and troubleshooting of the interaction of the corresponding data account, and avoiding important information omission.

[0137] The following will be described in conjunction with the accompanying drawings Figure 3With the data account interaction relationship visualization method provided in the specification, the application of the data account interaction relationship visualization method in the transaction flow analysis scene is taken as an example to further illustrate the data account interaction relationship visualization method. Among them, Figure 3 A processing flowchart of a data account interaction relationship visualization method applied in a transaction flow analysis scene is shown, which specifically includes the following steps:

[0138] Step 302: Obtain an initial bank card account, and divide the initial bank card account into a bank card account to be analyzed and an abnormal bank card account according to the attribute information of the initial bank card account.

[0139] Among them, the initial bank card account is each bank card account that the staff needs to analyze the fund transaction flow, which can be obtained from the corresponding data transaction platform, such as a bank client, a fund transaction data supervision platform, etc.

[0140] Step 304: Take the bank card account to be analyzed as a root node, take a leaf node connected to only one root node as a target leaf node, and take a leaf node connected to at least two root nodes as an intermediate node.

[0141] Among them, the leaf node is the opposite end account that exists fund transaction with the bank card account to be analyzed.

[0142] Step 306: Merge each root node and the target leaf node respectively to obtain a first layer clustering result.

[0143] Step 308: Input the first layer clustering points in the first layer clustering result and the intermediate nodes into a community discovery algorithm to obtain at least two analysis regions, and there is no connection relationship between different analysis regions.

[0144] Step 310: For each analysis region obtained by division, determine the target intermediate node connected to the same root node, and then merge the target intermediate node to obtain a second layer clustering result.

[0145] Step 312: For each first layer clustering point in the first layer clustering result, the data amount of each leaf node connected to the root node can be determined, and the leaf nodes within the same data amount range are merged to obtain a fourth layer clustering result.

[0146] Step 314: Determine the degree relationship matrix of each node in the second layer clustering result, then use the PCA principal component analysis algorithm to reduce the dimension of the degree relationship matrix to obtain a node topology structure feature matrix; then, use the K-means clustering algorithm to cluster the node topology structure feature matrix to obtain the grouping result of each node in the second layer clustering result, and merge the nodes in the same group to obtain a third layer clustering result.

[0147] Step 316: For each third layer clustering point in the third layer clustering result, determine the data amount of each node therein, merge nodes within the same data amount range, and obtain a fifth layer clustering result.

[0148] Step 318: Determine the number of lower layer sub-clusters or sub-nodes of each clustering layer, and determine a target clustering layer whose number of lower layer sub-clusters or sub-nodes is less than a set threshold value, and perform layer promotion processing on the lower layer sub-clusters or sub-nodes of the target clustering layer.

[0149] Step 320: Perform structure data integration and analysis on the obtained multi-layer clustering result, and generate a visual image corresponding to each initial bank card account.

[0150] It should be noted that the data account interaction relationship visualization method provided by the embodiments of the present specification can well optimize the display effect of the million-level fund big graph, reduce the possibility of full connectivity graph, and better reflect the fund flow direction.

[0151] Based on the method provided in the embodiments of the present specification, six groups of experiments were performed. For the six cases of the experiment, it is worth mentioning that the lower the edge percentage, the better the display effect will be, as shown in the experimental result table in Table 1.

[0152] Table 1 Experimental result table

[0153]

[0154] In addition, the model size and running rate can be as shown in Table 2. As can be seen from Table 2, the data account interaction relationship visualization method provided by the embodiments of the present specification can be used on a transaction flow of about 300w, and a transaction flow of less than 200w can generate results in less than 5 minutes. Obviously, it is superior to the related visualization method with a maximum of 15w flow.

[0155] Table 2 Visualization running effect table of transaction flow

[0156]

[0157]

[0158] It should be noted that the embodiments of the present specification provide a five-layer fund flow visualization big graph method, which can be efficiently visualized, with fewer node numbers in the visualized image, and the PCA algorithm, sparse matrix and unsupervised topological structure are used in the clustering process to generate clustering layers. The five-layer clustering functions provided are different, different clustering features are extracted, and have certain business implications, providing a more efficient design, suitable for large-scale flow data sets.

[0159] The data account interaction relationship visualization method provided by the embodiments of the present specification can take each data account to be analyzed as a root node, take the opposite end of the data account as a leaf node, then merge a target leaf node connected with only one root node with the corresponding root node to obtain a first layer clustering result; then, each node in the first layer clustering result is divided, and for each to-be-analyzed region obtained by the division, nodes with the same connection relationship can be further merged to obtain a second layer clustering result; then, each node in the second layer clustering result can be further grouped and nodes in the same group can be merged to obtain a third layer clustering result based on the relationship matrix of each node in the second layer clustering result, so as to be visualized. In this way, the related nodes are merged in a multi-layer clustering manner, the visualization image of each data account to be analyzed is optimized, the analysis and troubleshooting of large-scale data accounts are applicable, the number of nodes in the visualization image is greatly reduced, the connection relationship is simplified, and thus the visualization effect of each data account to be analyzed is improved, the interaction of the corresponding data account is facilitated to be analyzed and troubleshot, and important information is avoided to be missed.

[0160] Corresponding to the method embodiments, the present specification also provides data account interaction relationship visualization device embodiments, Figure 4 A structure schematic diagram of a data account interaction relationship visualization device provided by an embodiment of the present specification is shown. As shown in the figure, Figure 4 The device comprises:

[0161] The first merging module 402 is configured to take a data account to be analyzed as a root node, and merge the root node with a target leaf node connected therewith to obtain a first layer clustering result, wherein the target leaf node is an opposite end account having a data interaction with the corresponding data account.

[0162] The division module 404 is configured to divide each node in the first layer clustering result into at least two to-be-analyzed regions, wherein there is no connection relationship between different to-be-analyzed regions.

[0163] The second merging module 406 is configured to merge nodes with the same connection relationship in a target analysis region to obtain a second layer clustering result, wherein the target analysis region is any one of the to-be-analyzed regions obtained by the division.

[0164] The third merging module 408 is configured to determine a degree relationship matrix of each node in the second layer clustering result, group each node in the second layer clustering result according to the degree relationship matrix, merge nodes in the same group to obtain a third layer clustering result, and generate a corresponding visualization image, wherein the degree relationship matrix is used to indicate the distance between each node.

[0165] Optionally, the first merging module 402 is further configured as follows:

[0166] Based on the data flow of the data account to be analyzed, determine the corresponding peer account;

[0167] The account that is connected only to the first root node among all peer accounts is taken as the target leaf node of the first root node, where the first root node is any one of the root nodes;

[0168] Each root node is merged with the connected target leaf node to obtain the first layer clustering result.

[0169] Optionally, the first merging module 402 is further configured as follows:

[0170] Use accounts that are connected to at least two root nodes in each peer account as intermediate nodes;

[0171] Accordingly, partitioning module 404 is further configured as follows:

[0172] Determine the connection relationship between the root node and the intermediate node in the first-layer clustering result;

[0173] Based on the connection relationship, each node in the first layer clustering result is divided into at least two regions to be analyzed.

[0174] Optionally, the second merging module 406 is further configured as follows:

[0175] Identify the target intermediate nodes in the target analysis region that connect to the same root node;

[0176] The target intermediate nodes are merged to obtain the second layer clustering result.

[0177] Optionally, the third merging module 408 is further configured as follows:

[0178] Determine the shortest distance between the target node and other nodes, wherein the target node is any node in the target analysis region;

[0179] The degree relationship matrix is ​​generated based on the shortest distance between each node and other nodes in the target analysis region.

[0180] Optionally, the third merging module 408 is further configured as follows:

[0181] The degree relationship matrix is ​​reduced in dimensionality to obtain the node topology feature matrix;

[0182] Clustering is performed on the node topology feature matrix to obtain the grouping results of each node in the second layer clustering result.

[0183] Optionally, the device further includes a fourth merging module, configured to:

[0184] Determine the data amount of each leaf node connected to the target root node, wherein the target root node is any one of the root nodes;

[0185] The leaf nodes within the same data range are merged to obtain the fourth-level clustering result.

[0186] Optionally, the device further includes a fifth merging module, configured to:

[0187] Determine the data amount of each node in the third-layer clustering result;

[0188] Nodes within the same data range are merged to obtain the fifth-layer clustering result.

[0189] Optionally, the device further includes an acquisition module configured to:

[0190] Obtain initial data account;

[0191] Based on the attribute information of the initial data account, identify the abnormal data accounts in the initial data account that do not meet the set analysis conditions;

[0192] The data accounts in the initial data accounts, excluding the abnormal data accounts, are taken as the data accounts to be analyzed, and the data accounts to be analyzed are taken as the root nodes.

[0193] Optionally, the device further includes a processing module configured to:

[0194] Determine the number of lower-level sub-clusters or child nodes in each cluster layer, and determine the target cluster layer whose number of lower-level sub-clusters or child nodes is less than a set threshold.

[0195] The lower-level sub-clusters or sub-nodes of the target cluster layer are subjected to layer lifting processing.

[0196] The data account interaction visualization device provided in this specification can take each data account to be analyzed as the root node and the counterpart of the data account as the leaf node. Then, the target leaf node connected to only one root node is merged with the corresponding root node to obtain a first-level clustering result. Then, the nodes in the first-level clustering result are divided. For each region to be analyzed obtained by division, nodes with the same connection relationship can be further merged to obtain a second-level clustering result. After that, based on the relationship matrix of each node in the second-level clustering result, the nodes in the second-level clustering result can be further grouped, and nodes in the same group can be merged to obtain a third-level clustering result for visualization. In this way, by merging related nodes through multi-level clustering, the visualization image of each data account to be analyzed is optimized. It is suitable for the analysis and investigation of large-scale data accounts, significantly reduces the number of nodes in the visualization image, simplifies the connection relationship, thereby improving the visualization effect of each data account to be analyzed, facilitating the analysis and investigation of the interaction of the corresponding data accounts, and avoiding the omission of important information.

[0197] The above is an illustrative scheme of a data account interaction relationship visualization device according to this embodiment. It should be noted that the technical solution of this data account interaction relationship visualization device and the technical solution of the data account interaction relationship visualization method described above belong to the same concept. For details not described in detail in the technical solution of the data account interaction relationship visualization device, please refer to the description of the technical solution of the data account interaction relationship visualization method described above.

[0198] Figure 5 A structural block diagram of a computing device according to an embodiment of this specification is shown. The components of the computing device 500 include, but are not limited to, a memory 510 and a processor 520. The processor 520 is connected to the memory 510 via a bus 530, and a database 550 is used to store data.

[0199] The computing device 500 also includes an access device 540, which enables the computing device 500 to communicate via one or more networks 560. Examples of these networks include Public Switched Telephone Network (PSTN), Local Area Network (LAN), Wide Area Network (WAN), Personal Area Network (PAN), or combinations of communication networks such as the Internet. The access device 540 may include one or more of any type of wired or wireless network interface (e.g., Network Interface Controller (NIC)), such as an IEEE 802.11 Wireless Local Area Networks (WLAN) wireless interface, a Wi-MAX (Worldwide Interoperability for Microwave Access) interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, a Near Field Communication (NFC) interface, and so on.

[0200] In one embodiment of this specification, the above-described components of the computing device 500 and Figure 5 Other components, not shown, can also be connected to each other, for example, via a bus. It should be understood that... Figure 5 The block diagram of the computing device shown is for illustrative purposes only and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0201] The computing device 500 can be any type of stationary or mobile computing device, including mobile computers or mobile computing devices (e.g., tablet computers, personal digital assistants, laptop computers, notebook computers, netbooks, etc.), mobile phones (e.g., smartphones), wearable computing devices (e.g., smartwatches, smart glasses, etc.) or other types of mobile devices, or stationary computing devices such as desktop computers or PCs. The computing device 500 can also be a mobile or stationary server.

[0202] The processor 520 is configured to execute the following computer-executable instructions to implement the following method, which implements the steps of the above-described method for visualizing the interaction relationship of data accounts.

[0203] The above is an illustrative scheme of a computing device according to this embodiment. It should be noted that the technical solution of this computing device and the technical solution of the above-described method for visualizing the interaction relationship of data accounts belong to the same concept. For details not described in detail in the technical solution of the computing device, please refer to the description of the technical solution of the above-described method for visualizing the interaction relationship of data accounts.

[0204] An embodiment of this specification also provides a computer-readable storage medium storing computer instructions that, when executed by a processor, are used to implement the steps of the method for visualizing the interaction relationships of the data account.

[0205] The above is an illustrative scheme of a computer-readable storage medium according to this embodiment. It should be noted that the technical solution of this storage medium and the technical solution of the above-described method for visualizing the interaction relationship of data accounts belong to the same concept. For details not described in detail in the technical solution of the storage medium, please refer to the description of the technical solution of the above-described method for visualizing the interaction relationship of data accounts.

[0206] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0207] The computer instructions include computer program code, which may be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0208] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this specification is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this specification. Furthermore, those skilled in the art should also understand that the embodiments described in this specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this specification.

[0209] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0210] The preferred embodiments disclosed above are merely illustrative of this specification. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. These embodiments have been selected and specifically described in this specification to better explain the principles and practical applications of this specification, thereby enabling those skilled in the art to better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

1. A method for visualizing the interaction relationships of data accounts, characterized in that, The method includes: The data account to be analyzed is taken as the root node, and the root node is merged with the connected target leaf node to obtain the first-level clustering result. The target leaf node is the peer account that only has data interaction with the corresponding data account. Each node in the first-layer clustering result is divided into at least two regions to be analyzed, wherein there is no connection between different regions to be analyzed; Nodes with the same connection relationship in the target analysis region are merged to obtain the second-level clustering result, wherein the target analysis region is any one of the various regions to be analyzed obtained by partitioning; The degree relationship matrix of each node in the second-level clustering result is determined, and the nodes in the second-level clustering result are grouped according to the degree relationship matrix. The nodes in the same group are merged to obtain the third-level clustering result, and the corresponding visualization image is generated. The degree relationship matrix is ​​used to indicate the distance between each node.

2. The method according to claim 1, characterized in that, The step of merging the root node with the connected target leaf node to obtain the first-level clustering result includes: Based on the data flow of the data account to be analyzed, determine the corresponding peer account; The account that is connected only to the first root node among all peer accounts is taken as the target leaf node of the first root node, where the first root node is any one of the root nodes; Each root node is merged with the connected target leaf node to obtain the first layer clustering result.

3. The method according to claim 2, characterized in that, After determining the corresponding peer account based on the data flow of the data account to be analyzed, the process further includes: Use accounts that are connected to at least two root nodes in each peer account as intermediate nodes; Accordingly, dividing each node in the first-layer clustering result into at least two regions to be analyzed includes: Determine the connection relationship between the root node and the intermediate node in the first-layer clustering result; Based on the connection relationship, each node in the first layer clustering result is divided into at least two regions to be analyzed.

4. The method according to claim 3, characterized in that, The process of merging nodes with the same connectivity in the target analysis region to obtain the second-layer clustering result includes: Identify the target intermediate nodes in the target analysis region that connect to the same root node; The target intermediate nodes are merged to obtain the second layer clustering result.

5. The method according to claim 1, characterized in that, Determining the degree relationship matrix of each node in the second-layer clustering result includes: Determine the shortest distance between the target node and other nodes, wherein the target node is any node in the target analysis region; The degree relationship matrix is ​​generated based on the shortest distance between each node and other nodes in the target analysis region.

6. The method according to claim 1, characterized in that, The step of grouping the nodes in the second-layer clustering result according to the degree relationship matrix includes: The degree relationship matrix is ​​reduced in dimensionality to obtain the node topology feature matrix; Clustering is performed on the node topology feature matrix to obtain the grouping results of each node in the second layer clustering result.

7. The method according to any one of claims 1-6, characterized in that, After merging the root node with the connected leaf nodes to obtain the first-level clustering result, the process further includes: Determine the data amount of each leaf node connected to the target root node, wherein the target root node is any one of the root nodes; The leaf nodes within the same data range are merged to obtain the fourth-level clustering result.

8. The method according to any one of claims 1-6, characterized in that, After merging nodes in the same group to obtain the third-level clustering result, the process also includes: Determine the data amount of each node in the third-layer clustering result; Nodes within the same data range are merged to obtain the fifth-level clustering result.

9. The method according to any one of claims 1-6, characterized in that, Before using the data account to be analyzed as the root node, the process also includes: Obtain initial data account; Based on the attribute information of the initial data account, identify the abnormal data accounts in the initial data account that do not meet the set analysis conditions; The data accounts in the initial data accounts, excluding the abnormal data accounts, are taken as the data accounts to be analyzed, and the data accounts to be analyzed are taken as the root nodes.

10. The method according to any one of claims 1-6, characterized in that, After merging nodes in the same group to obtain the third-level clustering result, the process also includes: Determine the number of lower-level sub-clusters or child nodes in each cluster layer, and determine the target cluster layer whose number of lower-level sub-clusters or child nodes is less than a set threshold. The lower-level sub-clusters or sub-nodes of the target cluster layer are subjected to layer lifting processing.

11. A visualization device for the interaction relationship of data accounts, characterized in that, The device includes: The first merging module is configured to take the data account to be analyzed as the root node and merge the root node with the connected target leaf node to obtain the first-level clustering result, wherein the target leaf node is the peer account that only has data interaction with the corresponding data account; The partitioning module is configured to divide each node in the first-layer clustering result into at least two regions to be analyzed, wherein there is no connection between different regions to be analyzed; The second merging module is configured to merge nodes with the same connection relationship in the target analysis region to obtain the second-level clustering result, wherein the target analysis region is any one of the various regions to be analyzed obtained by partitioning; The third merging module is configured to determine the degree relationship matrix of each node in the second-layer clustering result, group each node in the second-layer clustering result according to the degree relationship matrix, merge the nodes in the same group to obtain the third-layer clustering result, and generate a corresponding visualization image, wherein the degree relationship matrix is ​​used to indicate the distance between each node.

12. A computing device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the steps of the data account interaction relationship visualization method according to any one of claims 1-10.

13. A computer-readable storage medium storing computer instructions that, when executed by a processor, implement the steps of the data account interaction relationship visualization method according to any one of claims 1-10.

Images