Methods, apparatus, electronic devices and storage media for determining abnormal node sets

Abstract

This application discloses a method, apparatus, electronic device, and storage medium for determining anomaly node sets. By constructing a target bipartite graph using the frequency of similar transactions occurring between similar nodes as the weight of the edges, the target bipartite graph can carry more information. Furthermore, by dividing the target bipartite graph into communities, the set of anomaly nodes can be determined by combining the characteristics of different transaction initiating nodes and service providing nodes, effectively improving the accuracy of anomaly node determination. Moreover, anomaly nodes are determined through the first distribution characteristics of service providing nodes in the target node set. On the one hand, service providing nodes play a passive role in transactions, reducing the imitability of transactions; on the other hand, the first distribution characteristics can accurately reflect the transaction characteristics of service providing nodes, thereby further improving the accuracy of anomaly node determination. This method can be widely applied in technologies such as cloud computing and artificial intelligence.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, electronic device, and storage medium for determining an abnormal node set. Background Technology

[0002] To improve the stability and reliability of transactions, timely detection of abnormal transaction nodes is crucial. Anomaly detection algorithms typically acquire statistical characteristics of the nodes conducting transactions, such as transaction volume and time, input these characteristics into a machine learning model, and then output the corresponding anomaly detection results. This approach only considers the node's own characteristics. When a transaction node mimics other nodes' transactions, these statistical characteristics may often appear normal, thus reducing the accuracy of identifying abnormal nodes. Summary of the Invention

[0003] The following is an overview of the subject matter described in detail in this application. This overview is not intended to limit the scope of the claims.

[0004] This application provides a method, apparatus, electronic device, and storage medium for determining anomaly node sets, which can improve the accuracy of anomaly node determination.

[0005] On the one hand, embodiments of this application provide a method for determining a set of abnormal nodes, including:

[0006] Obtain at least one transaction record between each transaction initiating node and its corresponding service providing node, and determine two transaction initiating nodes with similar transaction actions as similar node pairs based on the transaction records;

[0007] The target frequency of similar transaction actions occurring between similar node pairs is counted. The weight of the edges is determined based on the target frequency. Based on the edges, the similar node pairs are connected to the service provider nodes corresponding to the similar transaction actions to obtain the target bipartite graph.

[0008] The target bipartite graph is divided into communities to obtain multiple sets of target nodes;

[0009] Based on the transaction records, determine the first transaction volume information of the service providing nodes in the target node set at each first time point, determine the first distribution characteristics of the first transaction volume information in the first time period corresponding to multiple first time points, and determine the abnormal node set from multiple target node sets based on the first distribution characteristics.

[0010] On the other hand, embodiments of this application also provide an apparatus for determining an abnormal node set, including:

[0011] The transaction record acquisition module is used to acquire at least one transaction record between each transaction initiating node and the corresponding service providing node, and to determine two transaction initiating nodes with similar transaction actions as similar node pairs based on the transaction records.

[0012] The bipartite graph construction module is used to count the target frequency of similar transaction actions occurring between similar node pairs, determine the weight of the edges based on the target frequency, and connect the similar node pairs to the service provider nodes corresponding to the similar transaction actions based on the edges to obtain the target bipartite graph.

[0013] The community partitioning module is used to partition the target bipartite graph into communities, resulting in multiple sets of target nodes.

[0014] The analysis module is used to determine the first transaction volume information of the service providing nodes in the target node set at each first time point based on the transaction records, determine the first distribution characteristics of the first transaction volume information in the first time period corresponding to multiple first time points, and determine the abnormal node set from multiple target node sets based on the first distribution characteristics.

[0015] Furthermore, the aforementioned analysis module is specifically used for:

[0016] Generate a target distribution curve of the first transaction volume information in the first time period corresponding to multiple first time points;

[0017] Data analysis is performed on the target distribution curve to obtain the first distribution characteristics of the first transaction volume information in the first time period.

[0018] Furthermore, the aforementioned analysis module is specifically used for:

[0019] Determine the first difference between the first transaction volume information corresponding to two adjacent first time points in the target distribution curve, determine the target variance of multiple first differences, and use the target variance as the first distribution feature of the first transaction volume information in the first time period.

[0020] Alternatively, the first time period can be divided into a continuous first time sub-interval and a second time sub-interval. The first peak of the first transaction volume information in the first time sub-interval and the second peak of the first transaction volume information in the second time sub-interval can be determined. The second difference between the first peak and the second peak can be determined, and the second difference can be used as the first distribution feature of the first transaction volume information in the first time period.

[0021] Furthermore, the aforementioned analysis module is also used for:

[0022] Based on the transaction records, determine the second transaction volume information of the service-providing nodes outside the abnormal node set at each of the first time points;

[0023] Generate a candidate distribution curve of the second transaction volume information in the first time period;

[0024] Determine the curve similarity between the candidate distribution curve and the target distribution curve, determine the extended distribution curve from the candidate distribution curve based on the curve similarity, and add the service providing node corresponding to the extended distribution curve to the abnormal node set.

[0025] Furthermore, the aforementioned analysis module is specifically used for:

[0026] Calculate the distance between any point on the candidate distribution curve and each point on the target distribution curve, and construct a distance matrix using the distance values ​​as matrix elements;

[0027] Using the first vertex of the distance matrix as the starting point and the second vertex of the distance matrix as the ending point, determine the target path with the minimum sum of the matrix elements in the distance matrix, wherein the line connecting the first vertex and the second vertex is the diagonal of the distance matrix;

[0028] The curve similarity between the candidate distribution curve and the target distribution curve is obtained based on the sum of the matrix elements on the target path.

[0029] Furthermore, the aforementioned analysis module is specifically used for:

[0030] When the curve similarity is greater than or equal to a preset curve similarity threshold, the candidate distribution curve is determined as an extended distribution curve;

[0031] Alternatively, the curve similarity of multiple service-providing nodes outside the target node set can be sorted, and the candidate distribution curves corresponding to the curve similarity ranked before or after a preset ranking threshold can be determined as extended distribution curves.

[0032] Furthermore, the aforementioned community division module is specifically used for:

[0033] Obtain the preset weight coefficients;

[0034] In the target bipartite graph, the partition value is calculated as the sum of the path lengths from the first node, through the neighboring nodes of the first node, to the second node, where the first node is one of the transaction initiating nodes and the second node is one of the service providing nodes.

[0035] The expected value of the sum of path lengths from the first node, through the neighboring nodes, to the second node is calculated based on the weighting coefficients.

[0036] The target modularity is determined based on the difference between the partition value and the expected value;

[0037] The target bipartite graph is divided into communities based on the target modularity to obtain multiple target node sets.

[0038] Furthermore, the target node set contains at least one of the transaction initiating nodes, and the aforementioned analysis module is specifically used for:

[0039] Based on the transaction records, determine the third transaction volume information of the transaction initiating node in the target node set at each second time point;

[0040] Determine the second distribution characteristics of the third transaction volume information in the second time period corresponding to multiple second time points;

[0041] The abnormal node set is determined from the multiple target node sets based on the first distribution feature and the second distribution feature.

[0042] Furthermore, the target node set contains multiple service-providing nodes, and the analysis module described above is specifically used for:

[0043] Obtain the first node affiliation information of each of the service-providing nodes in the target node set;

[0044] Determine the first comparison result between the first node affiliation information of each of the service providing nodes;

[0045] Based on the first distribution characteristics and the first comparison result, an abnormal node set is determined from the multiple target node sets.

[0046] Furthermore, the target node set contains multiple transaction initiating nodes, and the aforementioned analysis module is specifically used for:

[0047] Obtain the second node affiliation information of each transaction initiating node in the target node set;

[0048] Determine the second comparison result between the second node attribution information of each of the transaction initiating nodes;

[0049] Based on the first distribution characteristics and the second comparison result, an abnormal node set is determined from the multiple target node sets.

[0050] Furthermore, the aforementioned analysis module is specifically used for:

[0051] Based on the transaction records, fourth transaction volume information of the reference node at each of the first time points is determined, wherein the reference node is another service provider node in the target node set other than the service provider node, and the node affiliation information of the reference node matches that of the service provider node in the target node set.

[0052] Determine the third distribution characteristic of the fourth transaction volume information in the first time period;

[0053] Determine the feature similarity between the first distribution feature and the third distribution feature, and determine the set of abnormal nodes from the multiple sets of target nodes based on the first distribution feature and the feature similarity.

[0054] Furthermore, the aforementioned transaction record acquisition module is specifically used for:

[0055] When the transaction record includes transaction time and transaction amount, for any two transaction initiating nodes that transact with the same service provider node among multiple transaction initiating nodes, the time difference of the transaction time and the amount difference of the transaction amount are determined. When the time difference is less than or equal to a preset duration threshold and the amount difference is less than or equal to a preset amount threshold, the corresponding transaction initiating nodes are determined as a similar node pair.

[0056] Alternatively, when the transaction record includes a transaction effective time, a transaction amount, and a transaction description text, the transaction effective time, the transaction amount, and the transaction description text are encoded to obtain a first vector corresponding to the transaction effective time, a second vector corresponding to the transaction amount, and a third vector corresponding to the transaction description text. The first vector, the second vector, and the third vector are concatenated to obtain a target vector. For any two transaction initiating nodes that transact with the same service provider node among multiple transaction initiating nodes, the vector similarity between the target vectors is determined. When the vector similarity is greater than or equal to a preset vector similarity threshold, the corresponding transaction initiating nodes are determined as a similar node pair.

[0057] On the other hand, embodiments of this application also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method for determining the set of abnormal nodes.

[0058] On the other hand, embodiments of this application also provide a computer-readable storage medium storing a computer program, which is executed by a processor to implement the above-described method for determining the set of abnormal nodes.

[0059] On the other hand, embodiments of this application also provide a computer program product, which includes a computer program stored in a computer-readable storage medium. A processor of a computer device reads the computer program from the computer-readable storage medium and executes the computer program, causing the computer device to perform the above-described method for determining the set of abnormal nodes.

[0060] The embodiments of this application include at least the following beneficial effects: By determining similar node pairs based on transaction records, since similar node pairs have similar transaction actions, further constructing a target bipartite graph using the target frequency of similar transaction actions in similar node pairs as the weight of the edges can make the target bipartite graph carry more information and better reflect the relationship between transaction initiating nodes and service providing nodes in the current transaction network; by performing community partitioning on the target bipartite graph, the nodes in the target node set are closely connected, and then an abnormal node set is determined from multiple target node sets based on the first distribution characteristics of the service providing nodes in the target node set. The abnormal node set can be determined by combining the characteristics of different transaction initiating nodes and service providing nodes. Compared with the method of only considering the characteristics of the nodes themselves, it can effectively improve the accuracy of abnormal node determination. In addition, what is obtained is a set of abnormal nodes rather than a single abnormal node, which can improve the efficiency of abnormal node determination to a certain extent. Furthermore, in this embodiment, abnormal nodes are determined by the first distribution characteristics of service-providing nodes in the target node set. On the one hand, service-providing nodes play a passive role when conducting transactions, which can reduce the imitability of transactions. On the other hand, the first distribution characteristics can accurately reflect the transaction characteristics of service-providing nodes, thereby further improving the accuracy of abnormal node determination.

[0061] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing the application. Attached Figure Description

[0062] The accompanying drawings are used to provide a further understanding of the technical solutions of this application and constitute a part of the specification. They are used together with the embodiments of this application to explain the technical solutions of this application and do not constitute a limitation on the technical solutions of this application.

[0063] Figure 1 A schematic diagram illustrating an optional implementation environment provided for an embodiment of this application;

[0064] Figure 2 An optional flowchart for the method of determining the set of abnormal nodes provided in the embodiments of this application;

[0065] Figure 3 The target binary provided for the embodiments of this application Figure 1 A schematic diagram of an optional structure;

[0066] Figure 4 A schematic diagram illustrating an optional result of community partitioning of a target bipartite graph provided in an embodiment of this application;

[0067] Figure 5 An optional schematic diagram of the target distribution curve provided in an embodiment of this application;

[0068] Figure 6 This is an optional schematic diagram illustrating the expansion of the abnormal node set provided in an embodiment of this application;

[0069] Figure 7 A schematic diagram of an optional process for determining curve similarity provided in an embodiment of this application;

[0070] Figure 8 A detailed flowchart of an optional method for determining the set of abnormal nodes provided in an embodiment of this application is shown.

[0071] Figure 9 A schematic diagram of an optional structure of the abnormal node set determination device provided in the embodiments of this application;

[0072] Figure 10 This is a partial structural block diagram of a terminal provided in an embodiment of this application;

[0073] Figure 11 A partial structural block diagram of the server provided in an embodiment of this application. Detailed Implementation

[0074] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0075] To facilitate understanding of the technical solutions provided in the embodiments of this application, some key terms used in the embodiments of this application will be explained below:

[0076] Bipartite graph: A bipartite graph is a graph structure with only two types of nodes. Nodes of the same type are not connected by edges, while nodes of different types are connected by edges.

[0077] Cloud computing refers to the delivery and usage model of IT (Internet Technology) infrastructure, meaning obtaining necessary resources in an on-demand and easily scalable manner through a network. In a broader sense, cloud computing also refers to the delivery and usage model of services, meaning obtaining necessary services in an on-demand and easily scalable manner through a network. These services can be IT and software related, internet-related, or other services. Cloud computing is a product of the development and integration of traditional computer and network technologies such as grid computing, distributed computing, parallel computing, utility computing, network storage technologies, virtualization, and load balancing.

[0078] Artificial intelligence (AI) is the theory, methods, technology, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. AI studies the design principles and implementation methods of various intelligent machines, enabling them to possess the functions of perception, reasoning, and decision-making.

[0079] Artificial intelligence (AI) is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, as well as machine learning / deep learning, autonomous driving, and intelligent transportation.

[0080] In anomaly detection algorithms of related technologies, a common approach is to acquire statistical characteristics of the nodes conducting transactions, such as transaction volume and time, and then input these characteristics into a machine learning model to output the corresponding anomaly detection results. This method only considers the characteristics of the node itself. When a transaction node mimics other nodes, the aforementioned statistical characteristics may often appear normal, thus reducing the accuracy of identifying anomalous nodes.

[0081] Based on this, this application provides a method, apparatus, electronic device, and storage medium for determining an abnormal node set, which can improve the accuracy of abnormal node determination.

[0082] Reference Figure 1 , Figure 1 This is a schematic diagram of an optional implementation environment provided in an embodiment of this application. The implementation environment includes multiple terminals 101 and a server 102, wherein the terminals 101 and the server 102 are connected through a communication network.

[0083] For example, multiple terminals 101 can act as transaction initiating nodes and service providing nodes, respectively. The transaction initiating nodes and service providing nodes conduct transactions through server 102. Server 102 can obtain at least one transaction record between each transaction initiating node and the corresponding service providing node. Based on the transaction record, two transaction initiating nodes with similar transaction actions are identified as similar node pairs. The target frequency of similar transaction actions occurring in similar node pairs is counted. The weight of the connection is determined based on the target frequency. Based on the connection, similar node pairs are connected to the service providing nodes corresponding to similar transaction actions to obtain a target bipartite graph. The target bipartite graph is divided into communities to obtain multiple target node sets. Based on the transaction record, the first transaction volume information of the service providing nodes in the target node sets at each first time point is determined. The first distribution characteristics of the first transaction volume information in the first time period corresponding to the multiple first time points are determined. Based on the first distribution characteristics, an abnormal node set is determined from the multiple target node sets.

[0084] Server 102 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. Additionally, server 102 can also be a node server in a blockchain network.

[0085] Terminal 101 can be a smartphone, tablet computer, laptop computer, desktop computer, smart speaker, smartwatch, vehicle terminal, etc., but is not limited to these. Terminal 101 and server 102 can be directly or indirectly connected via wired or wireless communication, and this embodiment of the application does not impose any limitations.

[0086] The methods provided in this application can be applied to various technical fields, including but not limited to cloud computing, artificial intelligence, and other technical fields.

[0087] based on Figure 1 The implementation environment shown is based on... Figure 2 , Figure 2 This is an optional flowchart of an abnormal node set determination method provided in the embodiments of this application. The abnormal node set determination method can be executed by a server or by a terminal that can obtain the transaction records between each transaction initiating node and the corresponding service providing node. The abnormal node set determination method includes, but is not limited to, the following steps 201 to 204.

[0088] Step 201: Obtain at least one transaction record between each transaction initiating node and the corresponding service providing node, and determine two transaction initiating nodes with similar transaction actions as similar node pairs based on the transaction records.

[0089] In one possible implementation, the transaction initiating node is the node that initiates the transaction, and the service providing node is the node that responds to the transaction initiating node and provides corresponding services to the transaction initiating node. The transaction initiating node or the service providing node may specifically correspond to a transaction account, a transaction terminal, etc., and this application embodiment does not limit it.

[0090] The method for determining the set of abnormal nodes provided in this application can be applied to different scenarios. For example, in the scenario of determining the set of abnormal nodes in medical transactions, the transaction initiating node can be the node corresponding to the patient, and the service providing node can be the node corresponding to the doctor; or, the transaction initiating node can be the node corresponding to the patient, and the service providing node can be the node corresponding to the department; or, the transaction initiating node can be the node corresponding to the patient, and the service providing node can be the node corresponding to the hospital; or, the transaction initiating node can be the node corresponding to the drug purchaser, and the service providing node can be the node corresponding to the pharmacy. As another example, in the scenario of determining the set of abnormal nodes in online transactions, the transaction initiating node can be the node corresponding to the product purchaser, and the service providing node can be the node corresponding to the online store. It is understood that the application scenarios provided in this application are merely illustrative examples.

[0091] In one possible implementation, the transaction record includes transaction data between the transaction initiating node and the corresponding service providing node, such as one or more of the following: transaction time, transaction amount, and transaction description text. The transaction description text is used to describe key information of the transaction. For example, in a medical transaction scenario where an abnormal node set is identified, the transaction description text could be examination results, a drug list, etc.; while in an online transaction scenario where an abnormal node set is identified, the transaction description text could be product information, logistics information, etc.

[0092] In one possible implementation, there are generally multiple transaction initiating nodes and multiple service providing nodes in the entire transaction network. A transaction initiating node can have transaction relationships with multiple service providing nodes, or a transaction initiating node can conduct multiple transactions with the same service providing node, or a service providing node can also have transaction relationships with multiple transaction initiating nodes. Therefore, when obtaining transaction records between transaction initiating nodes and service providing nodes, for one transaction initiating node, there will be one or more transaction records obtained.

[0093] For example, if a transaction network contains transaction initiating nodes A1, A2, and A3, and service providing nodes B1, B2, and B3, then retrieving the transaction records between the transaction initiating nodes and the service providing nodes could be: retrieving the transaction records between transaction initiating node A1 and service providing node B1, A1 and service providing node B2, A1 and service providing node B3, A2 and service providing node B1, A2 and service providing node B2, A2 and service providing node B3, A3 and service providing node B1, A3 and service providing node B2, and A3 and service providing node B3. Of course, if there are no transaction records between a transaction initiating node and a service providing node, the retrieved transaction records can be empty.

[0094] Among them, a similar node pair includes two transaction initiating nodes whose transaction actions are similar. For example, suppose there are transaction initiating node A1, transaction initiating node A2 and service provider node B1 in the transaction network. If the transaction between transaction initiating node A1 and service provider node B1 is referred to as transaction one and the transaction between transaction initiating node A2 and service provider node B1 is referred to as transaction two, and if transaction one and transaction two are similar transactions, then transaction initiating node A1 and transaction initiating node A2 are a similar node pair.

[0095] In one possible implementation, when the transaction record includes the transaction time and transaction amount, two transaction initiating nodes with similar transaction actions are identified as similar node pairs based on the transaction record. Specifically, for any two transaction initiating nodes that transact with the same service provider node among multiple transaction initiating nodes, the time difference of the transaction time and the amount difference of the transaction amount are determined. When the time difference is less than or equal to a preset duration threshold and the amount difference is less than or equal to a preset amount threshold, the corresponding transaction initiating nodes are identified as similar node pairs.

[0096] For example, the duration threshold could be 5 minutes, and the amount threshold could be 100 yuan. If the time difference between any two transaction initiation nodes is less than or equal to 5 minutes, and the amount difference is less than or equal to 100 yuan, then the two corresponding transaction initiation nodes can be determined as a similar node pair. It is understood that the duration and amount thresholds can be set according to actual circumstances, and this application embodiment does not impose any limitations.

[0097] When transaction records include transaction time and transaction amount, the time difference of transaction time and the amount difference of transaction amount can be used to easily and quickly determine whether the transaction actions of any two transaction initiating nodes are similar, and thus quickly identify similar node pairs.

[0098] In one possible implementation, when the transaction record includes the transaction effective time, transaction amount, and transaction description text, two transaction initiating nodes with similar transaction actions are identified as similar node pairs based on the transaction record. Specifically, the transaction effective time, transaction amount, and transaction description text can be encoded to obtain a first vector corresponding to the transaction effective time, a second vector corresponding to the transaction amount, and a third vector corresponding to the transaction description text. The first, second, and third vectors are concatenated to obtain the target vector. For any two transaction initiating nodes that transact with the same service provider node among multiple transaction initiating nodes, the vector similarity between the target vectors is determined. When the vector similarity is greater than or equal to a preset vector similarity threshold, the corresponding transaction initiating nodes are identified as similar node pairs.

[0099] For example, if the transaction effective time of the transaction between transaction initiating node A1 and service provider node B1 is t1, the transaction amount is g1, the transaction description text is T1, the first vector corresponding to the transaction effective time t1 is E11, the second vector corresponding to the transaction amount g1 is E12, and the third vector corresponding to the transaction description text T1 is E13, then the target vector corresponding to transaction initiating node A1 is E1 = E11 + E12 + E13; similarly, the transaction effective time of the transaction between transaction initiating node A2 and service provider node B1 is... The effective time is t2. The transaction amount between the transaction initiating node A2 and the service provider node B1 is g2. The transaction description text between the transaction initiating node A2 and the service provider node B1 is T2. The first vector corresponding to the transaction effective time t2 is E21, the second vector corresponding to the transaction amount g2 is E22, and the third vector corresponding to the transaction description text T2 is E23. Then, the target vector E2 corresponding to the transaction initiating node A2 is E2 = E21 + E22 + E23. Finally, the vector similarity between the target vectors E1 and E2 is determined. For example, the cosine similarity or Euclidean distance between the target vectors E1 and E2 can be calculated. The vector similarity threshold can be set according to the actual situation. For example, when using cosine similarity to calculate the vector similarity between the target vectors E1 and E2, the vector similarity threshold can be 0.8, 0.9, etc. This application embodiment does not limit this. When the cosine similarity between the target vectors E1 and E2 is greater than 0.9, then the transaction initiating node A1 and the transaction initiating node A2 are a similar node pair.

[0100] In one possible implementation, the BERT model can be used to encode the transaction effective time, transaction amount, and transaction description text.

[0101] When transaction records include transaction effective time, transaction amount, and transaction description text, target vectors can integrate transaction information from different dimensions, enabling more accurate determination of whether transaction actions between any two transaction initiating nodes and the same service provider node are similar, thereby improving the accuracy of identifying similar node pairs.

[0102] Step 202: Count the target frequency of similar transaction actions in similar node pairs, determine the weight of the edges based on the target frequency, and connect the similar node pairs with the service provider nodes corresponding to the similar transaction actions based on the edges to obtain the target bipartite graph.

[0103] In one possible implementation, there may be one or more transactions between each transaction initiating node and the corresponding service providing node. Accordingly, the target frequency of similar transaction actions occurring between transaction initiating nodes in similar node pairs can be one or more.

[0104] For example, if transaction initiating node A1 and service provider node B1 are a similar node pair, and in the transaction records, transaction initiating node A1 and service provider node B1 conducted a transaction of 100 yuan at 14:00 on January 1st, transaction initiating node A2 and service provider node B1 conducted a transaction of 110 yuan at 14:03 on January 1st, transaction initiating node A1 and service provider node B1 conducted a transaction of 200 yuan at 13:00 on January 2nd, and transaction initiating node A2 and service provider node B1 conducted a transaction of 250 yuan at 13:02 on January 2nd, then transaction initiating node A1 and transaction initiating node A2 had one similar transaction action on January 1st and one similar transaction action on January 2nd. Therefore, the target frequency for similar transaction actions for the similar node pair corresponding to transaction initiating node A1 and transaction initiating node A2 is twice.

[0105] In one possible implementation, a similar transaction list can be created to record the target frequency of similar transaction records appearing in similar node pairs. The similar transaction list can include the node identifier of the transaction initiating node in the similar node pair and the corresponding target frequency, and the similar transaction list can be updated in real time, thereby quickly determining the target frequency of similar transaction records appearing in similar node pairs.

[0106] Specifically, similar node pairs are connected to service provider nodes corresponding to similar transaction actions based on edge connections. That is, the transaction initiating node in each similar node pair is connected to the service provider node corresponding to the similar transaction action, while the transaction initiating nodes themselves are not connected. Furthermore, a similarity frequency threshold can be set. If the target frequency is greater than or equal to this threshold, the similar node pair is connected to the service provider node in the similar transaction record. The similarity frequency threshold can be set according to actual conditions, such as 3 times, 5 times, etc., and this embodiment does not limit the specific frequency. It is understood that the above connection action applies to multiple similar node pairs, meaning that multiple different similar node pairs exist in the same target bipartite graph.

[0107] For example, refer to Figure 3 , Figure 3 The target binary provided for the embodiments of this application Figure 1An optional structural diagram shows a transaction network containing transaction initiating nodes A1, A2, A3, A4, and A5, and service provider nodes B1, B2, and B3. Transaction initiating nodes A1 and A2 form a similar node pair (transacting with service provider node B1), with a target frequency of two transactions. Transaction initiating nodes A3 and A4 form a similar node pair (transacting with service provider node B2), with a target frequency of three transactions. Transaction initiating nodes A1 and A5 form a similar node pair (transacting with service provider node B1), with a target frequency of three transactions. Transaction initiating node B3 (transactions are conducted with service provider node B1), with a target frequency of two transactions; transaction initiating node A3 and transaction initiating node A5 are a similar node pair (transactions are conducted with service provider node B1), with a target frequency of one transaction; then transaction initiating node A1 and transaction initiating node A2 are each connected to service provider node B1, with an edge weight of 2; transaction initiating node A3 and transaction initiating node A4 are each connected to service provider node B2, with an edge weight of 3; transaction initiating node A1 and transaction initiating node A5 are each connected to service provider node B3, with an edge weight of 2; and transaction initiating node A3 and transaction initiating node A5 are each connected to service provider node B1, with an edge weight of 1. This is understandable. Figure 3 The target bipartite graph shown is for principle description only, and this application does not limit the specific structure of the target bipartite graph.

[0108] In one possible implementation, similar node pairs may have similar transaction actions with different service provider nodes. For example, transaction initiator node A1 and transaction initiator node A2 are a similar node pair. Transaction initiator node A1 and transaction initiator node A2 have two similar transaction actions with service provider node B1, and transaction initiator node A1 and transaction initiator node A2 have three similar transaction actions with service provider node B2. In this case, the similarity frequency of transaction initiator node A1 and transaction initiator node A2 is 5 times. When constructing the target bipartite graph, transaction initiator node A1 and transaction initiator node A2 will each be connected to service provider node B1 with an edge weight of 5; simultaneously, transaction initiator node A1 and transaction initiator node A2 will also each be connected to service provider node B2 with an edge weight of 5. Alternatively, when constructing the target bipartite graph, the weight of the edge connecting transaction initiator node A1 and transaction initiator node A2 to service provider node B1 can also be 2, and the weight of the edge connecting transaction initiator node A1 and transaction initiator node A2 to service provider node B2 can also be 3.

[0109] By constructing a target bipartite graph using the frequency of similar transactions between similar nodes as the weight of the edges, the target bipartite graph can carry more information and better reflect the relationship between transaction initiating nodes and service providing nodes in the current transaction network.

[0110] Step 203: Divide the target bipartite graph into communities to obtain multiple target node sets.

[0111] The target node set is the "community" obtained after dividing the target bipartite graph into communities. The target set can contain a number of transaction initiating nodes and a number of service providing nodes at the same time, or it can contain only a number of transaction initiating nodes or only a number of service providing nodes.

[0112] For example, refer to Figure 4 , Figure 4 This is a schematic diagram illustrating an optional result of community partitioning of a target bipartite graph provided in an embodiment of this application. Figure 4 The examples shown are Figure 3 Based on the target bipartite graph shown, Figure 3 The target bipartite graph shown is divided into two target node sets. Transaction initiating node A1, transaction initiating node A2, transaction initiating node A5, service provider node B1, and service provider node B3 form one target node set; transaction initiating node A3, transaction initiating node A4, and service provider node B2 form another target node set. It can be understood that... Figure 4 The community partitioning results of the target bipartite graph shown are for principle description only, and this application does not limit the community partitioning results of the target bipartite graph.

[0113] In one possible implementation, the target bipartite graph is partitioned into communities to obtain multiple sets of target nodes. Specifically, preset weight coefficients can be obtained. In the target bipartite graph, the partition value is calculated as the sum of path lengths from the first node through its neighboring nodes to the second node. Based on the weight coefficients, the expected value of the sum of path lengths from the first node through its neighboring nodes to the second node is calculated. The target modularity is determined based on the difference between the partition value and the expected value. The target bipartite graph is then partitioned into communities based on the target modularity to obtain multiple sets of target nodes.

[0114] Wherein, the first node is one of the transaction initiating nodes, the second node is one of the service providing nodes, and the target modularity can be represented as:

[0115]

[0116] Where Q represents the target modularity; p and q represent the number of nodes of the two classes in the bipartite graph, respectively; i and j represent the two classes of nodes in the bipartite graph, respectively; if node i and node j are in the same target node set, then δ(c i c j ) is 1; k i k j Let represent the weights of nodes i and j (the sum of the weights of the edges connecting them to either node i or node j); m represents the sum of the weights of all edges in the bipartite graph; w ia w ja This represents the length of a path that starts from node i (the first node), passes through node i's neighbor node a, and reaches node j (the second node). This represents the sum of the path lengths from node i (the first node), through its neighbor node a, to node j (the second node); m a This represents the weight of node a. This represents the weight from node i to node a. This represents the weight from node j to node a. This represents the length of a path starting from node i (the first node), passing through node i's neighbor node a, and reaching node j (the second node). Let γ represent the expected sum of the lengths of all paths starting from node i (the first node), passing through its neighbor node a, and reaching node j (the second node). γ represents the weighting coefficient. This represents the difference between the sum of all path lengths between a node pair (i, j) and the expected value.

[0117] The weight coefficient ranges from 0 to 1, and can be, for example, 0.7, 0.8, etc., which are not limited in this embodiment. By introducing a weight coefficient to calculate the expected value of the sum of path lengths from the first node through neighboring nodes to the second node, the expected value of the sum of path lengths can be reduced. This allows control over the size of the target node set obtained after dividing the target bipartite graph into communities, thereby improving the precision of community division of the target bipartite graph.

[0118] Specifically, the process of dividing the target bipartite graph into communities is as follows:

[0119] The first step is to treat each node in the target bipartite graph as a target node set. At this point, the number of target node sets is the same as the number of nodes in the target bipartite graph.

[0120] The second step is to merge each node in the target bipartite graph and its adjacent nodes in turn, calculate the target modularity between the two corresponding nodes, and if the target modularity is greater than 0, then put the node into the target node set where its adjacent node is located.

[0121] The third step is to iterate through the second step until the set of target nodes corresponding to all nodes no longer changes;

[0122] The fourth step is to compress the target node set obtained in the third step into a single node. The weights of the nodes in the target node set are converted into the weights of the compressed node, and the weights of the edges in the target node set are converted into the weights of the edges of the compressed node.

[0123] Fifth, repeat steps one through three until the set of target nodes corresponding to all nodes no longer changes;

[0124] Step 6: Output the final set of target nodes and the nodes in each target node set.

[0125] Step 204: Determine the first transaction volume information of the service-providing nodes in the target node set at each first time point based on the transaction records, determine the first distribution characteristics of the first transaction volume information in the first time period corresponding to multiple first time points, and determine the abnormal node set from multiple target node sets based on the first distribution characteristics.

[0126] In one possible implementation, a set of target nodes with at least one service provider node can be selected first. For a service provider node, transactions may occur with different transaction initiating nodes at different times; therefore, the service provider node will have multiple transaction records. The first transaction volume information is used to indicate the transaction scale of the service provider node. The first transaction volume information can be the total transaction amount or the transaction frequency; this embodiment does not limit this. The transaction records of the service provider node can be summarized to obtain the first transaction volume information of the service provider node at each first time point.

[0127] For example, if service provider node B1 conducts a transaction of 100 yuan with transaction initiator node A1 at 8:00, a transaction of 200 yuan with transaction initiator node A2 at 8:00, a transaction of 100 yuan with transaction initiator node A3 at 9:00, a transaction of 200 yuan with transaction initiator node A4 at 9:00, and a transaction of 300 yuan with transaction initiator node A5 at 9:00, then the first time points are 8:00 and 9:00. When the first transaction volume information is the transaction frequency, the first transaction volume information of service provider node B1 at 8:00 is 2, and the first transaction volume information at 9:00 is 3. When the first transaction volume information is the total transaction amount, the first transaction volume information of service provider node B1 at 8:00 is 300 yuan, and the first transaction volume information at 9:00 is 600 yuan. It is understood that the above-mentioned first time point is only used for principle explanation. In reality, the first time point is not necessarily an hour, and the granularity between multiple first time points is not necessarily one hour. It depends on the actual transaction situation of the service provider node. Similarly, the first transaction volume information of the service provider node also depends on the actual transaction situation of the service provider node. This application embodiment does not limit it.

[0128] In one possible implementation, the first distribution feature is used to characterize the data distribution of the first transaction volume information within a first time period. When the first transaction volume information includes the transaction frequency of the service provider node, the first distribution feature of the transaction frequency in the first time period corresponding to multiple first time points is determined to make the first distribution feature more specific, thereby enabling a more accurate judgment of the transaction status of the service provider node.

[0129] In one possible implementation, when determining the first distribution characteristics of the first transaction volume information in the first time period corresponding to multiple first time points, a target distribution curve of the first transaction volume information in the first time period corresponding to multiple first time points can be generated, and data analysis can be performed on the target distribution curve to obtain the first distribution characteristics of the first transaction volume information in the first time period.

[0130] For example, refer to Figure 5 , Figure 5 This is an optional schematic diagram of the target distribution curve provided in an embodiment of this application, wherein the first transaction volume information is taken as the transaction frequency as an example. Figure 5 The target distribution curve shown exemplifies the distribution of transaction frequency among three different service provider nodes during the first time period from 7:00 to 17:00 (corresponding to curve one, curve two, and curve three, respectively). The transaction records of the service provider nodes can be summarized using Python's visualization tools to generate the corresponding target distribution curve.

[0131] In addition, when determining the first distribution characteristics of the first transaction volume information within the first time period corresponding to multiple first time points, an array or matrix corresponding to the first transaction volume information can also be generated. Furthermore, generating a target distribution curve provides a higher level of visualization and can more intuitively reflect the data distribution of the first transaction volume information within the first time period.

[0132] In one possible implementation, data analysis is performed on the target distribution curve to obtain the first distribution characteristics of the first trading volume information in the first time period. Specifically, the first difference between the first trading volume information corresponding to two adjacent first time points in the target distribution curve can be determined, the target variance of multiple first differences can be determined, and the target variance can be used as the first distribution characteristics of the first trading volume information in the first time period.

[0133] For example, curve 1 has 11 time points, with corresponding first transaction volume information of "0, 34, 40, 10, 3, 0, 3, 7, 3, 0, 0". The multiple first differences are then "34, 6, 30, 7, 3, 3, 4, 4, 3, 0". Therefore, the target variance is the variance of these multiple first differences "34, 6, 30, 7, 3, 3, 4, 4, 3, 0", indicating that the service provider node corresponding to curve 1 is abnormal. Since the target variance can characterize the uniformity of the distribution of multiple first differences, by using the target variance as the first distribution feature of the first transaction volume information in the first time period, we can reflect the uniformity of the distribution of the first transaction volume information of the service provider node in the first time period, thus quickly and accurately determining whether the service provider node's transactions are normal.

[0134] In one possible implementation, data analysis is performed on the target distribution curve to obtain the first distribution characteristics of the first trading volume information in the first time period. Specifically, the first time period is divided into continuous first time sub-intervals and second time sub-intervals. The first peak of the first trading volume information in the first time sub-interval and the second peak of the first trading volume information in the second time sub-interval are determined. The second difference between the first peak and the second peak is determined and used as the first distribution characteristic of the first trading volume information in the first time period.

[0135] For example, the first time period could be from 7:00 to 17:00, the first sub-time period could be from 7:00 to 12:00, and the second sub-time period could be from 13:00 to 17:00, as shown in the reference. Figure 5 The first peak of curve 1 in the first time sub-interval is 40, and the second peak in the second time sub-interval is 10. Therefore, the second difference is 30, which shows that the service provider node corresponding to curve 1 is abnormal.

[0136] Specifically, taking the scenario of identifying abnormal node sets in medical transactions as an example, if the service provider node is a doctor node, the first time period is one day, the first time sub-interval is morning, and the second time sub-interval is afternoon, then the first transaction volume information of the service provider node should normally be evenly distributed between morning and afternoon throughout the day. Therefore, by dividing the first time period into continuous first and second time sub-intervals, and then determining the second difference between the first and second peaks, the first and second time sub-intervals can be used to simulate the transaction time characteristics of the service provider node. This allows the second difference to more closely approximate the fluctuations of the service provider node during actual transactions, thus enabling a quick and accurate determination of whether the service provider node's transactions are normal.

[0137] It is understood that the time granularity of the first time period can be determined according to the actual situation. Similarly, the division criteria of the first time sub-interval and the second time sub-interval can also be determined according to the actual situation. This application does not limit the specific criteria.

[0138] In one possible implementation, when the target variance is used as the first distribution feature of the first transaction volume information in the first time period, if the target variance is greater than or equal to a preset variance threshold, it can be determined that the corresponding service provider node is abnormal, and thus the target node set containing the service provider node is determined to be the abnormal node set. When the second difference is used as the first distribution feature of the first transaction volume information in the first time period, if the second difference is greater than or equal to a preset information difference threshold (which can be a transaction frequency threshold or a total transaction amount threshold), it can be determined that the corresponding service provider node is abnormal, and thus the target node set containing the service provider node is determined to be the abnormal node set.

[0139] It is understood that the above variance threshold and information difference threshold can be set according to the actual situation, such as depending on the specific service type provided by the service provider node, and this application embodiment does not limit them.

[0140] Abnormal nodes are identified by using the first distribution characteristics of service-providing nodes in the target node set. On the one hand, service-providing nodes play a passive role when conducting transactions, which reduces the imitability of transactions. On the other hand, the first distribution characteristics can accurately reflect the transaction characteristics of service-providing nodes, thereby further improving the accuracy of abnormal node identification.

[0141] Furthermore, by dividing the target bipartite graph into communities, the nodes in the target node set are closely connected. Then, based on the first distribution characteristics of the service provider nodes in the target node set, the abnormal node set is determined from multiple target node sets. The abnormal node set can be determined by combining the characteristics of different transaction initiating nodes and service provider nodes. Compared with the method of only considering the characteristics of the nodes themselves, it can effectively improve the accuracy of abnormal node determination. In addition, what is obtained is a set of abnormal nodes rather than a single abnormal node, which can improve the efficiency of abnormal node determination to a certain extent.

[0142] In one possible implementation, the target bipartite graph can be partitioned into communities based on the degree of overlap. In this case, some of the resulting sets of target nodes may overlap, meaning that a transaction initiating node or service provider node may exist in multiple sets of target nodes simultaneously. When a service provider node exists in multiple sets of target nodes, if the first distribution characteristics of the first transaction volume information are determined in the first time period corresponding to multiple first time points, and the corresponding service provider node is determined to be abnormal based on the first distribution characteristics, then all sets of target nodes containing the service provider node can be identified as abnormal sets, thereby improving the efficiency of determining the abnormal node set.

[0143] In one possible implementation, when generating the target bipartite graph, attribute information of each transaction initiating node and service providing node can be obtained. The attribute similarity between the transaction initiating node and service providing node is determined based on this attribute information. The weight of each edge is then determined based on the attribute similarity and the target frequency, thus generating the target bipartite graph. This allows for the incorporation of relevant attribute information when subsequently dividing the target bipartite graph into communities. For example, when the transaction initiating node is a patient node and the service providing node is a doctor node, the attribute information could be age, daily spending amount, etc.; when the transaction initiating node is a drug purchaser node and the service providing node is a pharmacy node, the attribute information could be a specific address (which needs to be encoded), etc. By introducing attribute similarity to determine edge weights, the target bipartite graph can carry more information, leading to more accurate community division later on.

[0144] In one possible implementation, after determining the abnormal node set from multiple target node sets based on the first distribution characteristics, the second transaction volume information of service provider nodes outside the abnormal node set at each first time point can be determined based on transaction records. Candidate distribution curves of the second transaction volume information in the first time period are generated, the curve similarity between the candidate distribution curve and the target distribution curve is determined, an extended distribution curve is determined from the candidate distribution curve based on the curve similarity, and the service provider node corresponding to the extended distribution curve is added to the abnormal node set.

[0145] Specifically, refer to Figure 6 , Figure 6 This is an optional schematic diagram for expanding the abnormal node set provided in this application embodiment. For example, the abnormal node set includes transaction initiating node A1, transaction initiating node A2, and service provider node B1. Service provider nodes outside the abnormal node set, i.e., other service provider nodes besides service provider node B1, such as service provider node B2, service provider node B3, etc. The principle of determining the second transaction volume information of service provider nodes outside the abnormal node set at each first time point is similar to the principle of determining the first transaction volume information of service provider nodes in the abnormal node set. The principle of generating the candidate distribution curve of the second transaction volume information in the first time period is similar to the principle of generating the target distribution curve of the first transaction volume information in the first time period, and will not be elaborated here.

[0146] After determining the set of abnormal nodes, the similarity between the candidate distribution curve and the target distribution curve is determined. Based on the curve similarity, an extended distribution curve is determined from the candidate distribution curves. The service provider node corresponding to the extended distribution curve is added to the set of abnormal nodes, which can expand the set of abnormal nodes and broaden the scope of abnormal node confirmation.

[0147] In one possible implementation, an extended distribution curve is determined from candidate distribution curves based on curve similarity. Specifically, when the curve similarity is greater than or equal to a preset curve similarity threshold, the candidate distribution curve is determined as the extended distribution curve. It is understood that the curve similarity threshold can be set according to actual circumstances, for example, it can be determined based on the specific calculation method of curve similarity; this application embodiment does not limit this.

[0148] In one possible implementation, the extended distribution curve is determined from the candidate distribution curves based on curve similarity. Specifically, this can involve sorting the curve similarities of multiple service-providing nodes outside the target node set, and determining the candidate distribution curves corresponding to curve similarities ranked before or after a preset ranking threshold as the extended distribution curves. It is understood that the ranking threshold can be set according to actual circumstances, for example, it can be determined based on the total number of candidate distribution curves; the larger the total number of candidate distribution curves, the larger the ranking threshold can be. This application does not impose such a limitation.

[0149] In one possible implementation, when determining the curve similarity between the candidate distribution curve and the target distribution curve, the distance value between any point on the candidate distribution curve and each point on the target distribution curve can be calculated. The distance value is used as matrix elements to construct a distance matrix. The first vertex of the distance matrix is ​​used as the starting point, and the second vertex of the distance matrix is ​​used as the ending point. The target path with the smallest sum of matrix elements in the distance matrix is ​​determined. The curve similarity between the candidate distribution curve and the target distribution curve is obtained based on the sum of matrix elements on the target path.

[0150] Specifically, the line connecting the first vertex and the second vertex is the diagonal of the distance matrix, for example, referring to... Figure 7 , Figure 7 This is a schematic diagram of an optional flowchart for determining curve similarity provided in an embodiment of this application. Assume there are 4 points on the target distribution curve, namely X1, X2, X3, and X4, and 6 points on the candidate distribution curve, namely Y1, Y2, Y3, Y4, Y5, and Y6. The first vertex of the constructed distance matrix can be the lower left vertex, i.e., (X1, Y1), and correspondingly, the second vertex is the upper right vertex, i.e., (X4, Y6). It is understood that the first vertex can also be changed according to the distribution order of the distance values ​​between the points; for example, the first vertex can also be the upper left vertex, and correspondingly, the second vertex can be the lower right vertex. This embodiment of the application does not impose such limitations.

[0151] Among these methods, determining the target path with the minimum sum of matrix elements in the distance matrix can be achieved through iterative calculation. Specifically:

[0152] The sum of matrix elements D(i,j) on the target path when i=0 and j=0 can be set to positive infinity, where i represents a point on the target distribution curve and j represents a point on the candidate distribution curve;

[0153] For i ranging from 1 to m, and j ranging from 1 to n, iterative calculation is performed:

[0154] d ij =d(x i y i )

[0155] D(i,j)=d ij +min{D(i-1,j),D(i,j-1),D(i-1,j-1)}

[0156] Where, d ij x represents the distance value corresponding to the point (i, j) in the distance matrix. i Let y be the value of the point corresponding to the target distribution curve. iLet D(i,j) represent the sum of matrix elements on the path ending at point (i,j), D(i-1,j) represent the sum of matrix elements on the path ending at the point directly to the left of point (i,j), D(i,j-1) represent the sum of matrix elements on the path ending at the point directly below point (i,j), and D(i-1,j-1) represent the sum of matrix elements on the path ending at the point to the lower left of point (i,j). For a point (i,j) in the distance matrix, the preceding point on the path can be one of three points: directly to the left, directly below, or to the lower left. Therefore, following the iterative calculation method described above, the target path with the smallest sum of matrix elements can be obtained. The sum of matrix elements on the target path can be used to measure the curve similarity between the target distribution curve and the candidate distribution curve.

[0157] In calculating D(i, j) above, multiple calculations can be performed. Specifically, a cumulative distance matrix (path sum matrix) can be constructed based on dynamic programming. The cumulative distance matrix is ​​used to record the above iterative calculation process, and can be represented as follows:

[0158]

[0159] Where a[0:i] represents the sequence of points on the target distribution curve, b[0:j] represents the sequence of points on the candidate distribution curve, and dp[i][j] represents the cumulative distance between points on the target distribution curve and points on the candidate distribution curve, which is the sum of matrix elements on the shortest path ending at point (i,j).

[0160] Since the transaction records of different service providers are different, the lengths of the target distribution curve and the candidate distribution curve may be different. Therefore, by determining the target path with the minimum sum of matrix elements in the distance matrix, and obtaining the curve similarity between the candidate distribution curve and the target distribution curve based on the sum of matrix elements on the target path, the effect of time warping can be achieved, making the curve similarity between the candidate distribution curve and the target distribution curve more accurate and improving the expansion effect on the abnormal node set.

[0161] In one possible implementation, the target node set also contains at least one transaction initiating node. When determining the abnormal node set from multiple target node sets based on the first distribution feature, specifically, based on the transaction records, the third transaction volume information of the transaction initiating node in the target node set at each second time point is determined, and the second distribution feature of the third transaction volume information in the second time period corresponding to multiple second time points is determined. The abnormal node set is then determined from multiple target node sets based on the first and second distribution features.

[0162] Specifically, determining the third transaction volume information of the transaction initiating nodes in the target node set at each second time point is similar in principle to determining the first transaction volume information of the service providing nodes in the abnormal node set; determining the second distribution characteristics of the third transaction volume information in the second time period corresponding to multiple second time points is similar in principle to determining the first distribution characteristics of the first transaction volume information in the first time period, and will not be elaborated further here. Since the transaction initiating node may transact with different service providing nodes, the second time period and the first time period may not be the same.

[0163] When it is determined that the service provider node is abnormal based on the first distribution feature, it is further determined whether the transaction initiating node in the same target node set is abnormal based on the second distribution feature. If it is determined that the service provider node is also abnormal based on the second distribution feature, then the corresponding target node set can be determined as the abnormal node set, thereby improving the accuracy and reliability of determining the abnormal node set.

[0164] In one possible implementation, there are multiple service provider nodes in the target node set. When determining the abnormal node set from the multiple target node sets based on the first distribution feature, the first node affiliation information of each service provider node in the target node set can be obtained, the first comparison result between the first node affiliation information of each service provider node can be determined, and the abnormal node set can be determined from the multiple target node sets based on the first distribution feature and the first comparison result.

[0165] Specifically, the first node attribution information is used to indicate the organization or region to which the service provider node belongs. For example, when the service provider node is a doctor node, the first node attribution information could be the corresponding department or hospital; when the service provider node is a department node, the first node attribution information could be the corresponding hospital; when the service provider node is a hospital node or a pharmacy, the first node attribution information could be the region corresponding to the specific address; and when the service provider node is an online store, the first node attribution information could be the region corresponding to the license. When it is determined that a service provider node is abnormal based on the first distribution characteristics, the first node attribution information can be further compared to obtain the first comparison result. If the first comparison result shows that the first node attribution information of any two service provider nodes matches, it can be determined that the two corresponding service provider nodes belong to the same organization or region. This further allows for the determination of the corresponding target node set as an abnormal node set, thereby improving the accuracy and reliability of determining the abnormal node set.

[0166] For example, if there are two doctor nodes in the target node set, and it is determined that at least one doctor node in the target node set is abnormal based on the first distribution feature, and it is further determined that the first node affiliation information of the two doctor nodes matches, that is, the two doctor nodes belong to the same department, then the corresponding target node set can be determined as the abnormal node set.

[0167] In one possible implementation, there are multiple transaction initiating nodes in the target node set. When determining the abnormal node set from the multiple target node sets based on the first distribution feature, the second node attribution information of each transaction initiating node in the target node set can be obtained, and the second comparison result between the second node attribution information of each transaction initiating node can be determined. The abnormal node set can then be determined from the multiple target node sets based on the first distribution feature and the second comparison result.

[0168] Specifically, the second node affiliation information is used to indicate the organization to which the transaction initiating node belongs. For example, the second node affiliation information could be the corresponding family or workplace. When it is determined that the service provider node is abnormal based on the first distribution characteristics, the second node affiliation information can be further compared to obtain a second comparison result. If the second comparison result shows that the second node affiliation information of any two transaction initiating nodes matches, it can be determined that the two corresponding transaction initiating nodes belong to the same organization. This further allows for the determination of the corresponding target node set as the abnormal node set, thereby improving the accuracy and reliability of determining the abnormal node set.

[0169] For example, if there are two patient nodes in the target node set, and the doctor node in the target node set is determined to be abnormal based on the first distribution feature, and the second node affiliation information of the two patient nodes is further determined to match, that is, the two patient nodes belong to the same family or the same company, then the corresponding target node set can be determined to be an abnormal node set.

[0170] In one possible implementation, when determining the set of abnormal nodes from multiple target node sets based on the first distribution feature, specifically, based on transaction records, the fourth transaction volume information of the reference node at each first time point can be determined, the third distribution feature of the fourth transaction volume information in the first time period can be determined, the feature similarity between the first distribution feature and the third distribution feature can be determined, and the set of abnormal nodes can be determined from multiple target node sets based on the first distribution feature and the feature similarity.

[0171] In this context, the reference node is another service-providing node besides those in the target node set, and the reference node's affiliation information matches that of the service-providing nodes in the target node set; that is, the reference node and the service-providing nodes in the target node set belong to the same organization or region. When an anomaly is determined in a service-providing node based on the first distribution feature, the feature similarity between the first and third distribution features can be further determined. If the feature similarity between the first and third distribution features is less than or equal to a preset feature similarity threshold, the corresponding target node set can be further determined as an anomalous node set, thereby improving the accuracy and reliability of determining the anomalous node set.

[0172] The principle of determining the fourth transaction volume information of the reference node at each first time point is similar to that of determining the first transaction volume information of the service provider node in the abnormal node set; the principle of determining the third distribution feature of the fourth transaction volume information in the first time period is similar to that of determining the first distribution feature of the first transaction volume information in the first time period, and will not be elaborated here.

[0173] For example, when it is determined that there are abnormal doctor nodes in the target node set based on the first distribution feature, the third distribution feature of the doctor nodes in the target node set and another doctor node (reference node) belonging to the same department is further determined. Then, the feature similarity between the first distribution feature and the third distribution feature is determined. If the feature similarity between the first distribution feature and the third distribution feature is less than or equal to the preset feature similarity threshold, it indicates that the transaction features of the doctor nodes in the target node set are significantly different from those of the reference node. Then, the corresponding target node set can be determined as an abnormal node set.

[0174] The principle of the abnormal node set determination method provided in the embodiments of this application will be explained in detail below through practical examples.

[0175] Reference Figure 8 , Figure 8 This is a detailed flowchart of an optional method for determining the set of abnormal nodes provided in an embodiment of this application. Figure 8Taking a medical scenario as an example, we can determine the set of abnormal nodes across different dimensions. First, we perform data processing and construct a bipartite graph. One approach is to obtain the transaction records between patient nodes and doctor nodes, and then use the affiliation relationships between doctor nodes and department nodes, and hospital nodes to statistically integrate these records, ultimately obtaining patient node consultation data, doctor node patient reception data, department node patient reception data, and hospital node patient reception data. Another approach is to directly retrieve these data from a database. Next, we construct a target bipartite graph based on the patient node consultation data (each doctor node, department node, and hospital node has a different target bipartite graph with the patient node), and then perform community partitioning on the target bipartite graph to obtain the target node set. Furthermore, based on different dimensions of service provider node patient visit data, such as doctor node patient visit data, department node patient visit data, and hospital node patient visit data, the distribution characteristics of transaction frequency are analyzed. Then, based on the analysis results of the distribution characteristics, the target node set is analyzed from different dimensions, thereby identifying the abnormal node set from multiple target node sets. Taking doctor nodes as an example, specifically:

[0176] For a target node set, if there is at least one doctor node in the target node set, and the distribution characteristics of the doctor node are abnormal, then the target node set can be preliminarily determined to be an abnormal node set.

[0177] Based on this, we can also determine the hospital node corresponding to the patient node, and determine whether the doctor node belongs to the hospital node. If the doctor node belongs to the hospital node, we can further determine that the target node set is an abnormal node set.

[0178] Based on this, the transaction concentration of each patient node in the target node set can also be determined. If all patient nodes in the target node set conduct concentrated transactions within the same time period, the target node set can be further identified as an abnormal node set. Specifically, for the transaction concentration of the same patient node, if the same patient node conducts multiple transactions within a short period of time, the transaction concentration of that patient node is high. For the transaction concentration of multiple patient nodes, if multiple patient nodes conduct transactions with the same doctor node within the same time period, or conduct the same transaction content with different doctor nodes, the transaction concentration of these multiple patient nodes is high.

[0179] Based on this, the sum of the number of patient nodes and doctor nodes in the target node set can also be determined. If the sum of the node counts is greater than or equal to a preset node count threshold, the target node set can be further determined as an abnormal node set. The node count threshold can be set according to the actual situation, for example, it can be 5, 10, etc., and this application embodiment does not limit it.

[0180] Based on this, if there are patient nodes belonging to the same family or company in the target node set, the target node set can be further determined as an abnormal node set.

[0181] Based on this, if there are doctor nodes belonging to the same department or hospital in the target node set, then the target node set can be further determined to be an abnormal node set.

[0182] Furthermore, for the patient nodes in the target node set, it can be further determined whether the quantity of medicines involved in the current transaction exceeds a preset medicine quantity threshold. If the quantity of medicines exceeds the medicine quantity threshold, the target node set can be further determined as an abnormal node set. The medicine quantity threshold can be set according to the actual situation, such as the quantity of normal patient nodes for a week, a month, etc., which is not limited in this embodiment.

[0183] Based on this, it can also be determined whether the reimbursement ratio of the patient node exceeds a preset reimbursement ratio threshold. If the reimbursement ratio exceeds the reimbursement ratio threshold, the target node set can be further determined as an abnormal node set. The reimbursement ratio threshold can be set according to the actual situation, such as 90%, 95%, etc., and this application embodiment does not limit it.

[0184] Based on this, the distribution characteristics of transaction frequency of patient nodes in the target node set can also be analyzed. If the distribution characteristics of patient nodes are abnormal, the target node set can be further determined to be an abnormal node set.

[0185] In addition, the transaction concentration of doctor nodes in the target node set can also be determined. If the same doctor node conducts multiple transactions in a short period of time, or conducts the same transactions with a large number of patient nodes, then the transaction concentration of the doctor node is high, and the target node set can be further determined to be an abnormal node set.

[0186] Based on this, the transaction content of doctor nodes can also be analyzed. For example, if the transaction content of a certain doctor node does not match the type of the doctor node, the target node set can be further identified as an abnormal node set.

[0187] Based on this, we can also determine the distribution characteristics of another doctor node belonging to the same department as the doctor nodes in the target node set. If the distribution characteristics of the doctor nodes in the target node set are not similar to the distribution characteristics of another doctor node belonging to the same department, then we can further determine that the target node set is an abnormal node set.

[0188] When constructing a target bipartite graph based on department nodes and hospital nodes, the method for determining the set of abnormal nodes is similar to that for doctor nodes, and will not be elaborated here.

[0189] It is understood that although the steps in the above flowcharts are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated in this embodiment, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the above flowcharts may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps.

[0190] It should be noted that in various specific embodiments of this application, when processing is required based on data related to the characteristics of the target object, such as target object attribute information or a set of attribute information, the permission or consent of the target object will be obtained first. The target object can be a user. Furthermore, the collection, use, and processing of this data will comply with the relevant laws, regulations, and standards of the relevant countries and regions. In addition, when embodiments of this application need to obtain target object attribute information, separate permission or consent from the target object will be obtained through pop-ups or redirection to a confirmation page. Only after obtaining the target object's separate permission or consent will the necessary target object-related data for the normal operation of the embodiments of this application be obtained.

[0191] Reference Figure 9 , Figure 9 This is a schematic diagram of an optional structure of the abnormal node set determination device 900 provided in the embodiments of this application. The abnormal node set determination device 900 includes:

[0192] The transaction record acquisition module 901 is used to acquire at least one transaction record between each transaction initiating node and the corresponding service providing node, and to determine two transaction initiating nodes with similar transaction actions as similar node pairs based on the transaction records.

[0193] The bipartite graph construction module 902 is used to count the target frequency of similar node pairs having similar transaction actions, determine the weight of the edges based on the target frequency, and connect the similar node pairs with the service provider nodes corresponding to the similar transaction actions based on the edges to obtain the target bipartite graph.

[0194] Community partitioning module 903 is used to partition the target bipartite graph into communities, resulting in multiple sets of target nodes.

[0195] Analysis module 904 is used to determine the first transaction volume information of the service providing nodes in the target node set at each first time point based on the transaction records, determine the first distribution characteristics of the first transaction volume information in the first time period corresponding to multiple first time points, and determine the abnormal node set from multiple target node sets based on the first distribution characteristics.

[0196] Furthermore, the aforementioned analysis module 904 is specifically used for:

[0197] Generate the target distribution curve of the first transaction volume information in the first time period corresponding to multiple first time points;

[0198] Data analysis of the target distribution curve yields the first distribution characteristics of the first transaction volume information within the first time period.

[0199] Furthermore, the aforementioned analysis module 904 is specifically used for:

[0200] Determine the first difference between the first transaction volume information corresponding to two adjacent first time points in the target distribution curve, determine the target variance of multiple first differences, and use the target variance as the first distribution feature of the first transaction volume information in the first time period.

[0201] Alternatively, the first time period can be divided into a continuous first time sub-interval and a second time sub-interval. The first peak of the target distribution curve for the first trading volume information in the first time sub-interval and the second peak of the first trading volume information in the second time sub-interval can be determined. The second difference between the first peak and the second peak can be determined, and the second difference can be used as the first distribution feature of the first trading volume information in the first time period.

[0202] Furthermore, the aforementioned analysis module 904 is also used for:

[0203] Based on the transaction records, determine the second transaction volume information of the service-providing nodes outside the abnormal node set that conducted transactions at each first time point;

[0204] Generate a candidate distribution curve for the second transaction volume information in the first time period;

[0205] Determine the curve similarity between the candidate distribution curve and the target distribution curve, determine the extended distribution curve from the candidate distribution curve based on the curve similarity, and add the service provider node corresponding to the extended distribution curve to the abnormal node set.

[0206] Furthermore, the aforementioned analysis module 904 is specifically used for:

[0207] Calculate the distance between any point on the candidate distribution curve and each point on the target distribution curve, and construct a distance matrix using the distance values ​​as matrix elements;

[0208] Using the first vertex of the distance matrix as the starting point and the second vertex of the distance matrix as the ending point, determine the target path with the minimum sum of matrix elements in the distance matrix, where the line connecting the first vertex and the second vertex is the diagonal of the distance matrix;

[0209] The similarity between the candidate distribution curve and the target distribution curve is obtained by summing the matrix elements along the target path.

[0210] Furthermore, the aforementioned analysis module 904 is specifically used for:

[0211] When the curve similarity is greater than or equal to the preset curve similarity threshold, the candidate distribution curve is determined as the extended distribution curve;

[0212] Alternatively, the similarity of curves corresponding to multiple service-providing nodes outside the target node set can be sorted, and the candidate distribution curves corresponding to the similarity of curves ranked before or after a preset ranking threshold can be determined as the extended distribution curves.

[0213] Furthermore, the aforementioned community division module 903 is specifically used for:

[0214] Obtain the preset weight coefficients;

[0215] In the target bipartite graph, calculate the partition value of the sum of path lengths from the first node, through the neighboring nodes of the first node, to the second node, where the first node is one of the transaction initiating nodes and the second node is one of the service providing nodes.

[0216] Calculate the expected value of the sum of path lengths from the first node, through neighboring nodes, to the second node based on the weighting coefficients.

[0217] The target modularity is determined based on the difference between the partition value and the expected value;

[0218] The target bipartite graph is divided into communities based on the target modularity, resulting in multiple sets of target nodes.

[0219] Furthermore, the target node set contains at least one transaction initiating node, and the aforementioned analysis module 904 is specifically used for:

[0220] Based on the transaction records, determine the third transaction volume information of the transaction initiating nodes in the target node set at each second time point;

[0221] Determine the second distribution characteristics of the third transaction volume information in the second time period corresponding to multiple second time points;

[0222] The set of abnormal nodes is determined from multiple sets of target nodes based on the first and second distribution characteristics.

[0223] Furthermore, the target node set contains multiple service-providing nodes, and the aforementioned analysis module 904 is specifically used for:

[0224] Obtain the first node affiliation information for each service-providing node in the target node set;

[0225] Determine the first comparison result between the first node affiliation information of each service provider node;

[0226] The set of abnormal nodes is determined from multiple target node sets based on the first distribution characteristics and the first comparison results.

[0227] Furthermore, since there are multiple transaction initiating nodes in the target node set, the aforementioned analysis module 904 is specifically used for:

[0228] Obtain the second node affiliation information for each transaction initiating node in the target node set;

[0229] Determine the second comparison result between the second node attribution information of each transaction initiating node;

[0230] The set of abnormal nodes is determined from multiple target node sets based on the first distribution characteristics and the second comparison results.

[0231] Furthermore, the aforementioned analysis module 904 is specifically used for:

[0232] Based on the transaction records, the fourth transaction volume information of the reference node at each first time point is determined. The reference node is another service provider node in the target node set besides the service provider node, and the node affiliation information of the reference node matches that of the service provider node in the target node set.

[0233] Determine the third distribution characteristic of the fourth transaction volume information in the first time period;

[0234] Determine the feature similarity between the first distribution feature and the third distribution feature, and determine the set of abnormal nodes from multiple target node sets based on the first distribution feature and the feature similarity.

[0235] Furthermore, the aforementioned transaction record acquisition module 901 is specifically used for:

[0236] When a transaction record includes transaction time and transaction amount, for any two transaction initiating nodes that transact with the same service provider node among multiple transaction initiating nodes, determine the time difference of the transaction time and the amount difference of the transaction amount. When the time difference is less than or equal to a preset duration threshold and the amount difference is less than or equal to a preset amount threshold, the corresponding transaction initiating nodes are determined as a similar node pair.

[0237] Alternatively, when the transaction record includes the transaction effective time, transaction amount, and transaction description text, the transaction effective time, transaction amount, and transaction description text are encoded to obtain a first vector corresponding to the transaction effective time, a second vector corresponding to the transaction amount, and a third vector corresponding to the transaction description text. The first vector, second vector, and third vector are concatenated to obtain the target vector. For any two transaction initiating nodes that transact with the same service provider node among multiple transaction initiating nodes, the vector similarity between the target vectors is determined. When the vector similarity is greater than or equal to a preset vector similarity threshold, the corresponding transaction initiating nodes are determined as a similar node pair.

[0238] The aforementioned abnormal node set determination device 900 and abnormal node set determination method are based on the same inventive concept. By determining similar node pairs based on transaction records, and since similar node pairs have similar transaction actions, a target bipartite graph is constructed by using the target frequency of similar transaction actions in similar node pairs as the weight of the edges. This allows the target bipartite graph to carry more information and better reflect the relationship between transaction initiating nodes and service providing nodes in the current transaction network. Furthermore, by performing community partitioning on the target bipartite graph, the nodes in the target node set are found to have close connections. Then, based on the first distribution characteristics of the service providing nodes in the target node set, an abnormal node set is determined from multiple target node sets. This method combines the characteristics of different transaction initiating nodes and service providing nodes to determine the abnormal node set. Compared to methods that only consider the characteristics of the nodes themselves, this method can effectively improve the accuracy of abnormal node determination. In addition, it obtains a set of abnormal nodes rather than a single abnormal node, which can improve the efficiency of abnormal node determination to a certain extent. Furthermore, in this embodiment, abnormal nodes are determined by the first distribution characteristics of service-providing nodes in the target node set. On the one hand, service-providing nodes play a passive role when conducting transactions, which can reduce the imitability of transactions. On the other hand, the first distribution characteristics can accurately reflect the transaction characteristics of service-providing nodes, thereby further improving the accuracy of abnormal node determination.

[0239] The electronic device provided in this application embodiment for executing the above-described method for determining the abnormal node set can be a terminal, as shown below. Figure 10 , Figure 10 This is a partial structural block diagram of a terminal provided in an embodiment of this application. The terminal includes: a radio frequency (RF) circuit 1010, a memory 1020, an input unit 1030, a display unit 1040, a sensor 1050, an audio circuit 1060, a wireless fidelity (WiFi) module 1070, a processor 1080, and a power supply 1090, among other components. Those skilled in the art will understand that... Figure 10 The terminal structure shown does not constitute a limitation on the terminal and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0240] The RF circuit 1010 can be used to receive and transmit signals during information transmission or calls. In particular, it receives downlink information from the base station and processes it with the processor 1080; in addition, it transmits uplink data to the base station.

[0241] The memory 1020 can be used to store software programs and modules. The processor 1080 executes various functional applications and data processing of the terminal by running the software programs and modules stored in the memory 1020.

[0242] The input unit 1030 can be used to receive input numeric or character information, and to generate key signal inputs related to the terminal's settings and function control. Specifically, the input unit 1030 may include a touch panel 1031 and other input devices 1032.

[0243] The display unit 1040 can be used to display input or provided information, as well as various menus of the terminal. The display unit 1040 may include a display panel 1041.

[0244] Audio circuitry 1060, speaker 1061, and microphone 1062 provide an audio interface.

[0245] In this embodiment, the processor 1080 included in the terminal can execute the abnormal node set determination method of the previous embodiment.

[0246] The electronic device provided in this application embodiment for executing the above-described method for determining the set of abnormal nodes can also be a server, see below. Figure 11 , Figure 11The diagram illustrates a partial structural block of a server provided in this application embodiment. The server 1100 can vary significantly due to different configurations or performance characteristics. It may include one or more Central Processing Units (CPUs) 1122 (e.g., one or more processors) and a memory 1132, and one or more storage media 1130 (e.g., one or more mass storage devices) for storing application programs 1142 or data 1144. The memory 1132 and storage media 1130 may be temporary or persistent storage. The program stored in the storage media 1130 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the server 1100. Furthermore, the CPU 1122 may be configured to communicate with the storage media 1130 and execute the series of instruction operations in the storage media 1130 on the server 1100.

[0247] Server 1100 may also include one or more power supplies 1126, one or more wired or wireless network interfaces 1150, one or more input / output interfaces 1158, and / or one or more operating systems 1141, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0248] The processor in server 1100 can be used to execute a method for determining the set of abnormal nodes.

[0249] This application also provides a computer-readable storage medium for storing program code for executing the abnormal node set determination method of the foregoing embodiments.

[0250] This application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. A processor of a computer device reads the computer program from the computer-readable storage medium and executes the computer program, causing the computer device to perform the above-described method for determining the set of abnormal nodes.

[0251] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented, for example, in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatuses.

[0252] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0253] It should be understood that in the description of the embodiments of this application, "multiple" means two or more, "greater than", "less than", "exceeding" etc. are understood to exclude the number itself, and "above", "below", "within" etc. are understood to include the number itself.

[0254] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.

[0255] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0256] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0257] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0258] It should also be understood that the various implementation methods provided in this application can be combined arbitrarily to achieve different technical effects.

[0259] The above provides a detailed description of the preferred embodiments of this application. However, this application is not limited to the above-described embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of this application. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.

Claims

1. A method for determining a set of abnormal nodes, characterized in that, include: Obtain at least one transaction record between each transaction initiating node and its corresponding service providing node, and determine two transaction initiating nodes with similar transaction actions as similar node pairs based on the transaction records; The target frequency of similar transaction actions occurring between similar node pairs is counted. The weight of the edges is determined based on the target frequency. Based on the edges, the similar node pairs are connected to the service provider nodes corresponding to the similar transaction actions to obtain the target bipartite graph. The target bipartite graph is divided into communities to obtain multiple sets of target nodes; Based on the transaction records, determine the first transaction volume information of the service providing nodes in the target node set at each first time point, determine the first distribution characteristics of the first transaction volume information in the first time period corresponding to multiple first time points, and determine the abnormal node set from multiple target node sets based on the first distribution characteristics.

2. The method for determining the set of abnormal nodes according to claim 1, characterized in that, Determining the first distribution characteristic of the first transaction volume information in the first time period corresponding to multiple first time points includes: Generate a target distribution curve of the first transaction volume information in the first time period corresponding to multiple first time points; Data analysis is performed on the target distribution curve to obtain the first distribution characteristics of the first transaction volume information in the first time period.

3. The method for determining the set of abnormal nodes according to claim 2, characterized in that, The step of performing data analysis on the target distribution curve to obtain the first distribution characteristics of the first transaction volume information in the first time period includes: Determine the first difference between the first transaction volume information corresponding to two adjacent first time points in the target distribution curve, determine the target variance of multiple first differences, and use the target variance as the first distribution feature of the first transaction volume information in the first time period. Alternatively, the first time period can be divided into a continuous first time sub-interval and a second time sub-interval. The first peak of the first transaction volume information in the first time sub-interval and the second peak of the first transaction volume information in the second time sub-interval can be determined. The second difference between the first peak and the second peak can be determined, and the second difference can be used as the first distribution feature of the first transaction volume information in the first time period.

4. The method for determining the set of abnormal nodes according to claim 2 or 3, characterized in that, After determining the set of abnormal nodes from the multiple sets of target nodes based on the first distribution feature, the method further includes: Based on the transaction records, determine the second transaction volume information of the service-providing nodes outside the abnormal node set at each of the first time points; Generate a candidate distribution curve of the second transaction volume information in the first time period; Determine the curve similarity between the candidate distribution curve and the target distribution curve, determine the extended distribution curve from the candidate distribution curve based on the curve similarity, and add the service providing node corresponding to the extended distribution curve to the abnormal node set.

5. The method for determining the set of abnormal nodes according to claim 4, characterized in that, Determining the curve similarity between the candidate distribution curve and the target distribution curve includes: Calculate the distance between any point on the candidate distribution curve and each point on the target distribution curve, and construct a distance matrix using the distance values ​​as matrix elements; Using the first vertex of the distance matrix as the starting point and the second vertex of the distance matrix as the ending point, determine the target path with the minimum sum of the matrix elements in the distance matrix, wherein the line connecting the first vertex and the second vertex is the diagonal of the distance matrix; The curve similarity between the candidate distribution curve and the target distribution curve is obtained based on the sum of the matrix elements on the target path.

6. The method for determining the set of abnormal nodes according to claim 4, characterized in that, The step of determining the extended distribution curve from the candidate distribution curves based on the curve similarity includes: When the curve similarity is greater than or equal to a preset curve similarity threshold, the candidate distribution curve is determined as an extended distribution curve; Alternatively, the curve similarity of multiple service-providing nodes outside the target node set can be sorted, and the candidate distribution curves corresponding to the curve similarity ranked before or after a preset ranking threshold can be determined as extended distribution curves.

7. The method for determining the set of abnormal nodes according to claim 1, characterized in that, The process of dividing the target bipartite graph into communities yields multiple sets of target nodes, including: Obtain the preset weight coefficients; In the target bipartite graph, the partition value is calculated as the sum of the path lengths from the first node, through the neighboring nodes of the first node, to the second node, where the first node is one of the transaction initiating nodes and the second node is one of the service providing nodes. The expected value of the sum of path lengths from the first node, through the neighboring nodes, to the second node is calculated based on the weighting coefficients. The target modularity is determined based on the difference between the partition value and the expected value; The target bipartite graph is divided into communities based on the target modularity to obtain multiple target node sets.

8. The method for determining the set of abnormal nodes according to claim 1, characterized in that, The step of identifying two transaction initiating nodes with similar transaction actions as a similar node pair based on the transaction records includes: When the transaction record includes transaction time and transaction amount, for any two transaction initiating nodes that transact with the same service provider node among multiple transaction initiating nodes, the time difference of the transaction time and the amount difference of the transaction amount are determined. When the time difference is less than or equal to a preset duration threshold and the amount difference is less than or equal to a preset amount threshold, the corresponding transaction initiating nodes are determined as a similar node pair. Alternatively, when the transaction record includes a transaction effective time, a transaction amount, and a transaction description text, the transaction effective time, the transaction amount, and the transaction description text are encoded to obtain a first vector corresponding to the transaction effective time, a second vector corresponding to the transaction amount, and a third vector corresponding to the transaction description text. The first vector, the second vector, and the third vector are concatenated to obtain a target vector. For any two transaction initiating nodes that transact with the same service provider node among multiple transaction initiating nodes, the vector similarity between the target vectors is determined. When the vector similarity is greater than or equal to a preset vector similarity threshold, the corresponding transaction initiating nodes are determined as a similar node pair.

9. A device for determining an abnormal node set, characterized in that, include: The transaction record acquisition module is used to acquire at least one transaction record between each transaction initiating node and the corresponding service providing node, and to determine two transaction initiating nodes with similar transaction actions as similar node pairs based on the transaction records. The bipartite graph construction module is used to count the target frequency of similar transaction actions occurring between similar node pairs, determine the weight of the edges based on the target frequency, and connect the similar node pairs to the service provider nodes corresponding to the similar transaction actions based on the edges to obtain the target bipartite graph. The community partitioning module is used to partition the target bipartite graph into communities, resulting in multiple sets of target nodes. The analysis module is used to determine the first transaction volume information of the service providing nodes in the target node set at each first time point based on the transaction records, determine the first distribution characteristics of the first transaction volume information in the first time period corresponding to multiple first time points, and determine the abnormal node set from multiple target node sets based on the first distribution characteristics.

10. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the method for determining the set of abnormal nodes as described in any one of claims 1 to 8.

11. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the method for determining the set of abnormal nodes as described in any one of claims 1 to 8.

12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the method for determining the set of abnormal nodes as described in any one of claims 1 to 8.

Images