Abnormal user identification method and device, computer device and medium

Abstract

The present application relates to the technical field of artificial intelligence, and in particular to an abnormal user identification method and device, computer equipment and medium. The method clusters N user nodes in user node graph data, determines the cluster set with the most user nodes as the first target set, updates the user node graph data with historical abnormal users as new nodes, clusters the obtained updated node graph data, determines the cluster set with the most user nodes as the second target set, calculates the intersection of the first target set and the second target set, deletes the user nodes in the first target set that do not belong to the intersection, clusters the obtained target node graph data, and determines the user nodes in the cluster set with the most user nodes as abnormal users. Precise identification of a large number of similar user nodes, combined with historical abnormal users to adjust the clustering result, improves the coverage and accuracy of abnormal user identification, and improves the reliability and effectiveness of online activities on the financial service platform.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, and in particular to an abnormal user identification method and device, a computer device and a medium. BACKGROUND

[0002] With the rise of artificial intelligence technology, artificial intelligence models have been widely used in financial service platforms, which can be insurance systems, bank systems, transaction systems, order systems, etc. The financial service platform can support functions such as shopping, socializing, interactive games, and resource transfers, and can also have functions such as applying for loans, credit cards, or purchasing insurance, financial products, etc.

[0003] The financial service platform can provide an Internet sales scenario. Typically, the financial service platform will launch some marketing activities, such as lotteries, forwarding, etc., to attract new customers and active customers when selling products, provide activity rewards for customers, and improve customer activity levels.

[0004] However, due to the low cost of participating in marketing activities in the Internet sales scenario, there may be abnormal users who use group control software, Android emulators, fake devices, etc. to maliciously register accounts in bulk and then attack marketing activities through these accounts to steal activity rewards, resulting in poor activity effectiveness. The existing method for identifying such abnormal users typically analyzes user data based on expert experience. However, the existing method has strong subjectivity and limitations, resulting in low accuracy and coverage of abnormal user identification. Therefore, how to improve the accuracy and coverage of abnormal user identification has become a problem to be solved. SUMMARY

[0005] Therefore, the embodiments of the present application provide an abnormal user identification method, device, computer device and medium to solve the problem of low accuracy and coverage of abnormal user identification.

[0006] In a first aspect, the embodiments of the present application provide an abnormal user identification method, which comprises:

[0007] Obtaining user node graph data composed of N user nodes and their corresponding node information, N being a positive integer;

[0008] According to the similarity between the node information, the N user nodes are clustered to obtain at least one initial clustering set, and the initial clustering set with the most user nodes is determined as the first target set;

[0009] The historical abnormal user obtained is taken as a new node, the user information corresponding to the historical abnormal user is taken as node information corresponding to the new node, the user node graph data is updated, updated node graph data is obtained, the updated node graph data is processed by clustering, at least one updated clustering set is obtained, and an updated clustering set with the most user nodes is determined as a second target set;

[0010] An intersection of the first target set and the second target set is calculated, all user nodes in the first target set that do not belong to the intersection are deleted from the user node graph data, and target node graph data is obtained;

[0011] The target node graph data is processed by clustering, at least one target clustering set is obtained, and all user nodes in a target clustering set with the most user nodes are determined as abnormal users.

[0012] In a second aspect, an embodiment of the present application provides an abnormal user identification device, and the identification device comprises:

[0013] A data acquisition module is configured to acquire user node graph data composed of N user nodes and corresponding node information, where N is a positive integer.

[0014] A first clustering module is configured to process the N user nodes by clustering according to the similarity between the node information, obtain at least one initial clustering set, and determine an initial clustering set with the most user nodes as a first target set.

[0015] A second clustering module is configured to take a historical abnormal user obtained as a new node, take user information corresponding to the historical abnormal user as node information corresponding to the new node, update the user node graph data, obtain updated node graph data, process the updated node graph data by clustering, obtain at least one updated clustering set, and determine an updated clustering set with the most user nodes as a second target set.

[0016] A node deletion module is configured to calculate an intersection of the first target set and the second target set, delete all user nodes in the first target set that do not belong to the intersection from the user node graph data, and obtain target node graph data.

[0017] A third clustering module is configured to process the target node graph data by clustering, obtain at least one target clustering set, and determine all user nodes in a target clustering set with the most user nodes as abnormal users.

[0018] In a third aspect, an embodiment of the present application provides a computer device, which comprises a processor, a memory, and a computer program stored in the memory and executable on the processor, and the processor implements the identification method according to the first aspect when executing the computer program.

[0019] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, which stores a computer program, and the computer program implements the identification method according to the first aspect when executed by a processor.

[0020] Compared with the prior art, the embodiment of the present application has the following beneficial effects:

[0021] The N user nodes and the node information corresponding to the N user nodes are obtained to form user node graph data, the N user nodes are clustered according to the similarity between the node information, at least one initial clustering set is obtained, the initial clustering set with the largest number of user nodes is determined as a first target set, the obtained historical abnormal user is taken as a new node, the user information corresponding to the historical abnormal user is taken as the node information corresponding to the new node, the user node graph data is updated to obtain updated node graph data, the updated node graph data is clustered to obtain at least one updated clustering set, the updated clustering set with the largest number of user nodes is determined as a second target set, the intersection of the first target set and the second target set is calculated, all user nodes in the first target set that do not belong to the intersection are deleted from the user node graph data to obtain target node graph data, the target node graph data is clustered to obtain at least one target clustering set, and all user nodes in the target clustering set with the largest number of user nodes are determined as abnormal users. The deep relationship between the user nodes is mined through clustering, a large number of similar user nodes with abnormalities can be accurately and quickly identified, the coverage of abnormal user identification is wide, the clustering result is adjusted in combination with the historical abnormal user, the misidentified user nodes are removed, the accuracy of abnormal user identification is improved, and the reliability and effect of the financial service platform in holding an online activity are improved. BRIEF DESCRIPTION OF DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0023] Figure 1 is an application environment schematic diagram of an abnormal user identification method provided by an embodiment of the present application;

[0024] Figure 2 is a flowchart of an abnormal user identification method provided by an embodiment of the present application;

[0025] Figure 3 is a structural diagram of an abnormal user identification device provided by an embodiment of the present application;

[0026] Figure 4 is a structural diagram of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0027] In the following description, for purposes of explanation and not limitation, specific details are set forth, such as particular sequences of steps, techniques, etc., in order to provide a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application can be practiced in other embodiments that depart from these specific details. In other instances, detailed descriptions of well-known methods, devices, circuits, and

[0028] It should be understood that the term "comprises" when used in this specification and the appended claims specifies the presence of stated features, integers, steps, operations, elements, and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0029] It should also be understood that the term "and / or" when used in this specification and the appended claims, unless otherwise stated, means any one of the associated listed items or a combination of any combination of at least one of the associated listed items.

[0030] As used in this specification and the appended claims, the term "if" can, unless otherwise indicated, be construed to mean "when" or "once" or "in response to determining" or "in response to detecting," rather than to mean "prior to determining" or "prior to detecting." Similarly, the phrase "if determined" or "if detected" can, unless otherwise indicated, be construed to mean "once determined" or "in response to determining" or "once detected" or "in response to detecting."

[0031] In addition, in the description of the present application and the appended claims, the terms "first", "second", "third", etc. are used only to distinguish descriptions, and cannot be understood as indicating or implying relative importance.

[0032] Reference within the specification of this document to "one embodiment" or "some embodiments" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. The appearances of the phrase "in one embodiment" or "in some embodiments" in various places within specified

[0033] The embodiments of the present application can acquire and process related data based on artificial intelligence technology. The artificial intelligence (AI) is to use a digital computer or a machine controlled by a digital computer to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use the knowledge to obtain the best results.

[0034] The basic technology of artificial intelligence generally includes technologies such as sensors, special artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction system, mechatronics, etc. The software technology of artificial intelligence mainly includes computer vision technology, robot technology, biometric technology, speech processing technology, natural language processing technology, and machine learning / deep learning, etc.

[0035] It should be understood that the size of the serial number of each step in the following embodiments does not mean the order of execution, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0036] In order to illustrate the technical solutions of the present application, the following will be explained by specific embodiments.

[0037] The abnormal user identification method provided by the first embodiment of the present application can be applied to, for example, Figure 1The application environment is a client-server communication environment. The client includes, but is not limited to, a palmtop computer, a desktop computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a cloud terminal device, a personal digital assistant (PDA), and the like. The server can be a standalone server or a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0038] The client and the server can be deployed in a financial service platform, which can be an insurance system, a bank system, a transaction system, an order system, and the like. The financial service platform can support functions such as shopping, socializing, interactive gaming, and resource transfer, and can also have functions such as applying for a loan, a credit card, or purchasing insurance, a financial product, and the like. The client can provide an abnormal user identification service to identify users who register accounts in batches by means such as group control software, an Android emulator, and a fake device, thereby improving the reliability and effectiveness of the financial service platform when holding online activities.

[0039] Referring to Figure 2 FIG. 1 is a flowchart of an abnormal user identification method according to an embodiment of the present application. The abnormal user identification method can be applied to a client in a client-server communication environment. The client corresponds to a computer device connected to a server to obtain user node graph data and historical abnormal user information. Figure 1 Figure 2 As shown in FIG. 1, the identification method can include the following steps:

[0040] Step S201: Obtain user node graph data composed of N user nodes and corresponding node information.

[0041] ​The user node corresponds to a to-be-identified user. In this embodiment, the user node can refer to a user registered on a financial service platform. The correspondence can be represented by a node identifier and a user identifier. The node identifier can be used to represent the position of the user node in the user node graph data. The user identifier can be represented by an identity identifier, a user name, or the like. The node information can include network environment, device parameter, registration password, behavior data, and the like collected by an application end. The application end can refer to a user terminal such as a mobile terminal or a computer device. The application end directly transmits the collected data to the service end for storage. The user node graph data can refer to a graph data composed of N user nodes, where N is a positive integer.

[0042] Specifically, the node information can be represented by a 1*M dimensional vector, that is, a vector of one row and M columns. Each column element in the vector corresponds to a type of node information. In this embodiment, the node information can include four types of network environment, device parameter, registration password, and behavior data, that is, the value of M is 4. For any type of node information, an encoding method can be used for representation to facilitate subsequent calculation. For example, the network environment can be represented by a digital IP address or a digital DNS address. The digital IP address can refer to an Internet Protocol address, that is, a unified logical address of the user terminal. The digital DNS address can refer to a domain name system, which is a distributed database for mapping domain names and IP addresses. The device parameter can be represented by a digital code of the number of user terminals. The registration password can be represented by a combination of digital, alphabetical, and symbolic codes. In particular, the behavior data can be obtained by a preset mapping table. The preset mapping table can include a mapping relationship between user behavior and behavior code. The user terminal records the operation data of the user as user behavior, and maps the behavior data to behavior code by the preset mapping table to represent the behavior data.

[0043] The above step of obtaining the user node graph data composed of N user nodes and corresponding node information represents the user to be identified and the user information in the form of graph data, which facilitates subsequent clustering analysis of the graph data, mines deep correlations between user nodes, improves the accuracy of subsequent identification of batch registration of abnormal users, and assigns rich node information to the nodes, which effectively improves the generalization ability of subsequent clustering, adapts to different abnormal user identification scenarios, and thus improves the accuracy and coverage of subsequent abnormal user identification.

[0044] In step S202, the N user nodes are clustered according to the similarity between the node information, to obtain at least one initial clustering set, and the initial clustering set with the largest number of user nodes is determined as the first target set.

[0045] The similarity can be used to represent the difference between the node information, the similarity can be calculated by using the Euclidean distance, cosine similarity and other measurement methods, the clustering method can be mean clustering, density clustering and other clustering methods, the initial clustering set can be the clustering result of clustering the N user nodes, each initial clustering set includes at least one user node, and the first target set can be the initial clustering set with the largest number of user nodes.

[0046] Specifically, the largest number of user nodes can represent that there are batch similar users, and such batch similar users can be registered in batches by abnormal users, and the batch similar users can participate in marketing activities in batches by using a large number of accounts without normal access behavior, so as to steal activity rewards.

[0047] In an embodiment, the first target set can also be determined according to all initial clustering sets, that is, the first target set is selected from the first K initial clustering sets with the largest number of nodes, for example, K can be 5.

[0048] In an embodiment, the first target set can also be determined by setting a node number threshold, for example, the node number threshold is set to 50, and the initial clustering set with a node number greater than the node number threshold is determined as the first target set.

[0049] Optionally, the N user nodes are clustered according to the similarity between the node information, and at least one initial clustering set is obtained.

[0050] For any node information, the intersection-union ratio between the node information and each other node information is calculated, and the intersection-union ratio is used as the similarity between the node information and the other node information.

[0051] Each node information is traversed to obtain the similarity between the node information, and the N user nodes are clustered according to the similarity between the node information, and at least one initial clustering set is obtained.

[0052] The other node information can be node information other than the node information, and the intersection-union ratio can be used to represent the overlap between the node information.

[0053] Specifically, for the node information to be targeted, there are N-1 other node information, and the Jaccard calculation between the node information and each other node information can be a Jaccard calculation between vectors representing the node information, taking the vector corresponding to the node information to be targeted as a first vector and the vector corresponding to any other node information as a second vector, and the first vector and the second vector have the same size, which can be considered to have a corresponding relationship, that is, the first column element of the first vector corresponds to the first column element of the second vector, the second column element of the first vector corresponds to the second column element of the second vector, the third column element of the first vector corresponds to the third column element of the second vector, and the fourth column element of the first vector corresponds to the fourth column element of the second vector. The number of element pairs with consistent comparison results is counted, and is set to C, and then C / M can represent the Jaccard, where M is the total number of elements contained in the vector, which is 4 in this embodiment.

[0054] Generally, the user information of the abnormal batch of registered users is the same, so this embodiment directly counts the number of element pairs with consistent comparison results to obtain the number of intersections. It should be noted that, due to the possibility of multi-user terminal batch registration, the network environment, registration password and other parameters may be slightly different at this time, and therefore, when comparing each pair of elements with a corresponding relationship, the cosine similarity between the element pairs with a corresponding relationship can be calculated, and the sum of the cosine similarities of each element pair is assigned to C, thereby improving the coverage and accuracy of abnormal user identification and avoiding missed judgments.

[0055] In an embodiment, the implementer can assign different weights to elements at different positions in the vector, for example, setting the weight of the behavior data to 2, the weight of the device parameter to 0.5, the weight of the network environment to 1.5, and the weight of the registration password to 1. It should be noted that the sum of the weights should be the same as the value of M.

[0056] In this embodiment, the similarity between the user information is represented by the Jaccard, and the Jaccard is adjusted for the case of multiple user terminals, so that the correlation between the user information can be accurately extracted, missed judgments can be avoided, and the coverage and accuracy of subsequent abnormal user identification are improved.

[0057] Optionally, according to the similarity between the node information, the N user nodes are clustered to obtain at least one initial cluster set, including:

[0058] An initial subset is assigned to each of the N user nodes, and for any user node, the first K other user nodes most similar to the user node are determined as neighbor nodes.

[0059] add the user node to each initial subset corresponding to each neighbor node to obtain K temporary subsets;

[0060] calculate the increment parameter of each temporary subset, and if the maximum increment parameter meets a preset condition, add the user node to the initial subset corresponding to the maximum increment parameter;

[0061] traverse each user node to obtain at least one updated initial subset, and determine at least one initial cluster set according to the at least one updated initial subset.

[0062] The initial subset can refer to a subset to which the user node belongs, and each user node has a corresponding initial subset after distribution. The neighbor node can refer to another user node similar to the user node. The temporary subset can refer to an initial subset to which the user node is added. The increment parameter can refer to the change of the modularization index of the temporary subset.

[0063] Specifically, for the user node, K other user nodes most similar to the user node are determined according to the similarity between the node information, and K can be set to 5 in this embodiment. The implementer can adjust the value of K according to the actual situation.

[0064] Each neighbor node has a corresponding initial subset, that is, K initial subsets, and the user node is added to the K initial subsets respectively to obtain K temporary subsets. At this time, a single temporary subset contains one neighbor node and the user node.

[0065] The preset condition can be used to determine whether the user node is suitable to be added to the initial subset corresponding to the maximum increment parameter. After the user node is added to the initial subset corresponding to the maximum increment parameter, the user node is removed from the initial subset to which the user node belongs before being added. If the initial subset is empty after being removed, the initial subset is also deleted.

[0066] In this embodiment, the initial subset to which the user node can be added is determined according to the similarity between the node information, and the user node is added to the initial subset that can most increase the modularization index, thereby playing a clustering effect. The algorithm time complexity of this kind of way is low, and the clustering division result is stable. Compared with the conventional clustering method, the influence of the hyperparameter on the clustering result is reduced, thereby avoiding misjudgment and improving the accuracy of subsequent abnormal user identification.

[0067] Optionally, after traversing each user node to obtain at least one updated initial subset, the method further comprises:

[0068] traversing each user node, returning to execute the user node is added to each neighbor node corresponding to the initial subset, respectively, to obtain K temporary subsets;

[0069] calculating the increment parameter of each temporary subset, if the largest increment parameter meets the preset condition, the user node is added to the initial subset corresponding to the largest increment parameter, until all initial subsets are no longer updated, to obtain at least one final initial subset;

[0070] Accordingly, according to at least one updated initial subset, determining at least one initial cluster set comprises:

[0071] According to at least one final initial subset, at least one initial cluster set is determined.

[0072] Wherein, the final initial subset can refer to the initial subset finally retained after completing the iteration process.

[0073] Specifically, the iteration process is used to adjust the clustering result. After the jth clustering is completed, the initial subset not containing the user node will be deleted, and the initial subset to which the user node belongs will change. In the j+1th clustering process, the initial subset to which the neighbor node of the same user node belongs may change, so the clustering result will also change. The direction of change is to make the sum of the modularity indexes of all initial subsets obtained by clustering the user node graph data larger and larger, which represents that similar user nodes are clustered into the same initial subset, and dissimilar user nodes are clustered into different initial subsets, thereby completing the clustering purpose.

[0074] In this embodiment, the clustering result is gradually corrected by iteration, so that similar user nodes can be clustered into a class. Such user nodes are the user nodes that may exist in abnormal batch registration, thereby accurately and stably discovering the user nodes that may exist in the user node graph data.

[0075] Optionally, calculating the increment parameter of each temporary subset comprises:

[0076] For any temporary subset, according to the initial subset corresponding to the temporary subset and the preset first modularity function, a first index is calculated;

[0077] According to the temporary subset and the preset second modularity function, a second index is calculated;

[0078] The difference between the first index and the second index is determined as the increment parameter.

[0079] Wherein, the preset first modularity function can be used to calculate the modularity index of the initial subset, that is, the first index, and the preset second modularity function can be used to calculate the modularity index of the temporary subset, that is, the second index.

[0080] Specifically, the calculation function of the first index Q1, i.e., the first modularization function, can be represented as:

[0081]

[0082] wherein ∑ in may represent the sum of the similarities of each pair of user nodes in the initial subset that have a neighbor relationship, ∑ tot may represent the sum of the similarities of each pair of user nodes in the initial subset that have a neighbor relationship, k i may represent the sum of the similarities of each pair of user nodes in the initial subset that have a neighbor relationship, m can represent the sum of the similarities of each pair of user nodes in the user node graph data.

[0083] The calculation function of the second index Q2, i.e., the second modularization function, can be represented as:

[0084]

[0085] wherein k i,in may represent the sum of the similarities of each pair of user nodes in the initial subset that have a neighbor relationship, m can represent the sum of the similarities of each pair of user nodes in the user node graph data.

[0086] The difference between the first index and the second index can mean that the second index is subtracted from the first index, and the incremental parameter ΔQ of the modularization index can be represented as ΔQ = Q2 - Q1.

[0087] In this embodiment, the modularization index is used to quantitatively represent the modularization degree of the temporary subset after adding the user node, so as to measure the modularization degree of the clustering result of the user node graph data, which is beneficial to improve the clustering effect of the user node graph data, thereby improving the accuracy and coverage of subsequent abnormal user identification.

[0088] Optionally, if the maximum incremental parameter satisfies a preset condition, the user node is added to the initial subset corresponding to the maximum incremental parameter, including:

[0089] The maximum incremental parameter and a preset parameter threshold are compared to obtain a comparison result.

[0090] If the comparison result is that the maximum incremental parameter is greater than the parameter threshold, it is determined that the maximum incremental parameter satisfies the preset condition, and the user node is added to the initial subset corresponding to the maximum incremental parameter.

[0091] The preset parameter threshold can be used to measure whether the temporary subset corresponding to the maximum incremental parameter has a modular degree optimization effect, and the comparison result can include two results that the maximum incremental parameter is greater than the parameter threshold and the maximum incremental parameter is not greater than the parameter threshold.

[0092] Specifically, when the maximum incremental parameter is greater than the parameter threshold, it indicates that the update of the temporary subset has a modular degree optimization effect, that is, the effect of making similar user nodes belong to the same subset, and therefore, the user node is added to the initial subset corresponding to the maximum incremental parameter. Correspondingly, when the maximum incremental parameter is not greater than the parameter threshold, it indicates that the update of the temporary subset can make similar user nodes belong to the same subset. In this embodiment, the preset parameter threshold is set to 0.

[0093] In this embodiment, the update effect of the temporary subset is measured by threshold comparison, and the maximum incremental parameter is directly compared with the parameter threshold, the optimal update scheme for the current user node is directly evaluated, the number of comparisons is reduced, the number of iterations caused by updating the user node to the wrong subset is avoided, the clustering effect is improved, and the clustering accuracy is improved.

[0094] The above step of clustering the N user nodes according to the similarity between the node information to obtain at least one initial clustering set and determining the initial clustering set with the largest number of user nodes as the first target set can be applied to different activity scenarios to improve the accuracy and coverage of abnormal user identification.

[0095] In step S203, the obtained historical abnormal user is taken as a new node, the user information corresponding to the historical abnormal user is taken as the node information corresponding to the new node, the user node graph data is updated to obtain updated node graph data, the updated node graph data is clustered to obtain at least one updated clustering set, and the updated clustering set with the largest number of user nodes is determined as the second target set.

[0096] The historical abnormal user can be an abnormal user identified in a historical abnormal identification process, the new node can be a node to be added to the user node graph data, the user information is the same as the node information, and also includes network environment, device parameter, registration password, behavior data, etc., and therefore can be directly used as the node information of the new node. The updated node graph data can be user node graph data containing the new node, and the second target set can be the updated clustering set containing the largest number of user nodes.

[0097] Specifically, the clustering manner of the updated node graph data is consistent with that of the user node graph data, and the second target set has two cases, one of which is that the second target set does not contain the new node, and the other of which is that the second target set contains the new node.

[0098] The above-mentioned history abnormal user is taken as the new node, and the user information corresponding to the history abnormal user is taken as the node information corresponding to the new node. The user node graph data is updated to obtain updated node graph data. The updated node graph data is clustered to obtain at least one updated cluster set. The updated cluster set with the largest number of user nodes is determined as the second target set. The history abnormal user information is additionally added. When the history abnormal user is registered again in batches, the subsequent abnormal user identification can be responded in time. Meanwhile, the misjudged user nodes can be removed according to the characteristics of the history abnormal user, and the accuracy of abnormal user identification is improved.

[0099] In step S204, the intersection of the first target set and the second target set is calculated. All user nodes in the first target set that do not belong to the intersection are deleted from the user node graph data to obtain target node graph data.

[0100] The intersection can include at least one user node, and the target node graph data can refer to the user node graph data after the misjudged user nodes are removed.

[0101] Specifically, the intersection of the first target set and the second target set is calculated only when the second target set contains the new node. At this time, it is indicated that the second target set contains a user node similar to the characteristics of the history abnormal user.

[0102] It should be noted that for the above-mentioned case where there are multiple first target sets, the same number of second target sets are also obtained. When the intersection is calculated subsequently, for any first target set, the intersection is calculated with each second target set containing the new node to obtain at least one intersection. All user nodes in the first target set that do not belong to all intersections are deleted.

[0103] The above-mentioned step of calculating the intersection of the first target set and the second target set and deleting all user nodes in the first target set that do not belong to the intersection from the user node graph data to obtain target node graph data deletes the misjudged user nodes from the user node graph data, thereby avoiding false identification and improving the accuracy of abnormal user identification.

[0104] In step S205, the target node graph data is clustered to obtain at least one target cluster set. All user nodes in the target cluster set with the largest number of user nodes are determined as abnormal users.

[0105] The abnormal user can be a user node that can have abnormal behavior.

[0106] Specifically, when the abnormal user is identified, the implementer needs to further verify to accurately determine the abnormal user. That is, the embodiment plays an auxiliary role in early screening, and the implementer can punish the abnormal user after verification by means of account ban and the like.

[0107] Similarly, a plurality of target cluster sets can be determined for determining the abnormal user. The specific determination manner can refer to the determination manner of the plurality of first target sets.

[0108] Optionally, after the target node graph data is clustered to obtain at least one target cluster set, the method further includes:

[0109] Each target cluster set is taken as a super node, and all super nodes constitute compressed graph data;

[0110] The compressed graph data is clustered to obtain at least one compressed cluster set;

[0111] Correspondingly, determining all user nodes in the target cluster set with the largest number of user nodes as abnormal users includes:

[0112] Determining all user nodes in the compressed cluster set with the largest number of user nodes as abnormal users.

[0113] The super node can be used to represent the target cluster set. When a target cluster set is regarded as a super node, the compressed graph data is graph data composed of all super nodes. The compressed cluster set can be a cluster set obtained by clustering the compressed graph data.

[0114] Specifically, the average of the similarity between each pair of user nodes in the two target cluster sets is taken as the similarity between the two super nodes corresponding to the two target cluster sets.

[0115] It should be noted that the implementer can also use an iterative manner to iteratively cluster the clustering result of the compressed graph data until the compressed cluster set to which each user node belongs is stable.

[0116] In the embodiment, the user node graph data is clustered after graph data compression, so that the embodiment can be applied to a massive user scenario and still accurately identify abnormal users in the massive user scenario, avoid missing abnormal users due to the clustering scale problem, and improve the accuracy and coverage of abnormal user identification.

[0117] The step of performing clustering processing on the target node graph data to obtain at least one target clustering set, and determining all user nodes in the target clustering set with the largest number of user nodes as abnormal users, can effectively improve the accuracy of abnormal user identification.

[0118] In the embodiment, the deep connection between user nodes is mined by clustering, a large number of similar user nodes with abnormalities can be accurately and quickly identified, the coverage of abnormal user identification is wide, the clustering result is adjusted in combination with historical abnormal users, misidentified user nodes are removed, the accuracy of abnormal user identification is improved, and the reliability and effect of online activities of the financial service platform are improved.

[0119] The abnormal user identification method of the embodiment, Figure 3 A structure block diagram of an abnormal user identification device provided by Embodiment Two of the application is shown, the identification device is applied to a client, a computer device corresponding to the client is connected to a server to obtain user node graph data and historical abnormal users and corresponding user information of the historical abnormal users, the user node graph data can be graph data composed of N user nodes that need to be identified for abnormal users, and the historical abnormal users and corresponding user information of the historical abnormal users can be abnormal users and corresponding user information of the abnormal users identified in a historical abnormal user identification process. For the convenience of description, only parts related to the embodiments of the application are shown.

[0120] Referring to Figure 3 The identification device comprises:

[0121] A data acquisition module 31 is configured to acquire user node graph data composed of N user nodes and corresponding node information, N being a positive integer;

[0122] A first clustering module 32 is configured to perform clustering processing on the N user nodes according to the similarity between the node information, to obtain at least one initial clustering set, and to determine an initial clustering set with the largest number of user nodes as a first target set;

[0123] A second clustering module 33 is configured to update the user node graph data by taking the historical abnormal users as new nodes and taking the user information corresponding to the historical abnormal users as node information corresponding to the new nodes, to obtain updated node graph data, and to perform clustering processing on the updated node graph data to obtain at least one updated clustering set, and to determine an updated clustering set with the largest number of user nodes as a second target set;

[0124] A node deletion module 34 is configured to calculate the intersection of the first target set and the second target set, to delete all user nodes in the first target set that do not belong to the intersection from the user node graph data, and to obtain target node graph data.

[0125] The third clustering module 35 is configured to perform clustering processing on the target node graph data to obtain at least one target cluster set, and determine all user nodes in a target cluster set with the largest number of user nodes as abnormal users.

[0126] Optionally, the first clustering module 32 includes:

[0127] The intersection-union ratio calculation sub-module is configured to calculate, for any node information, an intersection-union ratio between the node information and each other node information, and use the intersection-union ratio as a similarity between the corresponding other node information and the node information.

[0128] The information traversal sub-module is configured to traverse each node information to obtain similarities between the node information, and perform clustering processing on the N user nodes according to the similarities between the node information to obtain at least one initial cluster set.

[0129] Optionally, the first clustering module 32 further includes:

[0130] The subset allocation sub-module is configured to allocate an initial subset to each of the N user nodes, and determine, for any user node, the first K other user nodes most similar to the user node as neighbor nodes.

[0131] The temporary addition sub-module is configured to add the user nodes to the initial subsets corresponding to the neighbor nodes respectively to obtain K temporary subsets.

[0132] The parameter calculation sub-module is configured to calculate an incremental parameter of each temporary subset, and add the user nodes to the initial subset corresponding to the largest incremental parameter if the largest incremental parameter satisfies a preset condition.

[0133] The node traversal sub-module is configured to traverse each user node to obtain at least one updated initial subset, and determine at least one initial cluster set according to the at least one updated initial subset.

[0134] Optionally, the first clustering module 32 further includes:

[0135] The iteration execution sub-module is configured to traverse each user node and return to execute the step of adding the user nodes to the initial subsets corresponding to the neighbor nodes respectively to obtain the K temporary subsets.

[0136] The iteration termination sub-module is configured to calculate an incremental parameter of each temporary subset, and add the user nodes to the initial subset corresponding to the largest incremental parameter if the largest incremental parameter satisfies a preset condition, until all the initial subsets are no longer updated to obtain at least one final initial subset.

[0137] Correspondingly, the node traversal submodule includes:

[0138] The set determination unit is configured to determine at least one initial cluster set according to the at least one final initial subset.

[0139] Optionally, the parameter calculation submodule includes:

[0140] The first index calculation unit is configured to calculate a first index according to the initial subset corresponding to the temporary subset and a preset first modular function for any temporary subset.

[0141] The second index calculation unit is configured to calculate a second index according to the temporary subset and a preset second modular function.

[0142] The index difference calculation unit is configured to determine an incremental parameter by subtracting the second index from the first index.

[0143] Optionally, the parameter calculation submodule further includes:

[0144] The parameter comparison unit is configured to compare the largest incremental parameter with a preset parameter threshold to obtain a comparison result.

[0145] The condition determination unit is configured to determine that the largest incremental parameter meets a preset condition if the comparison result is that the largest incremental parameter is greater than the parameter threshold, and add the user node to the initial subset corresponding to the largest incremental parameter.

[0146] Optionally, the identification device further includes:

[0147] The set compression module is configured to take each target cluster set as a super node to form a compressed graph data by all super nodes.

[0148] The compressed data clustering module is configured to perform clustering processing on the compressed graph data to obtain at least one compressed cluster set.

[0149] Correspondingly, the third clustering module 35 includes:

[0150] The anomaly determination submodule is configured to determine all user nodes in the compressed cluster set with the largest number of user nodes as abnormal users.

[0151] It should be noted that the information interaction, execution process and the like between the above modules, submodules and units are based on the same concept as the method embodiments of the present application, and the specific functions and technical effects brought by them can be referred to the method embodiments part, which will not be described here.

[0152] Figure 4 A structural schematic diagram of a computer device provided for the third embodiment of the present application is shown in FIG. 3. Figure 4As shown, the computer device of this embodiment includes: at least one processor ( Figure 4 Only one is shown in the diagram), a memory, and a computer program stored in the memory and executable on at least one processor, which, when executed by the processor, implements the steps in any of the above-described identification method embodiments.

[0153] This computer device may include, but is not limited to, a processor and memory. Those skilled in the art will understand that... Figure 4 The examples of computer devices are merely examples and do not constitute a limitation on computer devices. Computer devices may include more or fewer components than shown in the illustration, or combinations of certain components, or different components, such as network interfaces, displays, and input devices.

[0154] The processor referred to can be a CPU, but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0155] Memory includes readable storage media, internal memory, etc., wherein internal memory can be the RAM of a computer device, providing an environment for the operation of the operating system and computer-readable instructions stored in the readable storage media. The readable storage media can be the hard drive of a computer device, or in other embodiments, it can be an external storage device of the computer device, such as a plug-in hard drive, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card. Furthermore, memory can include both internal storage units and external storage devices of a computer device. Memory is used to store the operating system, applications, bootloader, data, and other programs, such as program code for computer programs. Memory can also be used to temporarily store data that has been output or will be output.

[0156] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above-mentioned division of each functional unit and module is exemplified, and in actual application, the above-mentioned functions can be completed by different functional units and modules according to needs, that is, the internal structure of the device is divided into different functional units or modules to complete all or part of the above-described functions. Each functional unit and module in the embodiment can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of software functional unit. In addition, the specific names of each functional unit and module are only for easy distinction, and do not limit the protection scope of the present application. The specific working process of the unit and module in the above device can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here. If the integrated unit is realized in the form of software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the present application realizes all or part of the processes in the above-mentioned embodiment methods, which can be completed by a computer program to instruct related hardware. The computer program can be stored in a computer readable storage medium, and when the processor executes the computer program, the steps of the above-mentioned method embodiment can be realized. The computer program includes computer program code, which can be in the form of source code, object code, executable file or some intermediate form, etc. The computer readable medium can at least include any entity or device capable of carrying computer program code, recording medium, computer memory, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), electrical carrier signal, telecommunication signal and software distribution medium. For example, U disk, mobile hard disk, magnetic disk or optical disk, etc. In some jurisdictions, according to legislation and patent practice, the computer readable medium cannot be an electrical carrier signal and a telecommunication signal.

[0157] The present application realizes all or part of the processes in the above-mentioned embodiment methods, which can also be completed by a computer program product. When the computer program product runs on the computer device, it makes the computer device execute the steps in the above-mentioned method embodiment.

[0158] In the above-mentioned embodiments, the description of each embodiment has its own emphasis, and the parts not described or recorded in detail in a certain embodiment can be referred to the relevant description of other embodiments.

[0159] Those skilled in the art can understand that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized in electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0160] In the embodiments provided by the present application, it should be understood that the disclosed apparatus / computer device and method can be implemented in other manners. For example, the described apparatus / computer device embodiments are merely schematic. For example, the division of the modules or units can be different, and each can include a plurality of sub-units. Some or all of the modules or units can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms.

[0161] The units described as separated components can or can not be physically separated, and the components displayed as units can or can not be physical units, i.e. can be located in one place, or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purposes of the embodiments of the present application.

[0162] The above embodiments are only used to illustrate the technical solutions of the present application, rather than limit them. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalent ones. Such modifications or replacements do not make the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A method of identifying an abnormal user, characterized by, The identification method comprises: obtaining user node graph data composed of N user nodes and corresponding node information, N being a positive integer; performing clustering processing on the N user nodes according to the similarity between the node information, to obtain at least one initial clustering set, and determining an initial clustering set with the largest number of user nodes as a first target set; the clustering process of the initial clustering set specifically comprises allocating an initial subset to each of the N user nodes, and determining, for any user node, the first K other user nodes most similar to the user node as neighbor nodes; adding the user node to the initial subset corresponding to each neighbor node to obtain K temporary subsets; calculating the increment parameter of each temporary subset, and if the largest increment parameter meets a preset condition, adding the user node to the initial subset corresponding to the largest increment parameter; traversing each user node to obtain at least one updated initial subset, and determining the at least one initial clustering set according to the at least one updated initial subset; updating the user node graph data by taking the obtained historical abnormal user as a new node and taking the user information corresponding to the historical abnormal user as the node information corresponding to the new node, obtaining updated node graph data, performing clustering processing on the updated node graph data to obtain at least one updated clustering set, and determining an updated clustering set with the largest number of user nodes as a second target set; calculating the intersection of the first target set and the second target set, deleting all user nodes in the first target set that do not belong to the intersection from the user node graph data to obtain target node graph data; performing clustering processing on the target node graph data to obtain at least one target clustering set, and determining all user nodes in a target clustering set with the largest number of user nodes as abnormal users.

2. The identification method according to claim 1, characterized in that, The clustering processing on the N user nodes according to the similarity between the node information comprises: for any node information, calculating the intersection-union ratio between the node information and each other node information, and taking the intersection-union ratio as the similarity between the corresponding other node information and the node information; traversing each node information to obtain the similarity between the node information, and performing clustering processing on the N user nodes according to the similarity between the node information to obtain at least one initial clustering set.

3. The identification method according to claim 1, characterized in that, After traversing each user node to obtain at least one updated initial subset, the method further comprises: traversing each user node to return to the step of adding the user node to the initial subset corresponding to each neighbor node to obtain K temporary subsets; calculating the increment parameter of each temporary subset, and if the largest increment parameter meets a preset condition, adding the user node to the initial subset corresponding to the largest increment parameter until all initial subsets are no longer updated to obtain at least one final initial subset; correspondingly, the determination of the at least one initial clustering set according to the at least one updated initial subset comprises: determining the at least one initial cluster set according to the at least one final initial subset.

4. The identification method according to claim 1, characterized in that, The calculating the increment parameter of each temporary subset comprises: for any temporary subset, calculating a first index according to the initial subset corresponding to the temporary subset and a preset first modular function; calculating a second index according to the temporary subset and a preset second modular function; determining a difference result by subtracting the first index from the second index as the increment parameter.

5. The identification method according to claim 1, characterized in that, The adding the user node into the initial subset corresponding to the maximum increment parameter comprises: comparing the maximum increment parameter with a preset parameter threshold to obtain a comparison result; if the comparison result is that the maximum increment parameter is greater than the parameter threshold, it is determined that the maximum increment parameter meets the preset condition, and the user node is added into the initial subset corresponding to the maximum increment parameter.

6. The identification method according to any one of claims 1 to 5, characterized in that, After the clustering processing of the target node graph data is performed to obtain at least one target cluster set, the method further comprises: respectively taking each target cluster set as a super node, and constructing compressed graph data by all super nodes; performing clustering processing on the compressed graph data to obtain at least one compressed cluster set; correspondingly, the determining all user nodes in the compressed cluster set with the maximum number of user nodes as the abnormal user comprises: determining all user nodes in the compressed cluster set with the maximum number of user nodes as the abnormal user.

7. An abnormal user identifying apparatus characterized by comprising: The identification device comprises: a data acquisition module configured to acquire user node graph data composed of N user nodes and corresponding node information, N being a positive integer; a first clustering module configured to perform clustering processing on the N user nodes according to the similarity between the node information to obtain at least one initial cluster set, and determine an initial cluster set with the maximum number of user nodes as a first target set; the clustering process of the initial cluster set comprises: allocating an initial subset to each of the N user nodes, and determining the first K other user nodes most similar to any user node as neighbor nodes for the user node; adding the user node into the initial subset corresponding to each neighbor node to obtain K temporary subsets; calculating the increment parameter of each temporary subset, and adding the user node into the initial subset corresponding to the maximum increment parameter if the maximum increment parameter meets a preset condition; iterating through each user node to obtain at least one updated initial subset, and determining the at least one initial cluster set according to the at least one updated initial subset; a second clustering module configured to take a historical abnormal user as a new node, take user information corresponding to the historical abnormal user as node information corresponding to the new node, update the user node graph data to obtain updated node graph data, perform clustering processing on the updated node graph data to obtain at least one updated cluster set, and determine an updated cluster set with the maximum number of user nodes as a second target set; a node deleting module, configured to calculate an intersection of the first target set and the second target set, delete all user nodes in the first target set that do not belong to the intersection from the user node graph data, and obtain target node graph data; a third clustering module, configured to perform clustering processing on the target node graph data, and obtain at least one target cluster set; all user nodes in a target cluster set with the largest number of user nodes are determined as abnormal users.

8. A computer device, comprising: The computer device comprises a processor, a memory, and a computer program stored in the memory and executable on the processor, and the processor implements the identification method of any one of claims 1 to 6 when executing the computer program.

9. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 8. The computer program is executable on the processor to implement the identification method of any one of claims 1 to 6.

Images