Abnormal data identification method

Abstract

The present application relates to the field of abnormal identification technology, and provides an abnormal data identification method. The method includes: constructing a supplier relationship graph and an address relationship graph according to the bidding supplier ID and the bidding device MAC address in each bidding record; performing random walks in the supplier relationship graph and the address relationship graph with multiple steps to obtain a supplier low-dimensional embedding vector and an address low-dimensional embedding vector; splicing each supplier low-dimensional embedding vector, each address low-dimensional embedding vector and the preset feature data within the preset time window into the original bidding record to obtain an extended bidding record; according to the similarity between each target extended bidding record, identify whether each target extended bidding record is abnormal. The present application adopts a machine recognition method to avoid the decrease in recognition efficiency and accuracy caused by manual auditing, and at the same time analyzes the existing historical bidding information and current bidding information to further improve the accuracy of abnormal data recognition.

Description

Technical Field

[0001] The present application relates to the field of abnormality identification technology, and in particular to a method for identifying abnormal data. Background Art

[0002] During the government and enterprise bidding process, some suppliers may engage in illegal activities such as bid rigging and collusion in order to increase their chances of winning the bid.

[0003] However, government and enterprises usually rely on manual audits to analyze bidding information to identify abnormal data. The recognition efficiency and accuracy of this method are relatively low, and it only analyzes bidding information within the current audit cycle, ignoring the analysis of a large amount of existing historical bidding information in the bidding system, resulting in a further decrease in recognition accuracy. Summary of the invention

[0004] The embodiment of the present application provides a method for identifying abnormal data to solve the technical problem that the current government and enterprises usually rely on manual auditing to analyze bidding information, and only analyze the bidding information within the current audit cycle, ignoring the analysis of a large amount of historical bidding information that already exists in the bidding system, resulting in low efficiency and accuracy in identifying abnormal bidding data.

[0005] In a first aspect, an embodiment of the present application provides a method for identifying abnormal data, comprising:

[0006] Collect bidding records containing first preset characteristic data in the bidding system; the first preset characteristic data includes the bidding supplier ID and the bidding device MAC address;

[0007] A relationship graph is constructed based on the bidding supplier ID and the bidding device MAC address in each bidding record, and a supplier relationship graph with the bidding supplier ID as a node and an address relationship graph with the bidding device MAC address as a node are obtained;

[0008] Performing random walks in the supplier relationship graph and the address relationship graph with multiple steps respectively, to obtain supplier random walk sequences corresponding to the IDs of each bidding supplier in the supplier relationship graph and address random walk sequences corresponding to the MAC addresses of each bidding device in the address relationship graph;

[0009] According to the random walk sequence of each supplier and the random walk sequence of each address, the supplier low-dimensional embedding vector and the address low-dimensional embedding vector are obtained respectively;

[0010] Concatenate the low-dimensional embedding vector of each supplier, the low-dimensional embedding vector of each address, and the second preset feature data within the preset time window with the corresponding first preset feature data to obtain an extended bidding record;

[0011] According to the similarity between the target extension bidding records, identifying whether each target extension bidding record is abnormal;

[0012] The target extended bidding record is a bidding record obtained by performing data preprocessing on the extended bidding record.

[0013] In one embodiment, the step of identifying whether each target extended bidding record is abnormal based on the similarity between each target extended bidding record includes:

[0014] Calculate the similarity between each target extended bidding record according to a similarity algorithm;

[0015] If the similarity between any two target extended bidding records in each target extended bidding record is greater than the similarity threshold, it is determined that the any two target extended bidding records are abnormal;

[0016] If the similarity between any two target extended bidding records in each target extended bidding record is less than or equal to the similarity threshold, the any two target extended bidding records are added as samples to the sample set;

[0017] Inputting the sample set into an abnormal data recognition model to obtain the sample abnormality probability output by the abnormal data recognition model;

[0018] If the sample abnormality probability is greater than the probability threshold, determining that the target extended bidding record corresponding to the sample abnormality probability is abnormal;

[0019] The abnormal data recognition model is trained based on any classification model according to historical target extended bidding records and their corresponding classification labels.

[0020] In one embodiment, the relationship graph is constructed according to the bidding supplier ID and the bidding device MAC address in each bidding record to obtain a supplier relationship graph with the bidding supplier ID as a node and an address relationship graph with the bidding device MAC address as a node, including:

[0021] Taking each bidding supplier ID as a node, if any two bidding supplier IDs have the same bidding device MAC address in their respective bidding records, then an associated edge and edge weight are constructed between the nodes corresponding to the any two bidding supplier IDs to obtain a supplier relationship graph with the bidding supplier ID as a node;

[0022] Taking the MAC address of each bidding device as a node, if any two bidding device MAC addresses have the same bidding supplier ID in their respective bidding records, then an associated edge and edge weight are constructed between the nodes corresponding to the any two bidding device MAC addresses to obtain an address relationship graph with the bidding device MAC addresses as nodes.

[0023] In one embodiment, obtaining a supplier low-dimensional embedding vector according to the random walk sequence of each supplier includes:

[0024] According to multiple supplier random walk sequences of any node in the supplier relationship graph at multiple step sizes, a loss function of any node on each supplier random walk sequence is obtained;

[0025] Perform a weighted summation on each loss function to obtain a joint loss function of any node on the random walk sequence of each supplier;

[0026] Multiply the joint loss functions of each node to obtain the first objective loss function;

[0027] If the value of the first objective loss function is greater than or equal to the first loss threshold, the first objective loss function is recalculated after adjusting each node until the value of the recalculated first objective loss function is less than the first loss threshold, and the vector representation of each node in the first objective loss function at this time is determined as the supplier low-dimensional embedding vector.

[0028] In one embodiment, obtaining a low-dimensional embedding vector of an address according to a random walk sequence of each address includes:

[0029] According to multiple address random walk sequences of any node in the address relationship graph at multiple step sizes, a loss function of any node on each address random walk sequence is obtained;

[0030] Perform a weighted summation on each loss function to obtain a joint loss function of any node on each address random walk sequence;

[0031] Multiply the joint loss function of each node to obtain the second objective loss function;

[0032] If the value of the second objective loss function is greater than or equal to the second loss threshold, the second objective loss function is recalculated after adjusting each node until the value of the recalculated second objective loss function is less than the second loss threshold, and the vector representation of each node in the second objective loss function at this time is determined as the address low-dimensional embedding vector.

[0033] In one embodiment, the step of concatenating the low-dimensional embedding vectors of each supplier, the low-dimensional embedding vectors of each address, and the second preset feature data within the preset time window with the corresponding first preset feature data to obtain an extended bidding record includes:

[0034] Calculate the cumulative value and / or average value of the target bidding characteristic data within the preset time window according to the bidding supplier ID and the bidding device MAC address respectively, to obtain the second preset characteristic data;

[0035] The low-dimensional embedding vectors of each supplier, the low-dimensional embedding vectors of each address and the second preset feature data are concatenated with the corresponding first preset feature data to obtain an extended bidding record.

[0036] In one embodiment, the target extended bidding record is obtained through the following preprocessing:

[0037] If the missing value ratio of any preset characteristic data in each extended bidding record exceeds a preset percentage or the variance is equal to a preset variance, the preset characteristic data is deleted to obtain a first extended bidding record;

[0038] If in each first extended bidding record, any numerical preset characteristic data is less than a preset minimum threshold or greater than a preset maximum threshold, the numerical preset characteristic data is deleted to obtain a second extended bidding record; the preset minimum threshold and the preset maximum threshold are determined based on the lower quartile and the upper quartile of the numerical preset characteristic data;

[0039] Perform linear interpolation filling on the missing values ​​of the numerical type in each second extended bidding record, and perform new filling on the missing values ​​of the non-numerical type in each second extended bidding record, to obtain a third extended bidding record;

[0040] If the number of unique values ​​of any non-numeric preset feature data in each third extended bidding record is less than or equal to the quantity threshold, the non-numeric preset feature data is encoded using a one-hot encoding method; if the number of unique values ​​of any non-numeric preset feature data in each third extended bidding record is greater than the quantity threshold, the non-numeric preset feature data is encoded using a label encoding method to obtain the target extended bidding record.

[0041] In a second aspect, an embodiment of the present application provides an abnormal data identification device, comprising:

[0042] The data collection module is used to collect bidding records containing first preset characteristic data in the bidding system; the first preset characteristic data includes the bidding supplier ID and the bidding device MAC address;

[0043] A relationship graph construction module is used to: construct a relationship graph according to the bidding supplier ID and the bidding device MAC address in each bidding record, and obtain a supplier relationship graph with the bidding supplier ID as a node and an address relationship graph with the bidding device MAC address as a node;

[0044] A random walk module is used to: perform random walks in the supplier relationship graph and the address relationship graph with multiple steps respectively, to obtain a supplier random walk sequence corresponding to each bidding supplier ID in the supplier relationship graph and an address random walk sequence corresponding to each bidding device MAC address in the address relationship graph;

[0045] A low-dimensional vector acquisition module is used to obtain a supplier low-dimensional embedding vector and an address low-dimensional embedding vector according to the random walk sequence of each supplier and the random walk sequence of each address respectively;

[0046] A data concatenation module is used to concatenate the low-dimensional embedding vectors of each supplier, the low-dimensional embedding vectors of each address, and the second preset feature data within the preset time window with the corresponding first preset feature data to obtain an extended bidding record;

[0047] The abnormal data identification module is used to: identify whether each target extension bidding record is abnormal according to the similarity between each target extension bidding record;

[0048] The target extended bidding record is a bidding record obtained by performing data preprocessing on the extended bidding record.

[0049] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory storing a computer program, wherein when the processor executes the program, the steps of the abnormal data identification method described in the first aspect are implemented.

[0050] In a fourth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the abnormal data identification method described in the first aspect.

[0051] The abnormal data identification method provided in the present application collects bidding records containing first preset feature data in a bidding system, the first preset feature data includes a bidding supplier ID and a bidding device MAC address, constructs a relationship graph according to the bidding supplier ID and the bidding device MAC address in each bidding record, obtains a supplier relationship graph with the bidding supplier ID as a node and an address relationship graph with the bidding device MAC address as a node, performs random walks in the supplier relationship graph and the address relationship graph with multiple steps, obtains a supplier random walk sequence corresponding to each bidding supplier ID in the supplier relationship graph and an address random walk sequence corresponding to each bidding device MAC address in the address relationship graph, obtains a supplier low-dimensional embedding vector and an address low-dimensional embedding vector according to each supplier random walk sequence and each address random walk sequence, concatenates each supplier low-dimensional embedding vector, each address low-dimensional embedding vector and the second preset feature data within a preset time window with the corresponding first preset feature data, obtains an extended bidding record, and identifies whether each target extended bidding record is abnormal according to the similarity between each target extended bidding record. On the one hand, this application adopts machine recognition to avoid the decline in recognition efficiency and accuracy caused by manual auditing; on the other hand, this application collects all eligible bidding records in the bidding system, and analyzes the existing historical bidding information and current bidding information at the same time, and fully mines and expands the characteristics of each bidding information through relationship graphs, random walk sequences and data splicing, and finally uses similarity to identify abnormal data, thereby further improving the accuracy of abnormal data recognition. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the present application or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0053] Figure 1 This is one of the flow charts of the abnormal data identification method provided in the embodiment of the present application;

[0054] Figure 2 is a supplier relationship diagram of the abnormal data identification method provided in an embodiment of the present application;

[0055] Figure 3 is an address relationship diagram of the abnormal data identification method provided in an embodiment of the present application;

[0056] Figure 4 This is the second flow chart of the abnormal data identification method provided in the embodiment of the present application;

[0057] Figure 5This is the third flow chart of the abnormal data identification method provided in the embodiment of the present application;

[0058] Figure 6 This is the fourth flow chart of the abnormal data identification method provided in the embodiment of the present application;

[0059] Figure 7 This is the fifth flow chart of the abnormal data identification method provided in the embodiment of the present application;

[0060] Figure 8 is a structural diagram of an abnormal data identification device provided in an embodiment of the present application;

[0061] Fig. 9 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0063] It should be noted that in the description of the embodiments of the present application, the terms "include", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or device including the elements. The orientation or position relationship indicated by the terms "upper", "lower" and the like is based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present application and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present application. Unless otherwise clearly specified and limited, the terms "installed", "connected" and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be directly connected, or indirectly connected through an intermediate medium, or it can be a connection between the two elements. For those skilled in the art, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0064] The terms "first", "second", etc. in this application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0065] Figure 1 This is one of the flow charts of the abnormal data identification method provided in the embodiment of the present application;

[0066] Figure 2 is a supplier relationship diagram of the abnormal data identification method provided in an embodiment of the present application;

[0067] Figure 3 It is an address relationship diagram of the abnormal data identification method provided in the embodiment of the present application.

[0068] Reference Figure 1 , the embodiment of the present application provides a method for identifying abnormal data, which may include:

[0069] 101. Collect bidding records containing first preset characteristic data in the bidding system;

[0070] The first preset characteristic data includes the bidding supplier ID and the bidding device MAC address;

[0071] 102. Construct a relationship graph based on the bidding supplier ID and the bidding device MAC address in each bidding record to obtain a supplier relationship graph with the bidding supplier ID as a node and an address relationship graph with the bidding device MAC address as a node;

[0072] 103. Perform random walks in the supplier relationship graph and the address relationship graph with multiple steps to obtain a supplier random walk sequence corresponding to each bidding supplier ID in the supplier relationship graph and an address random walk sequence corresponding to each bidding device MAC address in the address relationship graph;

[0073] 104. Obtain a supplier low-dimensional embedding vector and an address low-dimensional embedding vector according to the random walk sequence of each supplier and the random walk sequence of each address respectively;

[0074] 105. Concatenate the low-dimensional embedding vectors of each supplier, the low-dimensional embedding vectors of each address, and the second preset feature data within the preset time window with the corresponding first preset feature data to obtain an extended bidding record;

[0075] 106. Identify whether each target extension bidding record is abnormal based on the similarity between the target extension bidding records.

[0076] The target extended bidding record is a bidding record obtained by performing data preprocessing on the extended bidding record.

[0077] In step 101, any bidding record It can be expressed as:

[0078] ;

[0079] Any bidding record Included The first preset characteristic data includes the bidding supplier ID and the bidding device MAC address, and may also include the bidding time, bidding amount, whether the bid is successful, etc. It can be the bidding supplier ID, i.e. , It can be the MAC address of the bidding device, i.e. .

[0080] In step 102, refer to Figure 2 , each bidding supplier ID can be used as a node. If any two bidding supplier IDs have the same bidding device MAC address in the bidding record, then an associated edge and edge weight are constructed between the nodes corresponding to the any two bidding supplier IDs to obtain a supplier relationship graph with the bidding supplier ID as a node;

[0081] Similarly, refer to Figure 3 , the MAC address of each bidding device can be used as a node. If any two bidding device MAC addresses have the same bidding supplier ID in their respective bidding records, then an associated edge and edge weight are constructed between the nodes corresponding to the any two bidding device MAC addresses to obtain an address relationship graph with the bidding device MAC addresses as nodes.

[0082] It should be noted that there is no time sequence restriction in constructing the supplier relationship graph and the address relationship graph.

[0083] In step 103, multiple step sizes can be selected according to actual needs, and are not limited here. In this embodiment, step sizes 1, 2, and 3 can be selected for random walks, that is, Figure 2 Any node As the starting node, random walks are performed with step sizes of 1, 2, and 3 respectively, and we get The supplier random walk sequences corresponding to step sizes 1, 2, and 3 respectively are:

[0084] ;

[0085] ;

[0086] ;

[0087] in, yes Corresponding to the supplier random walk sequence with step size 1, there are subsequences, representing Start with 1 step to reach Node Walking paths; yes Corresponding to the supplier random walk sequence with step size 2, there are subsequences, representing After 2 steps, you can reach Node Walking paths; yes Corresponding to the supplier random walk sequence with step length 3, there are subsequences, representing After 3 steps, you can reach Node A walking path.

[0088] Similarly, you can Figure 3 Any node As the starting node, random walks are performed with step sizes of 1, 2, and 3 respectively, and we get The address random walk sequences corresponding to step sizes 1, 2, and 3 are not described here.

[0089] It should be noted that there is no time order restriction for performing random walks in the supplier relationship graph and performing random walks in the address relationship graph.

[0090] In step 104, supplier nodes with strong correlation based on the same important MAC address can be screened out according to the supplier random walk sequence corresponding to step sizes 1, 2, and 3 of each supplier node, and low-dimensional embedding vectors of these supplier nodes can be obtained; similarly, MAC address nodes with strong correlation based on the same important supplier can be screened out according to the address random walk sequence corresponding to step sizes 1, 2, and 3 of each MAC address node, and low-dimensional embedding vectors of these MAC address nodes can be obtained.

[0091] It should be noted that the process of obtaining the supplier low-dimensional embedding vector and the address low-dimensional embedding vector is not restricted by time sequence.

[0092] In step 105, The low-dimensional embedding vector of the supplier, The address low-dimensional embedding vector and the second preset feature data within the preset time window are added to In, get Extended bidding record.

[0093] In step 106, after data preprocessing is performed on each extended bidding record, a target extended bidding record is obtained, and abnormal records are identified based on the similarity between the target extended bidding records.

[0094] Since the supplier relationship graph is constructed with the bidding supplier ID as the node and the common bidding device MAC address as the edge, and the edge weight is set, and the address relationship graph is constructed with the bidding device MAC address as the node and the common bidding supplier ID as the edge, and the edge weight is set, the relationship between supplier IDs based on the common important MAC address and the relationship between MAC addresses based on the common important supplier ID can be mined respectively through weighted random walks, and by setting different step sizes, rather than just 1 step size, the relationship between non-adjacent but close supplier IDs based on the common important MAC address and the relationship between MAC addresses based on the common important supplier ID can be mined in addition to adjacent supplier IDs and adjacent MAC addresses, so that the relationship between each supplier ID and each MAC address can be more fully mined, and the supplier low-dimensional embedding vector and the address low-dimensional embedding vector are obtained, wherein the supplier low-dimensional embedding vector is used as a behavior label for the corresponding supplier to share an important MAC address with other suppliers, and the address low-dimensional embedding vector is used as a behavior label for the corresponding MAC address and other MAC addresses to be used by the same important supplier. Both of these behavior labels indicate potential anomalies in the corresponding spliced ​​extended bidding records.

[0095] The abnormal data identification method provided in the present embodiment collects bidding records containing first preset feature data in a bidding system, wherein the first preset feature data includes a bidding supplier ID and a bidding device MAC address, constructs a relationship graph according to the bidding supplier ID and the bidding device MAC address in each bidding record, obtains a supplier relationship graph with the bidding supplier ID as a node and an address relationship graph with the bidding device MAC address as a node, performs random walks in the supplier relationship graph and the address relationship graph with multiple steps, respectively, obtains a supplier random walk sequence corresponding to each bidding supplier ID in the supplier relationship graph and an address random walk sequence corresponding to each bidding device MAC address in the address relationship graph, obtains a supplier low-dimensional embedding vector and an address low-dimensional embedding vector according to each supplier random walk sequence and each address random walk sequence, concatenates each supplier low-dimensional embedding vector, each address low-dimensional embedding vector and the second preset feature data within a preset time window with the corresponding first preset feature data, obtains an extended bidding record, and identifies whether each target extended bidding record is abnormal according to the similarity between each target extended bidding record. On the one hand, this embodiment adopts machine recognition to avoid the decrease in recognition efficiency and accuracy caused by manual auditing; on the other hand, this embodiment collects all qualified bidding records in the bidding system, and analyzes the existing historical bidding information and current bidding information at the same time, and fully mines and expands the characteristics of each bidding information through relationship graphs, random walk sequences and data splicing, and finally uses similarity to identify abnormal data, thereby further improving the accuracy of abnormal data recognition.

[0096] Figure 4 This is the second flow chart of the abnormal data identification method provided in the embodiment of the present application; Figure 4 In one embodiment, identifying whether each target extended bidding record is abnormal based on the similarity between each target extended bidding record may include:

[0097] 401. Calculate the similarity between each target extended bidding record according to a similarity algorithm;

[0098] 402. If the similarity between any two target extension bidding records in each target extension bidding record is greater than the similarity threshold, it is determined that the any two target extension bidding records are abnormal;

[0099] 403. If the similarity between any two target extended bidding records in each target extended bidding record is less than or equal to the similarity threshold, then the any two target extended bidding records are added as samples to the sample set;

[0100] 404. Input the sample set into the abnormal data recognition model to obtain the sample abnormality probability output by the abnormal data recognition model;

[0101] 405. If the sample abnormality probability is greater than the probability threshold, then determining that the target extended bidding record corresponding to the sample abnormality probability is abnormal.

[0102] The abnormal data recognition model is trained based on any classification model by expanding the bidding records and their corresponding classification labels according to historical targets.

[0103] In step 401, any similarity algorithm can be used to calculate the similarity between two target extension bid records, which is not limited here. Since any target extension bid record includes not only the first preset feature data, but also the spliced ​​supplier low-dimensional embedding vector, the address low-dimensional embedding vector and the second preset feature data within the preset time window, when performing similarity calculation, the similarity calculation can be performed on the corresponding feature data in the two target extension bid records, and then the similarities of each corresponding feature data are comprehensively calculated to obtain the overall similarity of the two target extension bid records. Although each low-dimensional embedding vector represents the potential anomaly of the target extension record, it cannot be used alone to determine the abnormality of the target extension record. Therefore, it is also necessary to perform similarity calculation on the data in the target extension record as a whole to achieve a more accurate recognition effect.

[0104] In step 402, if the similarity between any two target extended bidding records in each target extended bidding record is greater than the similarity threshold, it means that these two target extended bidding records not only have behavior labels representing potential anomalies, but also have high similarity as a whole, and it is very likely that there are illegal behaviors such as collusion in bidding. Therefore, it can be determined that these two target extended bidding records are abnormal;

[0105] In step 403, if the similarity between any two target extension bid records in each target extension bid record is less than or equal to the similarity threshold, it means that the potential anomaly has not been further confirmed by the overall similarity, but it does not mean that these two target extension bid records are definitely normal. In order to avoid missed detection of anomaly identification caused by errors in the similarity algorithm, further model testing is required for the target extension bid records that pass the similarity test.

[0106] In step 404 to step 405, abnormal data recognition can have better abnormal data recognition performance than the similarity algorithm due to a large amount of training with historical target extension bidding records and their corresponding classification labels. Therefore, by using this model to re-identify the target extension bidding records that have passed the similarity test, abnormal target extension bidding records that have not been identified by the similarity algorithm can be identified, thereby further improving the recognition accuracy.

[0107] This embodiment first confirms whether the target extension bid record with potential abnormality is abnormal through a similarity algorithm, and further uses an abnormal data recognition model to re-identify the target extension bid record that has passed the similarity algorithm test. It can accurately identify the abnormal target extension bid record that is missed by the similarity algorithm, and further improve the accuracy of abnormal data recognition.

[0108] Figure 5 This is the third flow chart of the abnormal data identification method provided in the embodiment of the present application; Figure 5 In one embodiment, obtaining a supplier low-dimensional embedding vector according to the random walk sequence of each supplier may include:

[0109] 501. According to multiple supplier random walk sequences of any node in the supplier relationship graph at multiple step sizes, obtain the loss function of the node on each supplier random walk sequence;

[0110] 502. Perform a weighted summation on each loss function to obtain a joint loss function of the node on each supplier's random walk sequence;

[0111] 503. Multiply the joint loss functions of each node to obtain a first target loss function;

[0112] 504. If the value of the first objective loss function is greater than or equal to the first loss threshold, adjust each node and recalculate the first objective loss function;

[0113] 505. If the recalculated value of the first objective loss function is less than the first loss threshold, the vector representation of each node in the first objective loss function at this time is determined as the supplier low-dimensional embedding vector.

[0114] In step 501, The three random walk sequences correspond to a loss function:

[0115]

[0116] in, is the corresponding supplier random walk sequence The loss function is is the corresponding supplier random walk sequence The loss function is is the corresponding supplier random walk sequence The loss function of yes The node can be reached after 1 step. yes The nodes that can be reached after 2 steps are: yes Nodes that can be reached after 3 steps; yes Context word list.

[0117] in, That is from to The transition probability of That is from to The transition probability, That is from to The above transition probability is related to the weight of the associated edge between the starting node and the arrival node, which reflects the importance of the corresponding bidding equipment. For example, the specific calculation method can be as follows:

[0118] ;

[0119] in, yes The vector representation of yes The vector representation of yes Any word vector in , yes The total number of word vectors in yes and The weight of the associated edge between . Similarly, we can calculate and , and then calculate , and .

[0120] In step 502, , and Perform weighted summation and get Joint loss function over the random walk sequences of each supplier.

[0121] In step 503, the joint loss functions of all supplier nodes are multiplied to obtain the first target loss function. It should be noted that if the number of multiplied joint loss functions is an even number, the negative sign in front will be offset after multiplication. In this case, a negative sign needs to be added in front to obtain the first target loss function.

[0122] In step 504, adjusting each node means replacing each node vector in the first objective loss function with other node vectors that meet the step size requirement.

[0123] This embodiment calculates the loss function of the supplier random walk sequence at each step length based on the transition probability, and then weights and multiplies each loss function to obtain the first target loss function, and adjusts each node vector with the goal of minimizing the first target loss function, so that the suppliers with the closest relationship based on the same important MAC address are finally screened out, and the low-dimensional embedding vectors of these suppliers are obtained, which is helpful to add them to the original bidding records for overall similarity judgment later.

[0124] Figure 6 This is a fourth flow chart of the abnormal data identification method provided in the embodiment of the present application; Figure 6 In one embodiment, obtaining a low-dimensional embedding vector of an address according to a random walk sequence of each address may include:

[0125] 601. According to multiple address random walk sequences of any node in the address relationship graph at multiple step sizes, obtain a loss function of the node on each address random walk sequence;

[0126] 602. Perform a weighted summation on each loss function to obtain a joint loss function of the node on each address random walk sequence;

[0127] 603. Multiply the joint loss function of each node to obtain a second objective loss function;

[0128] 604. If the value of the second objective loss function is greater than or equal to the second loss threshold, adjust each node and recalculate the second objective loss function;

[0129] 605. If the recalculated value of the second objective loss function is less than the second loss threshold, the vector representation of each node in the second objective loss function at this time is determined as the address low-dimensional embedding vector.

[0130] In step 601, The three random walk sequences correspond to a loss function:

[0131]

[0132] in, , , They are the loss functions of the random walk sequence of the corresponding addresses, yes The node can be reached after 1 step. yes The nodes that can be reached after 2 steps are: yes Nodes that can be reached after 3 steps; yes Context word list.

[0133] in, That is from to The transition probability of That is from to The transition probability, That is from to The above transition probability is related to the weight of the associated edge between the starting node and the arrival node, which reflects the importance of the corresponding bidding supplier. For example, the specific calculation method can be as follows:

[0134] ;

[0135] in, yes The vector representation of yes The vector representation of yes Any word vector in , yes The total number of word vectors in yes and The weight of the associated edge between . Similarly, we can calculate and , and then calculate , and .

[0136] In step 602, , and Perform weighted summation and get The joint loss function on the random walk sequences of each address.

[0137] In step 603, the joint loss functions of all MAC address nodes are multiplied to obtain the second target loss function. It should be noted that if the number of multiplied joint loss functions is an even number, the negative sign in front will be offset after multiplication. In this case, a negative sign needs to be added in front to obtain the second target loss function.

[0138] In step 604, adjusting each node means replacing each node vector in the second objective loss function with other node vectors that meet the step size requirement.

[0139] This embodiment calculates the loss function of the random walk sequence of addresses at each step length based on the transition probability, and then weights and multiplies the loss functions to obtain the second target loss function. The vectors of each node are adjusted with the goal of minimizing the second target loss function, so that the MAC addresses with the closest relationship with the same important supplier are finally screened out, and the low-dimensional embedding vectors of these addresses are obtained, which is helpful for adding them to the original bidding records for overall judgment of similarity.

[0140] In one embodiment, the low-dimensional embedding vectors of each supplier, the low-dimensional embedding vectors of each address, and the second preset feature data within the preset time window are concatenated with the corresponding first preset feature data to obtain an extended bidding record, which may include:

[0141] The cumulative value and / or average value of the target bidding feature data within the preset time window is calculated according to the bidding supplier ID and the bidding device MAC address respectively to obtain the second preset feature data, and the low-dimensional embedding vector of each supplier, the low-dimensional embedding vector of each address and the second preset feature data are concatenated with the corresponding first preset feature data to obtain an extended bidding record.

[0142] The target bidding characteristic data may be the number of bids, bid amount, number of winning bids, winning bid amount, etc., which are not limited here. The preset time window may be historical accumulation, accumulation in the past three years, accumulation in the past two years, accumulation in the past year, accumulation this year, historical average, average in the past three years, average in the past two years, etc., which are not limited here. Taking the number of bids as an example, the historical cumulative number of bids and / or the historical average number of bids for any bidding supplier ID, and the historical cumulative number of bids and / or the historical average number of bids for any bidding device MAC address can be used as the second preset characteristic data, and then these second preset characteristic data are spliced ​​into the original bidding records to which the corresponding bidding supplier ID and the corresponding bidding device MAC address belong.

[0143] This embodiment obtains the second preset feature data by respectively calculating the cumulative value and / or average value of the target bidding feature data in the preset time window corresponding to the bidding supplier ID and the bidding device MAC address, and then splices it together with the supplier low-dimensional embedding vector and the address low-dimensional embedding vector into the corresponding original bidding record. This allows the extended bidding record to include multiple data features obtained by multiple calculation methods, and the subsequent similarity calculation and model classification can fully reflect the degree of data correlation.

[0144] Figure 7 This is a flowchart of the abnormal data identification method provided in the embodiment of the present application; refer to Figure 7 In one embodiment, the target extended bidding record can be obtained through the following preprocessing:

[0145] 701. If the missing value ratio of any preset characteristic data in each extended bidding record exceeds a preset percentage or the variance is equal to a preset variance, the preset characteristic data is deleted to obtain a first extended bidding record;

[0146] 702. If any numerical preset characteristic data in each first extended bidding record is less than a preset minimum threshold or greater than a preset maximum threshold, the numerical preset characteristic data is deleted to obtain a second extended bidding record;

[0147] The preset minimum threshold and the preset maximum threshold are determined according to the lower quartile and the upper quartile of the preset characteristic data of the numerical class;

[0148] 703. Perform linear interpolation filling on the missing values ​​of the numerical type in each second extended bidding record, and perform new filling on the missing values ​​of the non-numerical type in each second extended bidding record, to obtain a third extended bidding record;

[0149] 704. If the number of unique values ​​of any non-numeric preset feature data in each third extended bidding record is less than or equal to the quantity threshold, the non-numeric preset feature data is encoded using a one-hot encoding method; if the number of unique values ​​of any non-numeric preset feature data in each third extended bidding record is greater than the quantity threshold, the non-numeric preset feature data is encoded using a label encoding method to obtain the target extended bidding record.

[0150] In step 701, the preset percentage and the preset variance can be set according to actual needs, which are not limited here. In this embodiment, the preset percentage can be 80%, and the preset variance can be 0.

[0151] Furthermore, for any extended bidding record, the correlation between any two preset characteristic data can be calculated, and when the correlation is greater than a specific value, one of the preset characteristic data is deleted to achieve the purpose of deduplication. The specific value can also be set according to actual needs, for example, set to 0.7.

[0152] In step 702, the preset minimum threshold can be obtained by the following formula: and preset maximum threshold :

[0153]

[0154] in, , is the lower quartile of the numerical preset feature data, It is the upper quartile of the numerical preset feature data.

[0155] It should be noted that, corresponding to the numerical preset feature data deleted in this step, the numerical preset feature data will be regarded as missing values ​​subsequently.

[0156] In step 704, the unique value of the non-numeric preset characteristic data is the category in which the non-numeric preset characteristic data exists. For example, for the winning month, there are only 12 categories from January to December, that is, the number of unique values ​​of the winning month is 12. The quantity threshold can be set according to actual needs and is not limited here. In this embodiment, the quantity threshold can be set to 5.

[0157] This embodiment cleans, fills and encodes the preset feature data in each extended membrane table record, so that the data in the obtained target extended bidding record can be more comparable, thereby improving the accuracy of subsequent similarity algorithms and model classification.

[0158] The abnormal data identification device provided in an embodiment of the present application is described below. The abnormal data identification device described below and the abnormal data identification method described above can be referenced to each other.

[0159] Figure 8 Schematic diagram of the structure of the abnormal data identification device provided in the embodiment of the present application. Figure 8 , the embodiment of the present application provides an abnormal data identification device, which may include:

[0160] The data collection module 801 is used to collect bidding records containing first preset characteristic data in the bidding system; the first preset characteristic data includes the bidding supplier ID and the bidding device MAC address;

[0161] The relationship graph construction module 802 is used to: construct a relationship graph according to the bidding supplier ID and the bidding device MAC address in each bidding record, and obtain a supplier relationship graph with the bidding supplier ID as a node and an address relationship graph with the bidding device MAC address as a node;

[0162] A random walk module 803 is used to perform random walks in the supplier relationship graph and the address relationship graph with multiple steps to obtain a supplier random walk sequence corresponding to each bidding supplier ID in the supplier relationship graph and an address random walk sequence corresponding to each bidding device MAC address in the address relationship graph;

[0163] The low-dimensional vector acquisition module 804 is used to obtain a supplier low-dimensional embedding vector and an address low-dimensional embedding vector according to each supplier random walk sequence and each address random walk sequence respectively;

[0164] The data concatenation module 805 is used to concatenate the low-dimensional embedding vectors of each supplier, the low-dimensional embedding vectors of each address, and the second preset feature data within the preset time window with the corresponding first preset feature data to obtain an extended bidding record;

[0165] The abnormal data identification module 806 is used to: identify whether each target extended bidding record is abnormal according to the similarity between each target extended bidding record;

[0166] The target extended bidding record is a bidding record obtained by performing data preprocessing on the extended bidding record.

[0167] The abnormal data identification device provided in the present embodiment collects bidding records containing first preset feature data in a bidding system, wherein the first preset feature data includes a bidding supplier ID and a bidding device MAC address, constructs a relationship graph according to the bidding supplier ID and the bidding device MAC address in each bidding record, obtains a supplier relationship graph with the bidding supplier ID as a node and an address relationship graph with the bidding device MAC address as a node, performs random walks in the supplier relationship graph and the address relationship graph with multiple steps, respectively, obtains a supplier random walk sequence corresponding to each bidding supplier ID in the supplier relationship graph and an address random walk sequence corresponding to each bidding device MAC address in the address relationship graph, obtains a supplier low-dimensional embedding vector and an address low-dimensional embedding vector according to each supplier random walk sequence and each address random walk sequence, respectively, splices each supplier low-dimensional embedding vector, each address low-dimensional embedding vector and the second preset feature data within a preset time window with the corresponding first preset feature data, obtains an extended bidding record, and identifies whether each target extended bidding record is abnormal according to the similarity between each target extended bidding record. On the one hand, this embodiment adopts machine recognition to avoid the decrease in recognition efficiency and accuracy caused by manual auditing; on the other hand, this embodiment collects all qualified bidding records in the bidding system, and analyzes the existing historical bidding information and current bidding information at the same time, and fully mines and expands the characteristics of each bidding information through relationship graphs, random walk sequences and data splicing, and finally uses similarity to identify abnormal data, thereby further improving the accuracy of abnormal data recognition.

[0168] In one embodiment, the abnormal data identification module 806 is specifically used to:

[0169] Calculate the similarity between each target extended bidding record according to a similarity algorithm;

[0170] If the similarity between any two target extended bidding records in each target extended bidding record is greater than the similarity threshold, it is determined that the any two target extended bidding records are abnormal;

[0171] If the similarity between any two target extended bidding records in each target extended bidding record is less than or equal to the similarity threshold, the any two target extended bidding records are added as samples to the sample set;

[0172] Inputting the sample set into an abnormal data recognition model to obtain the sample abnormality probability output by the abnormal data recognition model;

[0173] If the sample abnormality probability is greater than the probability threshold, determining that the target extended bidding record corresponding to the sample abnormality probability is abnormal;

[0174] The abnormal data recognition model is trained based on any classification model according to historical target extended bidding records and their corresponding classification labels.

[0175] In one embodiment, the relationship graph construction module 802 is specifically used to:

[0176] Taking each bidding supplier ID as a node, if any two bidding supplier IDs have the same bidding device MAC address in their respective bidding records, then an associated edge and edge weight are constructed between the nodes corresponding to the any two bidding supplier IDs to obtain a supplier relationship graph with the bidding supplier ID as a node;

[0177] Taking the MAC address of each bidding device as a node, if any two bidding device MAC addresses have the same bidding supplier ID in their respective bidding records, then an associated edge and edge weight are constructed between the nodes corresponding to the any two bidding device MAC addresses to obtain an address relationship graph with the bidding device MAC addresses as nodes.

[0178] In one embodiment, the low-dimensional vector acquisition module 804 is specifically used to:

[0179] According to multiple supplier random walk sequences of any node in the supplier relationship graph at multiple step sizes, a loss function of any node on each supplier random walk sequence is obtained;

[0180] Perform a weighted summation on each loss function to obtain a joint loss function of any node on the random walk sequence of each supplier;

[0181] Multiply the joint loss functions of each node to obtain the first objective loss function;

[0182] If the value of the first objective loss function is greater than or equal to the first loss threshold, the first objective loss function is recalculated after adjusting each node until the value of the recalculated first objective loss function is less than the first loss threshold, and the vector representation of each node in the first objective loss function at this time is determined as the supplier low-dimensional embedding vector.

[0183] In one embodiment, the low-dimensional vector acquisition module 804 is specifically used to:

[0184] According to multiple address random walk sequences of any node in the address relationship graph at multiple step sizes, a loss function of any node on each address random walk sequence is obtained;

[0185] Perform a weighted summation on each loss function to obtain a joint loss function of any node on each address random walk sequence;

[0186] Multiply the joint loss function of each node to obtain the second objective loss function;

[0187] If the value of the second objective loss function is greater than or equal to the second loss threshold, the second objective loss function is recalculated after adjusting each node until the value of the recalculated second objective loss function is less than the second loss threshold, and the vector representation of each node in the second objective loss function at this time is determined as the address low-dimensional embedding vector.

[0188] In one embodiment, the data splicing module 805 is specifically used to:

[0189] Calculate the cumulative value and / or average value of the target bidding characteristic data within the preset time window according to the bidding supplier ID and the bidding device MAC address respectively, to obtain the second preset characteristic data;

[0190] The low-dimensional embedding vectors of each supplier, the low-dimensional embedding vectors of each address and the second preset feature data are concatenated with the corresponding first preset feature data to obtain an extended bidding record.

[0191] In one embodiment, a data preprocessing module (not shown in the figure) is further included for:

[0192] If the missing value ratio of any preset characteristic data in each extended bidding record exceeds a preset percentage or the variance is equal to a preset variance, the preset characteristic data is deleted to obtain a first extended bidding record;

[0193] If in each first extended bidding record, any numerical preset characteristic data is less than a preset minimum threshold or greater than a preset maximum threshold, the numerical preset characteristic data is deleted to obtain a second extended bidding record; the preset minimum threshold and the preset maximum threshold are determined based on the lower quartile and the upper quartile of the numerical preset characteristic data;

[0194] Perform linear interpolation filling on the missing values ​​of the numerical type in each second extended bidding record, and perform new filling on the missing values ​​of the non-numerical type in each second extended bidding record, to obtain a third extended bidding record;

[0195] If the number of unique values ​​of any non-numeric preset feature data in each third extended bidding record is less than or equal to the quantity threshold, the non-numeric preset feature data is encoded using a one-hot encoding method; if the number of unique values ​​of any non-numeric preset feature data in each third extended bidding record is greater than the quantity threshold, the non-numeric preset feature data is encoded using a label encoding method to obtain the target extended bidding record.

[0196] FIG9 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Fig. 9 As shown, the electronic device may include: a processor 910, a communication interface 920, a memory 930 and a communication bus 940, wherein the processor 910, the communication interface 920 and the memory 930 communicate with each other through the communication bus 940. The processor 910 may call a computer program in the memory 930 to execute the steps of the abnormal data identification method, for example including:

[0197] Collect bidding records containing first preset characteristic data in the bidding system; the first preset characteristic data includes the bidding supplier ID and the bidding device MAC address;

[0198] A relationship graph is constructed based on the bidding supplier ID and the bidding device MAC address in each bidding record, and a supplier relationship graph with the bidding supplier ID as a node and an address relationship graph with the bidding device MAC address as a node are obtained;

[0199] Performing random walks in the supplier relationship graph and the address relationship graph with multiple steps respectively, to obtain supplier random walk sequences corresponding to the IDs of each bidding supplier in the supplier relationship graph and address random walk sequences corresponding to the MAC addresses of each bidding device in the address relationship graph;

[0200] According to the random walk sequence of each supplier and the random walk sequence of each address, the supplier low-dimensional embedding vector and the address low-dimensional embedding vector are obtained respectively;

[0201] Concatenate the low-dimensional embedding vector of each supplier, the low-dimensional embedding vector of each address, and the second preset feature data within the preset time window with the corresponding first preset feature data to obtain an extended bidding record;

[0202] According to the similarity between the target extension bidding records, identifying whether each target extension bidding record is abnormal;

[0203] The target extended bidding record is a bidding record obtained by performing data preprocessing on the extended bidding record.

[0204] In addition, the logic instructions in the above-mentioned memory 930 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0205] On the other hand, an embodiment of the present application further provides a computer program product, the computer program product including a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer can perform the steps of the abnormal data identification method provided in the above embodiments, for example, including:

[0206] Collect bidding records containing first preset characteristic data in the bidding system; the first preset characteristic data includes the bidding supplier ID and the bidding device MAC address;

[0207] A relationship graph is constructed based on the bidding supplier ID and the bidding device MAC address in each bidding record, and a supplier relationship graph with the bidding supplier ID as a node and an address relationship graph with the bidding device MAC address as a node are obtained;

[0208] Performing random walks in the supplier relationship graph and the address relationship graph with multiple steps respectively, to obtain supplier random walk sequences corresponding to the IDs of each bidding supplier in the supplier relationship graph and address random walk sequences corresponding to the MAC addresses of each bidding device in the address relationship graph;

[0209] According to the random walk sequence of each supplier and the random walk sequence of each address, the supplier low-dimensional embedding vector and the address low-dimensional embedding vector are obtained respectively;

[0210] Concatenate the low-dimensional embedding vector of each supplier, the low-dimensional embedding vector of each address, and the second preset feature data within the preset time window with the corresponding first preset feature data to obtain an extended bidding record;

[0211] According to the similarity between the target extension bidding records, identifying whether each target extension bidding record is abnormal;

[0212] The target extended bidding record is a bidding record obtained by performing data preprocessing on the extended bidding record.

[0213] On the other hand, an embodiment of the present application further provides a non-transitory computer-readable storage medium on which a computer program is stored, wherein the computer program is used to enable a processor to execute the steps of the abnormal data identification method provided in the above embodiments, for example, including:

[0214] Collect bidding records containing first preset characteristic data in the bidding system; the first preset characteristic data includes the bidding supplier ID and the bidding device MAC address;

[0215] A relationship graph is constructed based on the bidding supplier ID and the bidding device MAC address in each bidding record, and a supplier relationship graph with the bidding supplier ID as a node and an address relationship graph with the bidding device MAC address as a node are obtained;

[0216] Performing random walks in the supplier relationship graph and the address relationship graph with multiple steps respectively, to obtain supplier random walk sequences corresponding to the IDs of each bidding supplier in the supplier relationship graph and address random walk sequences corresponding to the MAC addresses of each bidding device in the address relationship graph;

[0217] According to the random walk sequence of each supplier and the random walk sequence of each address, the supplier low-dimensional embedding vector and the address low-dimensional embedding vector are obtained respectively;

[0218] Concatenate the low-dimensional embedding vector of each supplier, the low-dimensional embedding vector of each address, and the second preset feature data within the preset time window with the corresponding first preset feature data to obtain an extended bidding record;

[0219] According to the similarity between the target extension bidding records, identifying whether each target extension bidding record is abnormal;

[0220] The target extended bidding record is a bidding record obtained by performing data preprocessing on the extended bidding record.

[0221] The non-transitory computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)), etc.

[0222] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0223] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0224] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for identifying abnormal data, characterized in that: include: Collecting bidding records containing first preset characteristic data in the bidding system; The first preset characteristic data includes the bidding supplier ID and the bidding device MAC address; A relationship graph is constructed based on the bidding supplier ID and the bidding device MAC address in each bidding record, and a supplier relationship graph with the bidding supplier ID as a node and an address relationship graph with the bidding device MAC address as a node are obtained; Performing random walks in the supplier relationship graph and the address relationship graph with multiple steps respectively, to obtain supplier random walk sequences corresponding to the IDs of each bidding supplier in the supplier relationship graph and address random walk sequences corresponding to the MAC addresses of each bidding device in the address relationship graph; According to the random walk sequence of each supplier and the random walk sequence of each address, the supplier low-dimensional embedding vector and the address low-dimensional embedding vector are obtained respectively; Concatenate the low-dimensional embedding vector of each supplier, the low-dimensional embedding vector of each address, and the second preset feature data within the preset time window with the corresponding first preset feature data to obtain an extended bidding record; According to the similarity between the target extension bidding records, identifying whether each target extension bidding record is abnormal; The target extended bidding record is a bidding record obtained by performing data preprocessing on the extended bidding record.

2. The abnormal data identification method according to claim 1, characterized in that: The step of identifying whether each target extended bidding record is abnormal according to the similarity between each target extended bidding record includes: Calculate the similarity between each target extended bidding record according to a similarity algorithm; If the similarity between any two target extended bidding records in each target extended bidding record is greater than the similarity threshold, it is determined that the any two target extended bidding records are abnormal; If the similarity between any two target extended bidding records in each target extended bidding record is less than or equal to the similarity threshold, the any two target extended bidding records are added as samples to the sample set; Inputting the sample set into an abnormal data recognition model to obtain the sample abnormality probability output by the abnormal data recognition model; If the sample abnormality probability is greater than the probability threshold, determining that the target extended bidding record corresponding to the sample abnormality probability is abnormal; The abnormal data recognition model is trained based on any classification model according to historical target extended bidding records and their corresponding classification labels.

3. The abnormal data identification method according to claim 1, characterized in that: The method of constructing a relationship graph based on the bidding supplier ID and the bidding device MAC address in each bidding record to obtain a supplier relationship graph with the bidding supplier ID as a node and an address relationship graph with the bidding device MAC address as a node includes: Taking each bidding supplier ID as a node, if any two bidding supplier IDs have the same bidding device MAC address in their respective bidding records, then an associated edge and edge weight are constructed between the nodes corresponding to the any two bidding supplier IDs to obtain a supplier relationship graph with the bidding supplier ID as a node; Taking the MAC address of each bidding device as a node, if any two bidding device MAC addresses have the same bidding supplier ID in their respective bidding records, then an associated edge and edge weight are constructed between the nodes corresponding to the any two bidding device MAC addresses to obtain an address relationship graph with the bidding device MAC addresses as nodes.

4. The abnormal data identification method according to claim 1, characterized in that: According to the random walk sequence of each supplier, a low-dimensional embedding vector of the supplier is obtained, including: According to multiple supplier random walk sequences of any node in the supplier relationship graph at multiple step sizes, a loss function of any node on each supplier random walk sequence is obtained; Perform a weighted summation on each loss function to obtain a joint loss function of any node on the random walk sequence of each supplier; Multiply the joint loss functions of each node to obtain the first objective loss function; If the value of the first objective loss function is greater than or equal to the first loss threshold, the first objective loss function is recalculated after adjusting each node until the value of the recalculated first objective loss function is less than the first loss threshold, and the vector representation of each node in the first objective loss function at this time is determined as the supplier low-dimensional embedding vector.

5. The abnormal data identification method according to claim 1, characterized in that: The method of obtaining a low-dimensional embedding vector of an address according to a random walk sequence of each address includes: According to multiple address random walk sequences of any node in the address relationship graph at multiple step sizes, a loss function of any node on each address random walk sequence is obtained; Perform a weighted summation on each loss function to obtain a joint loss function of any node on each address random walk sequence; Multiply the joint loss function of each node to obtain the second objective loss function; If the value of the second objective loss function is greater than or equal to the second loss threshold, the second objective loss function is recalculated after adjusting each node until the value of the recalculated second objective loss function is less than the second loss threshold, and the vector representation of each node in the second objective loss function at this time is determined as the address low-dimensional embedding vector.

6. The abnormal data identification method according to claim 1, characterized in that: The step of concatenating the low-dimensional embedding vectors of each supplier, the low-dimensional embedding vectors of each address, and the second preset feature data within the preset time window with the corresponding first preset feature data to obtain an extended bidding record includes: Calculate the cumulative value and / or average value of the target bidding characteristic data within the preset time window according to the bidding supplier ID and the bidding device MAC address respectively, to obtain the second preset characteristic data; The low-dimensional embedding vectors of each supplier, the low-dimensional embedding vectors of each address and the second preset feature data are concatenated with the corresponding first preset feature data to obtain an extended bidding record.

7. The abnormal data identification method according to claim 1, characterized in that: The target extended bidding record is obtained through the following preprocessing: If the missing value ratio of any preset characteristic data in each extended bidding record exceeds a preset percentage or the variance is equal to a preset variance, the preset characteristic data is deleted to obtain a first extended bidding record; If in each first extended bidding record, any numerical preset characteristic data is less than a preset minimum threshold or greater than a preset maximum threshold, the numerical preset characteristic data is deleted to obtain a second extended bidding record; the preset minimum threshold and the preset maximum threshold are determined based on the lower quartile and the upper quartile of the numerical preset characteristic data; Perform linear interpolation filling on the missing values ​​of the numerical type in each second extended bidding record, and perform new filling on the missing values ​​of the non-numerical type in each second extended bidding record, to obtain a third extended bidding record; If the number of unique values ​​of any non-numeric preset feature data in each third extended bidding record is less than or equal to the quantity threshold, the non-numeric preset feature data is encoded using a one-hot encoding method; if the number of unique values ​​of any non-numeric preset feature data in each third extended bidding record is greater than the quantity threshold, the non-numeric preset feature data is encoded using a label encoding method to obtain the target extended bidding record.

8. An abnormal data identification device, characterized in that: include: A data collection module is used to collect bidding records containing first preset characteristic data in the bidding system; The first preset characteristic data includes the bidding supplier ID and the bidding device MAC address; A relationship graph construction module is used to: construct a relationship graph according to the bidding supplier ID and the bidding device MAC address in each bidding record, and obtain a supplier relationship graph with the bidding supplier ID as a node and an address relationship graph with the bidding device MAC address as a node; A random walk module is used to: perform random walks in the supplier relationship graph and the address relationship graph with multiple steps respectively, to obtain a supplier random walk sequence corresponding to each bidding supplier ID in the supplier relationship graph and an address random walk sequence corresponding to each bidding device MAC address in the address relationship graph; A low-dimensional vector acquisition module is used to obtain a supplier low-dimensional embedding vector and an address low-dimensional embedding vector according to the random walk sequence of each supplier and the random walk sequence of each address respectively; A data concatenation module is used to concatenate the low-dimensional embedding vectors of each supplier, the low-dimensional embedding vectors of each address, and the second preset feature data within the preset time window with the corresponding first preset feature data to obtain an extended bidding record; The abnormal data identification module is used to: identify whether each target extension bidding record is abnormal according to the similarity between each target extension bidding record; The target extended bidding record is a bidding record obtained by performing data preprocessing on the extended bidding record.

9. An electronic device comprising a processor and a memory storing a computer program, characterized in that: When the processor executes the computer program, the steps of the abnormal data identification method according to any one of claims 1 to 7 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the abnormal data identification method according to any one of claims 1 to 7 are implemented.

Images