Tissue identification method, device and equipment and readable storage medium

Abstract

The invention discloses an organization identification method, device and equipment and a readable storage medium, and is applied to the technical field of network security, and the method comprises the steps: generating an undirected graph according to user associated behavior information in a preset time window; the user association behavior information is information representing association between the users, nodes of the undirected graph represent the users, and information on edges represent association degrees between the users; performing community division on the undirected graph through a community discovery algorithm according to the association degree, and determining a community set; filtering non-aggregated communities in the community set according to the number of community nodes to obtain a target organization; the non-aggregated communities refer to communities of which the number of community nodes is smaller than a preset minimum number threshold value. According to the technical scheme provided by the invention, organization identification is carried out, so that even if a newly registered user has an association relationship with a previous user, the user can be determined as one member in the organization according to the association relationship, and the accuracy of organization identification is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an organization identification method, device, equipment and readable storage medium. Background Art

[0002] An organization generally refers to an act that uses the Internet as a medium and network technology as the main means to bring potential threats to the security of computer information systems and the management order of cyberspace.

[0003] In the prior art, when identifying an organization, non-correlated security defense is mainly performed based on risky mobile phone numbers, risky IP addresses, risky accounts, request frequency limits and other behavioral information, thereby executing processing on illegal accounts. However, organizations often use newly registered accounts to publish illegal information. Since new accounts have no historical behavioral data, newly registered accounts cannot be identified during the defense process, making it impossible to identify the organization, resulting in poor security defense effects.

[0004] Therefore, the prior art has the problem of low accuracy in tissue identification. Summary of the invention

[0005] In view of this, an object of the present invention is to provide a method, device, equipment and readable storage medium for tissue identification, which solve the technical problem of low accuracy of user identification in the prior art.

[0006] In order to solve the above technical problems, the present invention provides a tissue identification method, comprising:

[0007] Generate an undirected graph based on the user association behavior information within a preset time window; wherein the user association behavior information is information characterizing the association between users, the nodes of the undirected graph represent users, and the information on the edges represent the degree of association between users;

[0008] Divide the undirected graph into communities by using a community discovery algorithm according to the degree of association, and determine a community set;

[0009] The non-aggregated communities in the community set are filtered according to the number of community nodes to obtain a target organization; wherein the non-aggregated community refers to a community whose number of community nodes is less than a preset minimum number threshold.

[0010] Optionally, generating an undirected graph according to the user association behavior information within a preset time window includes:

[0011] Determine the weights corresponding to the associated behavior information between each user; wherein the weights are determined according to the accuracy of the associated behavior information in determining the illegal behavior;

[0012] The weight of each edge in the undirected graph is determined according to the weight corresponding to the associated behavior information between the users; wherein the information on the edge includes the weight of the edge.

[0013] Optionally, dividing the undirected graph into communities by using a community discovery algorithm according to the association degree to determine the community set includes:

[0014] Determine the closeness of nodes in the undirected graph according to the weight of the edge using the community discovery algorithm;

[0015] The undirected graph is divided into communities according to the closeness and the central node to obtain the community set; wherein the central node includes a user associated with multiple users.

[0016] Optionally, filtering the non-aggregated communities in the community set according to the number of community nodes to obtain the target organization includes:

[0017] Using a preset community node quantity threshold to filter non-aggregated communities in the community set to obtain an initial organization;

[0018] Determining whether there are user nodes with low association in the initial organization by using a clustering radius threshold;

[0019] The user nodes with low association in the initial organization are eliminated to obtain the target organization.

[0020] Optionally, after filtering the non-aggregated communities in the community set according to the number of community nodes to obtain the target organization, the method further includes:

[0021] Determine the risk level corresponding to each target organization according to the risk type of each user in the target organization;

[0022] Determine a restriction request method corresponding to the risk level.

[0023] Optionally, after filtering the non-aggregated communities in the community set according to the number of community nodes to obtain the target organization, the method further includes:

[0024] Determine whether there is a relationship between target organizations based on the association behavior information;

[0025] Aggregate the target organizations with associated relationships to obtain large associated organizations;

[0026] Determine a defense approach corresponding to the large associated organization.

[0027] Optionally, the user behavior information includes at least one of a mobile phone number, a behavior track and an IP address.

[0028] The present application also provides a tissue identification device, comprising:

[0029] An undirected graph determination module, used to generate an undirected graph based on user association behavior information within a preset time window; wherein the user association behavior information is information characterizing the association between users, the nodes of the undirected graph represent users, and the information on the edges represent the degree of association between users;

[0030] A partitioning module, used to perform community partitioning on the undirected graph according to the degree of association by using a community discovery algorithm to determine a community set;

[0031] The organization determination module is used to filter the non-aggregated communities in the community set according to the number of community nodes to obtain a target organization; wherein the non-aggregated community refers to a community with a number of community nodes less than a preset minimum number threshold.

[0032] The present application also provides a tissue identification device, comprising:

[0033] Memory for storing computer programs;

[0034] A processor is used to implement the tissue identification method as described above when executing the computer program.

[0035] The present application also provides a readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the tissue identification method as described above are implemented.

[0036] It can be seen that the present invention establishes an undirected graph based on the user and the behavior information of each user, and then uses the community discovery algorithm to process the community graph to obtain a community set, and uses the number of community nodes to filter the non-aggregated communities in the community set to obtain the target organization. Compared with the current static defense based on existing defense data, risky mobile phone numbers, risky IPs, risky accounts, request frequencies and other data, the present application will consider the user's association relationship in the process of judging the organization, so that even a newly registered user will have an association relationship with the previous user, so that the user can be determined as a member of the organization based on the association relationship, thereby improving the accuracy of organization identification.

[0037] In addition, the present invention also provides a tissue identification device, equipment and readable storage medium, which also have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0039] Figure 1 A flowchart of a tissue identification method provided by an embodiment of the present invention;

[0040] Figure 2 An example flowchart of a tissue identification method provided by an embodiment of the present invention;

[0041] Figure 3 An overall framework diagram of an organization mining method provided by an embodiment of the present invention;

[0042] Figure 4 A schematic diagram of a community set provided by an embodiment of the present invention;

[0043] Figure 5 A schematic diagram of an aggregation organization provided by an embodiment of the present invention;

[0044] Figure 6 A schematic diagram of an organization provided by an embodiment of the present invention;

[0045] Figure 7 A schematic diagram of the structure of a tissue identification device provided by an embodiment of the present invention;

[0046] Figure 8 A schematic diagram of the structure of a tissue identification device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] Please refer to Figure 1 , Figure 1 A flowchart of a tissue identification method provided by an embodiment of the present invention. The method may include:

[0049] S101, generating an undirected graph according to user association behavior information within a preset time window; wherein the user association behavior information is information representing the association between users, the nodes of the undirected graph represent users, and the information on the edges represent the degree of association between users.

[0050] The execution subject of this embodiment is an electronic device, and the electronic device in this embodiment can be a computer, a mobile phone, a tablet, etc. This embodiment does not limit the specific preset time window size, and the preset time window can be set according to demand, or can be determined according to the size of computing resources. For example, the preset time window size in this embodiment can be 1 hour; or, the preset time window size in this embodiment can be 1 day; or, the preset time window size in this embodiment can be 1 month. This embodiment does not limit specific user association behavior information. For example, the user association behavior information in this embodiment can be an IP (interconnection protocol between networks) address; or the user association behavior information in this embodiment can also be a mobile phone number; or the user association behavior information in this embodiment can also be a follow-up relationship or an interactive relationship; or the user association behavior information in this embodiment can also be device information; or the user association behavior information in this embodiment can also be a behavior trajectory. The nodes of the undirected graph in this embodiment are users, and the information on the edges represents the degree of association of each user, and the degree of association usually refers to the strength of the connection between two objects. This embodiment can use a queue to store user behavior data within a time window, and calculate in real time whether there is a correlation between users based on the data within a preset time window, such as the same device, the same IP, the same behavior trajectory, the IP within the time window, frequent device switching, and define various feature relationships, so as to establish a relationship chain between users. The degree of association in this embodiment can be determined based on the weight of the edge, and the weight of the edge can be determined based on the weight of each associated indicator; or the weight of the edge can be determined based on the product of the weight of each associated indicator and the number of associated indicators; or the method for determining the weight of the edge in this embodiment can be based on the adjacency matrix: the connection relationship between nodes can be represented by constructing the adjacency matrix of the graph. For an undirected graph, the adjacency matrix is ​​symmetrical, and the elements in the matrix can be represented as the size of the association weight between two nodes. If there is a connection between two nodes, the corresponding matrix element value is 1, otherwise it is 0. This method is simple and direct, and is suitable for small or medium-sized graphs. Or the method for determining the weight of the edge in this embodiment can be based on node feature calculation: if the node has quantifiable features, such as user behavior data, keywords of articles, etc., the weight of the edge can be assigned by calculating the similarity or difference between these features. For example, methods such as cosine similarity and Euclidean distance can be used to measure the strength of association between node features. Alternatively, the edge weight determination method in this embodiment can be based on network analysis indicators: some indicators in network analysis can be used to determine the edge weight, such as the interaction frequency between two nodes, the number of shared neighbors, etc. These indicators can reflect the degree of interaction and closeness between nodes, and thus serve as the basis for weights.

[0051] It should be further explained that, in order to improve the accuracy of undirected graph construction, the above-mentioned generation of an undirected graph according to the user association behavior information within a preset time window may include:

[0052] S1011, determining the weights corresponding to the associated behavior information between each user; wherein the weights are determined according to the accuracy of determining the illegal behavior by the associated behavior information;

[0053] S1012, determining the weight of each edge in the undirected graph according to the weight corresponding to the associated behavior information between each user; wherein the information on the edge includes the weight of the edge.

[0054] This embodiment will promptly determine the weights corresponding to the associated behavior information between each user, and thus determine the weights (degree of association) of each edge based on the weights, making the weights of the edges in the undirected graph more accurate, thereby improving the accuracy of the undirected graph construction. For ease of understanding, for example, the IPs of user A and user B are the same, and the behavior trajectories of user A and user C are the same; the devices of user B and user C are the same, the weight of the IP association index is 1, the weight of the behavior trajectory association index is 7, and the weight of the device association index is 2. At this time, the association size between user A and user B is 1, the association size between user A and user C is 7, and the association size between user B and user C is 2.

[0055] S102, dividing the undirected graph into communities by using a community discovery algorithm according to the degree of association, and determining a community set.

[0056] The community discovery algorithm in this embodiment is a series of algorithms for identifying community structures in a network. The community discovery algorithm in this embodiment may be a GN algorithm (Girvan-Newman Algorithm): This is a community discovery algorithm based on edge betweenness, which identifies community structures by continuously removing the edges with the highest network betweenness. Or the community discovery algorithm in this embodiment may be a Walktrap algorithm: This algorithm is based on the idea of ​​random walks, and determines the similarity between nodes by simulating the process of random walks, and divides communities accordingly. Or the community discovery algorithm in this embodiment may be a label propagation algorithm (Label Propagation Algorithm, LPA): This is a community discovery method based on label propagation, and the community affiliation of nodes will be updated according to the labels of adjacent nodes until a stable state is reached. Or the community discovery algorithm in this embodiment may be a Louvain algorithm: This is a community discovery algorithm based on modularity optimization, which divides communities by optimizing local and global modularity. Or the community discovery algorithm in this embodiment may be a Leiden algorithm, which is a community discovery algorithm based on modularity maximization. The community discovery algorithm in this embodiment divides communities by judging whether the connection relationship between users is close. Some communities are sparse because there are fewer connections between users. Some communities have more connections between users. The connections between users have weights. The degree of closeness is calculated according to the size of the weight (set according to needs), and then multiple communities are divided.

[0057] It should be further explained that, in order to improve the efficiency of determining the community set, the above-mentioned community division of the undirected graph according to the degree of association by the community discovery algorithm to determine the community set can include using the community discovery algorithm to determine the closeness of the nodes in the undirected graph according to the weight of the edge; dividing the undirected graph into communities according to the closeness and the central node to obtain a community set; wherein the central node includes a user associated with multiple users. The central node of the community in this embodiment generally refers to a node with a high centrality in the network, which has a high degree of connectivity both inside and outside the community. These nodes act as a bridge within the community, connecting different sub-communities, and also keep in touch with external communities. The central node is of great significance to the stability and information dissemination of the network. This embodiment can determine the central node according to the number of associated users, or can determine the central node according to the degree centrality greater than the set value; or can determine the central node according to the proximity centrality greater than the preset value; or this embodiment can use the betweenness centrality greater than the preset value as the central node. The reason why this embodiment divides the community according to the central node is that in a large-scale network, identifying the central node can reduce the number of nodes that need to be processed, thereby speeding up the community detection. This is particularly important for applications with limited computing resources or requiring fast response. In addition, it can enhance the cohesion of the community: dividing the community based on the central node helps ensure that the connection within the community is closer, because the central node often has more connections with the nodes around it. And it can simplify the community structure: defining the community by the central node can make the community structure clearer and easier to understand, because the central node itself is the core of the community, and the community boundaries formed around it are also clearer.

[0058] S103, filtering non-aggregated communities in the community set according to the number of community nodes to obtain a target organization; wherein the non-aggregated community refers to a community whose number of community nodes is less than a preset minimum number threshold.

[0059] This embodiment filters the non-aggregated communities in the community set according to the number of community nodes, removes the non-aggregated areas, and obtains the target organization. It is understandable that after the community is divided, the too small community can be filtered to obtain the target group. For example, the number of community nodes needs to reach 4 (or 5, or 6) to be considered to be aggregated. This embodiment does not limit the specific preset minimum number threshold. For example, the preset minimum number threshold in this embodiment can be 4; or the preset minimum number threshold in this embodiment can be 5.

[0060] It should be further explained that, in order to improve the accuracy of determining the target organization, the above filtering of non-aggregated communities in the community set according to the number of community nodes to obtain the target organization may specifically include:

[0061] S1031, filtering non-aggregated communities in the community set using a preset community node quantity threshold to obtain an initial organization;

[0062] S1032, using a clustering radius threshold to determine whether there are user nodes with low association in the initial organization;

[0063] S1033, removing user nodes with low relevance in the initial organization to obtain the target organization.

[0064] This embodiment can also use a clustering algorithm to perform clustering judgment on the initial organization. This embodiment does not limit the specific clustering algorithm. For example, the clustering algorithm in this embodiment can be DBSCAN, which is a density-based clustering algorithm that can find clusters of any shape and can identify and process noise data. The algorithm controls the clustering process through two key parameters: one is the neighborhood radius (Eps), which indicates the size of the neighborhood of a point in space; the other is the minimum number of points (MinPts), which indicates the minimum number of points required in a point neighborhood to form a dense area. If a point has more than the number of MinPts neighboring points within the Eps radius, these points are considered to be core objects and are expanded to form clusters. DBSCAN does not need to pre-specify the number of clusters and is suitable for data sets of different densities and irregular shapes. Or the clustering algorithm in this embodiment can also be Mean Shift, which is a clustering algorithm based on kernel density estimation, which gradually moves data points to the position with the highest density in its neighborhood, that is, the position of the centroid, in an iterative manner. In Mean Shift, there is also a concept similar to radius, which is usually associated with the bandwidth of the kernel function, and it defines the neighborhood range of the data points considered. The algorithm performs clustering by continuously calculating and moving to the area with the largest local density until the convergence condition is met. This embodiment does not limit the specific preset community node number threshold, and the preset community node number threshold can be set according to demand. For example, in this embodiment, the preset community node number threshold may be 2; or the preset community node number threshold in this embodiment may also be 4; or the preset community node number threshold in this embodiment may also be 5. In this embodiment, the clustering radius threshold is first used to determine whether there are user nodes with low correlation in the initial organization, so that the user nodes with low correlation in the initial organization are eliminated to obtain the target organization. It is understandable that after obtaining the community set, there will be some users in the community set whose direct correlation is not high. Direct correlation means that there are multiple users between two users in the same community, and they are assigned to the same community through indirect correlation. It can also be understood that the distance between the two users is too far, which will cause users to accidentally gather together. Therefore, it is necessary to make a clustering judgment, remove noise points, and remove users with low correlation, because they are far away from the community center and have weak correlation. Therefore, by removing the user nodes with low correlation in the initial organization, the accuracy of determining the target organization can be improved.

[0065] It should be further explained that in order to reduce network risks, after filtering the non-aggregated communities in the community set according to the number of community nodes and obtaining the target organization, it can also include: determining the risk level corresponding to each target organization according to the risk type of each user in the target organization; determining the restriction request method corresponding to the risk level. This embodiment does not limit the method for obtaining the risk type. For example, the risk type can be obtained from a table, or it can be obtained through the identification information of each user. There are many ways to obtain it. It can be understood that some users have been marked before, so it can be obtained from the table or identification information. This embodiment does not limit the specific risk type. For example, in this embodiment, the risk type of the user can be a selling account; or the risk type of the user in this embodiment can be a selling account; or the risk type of the user in this embodiment can also be a charging account; or the risk type of the user in this embodiment can be a wool-pulling or a good review; or the risk type of the user in this embodiment can be a fraud; or the risk type of the user in this embodiment can be a user (a user who has been previously determined). This embodiment does not limit the specific risk level. For example, when there are risk type users who sell accounts on behalf of others in the organization, the level may be medium, or when there are risk type users who steal goods and give good reviews in the organization, the level may be low; or when there are risk type users who commit fraud and / or in the organization, the level may be high. This embodiment does not limit the way of dividing risk levels. For example, the way of dividing risk levels in this embodiment may be low, medium, and high; or the risk levels in this embodiment may be level one, level two, level three, level four, etc. This embodiment does not limit the specific restriction request method. For example, the restriction request method in this embodiment may be account blocking, and login is not allowed, which means that the user will be prohibited from using the account and cannot log in to the relevant platform or service. Or the restriction request method in this embodiment may be that the user cannot participate in low-price activities, but the functions can be used normally, which means that the user will not be able to participate in specific low-price activities, but other functions can still be used normally. The restriction request method in this embodiment may be a penalty period, which means that the user will face a certain penalty period, during which some restrictions can be set, and the specific restriction content may vary depending on the situation. It is understandable that in Internet services, in order to maintain the security and order of the platform, different degrees of restrictions or penalties are imposed on the user's account according to the risk level of the user's behavior. Specifically: High risk level: In this case, the user's behavior may seriously violate the platform's usage regulations, such as suspected fraud, posting prohibited content, etc. Therefore, the platform will take the most severe measures, that is, banning the account, and the user will not be able to log in, which is equivalent to depriving the user of all rights on the platform. Low risk level: For users with minor violations, the platform may restrict their participation in specific activities, such as not being able to participate in preferential activities such as low-price promotions, but the user's other functions will not be affected and they can continue to use most services.Medium risk: This situation usually involves a penalty period during which the user may be subject to some functional restrictions, such as not being able to post, comment, or send private messages. After the penalty period, the account usually resumes regular use rights. Therefore, by determining the restriction request method corresponding to the risk level, the members of each organization are restricted accordingly, thereby improving network security and reducing network risks.

[0066] It should be further explained that, in order to improve the efficiency of combating organizations, after filtering the non-aggregated communities in the community set according to the number of community nodes and obtaining the target organization, it can also include: determining whether there is an association relationship between the target organizations according to the association behavior information; aggregating the target organizations with association relationships to obtain large-scale associated organizations; and determining the defense method corresponding to the large-scale associated organization. This embodiment does not limit the specific defense method. For example, the defense method in this embodiment can be to deploy an advanced intrusion detection and prevention system (IDS / IPS) to monitor and block malicious traffic; or the defense method in this embodiment can be to use anti-fraud solutions such as device fingerprinting and behavior analysis to identify and block fraudulent activities; or the defense method in this embodiment can be to implement endpoint protection, including installing anti-virus software, anti-spyware software and malware protection. The defense method in this embodiment can be to strengthen the security configuration of network firewalls and routers and limit the exposure of unnecessary ports and services. It can be understood that through association analysis, the connection between multiple small-scale organizations can be identified, so that they can be regarded as a whole for attack, thereby avoiding processing one by one and improving the efficiency of the attack. At the same time, a deep understanding of large-scale associated organizations helps to formulate more accurate and effective defense strategies, thereby improving the success rate of defense. At the same time, the organization's effective crackdown and defense can improve the security of the entire network environment and protect the interests of users and enterprises.

[0067] An organization identification method provided by an embodiment of the present invention may include: S101, generating an undirected graph according to user association behavior information within a preset time window; wherein the user association behavior information is information characterizing the association between users, the nodes of the undirected graph represent users, and the information on the edges represents the degree of association between users; S102, dividing the undirected graph into communities according to the degree of association through a community discovery algorithm to determine a community set; S103, filtering non-aggregated communities in the community set according to the number of community nodes to obtain a target organization; wherein a non-aggregated community refers to a community whose number of community nodes is less than a preset minimum number threshold. Compared with the current method of filtering users only according to the request frequency of the current user, the method provided by the present application considers the user's association relationship in the process of judging the organization, so that even a newly registered user (for example, although the A node is newly registered, it has a certain association relationship with other nodes in the community), because it has an association relationship with the previous user, the user can be determined as a member of the organization based on the association relationship, thereby improving the accuracy of organization identification. In addition, this embodiment will promptly determine the weights corresponding to the associated behavior information between each user, and thus determine the weights (degree of association) of each edge based on the weights, so that the weights of the edges in the undirected graph are more accurate, thereby improving the accuracy of the undirected graph construction; and, this embodiment divides the community according to the central node. In a large-scale network, identifying the central node can reduce the number of nodes that need to be processed, thereby speeding up the community detection; and, by eliminating user nodes with low association in the initial organization, the accuracy of the target organization determination can be improved; and, by determining the restriction request method corresponding to the risk level, corresponding restrictions are imposed on the members of each organization, thereby improving network security and reducing network risks; and, through association analysis, the connection between multiple small-scale organizations can be identified, so that they can be regarded as a whole for attack, thereby avoiding one-by-one processing and improving the efficiency of the attack.

[0068] In order to make the present invention easier to understand, please refer to Figure 2 , Figure 2 An example flow chart of a tissue identification method provided by an embodiment of the present invention, Figure 3 For Figure 2 The overall framework diagram of a corresponding organization mining method and the process example diagram of an organization identification method may specifically include:

[0069] S201, generating an undirected graph according to user association behavior information within a preset time window; wherein the user association behavior information is information representing the association between users, the nodes of the undirected graph represent users, and the information on the edges represents the degree of association between users.

[0070] In this embodiment Figure 3The overall framework diagram of organization mining is given. From the figure, it can be seen that when a user accesses, a secure access service will be requested, and the account will be judged based on the above-mentioned organization identification method. When it is determined to belong to an organization, Figure 3 The size of the organization is 100 people, the city is Wenzhou, and the risk level is high, so requests need to be restricted. This embodiment defines a preset time window, uses a queue to store user behavior data within the preset time window, and calculates in real time whether there is a correlation between users based on user behavior data, such as the same device, the same IP, the same behavior trajectory, the IP within the time window, and the device switching frequency to define various feature relationships, which can establish a relationship chain between users, thereby constructing an undirected graph. It is understandable that when a user's previous operation process is clustered, then this user may be a simulated request made by a script, and the security service will limit the requests of the aggregated users.

[0071] S202, dividing the undirected graph into communities by using a community discovery algorithm according to the degree of association, and determining a community set.

[0072] The purpose of dividing communities in this embodiment is to prevent accidental harm to users, because it is normal for nodes to have associations, and judgment needs to be made based on the degree of association and the size of the association group. Figure 4 This is a schematic diagram of a community collection provided by this application. It is an undirected graph generated by calculating the user association. The weight of the edge represents the degree of association between users. The number on the edge represents the weight. The community is divided by the community discovery algorithm. The community discovery algorithm is to divide the community by judging whether the connection relationship between users is tight. Some communities are sparse because there are fewer connections between users. Some communities have more connections between users. There are weights for the connections between users. The degree of closeness is calculated according to the size of the weight, so multiple communities are divided. After the community is divided, the community that is too small can be filtered. For example, the number of community nodes needs to reach 4 to be considered to be clustered. At this time, community A can be obtained.

[0073] S203, filtering the non-aggregated communities in the community set using a preset community node quantity threshold to obtain a plurality of initial organizations; a non-aggregated community refers to a community whose community node quantity is less than a preset minimum quantity threshold.

[0074] S204, performing graph clustering calculation on the multiple initial organizations to obtain a target clustering graph set, and determining whether there are user nodes with low correlation in the target clustering graph set based on a clustering radius threshold.

[0075] S205, removing user nodes with low correlation in the target clustering graph set to obtain multiple clustering organizations.

[0076] After this embodiment obtains the target cluster graph set, there will be some nodes in a community with low direct correlation between nodes. Direct correlation means that there are multiple users between two users in the same community. They are assigned to the same community through indirect correlation. It can also be understood that the distance between the two users is too far, which will cause users to cluster by mistake. Therefore, it is necessary to use the graph clustering algorithm DBSCAN (density-based clustering algorithm) to make clustering judgments, remove users with low correlation, and remove noise points, because the distance from the community center is relatively far and the correlation is weak. For details, please refer to Figure 5 , Figure 5 A schematic diagram of an aggregation organization provided for an embodiment of the present invention. In this embodiment, an aggregation radius of 1 and a number of aggregation nodes of 5 are defined. During actual use, it is necessary to consider the size of the community to configure the radius and the number of aggregation nodes, thereby removing edge nodes because the connection is not very close to prevent accidental injuries.

[0077] S206, making restriction requests to users in the aggregation organization according to the user labeling information; the user labeling information is information for determining the illegal category of the user.

[0078] S207, analyzing whether there is any connection between the clustered organizations according to the IP addresses and the device pool, treating the clustered organizations that are connected as the same community, and obtaining the target organization.

[0079] This embodiment marks the gathered users, restricts requests, and analyzes whether there is a connection between each community, such as city, IP pool, device pool, etc. to determine whether they belong to the same community, so that each organization can be gradually mined. For easier understanding, please refer to Figure 6 , Figure 6 A schematic diagram of an organization provided by an embodiment of the present invention. It can be seen from the figure that there is a correlation between the clustered organizations, so the two organizations are regarded as the same community to obtain the target organization. When obtaining the target organization, the embodiment can use advanced data analysis and machine learning algorithms to analyze behavior patterns and track its activities. At the same time, the embodiment blocks the websites, servers and accounts used by the organization and cuts off its operating platform.

[0080] The following is an introduction to a tissue identification device provided in an embodiment of the present invention. The tissue identification device described below and the tissue identification method described above can be referenced to each other.

[0081] Please refer to Figure 7 , Figure 7 A schematic diagram of a structure of a tissue identification device provided by an embodiment of the present invention may include:

[0082] The undirected graph determination module 100 is used to generate an undirected graph according to the user association behavior information within a preset time window; wherein the user association behavior information is information representing the association between users, the nodes of the undirected graph represent users, and the information on the edges represents the degree of association between users;

[0083] A partitioning module 200 is used to perform community partitioning on the undirected graph according to the association degree by using a community discovery algorithm to determine a community set;

[0084] The organization determination module 300 is used to filter the non-aggregated communities in the community set according to the number of community nodes to obtain a target organization; wherein the non-aggregated community refers to a community with a number of community nodes less than a preset minimum number threshold.

[0085] It should be further explained that, based on the above embodiment, the above undirected graph determination module 100 may include:

[0086] A weight determination unit, used to determine the weight corresponding to the associated behavior information between each user; wherein the weight is determined according to the accuracy of determining the illegal behavior by the associated behavior information;

[0087] The edge weight determination unit is used to determine the weight of each edge in the undirected graph according to the weight corresponding to the associated behavior information between the users; wherein the information on the edge includes the weight of the edge.

[0088] It should be further explained that, based on any of the above embodiments, the above division module 200 may include:

[0089] A compactness determination unit, used to determine the compactness of nodes in the undirected graph according to the weight of the edge using the community discovery algorithm;

[0090] A community division unit is used to divide the undirected graph into communities according to the closeness and the central node to obtain the community set; wherein the central node includes a user associated with multiple users.

[0091] It should be further explained that, based on any of the above embodiments, the organization determination module 300 may include:

[0092] An initial organization determination unit, configured to filter non-aggregated communities in the community set using a preset community node quantity threshold to obtain an initial organization;

[0093] A relevance determination unit, configured to determine whether there are user nodes with low relevance in the initial organization by using a clustering radius threshold;

[0094] The target organization determination unit is used to eliminate user nodes with low relevance in the initial organization to obtain the target organization.

[0095] It should be further explained that, based on any of the above embodiments, the above tissue identification device may further include:

[0096] A risk level determination module, used to determine the risk level corresponding to each target organization according to the risk type of each user in the target organization;

[0097] The restriction request mode determination module is used to determine the restriction request mode corresponding to the risk level.

[0098] It should be further explained that, based on any of the above embodiments, the above tissue identification device may further include:

[0099] An organization association relationship determination module is used to determine whether there is an association relationship between target organizations based on association behavior information;

[0100] The organization aggregation module is used to aggregate target organizations with associated relationships to obtain large associated organizations;

[0101] The defense mode determination module is used to determine the defense mode corresponding to the large associated organization.

[0102] Further, based on any of the above embodiments, the above user behavior information includes at least one of a mobile phone number, a behavior track and an IP address.

[0103] It should be noted that the order of the modules and units in the above tissue identification device can be changed without affecting the logic.

[0104] The organization identification device provided by the embodiment of the present invention may include: an undirected graph determination module 100, which is used to generate an undirected graph according to user association behavior information within a preset time window; wherein the user association behavior information is information that characterizes the association between users, the nodes of the undirected graph represent users, and the information on the edges represents the degree of association between users; a division module 200, which is used to divide the undirected graph into communities according to the degree of association through a community discovery algorithm to determine a community set; an organization determination module 300, which is used to filter the non-aggregated communities in the community set according to the number of community nodes to obtain a target organization; wherein the non-aggregated community refers to a community whose number of community nodes is less than a preset minimum number threshold. Compared with the current method of filtering users only according to the request frequency of the current user, the method provided by the present application considers the user's association relationship in the process of judging the organization, so that even a newly registered user (for example, although the A node is newly registered, it has a certain association relationship with other nodes in the community), because it has an association relationship with the previous user, the user can be determined as a member of the organization according to the association relationship, thereby improving the accuracy of organization identification. In addition, this embodiment will promptly determine the weights corresponding to the associated behavior information between each user, and thus determine the weights (degree of association) of each edge based on the weights, so that the weights of the edges in the undirected graph are more accurate, thereby improving the accuracy of the undirected graph construction; and, this embodiment divides the community according to the central node. In a large-scale network, identifying the central node can reduce the number of nodes that need to be processed, thereby speeding up the community detection; and, by eliminating user nodes with low association in the initial organization, the accuracy of the target organization determination can be improved; and, by determining the restriction request method corresponding to the risk level, corresponding restrictions are imposed on the members of each organization, thereby improving network security and reducing network risks; and, through association analysis, the connection between multiple small-scale organizations can be identified, so that they can be regarded as a whole for attack, thereby avoiding one-by-one processing and improving the efficiency of the attack.

[0105] A tissue identification device provided by an embodiment of the present invention is introduced below. The tissue identification device described below and the tissue identification method described above can refer to each other.

[0106] Please refer to Figure 8 , Figure 8 A structural diagram of a tissue identification device provided by an embodiment of the present invention may include:

[0107] A memory 10, used for storing computer programs;

[0108] The processor 20 is used to execute a computer program to implement the steps of the above-mentioned tissue identification method.

[0109] The memory 10 , the processor 20 , and the communication interface 30 all communicate with each other via a communication bus 40 .

[0110] In the embodiment of the present invention, the memory 10 is used to store one or more programs, and the program may include program code, and the program code includes computer operation instructions. In the embodiment of the present invention, the memory 10 may store programs for implementing the following functions:

[0111] Generate an undirected graph based on the user association behavior information within a preset time window; wherein the user association behavior information is information representing the association between users, the nodes of the undirected graph represent users, and the information on the edges represents the degree of association between users;

[0112] According to the degree of association, the undirected graph is divided into communities through the community discovery algorithm to determine the community set;

[0113] The non-aggregated communities in the community set are filtered according to the number of community nodes to obtain the target organization; wherein the non-aggregated community refers to a community whose number of community nodes is less than a preset minimum number threshold.

[0114] In a possible implementation, the memory 10 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function, etc.; the data storage area may store data created during use.

[0115] In addition, the memory 10 may include a read-only memory and a random access memory, and provide instructions and data to the processor. A portion of the memory may also include an NVRAM. The memory stores an operating system and operating instructions, executable modules or data structures, or a subset thereof, or an extended set thereof, wherein the operating instructions may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic tasks and processing hardware-based tasks.

[0116] The processor 20 may be a central processing unit (CPU), an application specific integrated circuit, a digital signal processor, a field programmable gate array or other programmable logic device, a microprocessor or any conventional processor, etc. The processor 20 may call a program stored in the memory 10 .

[0117] The communication interface 30 may be an interface of a communication module, and is used to connect to other devices or systems.

[0118] Of course, it should be noted that Figure 8The structure shown does not constitute a limitation on the tissue identification device in the embodiment of the present invention. In actual applications, the tissue identification device may include Figure 8 More or fewer components than shown, or combinations of certain components.

[0119] The following is an introduction to a readable storage medium provided in an embodiment of the present invention. The readable storage medium described below and the tissue identification method described above can be referenced to each other.

[0120] The present invention also provides a readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above-mentioned tissue identification method are implemented.

[0121] The readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0122] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0123] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0124] Finally, it should be noted that, in this article, relationships such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variations are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0125] The above is a detailed introduction to a tissue identification method, device, equipment and readable storage medium provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A tissue identification method, characterized in that: include: Generate an undirected graph based on the user association behavior information within a preset time window; wherein the user association behavior information is information characterizing the association between users, the nodes of the undirected graph represent users, and the information on the edges represent the degree of association between users; Divide the undirected graph into communities by using a community discovery algorithm according to the degree of association, and determine a community set; The non-aggregated communities in the community set are filtered according to the number of community nodes to obtain a target organization; wherein the non-aggregated community refers to a community whose number of community nodes is less than a preset minimum number threshold.

2. The tissue identification method according to claim 1, characterized in that: The generating of an undirected graph according to the user association behavior information within a preset time window includes: Determine the weights corresponding to the associated behavior information between each user; wherein the weights are determined according to the accuracy of the associated behavior information in determining the illegal behavior; The weight of each edge in the undirected graph is determined according to the weight corresponding to the associated behavior information between the users; wherein the information on the edge includes the weight of the edge.

3. The tissue identification method according to claim 1, characterized in that: The step of dividing the undirected graph into communities by using a community discovery algorithm according to the degree of association to determine a community set includes: Determine the closeness of nodes in the undirected graph according to the weight of the edge using the community discovery algorithm; The undirected graph is divided into communities according to the closeness and the central node to obtain the community set; wherein the central node includes a user associated with multiple users.

4. The tissue identification method according to any one of claims 1 to 3, characterized in that: The filtering of the non-aggregated communities in the community set according to the number of community nodes to obtain the target organization includes: Using a preset community node quantity threshold to filter non-aggregated communities in the community set to obtain an initial organization; Determining whether there are user nodes with low association in the initial organization by using a clustering radius threshold; The user nodes with low association in the initial organization are eliminated to obtain the target organization.

5. The tissue identification method according to claim 1, characterized in that: After filtering the non-aggregated communities in the community set according to the number of community nodes to obtain the target organization, the method further includes: Determine the risk level corresponding to each target organization according to the risk type of each user in the target organization; Determine a restriction request method corresponding to the risk level.

6. The tissue identification method according to claim 1, characterized in that: After filtering the non-aggregated communities in the community set according to the number of community nodes to obtain the target organization, the method further includes: Determine whether there is a relationship between target organizations based on the association behavior information; Aggregate the target organizations with associated relationships to obtain large associated organizations; Determine a defense approach corresponding to the large associated organization.

7. The tissue identification method according to claim 1, characterized in that: The user behavior information includes at least one of a mobile phone number, a behavior track and an IP address.

8. A tissue identification device, characterized in that: include: An undirected graph determination module, used to generate an undirected graph based on user association behavior information within a preset time window; wherein the user association behavior information is information characterizing the association between users, the nodes of the undirected graph represent users, and the information on the edges represent the degree of association between users; A partitioning module, used to perform community partitioning on the undirected graph according to the degree of association by using a community discovery algorithm to determine a community set; The organization determination module is used to filter the non-aggregated communities in the community set according to the number of community nodes to obtain a target organization; wherein the non-aggregated community refers to a community with a number of community nodes less than a preset minimum number threshold.

9. A tissue identification device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the tissue identification method according to any one of claims 1 to 7 when executing the computer program.

10. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the tissue identification method according to any one of claims 1 to 7 are implemented.

Images