Abnormal behavior mining method and device, equipment and storage medium

Abstract

The invention provides an abnormal behavior mining method and apparatus, a device and a storage medium. The method comprises the steps of obtaining event information of an event corresponding to an abnormal behavior; based on an information extraction model, key information extraction is carried out on the event information to obtain key information, and the information extraction model is constructed on the basis of a large language model; performing relation mining based on the key information and the event information to obtain an execution group of the abnormal behaviors and a relation graph among members in the execution group; based on the key information, the execution group and the relation graph are visually displayed, so that processing personnel can clearly and visually know the mining degree of the abnormal behaviors and clearly know clues and suspicious members of event processing, the abnormal behaviors and the execution group can be accurately mined, the mining accuracy and efficiency are improved, and the mining efficiency is improved. The defect that accurate and rapid mining cannot be achieved in a traditional scheme is overcome, comprehensive mining and accurate mining of the abnormal behaviors are achieved, and guarantee is provided for property safety of the masses and social stability.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to an abnormal behavior mining method, device, equipment and storage medium. Background Art

[0002] With the rapid development of Internet technology, especially the widespread application of advanced technologies such as big data and artificial intelligence, activities related to abnormal network behavior are becoming increasingly rampant and covert, which not only seriously infringes on the property safety of the masses, but also affects social stability.

[0003] At present, the mining of abnormal behaviors mostly relies on set rules and statistical analysis, but these methods are unable to cope with complex and large data. Specifically, this type of method has difficulty in accurately identifying and extracting key behavioral features when dealing with semantically complex or implicit text information; at the same time, it is also highly dependent on manually designed features, which is not only time-consuming and labor-intensive, but also difficult to adapt to rapidly changing data patterns and new methods. In addition, the adaptability and scalability of traditional methods are limited. Faced with increasingly complex abnormal behaviors, their performance bottlenecks are becoming more and more obvious, making it difficult to meet the needs of various localities and departments to mine abnormal behaviors in a timely and accurate manner. Summary of the invention

[0004] The present invention provides an abnormal behavior mining method, device, equipment and storage medium, which are used to solve the defects of the prior art that abnormal behavior mining relies on set rules, has limited accuracy, flexibility and generalization ability, and cannot meet the needs of accurate and timely mining, realizes comprehensive mining and analysis of abnormal behaviors, and can intuitively display the execution groups of abnormal behaviors and the internal structure of the groups, thereby effectively improving the accuracy and efficiency of abnormal behavior mining.

[0005] The present invention provides an abnormal behavior mining method, comprising: Obtain event information of events corresponding to abnormal behaviors; Based on the information extraction model, extract key information from the event information to obtain key information, wherein the information extraction model is constructed based on a large language model; Performing relationship mining based on the key information and the event information to obtain the execution group of the abnormal behavior and the relationship map between members in the execution group; Based on the key information, the execution group and the relationship map are visualized.

[0006] According to an abnormal behavior mining method provided by the present invention, the event information includes a text describing event details; The key information is extracted from the event information based on the information extraction model to obtain the key information, including: Based on the information extraction model, entity extraction is performed on the event detail statement text, and relationship extraction is performed based on the event detail statement text and key entities obtained by entity extraction to obtain entity relationships between the key entities; The key information is determined based on the key entities and the entity relationships.

[0007] According to an abnormal behavior mining method provided by the present invention, based on the information extraction model, entity extraction is performed on the event detail statement text, and relationship extraction is performed based on the event detail statement text and key entities obtained by entity extraction to obtain entity relationships between the key entities, including: Determining a first prompt sentence based on the event details statement text; Inputting the first prompt sentence into the information extraction model to obtain the key entity output by the information extraction model; Determining a second prompt sentence based on the event details statement text and the key entity; Inputting the second prompt sentence into the information extraction model to obtain the entity relationship output by the information extraction model; Among them, the first prompt sentence is used to prompt the information extraction model to extract the key entity based on the event detail statement text, and the second prompt sentence is used to prompt the information extraction model to extract the entity relationship based on the event detail statement text and the key entity.

[0008] According to an abnormal behavior mining method provided by the present invention, the event information also includes a capital flow chart, and there are multiple events corresponding to the abnormal behavior; The performing of relationship mining based on the key information and the event information to obtain the execution group of the abnormal behavior and the relationship graph between members in the execution group includes: Based on the fund flow chart corresponding to each event, the events are associated to obtain the associated events in each event; Relationship mining is performed based on the key information corresponding to the associated events and the capital flow chart to obtain the execution group of the abnormal behavior and the relationship map between the members of the execution group.

[0009] According to an abnormal behavior mining method provided by the present invention, the event association is performed based on the fund flow chart corresponding to each event to obtain the associated events in each event, and then further includes: Perform commonality mining based on key information corresponding to the associated events to obtain common characteristics between the associated events; Based on the common characteristics between the associated events and the event detail statement texts corresponding to the associated events, behavior prediction is performed to obtain the action trend of the execution group of the abnormal behavior; Based on the action trend, an early warning is issued for the abnormal behavior.

[0010] According to an abnormal behavior mining method provided by the present invention, the relationship graph includes the role division and member relationship of each member; The visual display of the execution group and the relationship map based on the key information includes: Based on the key information, determining a suspected member who performs the abnormal behavior from the execution group; Based on the relationship graph and the event information, determining the abnormal behavior record of the suspected member, the role division of the suspected member, and the associated members in the execution group; Feature extraction is performed based on the abnormal behavior record, role division and associated members of the suspected member, and a portrait is portrayed based on the character features of the suspected member obtained by the feature extraction, and a portrait of the suspected member is obtained and displayed.

[0011] According to an abnormal behavior mining method provided by the present invention, obtaining and displaying the portrait of the suspected member includes: Obtaining processing information of the event corresponding to the abnormal behavior and status information of the suspected member; Based on the processing information, as well as the portrait and status information of the suspected member, an abnormal behavior map is generated and displayed.

[0012] The present invention also provides an abnormal behavior mining device, comprising: An acquisition unit, used to acquire event information of an event corresponding to an abnormal behavior; An extraction unit, configured to extract key information from the event information based on an information extraction model to obtain key information, wherein the information extraction model is constructed based on a large language model; A mining unit, configured to perform relationship mining based on the key information and the event information to obtain an execution group of the abnormal behavior and a relationship graph between members in the execution group; A display unit is used to visually display the execution group and the relationship map based on the key information.

[0013] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the abnormal behavior mining method as described above is implemented.

[0014] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the abnormal behavior mining method as described in any one of the above is implemented.

[0015] The abnormal behavior mining method, device, equipment and storage medium provided by the present invention extract key information from the event information of the event corresponding to the abnormal behavior based on the information extraction model, extract the key information of each event through efficient data mining and analysis, and mine the execution group and its internal structural relationship based on this, and obtain the relationship map between the members. Through the visual display of the execution group and the relationship map, the processing personnel can clearly and intuitively understand the mining degree of abnormal behavior, understand the clues and suspicious members of event processing, which is conducive to accurately mining abnormal behavior and execution groups, improving mining accuracy and efficiency, overcoming the defect of traditional solutions that cannot mine accurately and in real time, realizing comprehensive and accurate mining of abnormal behavior, and providing protection for the property safety of the masses and social stability. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1 It is a flow chart of the abnormal behavior mining method provided by the present invention; Figure 2 It is the overall framework diagram of the abnormal behavior mining method provided by the present invention; Figure 3 It is a structural schematic diagram of the abnormal behavior mining device provided by the present invention; Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] In recent years, network abnormal behaviors have become increasingly rampant, posing a serious threat to social stability and people's property safety. In this case, mining abnormal behaviors has become a top priority. However, despite the increasing mining efforts, there are still many problems with network abnormal behaviors with complex structures and many participants.

[0020] In the current mining of abnormal network behavior, key information extraction technology and knowledge graph technology are key and important cornerstones supporting research in this field. Among them, key information extraction technology extracts key information from massive data through data preprocessing, feature engineering, model training, evaluation and optimization, providing strong support for event processing. However, traditional methods have problems such as insufficient ability to understand complex texts, high dependence on manually designed features, limited adaptability and scalability, and performance bottlenecks. Knowledge graph technology realizes knowledge storage, query and analysis by constructing entity and relationship networks. However, traditional knowledge graph technology also faces challenges in processing complex relationships, large-scale data computing efficiency, and knowledge updating.

[0021] In this regard, the present invention provides an abnormal behavior mining method, which aims to analyze and process event information of events corresponding to abnormal behaviors, extract key information of each event through efficient data mining and analysis methods, and mine the execution group and its internal structural relationship based on this, and obtain the relationship map between each member. By displaying the execution group and the relationship map, it can greatly help relevant departments to identify and mine abnormal behaviors and execution groups, improve mining accuracy and efficiency, and provide protection for the property safety of the masses.

[0022] Figure 1 is a flow chart of the abnormal behavior mining method provided by the present invention, such as Figure 1 As shown, the method includes: Step 110, obtaining event information of an event corresponding to the abnormal behavior; Step 120, extracting key information from the event information based on the information extraction model to obtain key information, wherein the information extraction model is constructed based on the large language model; Step 130, performing relationship mining based on key information and event information to obtain an execution group of abnormal behavior and a relationship map between members in the execution group; Step 140 , based on the key information, visualize the execution groups and relationship graphs.

[0023] Specifically, taking into account the various problems existing in the key information extraction technology and knowledge graph technology on which the current abnormal behavior mining is based, such as insufficient ability to understand complex texts, lack of ability to process complex relationships, inefficient large-scale data calculations, high reliance on manually designed features, limited flexibility and generalization, etc., in the embodiments of the present invention, taking into account the powerful learning, understanding and data mining capabilities of the large model, it is proposed to perform abnormal behavior analysis based on the large model to achieve comprehensive mining of the execution group of abnormal behavior, and through the display of the relationship graph between the execution group and its members, make its internal structure clearer, which is more conducive to the relevant departments to conduct accurate mining, thereby improving the accuracy and efficiency of abnormal behavior mining.

[0024] Prior to this, what needs to be determined is the basis for abnormal behavior mining, that is, the information based on which the abnormal behavior is mined. In the embodiment of the present invention, the event corresponding to a type of abnormal behavior to be mined is used as a benchmark, and analysis is performed based on the event information to achieve the purpose of mining. Therefore, in the embodiment of the present invention, before performing abnormal behavior mining, the first thing that needs to be determined is the event information of the event corresponding to the abnormal behavior.

[0025] Here, there are generally multiple events corresponding to abnormal behavior, and there may be correlation between the events, or there may be no correlation. For example, there may be multiple correlated events corresponding to the abnormal behavior, or there may be multiple unrelated events, or there may be multiple events including both correlated events and unrelated events. The embodiments of the present invention do not make specific limitations on this. The event information may be a text describing the content of the corresponding event, such as a text describing the event details, an event outline, etc., or data indicating the flow of funds for the corresponding event, such as a fund flow chart, a fund conversion link, etc., or information about the relevant personnel of the corresponding event, event clues, etc. The embodiments of the present invention do not make specific limitations on this. The event information here may be provided by the application party, such as a local department, etc.

[0026] After obtaining the event information, in an embodiment of the present invention, information extraction can be performed based on the event information to extract the most critical parts, thereby obtaining the key information of each event. However, considering the shortcomings of current information extraction technology in dealing with massive and complex data, in an embodiment of the present invention, it is proposed to use a large model with powerful analysis and processing capabilities to extract key information to obtain the key information of each event.

[0027] Specifically, an information extraction model may be used here to extract event information from the event information of each event, so as to extract key points that are helpful for event processing, such as the time of the incident, the persons involved, the amount involved, the means adopted, etc., as well as the correlation between the key points, such as the relationship between the persons involved, the means adopted and the amount involved, the correlation between the persons involved, etc., so as to integrate the key information of each event.

[0028] For example, if the event information of an event includes "Under the guidance of member A, 5,000 yuan was transferred to account A and account B successively through a certain software", the key information can be extracted through the information extraction model to obtain "member A", "account A", "account B", "a certain software APP" and "5,000 yuan", as well as "member A-account A", "member A-account B" and "account A-account B", and the key information can be obtained after integration.

[0029] Among them, the information extraction model is constructed on the basis of a large language model (referred to as the large model), that is, the large language model can be directly used as the information extraction model, or the large language model can be structurally improved or parameterized to construct the information extraction model, and the embodiment of the present invention does not specifically limit this. Here, a large language model refers to a natural language processing (NLP) model with a large parameter scale, the number of model parameters and / or the complexity of the model structure exceeds a preset threshold, and the model processes large-scale text data in the pre-training stage and has the ability to understand and generate natural language. For example, a large language model may include a Spark large model, etc.

[0030] Moreover, due to the learning of a large amount of text data in the pre-training stage, the large language model has extraordinary learning, understanding, data analysis and mining capabilities, and can comprehensively and accurately mine important information from massive data. In the embodiment of the present invention, the information extraction model constructed on the basis of this large language model not only completely "inherits" its analysis and mining capabilities, but also optimizes and improves its capabilities in further fine-tuning training tasks, that is, it can extract key information from huge event information more quickly and accurately, avoiding the current problems of insufficient complex text understanding ability, lack of complex relationship processing ability, high reliance on manually designed features, limited flexibility and generalization ability in key information extraction, and improving the comprehensiveness and accuracy of the extracted key information.

[0031] Here, the key information extraction process based on the information extraction model can utilize the powerful capabilities of the large model in knowledge processing and language understanding to quickly extract information such as the persons involved, the means adopted, and the accounts flowing through from the huge data, and on this basis, obtain key information through its knowledge fusion capabilities, which greatly improves the efficiency and accuracy of information extraction, improves the quality of key information, lays the foundation for fast and accurate relationship mining, and provides data support for the precise mining of abnormal behaviors and their execution groups. In addition, compared with traditional means, the information extraction model used in the embodiment of the present invention has a strong generalization ability and can perform well in different types of abnormal behavior mining tasks.

[0032] Furthermore, after obtaining the key information of each event, in an embodiment of the present invention, this key information can be used to perform abnormal behavior mining to explore the execution group of the abnormal behavior and the role division, member relationship, etc. within the group; that is, based on the event information, in-depth relationship mining is performed guided by the key information of each event, so as to obtain the execution group of the abnormal behavior and the relationship map between the members in the execution group.

[0033] Specifically, the process of relationship mining here is to "unravel" the hidden member relationships in the event information based on the extracted key information. Specifically, under the guidance of the extracted key information, the hidden executors and the relationships between executors are mined from the huge event information, that is, the execution group and its group structure are mined, so as to obtain the relationship map between the execution group of abnormal behavior and its members. Here, the relationship map can be understood as a knowledge map that represents the role division of each member within the group and the relationship between members. The mining of the relationship map greatly helps the mining process of abnormal behavior, making the event clues clearer, the member relationships more intuitive, and easier to identify and mine the execution group of abnormal behavior, significantly improving the processing efficiency and mining capabilities.

[0034] After that, the mined execution groups and the relationship maps between the members of the execution groups can be visualized so that the processing personnel can understand the relationship between them more intuitively and clearly, and thus can carry out precise strikes based on this, that is, more comprehensively curb abnormal behaviors and break the execution groups of abnormal behaviors, thereby reducing the threat of abnormal behaviors to the property safety of the masses and the harm to social stability.

[0035] Among them, the visualization of the execution group of abnormal behavior and the relationship map can be achieved through the display of text and images. Specifically, key information can be used to process the execution group and the relationship map to obtain the core and focus of event processing and group mining, and text and images are generated based on this for display.

[0036] For example, key information can be used to obtain event clues from the execution group and relationship map, and the event clues can be displayed through text, images, etc.; or key information can be used to determine possible executors of abnormal behavior from the execution group, and the roles they play, associated members, etc. can be displayed through text, images, etc.

[0037] It should be noted that the display of event clues, roles, related members, etc. can be carried out on the basis of the relationship map, such as marking them on the relationship map, or it can be carried out separately, such as separately generating clue description text, clue travel images, related member maps, etc. The embodiments of the present invention do not make specific limitations on this.

[0038] The abnormal behavior mining method provided by the present invention extracts key information from event information of events corresponding to abnormal behaviors based on an information extraction model, extracts key information from the event information through efficient data mining and analysis methods, and mines the execution group and its internal structural relationship based on this, and obtains the relationship map between the members. Through the visual display of the execution group and the relationship map, the processing personnel can clearly and intuitively understand the mining degree of abnormal behaviors, understand the clues and suspicious members of event processing, which is conducive to accurately mining abnormal behaviors and execution groups, improves mining accuracy and efficiency, overcomes the defect of traditional solutions that cannot mine accurately in real time, realizes comprehensive mining and accurate mining of abnormal behaviors, and provides protection for the property safety of the masses and social stability.

[0039] Based on the above embodiment, the event information includes event details statement text; Step 120 includes: Based on the information extraction model, entity extraction is performed on the event detail statement text, and relationship extraction is performed based on the event detail statement text and the key entities obtained by entity extraction to obtain the entity relationship between the key entities; Determine key information based on key entities and entity relationships.

[0040] Specifically, in step 120, the process of extracting key information from event information according to the information extraction model to obtain key information may specifically include: First, based on the event information, the information extraction model can be used to extract entities to extract key entities from the event details text in the event information. Here, the powerful analysis and processing capabilities of the information extraction model are used to extract the most critical entity parts from the event details text in the event information of each event, such as the time of the incident, the persons involved, the amount involved, the means used, etc., so as to obtain the key entities corresponding to each event.

[0041] Subsequently, relationship extraction can be performed on the basis of the extracted key entities to obtain the entity relationships between the key entities corresponding to each event, that is, relationship extraction can be performed on the basis of the key entities corresponding to each event in combination with the event information of each event, so as to extract the relationship between entities from the event details statement text that describes the event details in the event information, thereby obtaining the entity relationships between the key entities. Here, specifically, based on the event details statement text as a benchmark, under the guidance of the corresponding key entity, the relationship between entities is extracted through the information extraction model, such as the relationship between the persons involved, the means used and the amount involved, the association between the persons involved, etc., thereby obtaining the entity relationships between the key entities output by the model.

[0042] After that, the key information corresponding to each event can be determined based on the extracted key entities and the entity relationships between the key entities, that is, the key entities corresponding to each event and the entity relationships between the key entities are integrated to obtain clear, complete, and key and core information that can fully reflect the corresponding events, that is, the key information of each event. Here, the information fusion process can be completed autonomously by the information extraction model. Through the powerful knowledge fusion ability of the information extraction model, the above information can be well integrated to obtain key information.

[0043] Based on the above embodiment, entity extraction is performed on the event detail statement text based on the information extraction model, and relationship extraction is performed based on the event detail statement text and the key entities obtained by the entity extraction to obtain entity relationships between the key entities, including: Determine a first prompt sentence based on the event details statement text; Inputting the first prompt sentence into the information extraction model to obtain the key entity output by the information extraction model; Determine a second prompt sentence based on the event details statement text and key entities; Inputting the second prompt sentence into the information extraction model to obtain the entity relationship output by the information extraction model; The first prompt statement is used to prompt the information extraction model to extract key entities based on the event detail statement text, and the second prompt statement is used to prompt the information extraction model to extract entity relationships based on the event detail statement text and key entities.

[0044] Specifically, the above process of using the information extraction model to extract entities and relations may include the following steps: Considering that the large language model used to construct the information extraction model has learned a large number of samples and language specifications during training, it has relatively strict requirements for input information, requiring that the input information must conform to the language form and specifications that it can receive and understand, so that it can correctly understand the input information and give a corresponding reply. Therefore, in the embodiment of the present invention, before using the information extraction model to extract key information, it is also necessary to convert the information based on the key information extraction into a form that the model can understand. For example, language standardization, expansion, highlighting key points, etc. can be performed to form a sentence that the information extraction model can understand, so as to prompt the information extraction model to perform the corresponding task and obtain the required reply.

[0045] In detail, in the embodiment of the present invention, the entity extraction task is performed first, so the event detail statement text based on which the entity extraction is based can be converted into a sentence that can be understood by the model, that is, the event detail statement text can be processed to generate a sentence for prompting the information extraction model to extract the entity, which is referred to as the first prompt sentence. The first prompt sentence here is essentially a kind of data carrying the event detail statement text of the event, for example, it can be prompt, which is data that the information extraction model can receive and understand, and based on this, the information extraction model can be prompted to extract the entity, so that the key entity output by the model can be obtained.

[0046] Subsequently, the first prompt sentence can be input into the information extraction model so that the information extraction model can automatically perform entity extraction based on the information carried by the first prompt sentence, such as the event details statement text carried, or the event details statement text carried and entity extraction requirements, and output the extracted entity, which is the key entity corresponding to the event details statement text.

[0047] Furthermore, after obtaining the key entity, in the embodiment of the present invention, a sentence for prompting the information extraction model to extract the relationship can be generated based on the key entity and the event detail statement text, which is referred to as the second prompt sentence. The second prompt sentence here is essentially a kind of data carrying the event statement text and the key entity, for example, it can be prompt, which is data that the information extraction model can receive and understand, and based on this, the information extraction model can be prompted to extract the relationship, so that the entity relationship between the key entities output by the model can be obtained.

[0048] After that, the second prompt statement can be input into the information extraction model so that the information extraction model can automatically perform relationship extraction based on the information carried by the second prompt statement, such as the event details statement text and key entities carried, or the event details statement text, key entities and relationship extraction requirements carried, and output the extracted entity relationships, so that the entity relationships between the key entities corresponding to each event can be obtained.

[0049] In the embodiment of the present invention, in the extraction of key information, the information extraction model can be directly guided to perform specific information extraction tasks through formalized language input (prompt statements), so that the information extraction process is more accurate and controllable, and output that is more in line with expectations can be obtained.

[0050] Based on the above embodiment, the event information also includes a fund flow chart, and there are multiple events corresponding to abnormal behavior; step 130 includes: Based on the fund flow chart corresponding to each event, the events are associated to obtain the associated events in each event; Relationship mining is performed based on the key information corresponding to the associated events and the capital flow chart to obtain the execution group of abnormal behavior and the relationship map between the members of the execution group.

[0051] Specifically, in step 130, the process of performing relationship mining based on key information and event information to obtain the execution group of abnormal behavior and the relationship map between members in the execution group may specifically include the following steps: First, event association can be performed based on event information to determine associated events, i.e., associated events, from among various events; here, the process of event association is to analyze the events using data in the event information that reflects the flow of funds for the corresponding events, i.e., a fund flow chart, so as to identify associated events among various events.

[0052] Here, we can specifically conduct in-depth analysis and mining based on the fund flow chart to capture the characteristics of the event, mine the commonalities between events, and thus identify the potential connections between them, and then determine the related events. For example, we can analyze the direction of funds in the event, the accounts through which they pass, and the accounts to which they are finally remitted, based on the fund flow chart of each event. Through this information, we can mine the connection between events. For example, if the funds of multiple events all flow to the same account, or if the funds of multiple events all pass through the same account, we can determine that there is a connection between these multiple events, which are related events.

[0053] Then, the event information of the associated events can be used to conduct relationship mining to obtain the execution group of abnormal behavior and the relationship map between the members in the execution group. That is, in-depth relationship mining can be carried out based on the key information of the associated events and the capital flow chart to explore the execution group and the role division and member relationship within the group, so as to obtain a relationship map.

[0054] Here, the process of relationship extraction can be carried out with the help of relationship network analysis tools. For example, based on the key information of the related events, the relationship network analysis tool developed by the graph database HugeGraph is used to conduct in-depth relationship mining, so as to mine the potential executors and the relationships between executors from the capital flow chart, that is, to mine the execution group and its group structure, so as to obtain the execution group of abnormal behavior and the relationship map between its members.

[0055] For example, when it is found that the funds of victims in multiple incidents all flow to the same account, these incidents can be linked. Furthermore, the key information and fund flow charts of these events can be used to mine the roles played by the members involved in the fund transactions in the related activities of the abnormal behavior, the relationships between members, etc., thereby revealing the internal structure of the group, and then obtaining the relationship map of the execution group of the abnormal behavior and its members.

[0056] Based on the above embodiment, event association is performed based on the fund flow chart corresponding to each event to obtain the associated events in each event, and then the following is further included: Conduct commonality mining based on the key information corresponding to the associated events to obtain the common characteristics between the associated events; Based on the common characteristics between related events and the event details statement text corresponding to the related events, behavior prediction is performed to obtain the action trend of the execution group of abnormal behavior; Based on action trends, early warning of abnormal behavior is provided.

[0057] Considering that most of the current abnormal behavior mining is based on analysis and mining of events that have already occurred, and there is rarely mining of situations that have not yet occurred, compared with situations that have already occurred, mining and issuing early warnings before abnormal behaviors occur can reduce property losses to a greater extent and avoid risks on a larger scale.

[0058] Based on this, in an embodiment of the present invention, after the events are associated according to the capital flow chart corresponding to each event and the associated events in each event are obtained, the information of the associated events can be used for further analysis to predict the activity trends, action ranges, trajectories, etc. of the group that performs the abnormal behavior, so that early warnings can be issued for the abnormal behavior that is about to be implemented, so as to remind relevant personnel to take precautions and avoid property losses.

[0059] Specifically, in an embodiment of the present invention, commonality mining is performed using key information of related events, so as to perform further mining after event association to mine the common characteristics between these related events. Specifically, the potential connections between different events can be discovered through data mining and association rule learning, thereby analyzing and obtaining common characteristics.

[0060] Furthermore, the common characteristics between related events can be used to predict behavior, so as to predict the action trajectory and activity trend of the execution group, and thus obtain the action trend of the predicted abnormal behavior execution group. Here, the event details statement text corresponding to the related events is used as the benchmark, and the behavior prediction is performed through the common characteristics between the related events to reveal the hidden group structure, activity trend, etc., and obtain the action trend of the execution group. After that, abnormal behavior warning can be carried out based on this action trend, so that relevant personnel can take precautions as soon as possible to avoid losses.

[0061] For example, when it is discovered that multiple abnormal behavior events in a certain place are related to the same execution group, the common characteristics of these events can be deeply analyzed through the key information corresponding to these events. On this basis, the event details statement text of the corresponding events can be combined to predict the future action trajectory, activity trend, etc. of the execution group, thereby obtaining the action trend.

[0062] In the embodiments of the present invention, the action trends are obtained through commonality mining and behavior prediction, which can not only accelerate the event handling process, but also provide early warning before or in the early stages of abnormal behavior, effectively reducing the danger of abnormal behavior to the property safety of the masses and the harm to social stability.

[0063] Based on the above embodiment, the relationship map includes the role division and member relationships of each member; Step 140 includes: Based on key information, identify suspected members who perform abnormal behaviors from the execution group; Based on the relationship map and event information, determine the abnormal behavior records of suspected members, the role division of suspected members and related members in the execution group; Feature extraction is performed based on the abnormal behavior records, role division and related members of the suspected member, and a portrait is portrayed based on the character characteristics of the suspected member obtained by the feature extraction, and a portrait of the suspected member is obtained and displayed.

[0064] Specifically, in step 140, the process of visually displaying the execution group and the relationship map according to the key information may include: After obtaining the execution group and the relationship map between the members in the execution group, when performing a visual display, in an embodiment of the present invention, the possible executors of abnormal behavior can be determined from the members in the execution group obtained by mining through key information, that is, the persons involved in the key information obtained by information extraction are used to determine the suspected members who performed abnormal behavior from the execution group. This step actually matches the suspected perpetrators in the key information with the members in the execution group to determine the matching members, that is, the suspected members.

[0065] Furthermore, the activity records of the suspected member, the role played by the suspected member in the related activities of each abnormal behavior, the division of labor in the execution group, and the relationship with other members can be found through the event information of the events in which the suspected member participated and the relationship map of the execution group, and finally the abnormal behavior records of the suspected member, the division of roles of the suspected member and the associated members in the execution group can be integrated.

[0066] After that, the suspected member can be visualized based on the information obtained in the previous step. The visualization here is essentially a graphical display, that is, feature extraction can be performed based on the abnormal behavior record, role division and related members of the suspected member, so as to obtain the character characteristics of the suspected member through the information related to the suspected member, that is, to capture the characteristics of the person through the information related to the person, such as behavior, personality, etc., so as to integrate and summarize the character characteristics. After that, a portrait can be portrayed based on this character feature to generate a portrait that matches the character feature, that is, the portrait of the suspected member, and it can be displayed.

[0067] In the embodiment of the present invention, the display of the portrait of the suspected member can enable the processing personnel to clearly and intuitively understand the key features, so that they can conduct accurate mining, thereby accelerating the event processing speed, improving the processing efficiency, and reducing the adverse effects caused by it.

[0068] Based on the above embodiment, obtaining and displaying a portrait of a suspected member includes: Obtain the processing information of the events corresponding to the abnormal behavior and the status information of the suspected members; Based on the processing information, as well as the portrait and status information of the suspected members, an abnormal behavior map is generated and displayed.

[0069] Specifically, the process of obtaining the portrait of the suspected member through portrait depiction and displaying the portrait may include: It can be understood that after obtaining the portrait of the suspected member, in order to facilitate the processing personnel to have a more comprehensive understanding of the situation of the incident, in the embodiment of the present invention, the event processing information and the status of the suspected member can be combined to present the entire event to show the overall picture of the event processing, so that the processing personnel can "see at a glance" the progress and core information of the event processing, which is more conducive to event processing.

[0070] That is, we can first obtain the current status of the event corresponding to the abnormal behavior, that is, the processing information of the event. This processing information can reflect the process and current status of the event processing, and at the same time, we can also obtain the status information of the suspected members, that is, the current status of the suspected personnel. Then, based on this processing information and the status information of the suspected members, combined with the portraits of the suspected members, we can generate the relevant knowledge graph of the entire event processing, that is, the abnormal behavior graph, and display it. Through the display of this abnormal behavior graph, the processing personnel can fully understand the relevant information of the event processing, clarify the degree of mining of the execution group of the abnormal behavior, and thus be more conducive to the establishment of the focus of the next step of work.

[0071] In the embodiment of the present invention, by combining the processing information of the event, the status information and portrait of the suspected member, an abnormal behavior map is generated and displayed, so that the processing personnel can clearly and intuitively understand the information of the event, so that they can more comprehensively curb the abnormal behavior, break the execution group of the abnormal behavior, and thus reduce the harm of the bad behavior.

[0072] Figure 2 It is the overall framework diagram of the abnormal behavior mining method provided by the present invention, such as Figure 2 As shown, the method includes: First, obtain the event information of the event corresponding to the abnormal behavior.

[0073] Then, based on the information extraction model, key information of the event information is extracted to obtain key information. The information extraction model is built on the basis of a large language model.

[0074] Here, based on the information extraction model, key information is extracted from the event information to obtain key information, including: based on the information extraction model, entity extraction is performed on the event detail statement text in the event information, and relationship extraction is performed based on the event detail statement text and the key entities obtained by entity extraction to obtain entity relationships between key entities; based on the key entities and entity relationships, key information is determined.

[0075] Among them, based on the information extraction model, entity extraction is performed on the event details statement text, and relationship extraction is performed based on the event details statement text and the key entities obtained by entity extraction to obtain the entity relationship between the key entities. Specifically, based on the event details statement text, a first prompt sentence is determined; the first prompt sentence is input into the information extraction model to obtain the key entity output by the information extraction model; based on the event details statement text and the key entity, a second prompt sentence is determined; the second prompt sentence is input into the information extraction model to obtain the entity relationship output by the information extraction model; wherein the first prompt sentence is used to prompt the information extraction model to extract the key entity based on the event details statement text, and the second prompt sentence is used to prompt the information extraction model to extract the entity relationship based on the event details statement text and the key entity.

[0076] Subsequently, relationship mining is performed based on key information and event information to obtain the execution group of abnormal behavior and the relationship map between members in the execution group.

[0077] Here, relationship mining is performed based on key information and event information to obtain the execution group of abnormal behavior and the relationship map between the members in the execution group. Specifically, event association is performed based on the capital flow chart in the event information of each event to obtain the associated events in each event; relationship mining is performed based on the key information and capital flow chart corresponding to the associated events to obtain the execution group of abnormal behavior and the relationship map between the members in the execution group.

[0078] Afterwards, based on the key information, the execution groups and relationship maps are visualized.

[0079] Here, the relationship map includes the role division and member relationships of each member; based on the key information, the execution group and the relationship map are visualized, including: based on the key information, determining the suspected member who performs abnormal behavior from the execution group; based on the relationship map and event information, determining the abnormal behavior record of the suspected member, the role division of the suspected member and the associated members in the execution group; based on the abnormal behavior record, role division and associated members of the suspected member, feature extraction is performed, and a portrait is portrayed based on the character features of the suspected member obtained by the feature extraction, and the portrait of the suspected member is obtained and displayed.

[0080] Among them, the portrait of the suspected member is obtained and displayed, specifically, the processing information of the event corresponding to the abnormal behavior and the status information of the suspected member are obtained; based on the processing information, the portrait and status information of the suspected member, an abnormal behavior map is generated and displayed.

[0081] Among them, based on the fund flow chart corresponding to each event, event association is performed to obtain the associated events in each event, and then it also includes: based on the key information corresponding to the associated events, commonality mining is performed to obtain the common characteristics between the associated events; based on the common characteristics between the associated events and the event detail statement text corresponding to the associated events, behavior prediction is performed to obtain the action trend of the group performing abnormal behavior; based on the action trend, early warning is given to abnormal behavior.

[0082] The method provided by the embodiment of the present invention extracts key information from the event information of the event corresponding to the abnormal behavior based on the information extraction model, extracts the key information of each event through efficient data mining and analysis, and mines the execution group and its internal structural relationship based on this, and obtains the relationship map between the members. Through the visual display of the execution group and the relationship map, the processing personnel can clearly and intuitively understand the degree of mining of abnormal behavior, understand the clues and suspicious members of event processing, which is conducive to accurately mining abnormal behavior and execution groups, improves mining accuracy and efficiency, overcomes the defect of traditional solutions that cannot mine accurately and in real time, realizes comprehensive and accurate mining of abnormal behavior, and provides protection for people's property safety and social stability.

[0083] The abnormal behavior mining device provided by the present invention is described below. The abnormal behavior mining device described below and the abnormal behavior mining method described above can be referred to each other.

[0084] Figure 3 Schematic diagram of the structure of the abnormal behavior mining device provided by the present invention. Figure 3 As shown, the device comprises: An acquisition unit 310 is used to acquire event information of an event corresponding to an abnormal behavior; An extraction unit 320, configured to extract key information from the event information based on an information extraction model to obtain key information, wherein the information extraction model is constructed based on a large language model; A mining unit 330 is used to perform relationship mining based on the key information and the event information to obtain the execution group of the abnormal behavior and the relationship map between the members in the execution group; The display unit 340 is used to visually display the execution group and the relationship map based on the key information.

[0085] The abnormal behavior mining device provided by the present invention extracts key information from the event information of the event corresponding to the abnormal behavior based on the information extraction model, extracts the key information of each event through efficient data mining and analysis, and mines the execution group and its internal structural relationship based on this, and obtains the relationship map between each member. Through the visual display of the execution group and the relationship map, the processing personnel can clearly and intuitively understand the mining degree of abnormal behavior, understand the clues and suspicious members of event processing, which is conducive to accurately mining abnormal behavior and execution groups, improving mining accuracy and efficiency, overcoming the defect of traditional solutions that cannot mine accurately and in real time, realizing comprehensive and accurate mining of abnormal behavior, and providing protection for people's property safety and social stability.

[0086] Based on the above embodiment, the event information includes a text describing the event details; The extraction unit 320 is used to: Based on the information extraction model, entity extraction is performed on the event detail statement text, and relationship extraction is performed based on the event detail statement text and key entities obtained by entity extraction to obtain entity relationships between the key entities; The key information is determined based on the key entities and the entity relationships.

[0087] Based on the above embodiment, the extraction unit 320 is used for: Determining a first prompt sentence based on the event details statement text; Inputting the first prompt sentence into the information extraction model to obtain the key entity output by the information extraction model; Determining a second prompt sentence based on the event details statement text and the key entity; Inputting the second prompt sentence into the information extraction model to obtain the entity relationship output by the information extraction model; Among them, the first prompt sentence is used to prompt the information extraction model to extract the key entity based on the event detail statement text, and the second prompt sentence is used to prompt the information extraction model to extract the entity relationship based on the event detail statement text and the key entity.

[0088] Based on the above embodiment, the event information also includes a fund flow chart, and there are multiple events corresponding to the abnormal behavior; the mining unit 330 is used to: Based on the fund flow chart corresponding to each event, the events are associated to obtain the associated events in each event; Relationship mining is performed based on the key information corresponding to the associated events and the capital flow chart to obtain the execution group of the abnormal behavior and the relationship map between the members of the execution group.

[0089] Based on the above embodiment, the mining unit 330 is further used for: Perform commonality mining based on key information corresponding to the associated events to obtain common characteristics between the associated events; Based on the common characteristics between the associated events and the event detail statement texts corresponding to the associated events, behavior prediction is performed to obtain the action trend of the execution group of the abnormal behavior; Based on the action trend, an early warning is issued for the abnormal behavior.

[0090] Based on the above embodiment, the relationship map includes the role division and member relationship of each member; the display unit 340 is used to: Based on the key information, determining a suspected member who performs the abnormal behavior from the execution group; Based on the relationship graph and the event information, determining the abnormal behavior record of the suspected member, the role division of the suspected member, and the associated members in the execution group; Feature extraction is performed based on the abnormal behavior record, role division and associated members of the suspected member, and a portrait is portrayed based on the character features of the suspected member obtained by the feature extraction, and a portrait of the suspected member is obtained and displayed.

[0091] Based on the above embodiment, the display unit 340 is used for: Obtaining processing information of the event corresponding to the abnormal behavior and status information of the suspected member; Based on the processing information, as well as the portrait and status information of the suspected member, an abnormal behavior map is generated and displayed.

[0092] Figure 4 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 4 As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430 and a communication bus 440, wherein the processor 410, the communication interface 420 and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the abnormal behavior mining method, which includes: obtaining event information of an event corresponding to the abnormal behavior; extracting key information from the event information based on an information extraction model to obtain key information, wherein the information extraction model is constructed based on a large language model; performing relationship mining based on the key information and the event information to obtain an execution group of the abnormal behavior and a relationship map between members in the execution group; and visually displaying the execution group and the relationship map based on the key information.

[0093] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0094] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the abnormal behavior mining method provided by the above-mentioned methods, and the method includes: obtaining event information of events corresponding to abnormal behaviors; based on an information extraction model, extracting key information from the event information to obtain key information, and the information extraction model is constructed on the basis of a large language model; based on the key information and the event information, performing relationship mining to obtain an execution group of the abnormal behavior and a relationship map between members in the execution group; based on the key information, visually displaying the execution group and the relationship map.

[0095] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the abnormal behavior mining method provided by the above-mentioned methods, the method comprising: obtaining event information of an event corresponding to the abnormal behavior; extracting key information from the event information based on an information extraction model to obtain key information, wherein the information extraction model is constructed based on a large language model; performing relationship mining based on the key information and the event information to obtain an execution group of the abnormal behavior and a relationship map between members of the execution group; and visually displaying the execution group and the relationship map based on the key information.

[0096] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0097] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0098] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for mining abnormal behavior, characterized in that: include: Obtain event information of events corresponding to abnormal behaviors; Based on the information extraction model, extract key information from the event information to obtain key information, wherein the information extraction model is constructed based on a large language model; Performing relationship mining based on the key information and the event information to obtain the execution group of the abnormal behavior and the relationship map between members in the execution group; Based on the key information, the execution group and the relationship map are visualized.

2. The abnormal behavior mining method according to claim 1, characterized in that: The event information includes a text describing the event details; The key information is extracted from the event information based on the information extraction model to obtain the key information, including: Based on the information extraction model, entity extraction is performed on the event detail statement text, and relationship extraction is performed based on the event detail statement text and key entities obtained by entity extraction to obtain entity relationships between the key entities; The key information is determined based on the key entities and the entity relationships.

3. The abnormal behavior mining method according to claim 2, characterized in that: The method of performing entity extraction on the event details statement text based on the information extraction model, and performing relationship extraction based on the event details statement text and key entities obtained by entity extraction to obtain entity relationships between the key entities includes: Determining a first prompt sentence based on the event details statement text; Inputting the first prompt sentence into the information extraction model to obtain the key entity output by the information extraction model; Determining a second prompt sentence based on the event details statement text and the key entity; Inputting the second prompt sentence into the information extraction model to obtain the entity relationship output by the information extraction model; Among them, the first prompt sentence is used to prompt the information extraction model to extract the key entity based on the event detail statement text, and the second prompt sentence is used to prompt the information extraction model to extract the entity relationship based on the event detail statement text and the key entity.

4. The abnormal behavior mining method according to claim 2, characterized in that: The event information also includes a fund flow chart, and there are multiple events corresponding to the abnormal behavior; The performing of relationship mining based on the key information and the event information to obtain the execution group of the abnormal behavior and the relationship graph between members in the execution group includes: Based on the fund flow chart corresponding to each event, the events are associated to obtain the associated events in each event; Relationship mining is performed based on the key information corresponding to the associated events and the capital flow chart to obtain the execution group of the abnormal behavior and the relationship map between the members of the execution group.

5. The abnormal behavior mining method according to claim 4, characterized in that: The event association is performed based on the fund flow chart corresponding to each event to obtain the associated events in each event, and then further includes: Perform commonality mining based on key information corresponding to the associated events to obtain common characteristics between the associated events; Based on the common characteristics between the associated events and the event detail statement texts corresponding to the associated events, behavior prediction is performed to obtain the action trend of the execution group of the abnormal behavior; Based on the action trend, an early warning is issued for the abnormal behavior.

6. The abnormal behavior mining method according to any one of claims 1 to 5, characterized in that: The relationship map includes the role division and member relationships of each member; The visual display of the execution group and the relationship map based on the key information includes: Based on the key information, determining a suspected member who performs the abnormal behavior from the execution group; Based on the relationship graph and the event information, determining the abnormal behavior record of the suspected member, the role division of the suspected member, and the associated members in the execution group; Feature extraction is performed based on the abnormal behavior record, role division and associated members of the suspected member, and a portrait is portrayed based on the character features of the suspected member obtained by the feature extraction, and a portrait of the suspected member is obtained and displayed.

7. The abnormal behavior mining method according to claim 6, characterized in that: The obtaining and displaying of the portrait of the suspected member includes: Obtaining processing information of the event corresponding to the abnormal behavior and status information of the suspected member; Based on the processing information, as well as the portrait and status information of the suspected member, an abnormal behavior map is generated and displayed.

8. An abnormal behavior mining device, characterized in that: include: An acquisition unit, used to acquire event information of an event corresponding to an abnormal behavior; An extraction unit, configured to extract key information from the event information based on an information extraction model to obtain key information, wherein the information extraction model is constructed based on a large language model; A mining unit, configured to perform relationship mining based on the key information and the event information to obtain an execution group of the abnormal behavior and a relationship graph between members in the execution group; A display unit is used to visually display the execution group and the relationship map based on the key information.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the abnormal behavior mining method according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the abnormal behavior mining method according to any one of claims 1 to 7 is implemented.

Images