Abnormal synchronization behavior identification method and device, computer equipment and storage medium

Abstract

The invention relates to the field of big data and financial science and technology, and discloses an abnormal synchronization behavior recognition method and device, computer equipment and a storage medium. The method comprises the following steps: acquiring a user set for executing a target event; analyzing the behavior similarity of executing the target event among the users in the user set within the specified time; and judging whether the corresponding user has an abnormal synchronization behavior or not according to the behavior similarity. According to the method and the device, the similarity of the behaviors of executing the same event among the users within the same time is detected, so that whether the target event executed among the users has synchronism or not is conveniently judged, accurate identification of abnormal synchronization behaviors is realized, abnormal users or abnormal groups can be mined from like, comments, transactions or other behaviors which occur synchronously, and the user experience is improved. And the complexity of anomaly identification is greatly reduced, so that the spreading of black industry is effectively restrained, and the financial network environment is prevented from being invaded by fraud activities.

Description

Technical Field

[0001] The present invention relates to the fields of big data and financial technology, and in particular to a method, device, computer equipment and storage medium for identifying abnormal synchronous behavior. Background Art

[0002] In the context of the current deep integration of science and technology and finance, the cyber black industry has shown a trend of industrialization, chainization and specialization, and its cheating methods and tools are becoming increasingly diverse, greatly increasing the difficulty of anti-fraud work. Many professional hackers and black industry participants use fraudulent means to make illegal profits. In order to maximize illegal profits, they usually manipulate malicious accounts, conduct a large number of simultaneous logins, false likes, false comments, false transactions and other abnormal behaviors with a certain degree of synchronization, which seriously affects the security of financial networks.

[0003] In order to combat the black industry and maintain network security, this field often uses a clustered identification strategy to monitor a large number of accounts based on the same IP address or device ID information for business data, transaction data or other data to identify malicious accounts. However, with the continuous evolution of black industry technology, especially the application of technologies such as one-click new machine and instant IP dialing, the black industry can achieve a one-to-one binding of accounts, IPs and devices to circumvent traditional monitoring methods, thereby significantly reducing the accuracy of abnormal identification. Summary of the invention

[0004] The present invention provides an abnormal synchronous behavior recognition method, an apparatus, a computer device and a storage medium to solve the technical problem that the recognition result of the aggregation recognition method based on IP address and device ID is poor in accuracy.

[0005] In a first aspect, a method for identifying abnormal synchronization behavior is provided, comprising:

[0006] Get the user set that executes the target event;

[0007] Analyze the similarity of behaviors of executing target events between users in the user set within a specified time period;

[0008] It is determined whether the corresponding user has abnormal synchronization behavior based on the behavior similarity.

[0009] In a second aspect, a device for identifying abnormal synchronous behavior is provided, comprising:

[0010] A data acquisition module is used to obtain a set of users who execute a target event;

[0011] A data analysis module, used to analyze the similarity of behaviors of executing target events between users in the user set within a specified time;

[0012] The abnormality determination module is used to determine whether the corresponding user has abnormal synchronization behavior based on the behavior similarity.

[0013] In a third aspect, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned abnormal synchronization behavior identification method when executing the computer program.

[0014] In a fourth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned abnormal synchronization behavior identification method are implemented.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention detects the behavioral similarities of users performing the same event at the same time, so as to determine whether the target event is executed synchronously between users, thereby realizing accurate identification of abnormal synchronous behaviors, and helping to discover abnormal users or abnormal groups from synchronously occurring likes, comments, transactions or other behaviors, thereby greatly reducing the complexity of abnormal identification, thereby effectively curbing the spread of the black industry and ensuring that the financial network environment is free from fraudulent activities.

[0016] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the following preferred embodiments are specifically cited and described in detail as follows. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 is a schematic diagram of an application environment of an abnormal synchronization behavior identification method in an embodiment of the present invention;

[0018] Figure 2 is a flow chart of a method for identifying abnormal synchronization behavior in one embodiment of the present invention;

[0019] Figure 3 yes Figure 2 A schematic flow chart of a specific implementation of step S20;

[0020] Figure 4 yes Figure 3 A schematic flow chart of a specific implementation of step S25;

[0021] Figure 5 yes Figure 4 A schematic flow chart of a specific implementation of step S253;

[0022] Figure 6 yes Figure 4 A schematic flow chart of a specific implementation of step S254;

[0023] Figure 7 is a structural schematic diagram of an abnormal synchronous behavior identification device in one embodiment of the present invention;

[0024] Figure 8 is a schematic diagram of a structure of a computer device in one embodiment of the present invention;

[0025] Fig. 9 It is another structural schematic diagram of a computer device in one embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solution and advantages of the present invention clearer, the present invention is further described in detail in conjunction with the accompanying drawings and specific implementation methods. The technical solution in the embodiment of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0028] It should also be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, the singular forms "a", "an" and "the" are intended to include plural forms unless the context clearly indicates otherwise.

[0029] It should be further understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0030] See also Figure 1 and Figure 2 , Figure 1A schematic diagram of an application scenario of an abnormal synchronous behavior identification method provided by an embodiment of the present invention. Among them, the client communicates with the server through a network and transmits data information to the server. The server can obtain and store the data information of the client through the network, such as user information, transaction information, etc. The server can also obtain the user set that executes the target event from the stored data information, and analyze the behavioral similarity of executing the target event between users in the user set within a specified time, and judge whether the corresponding user has abnormal synchronous behavior according to the behavioral similarity, so as to detect the behavioral similarity of executing the same event between users in the same time, so as to determine whether the target event executed between users has synchronization, and ensure the accuracy of identifying abnormal synchronous behavior, which helps to start from the likes, comments, transactions or other behaviors that occur synchronously, and mine abnormal users or abnormal groups, greatly reducing the complexity of abnormal identification, thereby effectively curbing the spread of black industries and ensuring that the financial network environment is free from fraudulent activities. Among them, the client can be but not limited to various personal computers, laptops, smart phones, tablet computers and portable wearable devices. The server can be implemented with an independent server or a server cluster composed of multiple servers. The present invention is described in detail below through specific embodiments.

[0031] See also Figure 2 As shown, Figure 2 A schematic flow chart of an abnormal synchronization behavior identification method provided by an embodiment of the present invention. The abnormal synchronization behavior identification method comprises the following steps:

[0032] S10: Obtain a set of users who execute the target event.

[0033] The abnormal synchronous behavior identification method provided by the present invention selects sample data based on specific application scenarios, such as account transfer-in and transfer-out scenarios. In actual applications, some platforms usually provide some rewards when users transfer-in and transfer-out in order to activate users. In order to obtain a large number of these rewards, the accounts of the black industry will trade in large quantities and frequently. Collect all users who have executed specific events in the transfer-in and transfer-out scenarios, for example, obtain all users who have executed transfer-out events, so as to analyze the abnormal synchronous behavior of the users therein. In addition, the target events include but are not limited to: likes, comments, transactions and related events.

[0034] S20: Analyze the similarity of the behaviors of executing the target event between users in the user set within a specified time.

[0035] The behavior similarity in this embodiment refers to the similarity between two users in performing the same event at the same time. For example, user A and user B both perform the same number of transactions within a specified time T.

[0036] After obtaining the set of users who executed the target event, a specified time is selected to perform a preliminary screening of the users in the user set, and users who do not execute the target event within the specified time are screened out. All users who have executed the target event are compared for behavioral similarity until all users are compared. By analyzing the behavioral similarity between users in the time dimension, it is possible to avoid dependence on user IP addresses and device IDs, and adapt to changes in black industry means. Even if the black industry can achieve a one-to-one binding of accounts with IPs and devices, the present invention can still reveal the behavioral correlation and synchronization between abnormal users through the analysis of behavioral similarity, thereby maintaining an effective crackdown on the black industry.

[0037] Specifically, the user set of this embodiment includes a user identification, user information, and an event occurrence time set associated with the user.

[0038] The user set is a set of user data. The data associated with each user includes user identification, user information and event occurrence time set. User identification is used to identify the identity of the user, such as user ID. One user identification corresponds to one user. The number of user identifications in the user set represents the number of users in the set. User information includes but is not limited to mobile phone number, mobile phone number segment, IP address, device ID, device fingerprint and other characteristic parameters. User information is used to assist in the similarity of behavior to determine whether there is abnormal synchronization behavior between users, thereby improving the accuracy of identifying abnormal synchronization behavior. The event occurrence time set is a set of event occurrence times. It can be understood that the number of event occurrence times in the event occurrence time set can be one or more. When a user executes a target event once, an event occurrence time information is generated, that is, the number of event occurrence times represents the number of times the user executes the target event. By comparing the event occurrence times between users within a specified time, it is possible to preliminarily understand whether there is abnormal synchronization behavior between users.

[0039] The following is an implementation example for getting user data from the users collection:

[0040] user_id var

[0041] 1mobile:1307639****

[0042] 1mobile_front:1307639

[0043] 1ip:116.**.14*.243

[0044] 1device_id:94d25c90f3fdeb23b2115dd89e9e50f4e

[0045] 1time:2023-04-1907:10:04

[0046] 2mobile:1897638****

[0047] 2mobile_front:1897638

[0048] 2ip:120.23*.0.3**

[0049] 2device_id: 9950f323a0641e1da8453a1ca41ca1ead

[0050] 2time:2023-04-1911:16:08

[0051] 3mobile:1367636****

[0052] 3mobile_front:1367636

[0053] 3ip:117.28.***.2**

[0054] 3device_id: 3c9b1baae9fa0a24c589acb0ebe00161f

[0055] 3time:2023-04-1913:18:12

[0056] Among them, user_id is the user identifier, that is, the user ID. var is the variable of user data, including: mobile (mobile phone number), mobile_front (mobile phone number segment), ip (IP address), device_id (device ID), time (event occurrence time).

[0057] In practical applications, mobile phone numbers can be used as the user's unique identifier. Mobile phone numbers are highly practical and can be applied to a variety of application scenarios. The user identifier is consistent with a feature in the user information, which can reduce the amount of data transmitted and improve the efficiency of data transmission and processing to a certain extent.

[0058] In some embodiments of the present invention, Figure 3 As shown, a specific behavior similarity analysis scheme is provided, in S20, that is, analyzing the behavior similarity of executing the target event between users in the user set within a specified time, specifically including the following steps S21-S25.

[0059] S21: Acquire the number of event occurrence times in the event occurrence time set to obtain the total number of times the user executes the target event.

[0060] Each time a user executes a target event, a record of the event occurrence time is generated. Therefore, the number of event occurrence times in the corresponding event occurrence time set can be used to represent the total number of times the user executes the target event. The event occurrence time can be used to divide time, which can be used as a basis for preliminary screening of users and as a basis for the total number of times users execute target events. It can reduce the amount of data transmission and avoid analyzing too much data, which makes the overall recognition process time-consuming.

[0061] S22: Select any event occurrence time in the event occurrence time set, and slice the event occurrence time to obtain a time slice.

[0062] This embodiment adopts the idea of ​​synchTrap algorithm, slices the event occurrence time, and then aggregates the users. Time slicing refers to capturing and recording an object, phenomenon or behavior at a specific time point or time period; the time slice of this embodiment is used to segment the event occurrence time, so as to more carefully observe and analyze the changes of user behavior at different time points.

[0063] In specific implementation, different methods of selecting slicing time are used based on different target events. The following is an implementation example of slicing the transaction event occurrence time using 1 minute as a time slice length:

[0064] The event occurrence time in the time format of 2024-04-1915:28:21 is sliced ​​into 2024041915(28)-2024041915(29). A time slice of 1 minute in length is obtained. The time slice is used as the primary key to integrate the data of multiple users in order to calculate the behavioral similarity between users within this 1 minute.

[0065] It is understandable that before step S22, the user may be screened twice. Specifically, the user may be screened twice, including the following steps:

[0066] Preset execution count threshold;

[0067] Compare the total number of times with the execution number threshold, and if the total number of times is lower than the execution number threshold, determine that the user is a regular user;

[0068] The regular users are filtered out from the user set.

[0069] For example, based on transaction events, the execution count threshold is set to 20 times, that is, the total number of times a user executes a transaction event does not exceed 20 times. It can be determined that the user does not have abnormal behaviors such as high brushing and is a regular user. Regular users do not need to perform behavioral similarity analysis within the time slice, which reduces the number of users to be analyzed, greatly shortens the analysis time, and effectively improves the analysis efficiency of behavioral similarity between users.

[0070] S23: Counting the number of times the user identifiers co-occur between users in the time slice.

[0071] In specific implementation, the number of times the user ID of each user appears in the time slice is counted in advance; the number of times the user ID of each user appears in the time slice is then compared in pairs; and finally the number of times the two users appear together is recorded. For example, the statistical result is 1307639****,1897638****,10, that is, two users with mobile phone numbers 130****1407 and 131****6068 appear together 10 times in the same time slice.

[0072] Each time a user executes a target event, the event occurrence time and the user ID are recorded once. In this embodiment, the number of times the user ID appears reflects the number of times the user executes the target event within the time slice. The number of times the user ID appears can also reflect the direct connection between the corresponding event occurrence time and the user, which is intuitive and reduces the difficulty of data analysis.

[0073] S24: Calculate the Jaccard similarity coefficient between every two of the users according to the number of occurrences of the user identifiers in the time slice and the total number of occurrences.

[0074] Although the number of times all users executed the target event within the time slice was counted separately, there are certain limitations in calculating the behavior similarity based solely on the number of times in the time slice. For example, if both user A and user B completed 10 transaction events within the time slice, it is difficult to exclude the impact of accidental events on the analysis results, so it is not possible to directly determine that user A and user B have abnormal synchronous behavior. However, if user A executes transaction events 15 times in total, and each time the behavior of executing a transaction event occurs at the same time as each time the behavior of user B executes a transaction event, it can be determined that there is a large abnormal behavior synchronization between user A and user B. Therefore, the Jaccard similarity coefficient between users is calculated to exclude the impact of accidental events on the analysis results.

[0075] Among them, the Jaccard similarity coefficient is an indicator used to measure the similarity between two sets. It is defined as the size of the intersection of two sets divided by the size of their union, and its value is between 0 and 1. The higher the Jaccard similarity coefficient, the more similar the two sets are.

[0076] The following is an implementation example of calculating the Jaccard similarity coefficient:

[0077] Set A={a,b,b,b,b,b,b,b,b,b,b};

[0078] Set B = {b,b,b,b,b,b,b,b,b,c,d};

[0079] Each element in the set represents a target event executed by a user. For ease of understanding, elements a, b, and c represent records of target event executions in different time slices. Specifically, set A is a set of the number of times user C executes a target event, which means that user C executes a target event once in time slice a and 10 times in time slice b. Set B is a set of the number of times user D executes a target event, which means that user D executes 10 target events in time slice b, 1 target event in time slice c, and 1 target event in time slice d. That is, the total number of times user C executes transaction events is 11 times, and the total number of times user D executes transaction events is 12 times; in time slice b, C executes transaction events 10 times, and user D also executes transaction events 10 times.

[0080] According to the intersection and union of set A and set B:

[0081] A∩B={b,b,b,b,b,b,b,b,b,b};

[0082] A∪B={a,b,b,b,b,b,b,b,b,b,b,c,d};

[0083] We can get |A∩B|=10, |A∪B|=13;

[0084] The calculation formula of Jaccard similarity coefficient is:

[0085]

[0086] The Jaccard similarity coefficient between user C and user D is:

[0087]

[0088] Among them, the higher the Jaccard similarity coefficient is, the higher the behavioral similarity between user C and user D is.

[0089] It is understandable that, before step S24, further screening of users may be performed. The specific steps include: presetting a time slice execution threshold; comparing the number of times the user identifier appears in the time slice with the time slice execution threshold, and if the number of times the user identifier appears in the time slice is lower than the time slice execution threshold, the corresponding user is screened out from the user set. Screening out users who execute the target event less times in the specified time slice can reduce the amount of calculation of the Jaccard similarity coefficient, effectively improving the analysis efficiency of behavior similarity, so that the abnormal synchronous behavior recognition method of this embodiment is suitable for the analysis of large-scale data.

[0090] S25: Determine the behavior similarity of executing the target event between users according to the Jaccard similarity coefficient.

[0091] In specific implementation, the higher the Jaccard similarity coefficient is, the higher the similarity of the behaviors of users in executing the target event is, and the higher the risk that there is abnormal synchronization behavior between the corresponding users and the corresponding users are abnormal users is.

[0092] In some embodiments of the present invention, Figure 4 As shown, a solution for specifically determining the behavioral similarity between users is provided. In S25, the behavioral similarity between users in executing the target event is determined based on the Jaccard similarity coefficient, which specifically includes the following steps S251-S254.

[0093] S251: pre-set a similarity coefficient threshold, and compare the Jaccard similarity coefficient with the similarity coefficient threshold.

[0094] S252: If the Jaccard similarity coefficient exceeds the similarity coefficient threshold, the corresponding user is marked as a suspected abnormal user, all suspected abnormal users are grouped into a suspected abnormal group, and the row of the corresponding target event executed by the suspected abnormal user is determined as a suspected abnormal synchronization behavior.

[0095] For example, if the similarity coefficient threshold is set to 0.7, and the Jaccard similarity coefficient between user A and user B exceeds 0.7, then user A and user B are marked as suspected abnormal users. If the Jaccard similarity coefficient between user A and user C also exceeds 0.7, and the Jaccard similarity coefficient between user D and user E also exceeds 0.7, then user C, user D, and user E are also marked as suspected abnormal users, and user A, user B, user C, user D, and user E are associated as a suspected abnormal group.

[0096] Steps S251-S252 implement a preliminary judgment on abnormal synchronization behaviors between corresponding users, so as to track, monitor or restrict suspected abnormal users, thereby ensuring the security of the financial network.

[0097] S253: constructing a relationship connectivity graph according to the user identification of the suspected abnormal user, the Jaccard similarity coefficient and / or the user information.

[0098] The relationship connectivity graph is an effective tool for intuitively displaying the correlation and synchronization of behaviors between users. The relationship connectivity graph of this embodiment presents the abnormal synchronous behavior relationship between users in the form of nodes and connecting edges. Each node represents a suspected abnormal user, and the connecting edges between nodes represent the similarity of these users. The relationship connectivity graph has visualization characteristics, which helps to quickly discover and locate black production gangs, and can also reveal the abnormal user behavior or information means used by black production gangs, providing strong support for subsequent tracking and crackdowns, and enhancing the practicality of the abnormal synchronous behavior identification method provided by the present invention.

[0099] See also Figure 5 As shown, step S253, i.e., constructing a relationship connectivity graph according to the user identification of the suspected abnormal user, the Jaccard similarity coefficient and / or the user information, includes the following steps S2531-S2534.

[0100] S2531: Setting a node of the relationship connectivity graph based on the user identifier;

[0101] S2532: Create a connection edge between the nodes corresponding to the two suspected abnormal users whose Jaccard similarity coefficient exceeds the similarity coefficient threshold.

[0102] For steps S2531-S2532, when constructing the relationship connectivity graph, first create nodes based on the user identifications of the suspected abnormal users, and then for each pair of suspected abnormal users, if the Jaccard similarity coefficient between them exceeds the preset similarity coefficient threshold, draw a connection edge connecting their corresponding nodes.

[0103] S2533: Obtain all parameters in the user information, and combine the parameters in pairs to form corresponding additional constraints.

[0104] S2534: Create a connection edge between the nodes corresponding to the two suspected abnormal users that have consistent additional constraints.

[0105] For steps S2533-S2534, the parameters are combined in pairs to form additional constraints, which can derive new information features. By comparing the new information features, the information correlation between users is analyzed, which makes up for the defect of the singleness of the traditional information feature clustering identification method, improves the richness of anomaly identification means, and further enhances the information density and accuracy of the relationship connectivity graph.

[0106] In this embodiment, the parameters include: mobile phone number segment, IP address and device ID. The mobile phone number segment, IP address and device ID are combined in pairs to obtain the following three additional constraints: mobile phone number segment-IP address, IP address-device ID, device ID-mobile phone number segment, and then a connection edge is created based on the additional constraints. For example, if the mobile phone number segment and IP address of two suspected abnormal users are the same, a connection edge is drawn for the corresponding two nodes.

[0107] Specifically, the number of connecting edges is used as the weight. For example, between user A, user B, and user C, if the "mobile phone number segment-IP address" between user A and user B is the same, then the nodes corresponding to user A and user B are connected by an edge and the weight of the edge is 1; if the "mobile phone number segment-device ID" and "IP address-device ID" between user A and user C are the same, then user A and user C are connected by an edge and the weight is 2.

[0108] S254: Perform community division on the relationship connectivity graph to determine abnormal communities.

[0109] In the relationship connectivity graph, community division helps to identify user groups with close associations and high behavioral similarities, namely abnormal communities. The abnormal communities in this embodiment represent potential black market gangs.

[0110] Specifically, this embodiment divides the relationship connectivity graph into communities through the Louvain algorithm. The Louvain algorithm is a community discovery algorithm based on modularity optimization. Its core idea is to maximize the modularity of the entire network to divide the community. Modularity is an indicator to measure the quality of community division, and its value is between [-1,1]. The larger the value of modularity, the better the effect of community division. The Louvain algorithm continuously adjusts the community affiliation of nodes in an iterative manner, so that the modularity of the entire network is maximized, which is highly efficient.

[0111] In addition, the Louvain algorithm has the following advantages:

[0112] No need to specify the number of communities: Compared with other algorithms that require the number of communities to be specified in advance, the Louvain algorithm does not need to specify the number of communities and can automatically divide the appropriate number of communities according to the topological structure of the network.

[0113] The results are highly interpretable: The community structure divided by the Louvain algorithm is clear and easy to analyze and mine. At the same time, the algorithm can also output the community belonging information of each node, which facilitates the subsequent community analysis.

[0114] See also Figure 6 As shown, in step S254, the relationship connectivity graph is divided into communities using the Louvain algorithm, including the following steps S2541-S2545.

[0115] S2541: Divide each node in the relationship connectivity graph into initial communities.

[0116] S2542: Add each node to the community where the adjacent node is located in turn, and calculate the modularity index increment of the initial community before and after adding the community to which each adjacent node belongs, and record the neighbor node corresponding to the maximum modularity index increment. If the modularity index increment is greater than zero, assign the node to the community to which the neighbor node belongs, otherwise keep the initial community unchanged.

[0117] Steps S2541-S2542 are the modularity optimization stage of the Louvain algorithm, which is used to determine the community to which each node belongs. Step S2542 is performed sequentially until the communities to which all nodes belong no longer change.

[0118] S2543: When the communities to which all nodes belong no longer change, compress the relationship connectivity graph, compress all nodes under the communities into a super node, and convert the connection edge weights between nodes in the community into the ring weights of the super node, and convert the connection edge weights between communities into the connection edge weights between super nodes, so as to obtain a stable community.

[0119] After the modularity optimization phase is completed, each community formed is regarded as a super node to reconstruct the entire network. It is determined whether the modularity of the reconstructed network no longer changes or reaches a preset number of iterations. If so, it is a stable community; if not, steps S2541-S2543 are repeated to repeat the modularity optimization phase and the network cohesion phase for the reconstructed network until the modularity of the entire network no longer changes or reaches a preset number of iterations, and finally a stable community is obtained.

[0120] S2544: Calculate the total number of nodes in each of the stable communities.

[0121] S2545: Mark the stable community whose total number of nodes exceeds a preset node threshold as an abnormal community, and mark the suspected abnormal users corresponding to the nodes in the abnormal community as abnormal users.

[0122] In specific implementation, if the preset node threshold is set to 200, all communities with more than 200 nodes in all stable communities will be judged as abnormal communities, that is, black market gangs.

[0123] The stable community obtained by the Louvain algorithm is a group with high behavioral similarity and high information correlation between users. The group and the users within the group are tracked, monitored or punished to crack down on black industry gangs and clean up the financial network environment.

[0124] It can be seen that in the above scheme, by detecting the behavioral similarity of the same event executed by users at the same time, and then determining whether the execution of the target event between users is synchronous, accurate identification of abnormal synchronous behavior is achieved, which helps to discover abnormal users or abnormal groups starting from the likes, comments, transactions or other behaviors that occur synchronously, greatly reducing the complexity of anomaly identification, thereby effectively curbing the spread of the black industry and ensuring that the financial network environment is free from fraudulent activities.

[0125] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0126] In one embodiment, the present invention provides an abnormal synchronization behavior recognition device, which corresponds one-to-one to the abnormal synchronization behavior recognition method in the above embodiment. Figure 7 As shown, the abnormal synchronous behavior recognition device includes a data acquisition module 101, a data analysis module 102 and an abnormality determination module 103. The detailed description of each functional module is as follows:

[0127] The data acquisition module 101 is used to acquire a set of users who execute a target event;

[0128] The data analysis module 102 is used to analyze the similarity of the behaviors of executing the target event between users in the user set within a specified time;

[0129] The abnormality determination module 103 is used to determine whether the corresponding user has abnormal synchronization behavior according to the behavior similarity.

[0130] In one embodiment, the user set includes a user identification, user information, and an event occurrence time set associated with the user.

[0131] In one embodiment, the data analysis module 102 is specifically configured to:

[0132] Obtaining the number of event occurrence times in the event occurrence time set to obtain the total number of times the user executes the target event;

[0133] Select any event occurrence time of the event occurrence time set, slice the event occurrence time, and obtain a time slice;

[0134] Counting the number of times the user identifiers co-occur between users in the time slice;

[0135] Calculate the Jaccard similarity coefficient between every two users according to the number of occurrences of the user identifier in the time slice and the total number of occurrences;

[0136] The behavior similarity of executing the target event between users is determined according to the Jaccard similarity coefficient.

[0137] In one embodiment, the abnormality determination module 103 is specifically configured to:

[0138] Presetting a similarity coefficient threshold, and comparing the Jaccard similarity coefficient with the similarity coefficient threshold;

[0139] If the Jaccard similarity coefficient exceeds the similarity coefficient threshold, the corresponding user is marked as a suspected abnormal user, all suspected abnormal users are collected to form a suspected abnormal group, and the row of the corresponding target event executed by the suspected abnormal user is determined as a suspected abnormal synchronization behavior;

[0140] Constructing a relationship connectivity graph based on the user identification of the suspected abnormal user, the Jaccard similarity coefficient and / or the user information;

[0141] Perform community division on the relationship connectivity graph to determine abnormal communities.

[0142] Specifically, constructing a relationship connectivity graph according to the user identification of the suspected abnormal user, the Jaccard similarity coefficient and / or the user information includes:

[0143] Based on the user identifier, setting a node of the relationship connectivity graph;

[0144] Creating a connection edge between the nodes corresponding to the two suspected abnormal users whose Jaccard similarity coefficient exceeds the similarity coefficient threshold;

[0145] Acquire all parameters in the user information, and combine the parameters in pairs to form corresponding additional constraints;

[0146] A connection edge is created between the nodes corresponding to the two suspected abnormal users that are consistent with the additional constraints.

[0147] Specifically, performing community division on the relationship connectivity graph to determine abnormal communities includes:

[0148] Dividing each node in the relationship connectivity graph into initial communities;

[0149] Add each node to the community where the neighboring node is located in turn, and calculate the modularity index increment of the initial community before and after adding the community to which each neighboring node belongs, and record the neighboring node corresponding to the maximum modularity index increment. If the modularity index increment is greater than zero, assign the node to the community to which the neighboring node belongs, otherwise keep the initial community unchanged;

[0150] When the communities to which all nodes belong no longer change, the relationship connectivity graph is compressed, all nodes under the community are compressed into a super node, and the connection edge weights between nodes in the community are converted into the ring weights of the super node, and the connection edge weights between communities are converted into the connection edge weights between super nodes, so as to obtain a stable community;

[0151] Calculate the total number of nodes in each of the stable communities;

[0152] The stable community whose total number of nodes exceeds a preset node threshold is marked as an abnormal community, and the suspected abnormal users corresponding to the nodes in the abnormal community are marked as abnormal users.

[0153] For the specific definition of the abnormal synchronous behavior identification device, please refer to the definition of the abnormal synchronous behavior identification method above, which will not be repeated here. Each module in the above-mentioned abnormal synchronous behavior identification device can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0154] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 8 As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile and / or volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external client via a network connection. When the computer program is executed by the processor, it realizes the functions or steps on the server side of an abnormal synchronous behavior identification method.

[0155] In one embodiment, a computer device is provided. The computer device may be a client, and its internal structure diagram may be as follows: Fig. 9As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external server via a network connection. When the computer program is executed by the processor, it implements the functions or steps of a client side of an abnormal synchronous behavior identification method.

[0156] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0157] Get the user set that executes the target event;

[0158] Analyze the similarity of behaviors of executing target events between users in the user set within a specified time period;

[0159] It is determined whether the corresponding user has abnormal synchronization behavior based on the behavior similarity.

[0160] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0161] Get the user set that executes the target event;

[0162] Analyze the similarity of behaviors of executing target events between users in the user set within a specified time period;

[0163] It is determined whether the corresponding user has abnormal synchronization behavior based on the behavior similarity.

[0164] It should be noted that the above functions or steps that can be implemented by the computer-readable storage medium or computer device can refer to the relevant descriptions on the server side and the client side in the aforementioned method embodiment. To avoid repetition, they will not be described one by one here.

[0165] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0166] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0167] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A method for identifying abnormal synchronous behavior, characterized in that: include: Get the user set that executes the target event; Analyze the similarity of behaviors of executing target events between users in the user set within a specified time period; It is determined whether the corresponding user has abnormal synchronization behavior based on the behavior similarity.

2. The abnormal synchronization behavior identification method according to claim 1, characterized in that: The user set includes a user identifier, user information and event occurrence time set associated with the user; The analyzing the similarity of the behaviors of executing the target event between users in the user set within the specified time includes: Obtaining the number of event occurrence times in the event occurrence time set to obtain the total number of times the user executes the target event; Select any event occurrence time of the event occurrence time set, slice the event occurrence time, and obtain a time slice; Counting the number of times the user identifiers co-occur between users in the time slice; Calculate the Jaccard similarity coefficient between every two users according to the number of occurrences of the user identifier in the time slice and the total number of occurrences; The behavior similarity of executing the target event between users is determined according to the Jaccard similarity coefficient.

3. The abnormal synchronization behavior identification method according to claim 2, characterized in that: The determining, based on the behavior similarity, whether the corresponding user has abnormal synchronization behavior includes: Presetting a similarity coefficient threshold, and comparing the Jaccard similarity coefficient with the similarity coefficient threshold; If the Jaccard similarity coefficient exceeds the similarity coefficient threshold, the corresponding user is marked as a suspected abnormal user, all suspected abnormal users are collected to form a suspected abnormal group, and the row of the corresponding target event executed by the suspected abnormal user is determined as a suspected abnormal synchronization behavior.

4. The abnormal synchronization behavior identification method according to claim 3 is characterized in that: The determining, based on the behavior similarity, whether the corresponding user has abnormal synchronization behavior also includes: Constructing a relationship connectivity graph based on the user identification of the suspected abnormal user, the Jaccard similarity coefficient and / or the user information; Perform community division on the relationship connectivity graph to determine abnormal communities.

5. The abnormal synchronization behavior identification method according to claim 4, characterized in that: The step of constructing a relationship connectivity graph according to the user identification of the suspected abnormal user, the Jaccard similarity coefficient and / or the user information includes: Based on the user identifier, setting a node of the relationship connectivity graph; A connection edge is created between the nodes corresponding to the two suspected abnormal users whose Jaccard similarity coefficient exceeds the similarity coefficient threshold.

6. The abnormal synchronization behavior identification method according to claim 5, characterized in that: The step of constructing a relationship connectivity graph according to the user identification of the suspected abnormal user, the Jaccard similarity coefficient and / or the user information further includes: Acquire all parameters in the user information, and combine the parameters in pairs to form corresponding additional constraints; A connection edge is created between the nodes corresponding to the two suspected abnormal users that are consistent with the additional constraints.

7. The abnormal synchronization behavior identification method according to claim 6, characterized in that: The performing community division on the relationship connectivity graph to determine abnormal communities includes: Dividing each node in the relationship connectivity graph into initial communities; Add each node to the community where the neighboring node is located in turn, and calculate the modularity index increment of the initial community before and after adding the community to which each neighboring node belongs, and record the neighboring node corresponding to the maximum modularity index increment. If the modularity index increment is greater than zero, assign the node to the community to which the neighboring node belongs, otherwise keep the initial community unchanged; When the communities to which all nodes belong no longer change, the relationship connectivity graph is compressed, all nodes under the community are compressed into a super node, and the connection edge weights between nodes in the community are converted into the ring weights of the super node, and the connection edge weights between communities are converted into the connection edge weights between super nodes, so as to obtain a stable community; Calculate the total number of nodes in each of the stable communities; The stable community whose total number of nodes exceeds a preset node threshold is marked as an abnormal community, and the suspected abnormal users corresponding to the nodes in the abnormal community are marked as abnormal users.

8. An abnormal synchronous behavior recognition device, characterized in that: include: A data acquisition module is used to obtain a set of users who execute a target event; A data analysis module, used to analyze the similarity of behaviors of executing target events between users in the user set within a specified time; The abnormality determination module is used to determine whether the corresponding user has abnormal synchronization behavior based on the behavior similarity.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the abnormal synchronous behavior identification method according to any one of claims 1 to 7 are implemented.

10. A storage medium, wherein the computer-readable storage medium stores a computer program, characterized in that: When the computer program is executed by a processor, the steps of the abnormal synchronous behavior identification method according to any one of claims 1 to 7 are implemented.

Images