Case series-parallel method and device based on transfer relation reasoning, equipment and storage medium

Abstract

The invention relates to a case series-parallel method and device based on transitive relationship reasoning, computer equipment and a storage medium. The method comprises the steps of obtaining multiple fraud-related cases and extracting multiple clue features of each fraud-related case; performing intersection analysis on the plurality of clue features of each fraud-related case, and determining a first fraud-related case set and a second fraud-related case set associated with the clue features; if one or more same fraud-related cases exist in the first fraud-related case set and the second fraud-related case set, determining that the first fraud-related case set and the second fraud-related case set have a relationship belonging to the same fraud-related case, and configuring a transfer relationship between the first fraud-related case set and the second fraud-related case set, and performing series-parallel case processing on the fraud-related cases in the first fraud-related case set and the fraud-related cases in the second fraud-related case set according to the transmission relationship. According to the method, the novel fraud-related cases can be deeply analyzed and effectively merged, intelligent merging of the fraud-related cases is realized, and the detection efficiency of the fraud-related cases is improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a case stringing and paralleling method, device, computer equipment and storage medium based on transitive relationship reasoning. Background Art

[0002] With the rapid development of information technology, cybercrime has become increasingly complex, concealed, and cross-regional. Fraud cases such as online fraud, fake rebates, and pig-killing schemes are emerging one after another, posing a severe challenge to public security. Traditional analysis of fraud cases mainly relies on manual review, information comparison, and the assistance of certain data analysis tools. However, the current network environment is complex, the means of fraud are diverse, and the amount of data on fraud cases is large. Manual analysis of fraud cases is inefficient in the face of big data, which is not conducive to the rapid detection of fraud cases. Summary of the invention

[0003] Based on this, it is necessary to provide a case stringing and merging method, device, computer equipment and storage medium based on transitive relationship reasoning to address the above-mentioned technical problems, which can conduct in-depth analysis and effective merging of new fraud-related cases, realize intelligent merging of fraud-related cases, and improve the efficiency of detecting fraud-related cases.

[0004] A case concatenation and merging method based on transitive relationship reasoning comprises: obtaining multiple fraud-related cases from multiple Internet-related cases; extracting multiple clue features of each fraud-related case, wherein the multiple clue features include any multiple of communication clues, fraud-related network behavior clues, fund transaction clues, and fraud-related application clues; performing intersection analysis on the multiple clue features of each fraud-related case to determine a first fraud-related case set and a second fraud-related case set with associated clue features, wherein the first fraud-related case set has an intersection of the first clue features between the fraud-related cases, and the second fraud-related case set has an intersection of the second clue features between the fraud-related cases. set, the first clue feature and the second clue feature are different; if there are one or more identical fraud cases in the first fraud case set and the second fraud case set, it is determined that the first fraud case set and the second fraud case set are related as cases of the same fraud nature; if it is identified that the first fraud case set and the second fraud case set are related as cases of the same fraud nature, a transmission relationship between the first fraud case set and the second fraud case set is configured; according to the transmission relationship between the first fraud case set and the second fraud case set, the fraud cases in the first fraud case set and the fraud cases in the second fraud case set are linked and processed.

[0005] In one embodiment, the communication clues include any one or more of a mobile phone number and the communication contacts in the mobile phone number, an instant messaging number and the communication contacts in the instant messaging number, an email number and the email contacts in the email number; and / or, the financial transaction clues include a financial transaction account and a transfer account; and / or, the fraudulent network behavior clues include one or more of the fraudulent website domain name, the fraudulent website IP address and the third-party service ID.

[0006] In one of the embodiments, the clues of the fraudulent application include information of the fraudulent application and associated information of the fraudulent application. The information of the fraudulent application includes the package name and packaging information of the fraudulent application, the MD5 value of the fraudulent application file, the signature of the fraudulent application and the MD5 value of the fraudulent application icon. The associated information of the fraudulent application includes the distribution URL of the fraudulent application, the distribution download address of the fraudulent application, the application server IP of the fraudulent application, the application server domain name of the fraudulent application, the packaging service system of the fraudulent application, the customer service system of the fraudulent application and the push platform of the fraudulent application.

[0007] In one of the embodiments, multiple clue features of each fraud case are subjected to intersection analysis to determine a first fraud case set with associated clue features, including: performing intersection analysis on information of fraud applications of each fraud case and associated information of fraud applications; if the package names and packaging information of fraud applications of any two fraud cases are associated, determining whether any of the MD5 values ​​of the fraud application files, the signatures of the fraud applications, and the MD5 values ​​of the fraud application icons of any two fraud cases are associated; if any one or more of the associations exist, determining that any two fraud cases are both fraud cases in the first fraud case set, and the The first clue feature is the clue of fraudulent application; if there is no correlation between the package names and packaging information of the fraudulent applications of any two fraud cases, then determine whether there is a correlation between any of the distribution URLs of the fraudulent applications, the distribution download addresses of the fraudulent applications, the application server IPs of the fraudulent applications, the application server domain names of the fraudulent applications, the packaging service systems of the fraudulent applications, the customer service systems of the fraudulent applications and the push platforms of the fraudulent applications of any two fraud cases; if any one or more correlations exist, then it is determined that any two fraud cases are both fraudulent cases in the first fraud case set, and the first clue feature is the clue of fraudulent application.

[0008] In one embodiment, an intersection analysis is performed on multiple clue features of each fraud-related case to determine a second set of fraud-related cases with associated clue features, including: an intersection analysis is performed on multiple clue features of each fraud-related case to determine multiple fraud-related cases with associated second clue features, and a second set of fraud-related cases is constructed based on the multiple fraud-related cases with associated second clue features, wherein the second clue feature is any one or more of communication clues, fraud-related network behavior clues, and financial transaction clues.

[0009] In one of the embodiments, after the step of combining the fraud cases in the first fraud case set and the fraud cases in the second fraud case set according to the transmission relationship between the first fraud case set and the second fraud case set, the step also includes: obtaining the collection unit information of each target fraud case obtained by the combination processing; dividing the multiple target fraud cases according to the collection unit information of each target fraud case and according to the place of affiliation to obtain the target fraud case set for each place of affiliation.

[0010] In one embodiment, the first clue feature is one and the second clue feature is one; or, the first clue feature is multiple and the second clue feature is one and the second clue feature is different from any of the first clue features; or, the first clue feature is multiple and the second clue feature is multiple and any of the second clue features is different from any of the first clue features; further comprising: configuring search keywords for the first set of fraud-related cases according to the first clue feature, and configuring search keywords for the second set of fraud-related cases according to the second clue feature; wherein, when the first clue feature is one, the search keyword for the first set of fraud-related cases is one, and when the first clue feature is multiple, the search keywords for the first set of fraud-related cases are multiple and the first set of fraud-related cases is retrieved by inputting multiple search keywords; when the second clue feature is one, the search keyword for the second set of fraud-related cases is one, and when the second clue feature is multiple, the search keywords for the second set of fraud-related cases are multiple and the second set of fraud-related cases is retrieved by inputting multiple search keywords.

[0011] A case stringing and paralleling device based on transitive relationship reasoning comprises: an acquisition module for acquiring multiple fraud-related cases from multiple network-related cases; an extraction module for extracting multiple clue features of each fraud-related case, wherein the multiple clue features include any multiple of communication clues, fraud-related network behavior clues, fund transaction clues, and fraud-related application clues; an intersection analysis module for performing intersection analysis on the multiple clue features of each fraud-related case to determine a first fraud-related case set and a second fraud-related case set with associated clue features, wherein the first fraud-related case set has an intersection of the first clue features between the fraud-related cases, and the second fraud-related case set has an intersection of the second clue features between the fraud-related cases. a set, the first clue feature and the second clue feature are different; a determination module, for determining that the first fraud case set and the second fraud case set are related as cases of the same fraud nature if there are one or more identical fraud cases in the first fraud case set and the second fraud case set; a configuration module, for configuring a transmission relationship between the first fraud case set and the second fraud case set if it is identified that the first fraud case set and the second fraud case set are related as cases of the same fraud nature; a serial and parallel processing module, for serial and parallel processing of the fraud cases in the first fraud case set and the fraud cases in the second fraud case set according to the transmission relationship between the first fraud case set and the second fraud case set.

[0012] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of any of the above-mentioned embodiments are implemented.

[0013] A computer-readable storage medium stores a computer program, which implements the steps of any of the above-mentioned method embodiments when the computer program is executed by a processor.

[0014] The above-mentioned case stringing and paralleling method, device, computer equipment and storage medium based on transitive relationship reasoning obtain multiple fraud-related cases from multiple Internet-related cases; extract multiple clue features of each fraud-related case, and the multiple clue features include any multiple of communication clues, fraud-related network behavior clues, fund transaction clues and fraud-related application clues; perform intersection analysis on the multiple clue features of each fraud-related case to determine a first fraud-related case set and a second fraud-related case set with associated clue features, wherein the first fraud-related case set has an intersection of the first clue features between the fraud-related cases, and the second fraud-related case set has an intersection of the second clue features between the fraud-related cases. The intersection of clue features, the first clue feature and the second clue feature are different; if there are one or more identical fraud cases in the first fraud case set and the second fraud case set, it is determined that the first fraud case set and the second fraud case set are related as cases of the same fraud nature; if it is identified that the first fraud case set and the second fraud case set are related as cases of the same fraud nature, a transmission relationship between the first fraud case set and the second fraud case set is configured; according to the transmission relationship between the first fraud case set and the second fraud case set, the fraud cases in the first fraud case set and the second fraud case set are combined and processed.

[0015] Therefore, it is possible to automatically analyze multiple clue features of fraud cases, determine the first fraud case set and the second fraud case set with associated clue features, and preliminarily screen out fraud cases with the same clue features. Then, it is determined whether the first fraud case set and the second fraud case set contain the same fraud case. If so, it is inferred that the first fraud case set and the second fraud case set are cases of the same fraud nature. Then, the transmission relationship between the two is configured. Finally, when processing the fraud cases in series and in parallel, the fraud cases in the two case sets are processed in series and in parallel based on the transmission relationship between the two. The entire process does not require manual review and analysis, and can conduct in-depth analysis and effective merger of new fraud cases, realize intelligent merger of fraud cases, and improve the efficiency of detecting fraud cases. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is an application environment diagram of a case stringing and paralleling method based on transitive relationship reasoning in one embodiment;

[0017] Figure 2 A flowchart of a case stringing and merging method based on transitive relationship reasoning in one embodiment;

[0018] Figure 3 A schematic diagram of a system configuration module of a case stringing and paralleling method based on transitive relationship reasoning in one embodiment;

[0019] Figure 4 A schematic diagram of a case stringing and paralleling method based on transitive relationship reasoning in an example;

[0020] Figure 5 It is a structural block diagram of a case stringing and paralleling device based on transitive relationship reasoning in one embodiment;

[0021] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0023] This application provides a case concatenation method based on transitive relationship reasoning, which is applied to Figure 1 In the application environment shown. Figure 1 As shown, the server 102 obtains multiple fraud cases from the database of each platform, extracts multiple clue features of each fraud case, and the multiple clue features include any multiple of communication clues, fraud network behavior clues, fund transaction clues, and fraud application clues, and performs intersection analysis on the multiple clue features of each fraud case to determine multiple target fraud cases associated with clue features, and performs serial and parallel case processing on the multiple target fraud cases. The server 102 can be implemented by an independent server or a server cluster composed of multiple servers.

[0024] Among them, in the following embodiments of the present application, APP, application, and application program have the same meaning and all express application programs.

[0025] In one embodiment, Figure 2 As shown in the figure, a case concatenation method based on transitive relation reasoning is provided. Figure 1 Taking the server 102 in the example as an example, the following steps are included:

[0026] S202, obtaining multiple fraud-related cases from multiple Internet-related cases.

[0027] In this embodiment, multiple Internet-related cases are collected, and each Internet-related case can come from a case collection platform in a different region. That is, multiple fraud-related cases can come from the fraud-related case management platform of the collection unit in different administrative regions, or from the same fraud-related case management platform. Specifically, multiple fraud-related cases can be searched and obtained based on the relevant information of the fraud-related case investigation to provide intelligent assistance for the investigation and analysis of the fraud-related case.

[0028] S204, extracting multiple clue features of each fraud case, the multiple clue features including any multiple of communication clues, fraud-related network behavior clues, fund transaction clues, and fraud-related application clues.

[0029] In this embodiment, the multiple clue features of each fraud case include any number of communication clues, fraud network behavior clues, fund transaction clues, and fraud application clues. Among them, the communication clues are used to identify the communication relationship between the fraud personnel in the fraud case, the fund transaction clues are used to identify the fund transaction relationship between the fraud personnel in the fraud case, the fraud network behavior clues are used to identify the network fraud operation process used by the fraud personnel in the fraud case, and the fraud application clues are used to identify the network fraud tools used by the fraud personnel in the fraud case. These clue features can reflect the correlation between multiple fraud cases, and can assist the case officers in the rapid case investigation when investigating a large number of fraud cases in a big data environment.

[0030] In one example, communication clues include any one or more of a mobile phone number and the communication contacts in the mobile phone number, an instant messaging number and the communication contacts in the instant messaging number, an email number and the email contacts in the email number; and / or, financial transaction clues include financial transaction account numbers and transfer account numbers; and / or, fraudulent network behavior clues include one or more of fraudulent website domain names, fraudulent website IP addresses, and third-party service IDs.

[0031] Specifically, communication clues: merge fraud cases through the number identification data of mobile phone numbers, bank cards, ID cards, email addresses, WeChat, WeChat groups, QQ, QQ groups, etc. in the investigation data of fraud cases. Also, merge fraud cases through the information of WeChat group members and QQ group members in the investigation data of fraud cases. Fraud network behavior clues: merge fraud cases through the fraud websites and related information of fraud cases, such as website domain names, website IPs, third-party service IDs, etc. Also, merge fraud cases across regions through online data services.

[0032] In one example, clues of fraudulent applications include information about the fraudulent applications and associated information about the fraudulent applications. The information about the fraudulent applications includes the package name and packaging information of the fraudulent applications, the MD5 value of the fraudulent application files, the signature of the fraudulent applications, and the MD5 value of the fraudulent application icons. The associated information about the fraudulent applications includes the distribution URL of the fraudulent applications, the distribution download address of the fraudulent applications, the application server IP of the fraudulent applications, the application server domain name of the fraudulent applications, the packaging service system of the fraudulent applications, the customer service system of the fraudulent applications, and the push platform of the fraudulent applications.

[0033] In this example, the fraud cases are merged through the information of the fraudulent applications and the associated information of the fraudulent applications. For example, the information of the fraudulent applications includes the APP package name, the APP file MD5 value, the APP signature information, and the APP icon MD5 value. The associated information of the fraudulent applications includes the APP distribution website, the APP distribution download address, the APP packaging information, the APP application server IP, the APP application server domain name, the APP packaging service, the APP customer service system, the APP push platform, etc.

[0034] S206, performing intersection analysis on multiple clue features of each fraud-related case to determine a first fraud-related case set and a second fraud-related case set with associated clue features, wherein the first fraud-related cases in the first fraud-related case set have an intersection of first clue features, and the second fraud-related cases in the second fraud-related case set have an intersection of second clue features, and the first clue feature and the second clue feature are different.

[0035] In this embodiment, the intersection analysis of each clue feature of all fraud cases obtained is performed, and as long as there is an intersection of clue features, it will be attributed to the corresponding fraud case set. If there is an intersection of fraud network behavior clues between multiple fraud cases, then the multiple fraud cases are all used as fraud cases in one of the fraud case sets. If there is an intersection of fund transaction clues between multiple fraud cases, then the multiple fraud cases are all used as fraud cases in another fraud case set. If there is an intersection of communication clues between multiple fraud cases, then the multiple fraud cases are all used as fraud cases in another fraud case set. If there is an intersection of fraud application clues between multiple fraud cases, then the multiple fraud cases are all used as fraud cases in another fraud case set. It can be seen that multiple fraud cases are divided into multiple fraud case sets according to the characteristics of each clue. Among them, the first fraud case set and the second fraud case set can be any two fraud case sets in these fraud case sets.

[0036] For example, if there is an intersection of communication clues between fraud case A and fraud case B, then both fraud case A and fraud case B are considered as fraud cases in the first fraud case set, and the first clue feature is the communication clue. If there is an intersection of fraud application clues between fraud case B and fraud case C, then both fraud case B and fraud case C are considered as fraud cases in the second fraud case set, and the second clue feature is the fraud application clue.

[0037] In an example, the above-mentioned intersection analysis of multiple clue features of each fraud case is performed to determine the first fraud case set and the second fraud case set with associated clue features, including: performing intersection analysis on multiple clue features of each fraud case to determine target clue features with intersections between the fraud cases, identifying the number of fraud cases containing the target clue features, and if the number is greater than a set number threshold, determining the first fraud case set and the second fraud case set with associated target clue features.

[0038] In this example, after there is an intersection of clue features between fraud cases, further judgment is required on the clue features of the intersection. When the number of times the clue features of the intersection are collected is greater than the set number, the clue features of the intersection are used as the correlation features between the two fraud cases. The number of times the clue features of the intersection are collected is determined by the number of fraud cases that contain the clue features. For example, as shown in the following table:

[0039]

[0040]

[0041]

[0042]

[0043] In one embodiment, the above-mentioned intersection analysis of multiple clue features of each fraud case to determine the first fraud case set with associated clue features includes: intersection analysis of the information of the fraud application of each fraud case and the associated information of the fraud application; if the package names and packaging information of the fraud application of any two fraud cases are associated, then determine whether any of the MD5 values ​​of the fraud application files, the signatures of the fraud application, and the MD5 values ​​of the fraud application icons of any two fraud cases are associated; if any one or more of the associations exist, then determine that any two fraud cases are fraud cases in the first fraud case set, where The first clue feature is the clue of fraudulent application; if there is no correlation between the package names and packaging information of the fraudulent applications of any two fraud cases, then determine whether there is a correlation between any of the distribution URLs of the fraudulent applications, the distribution download addresses of the fraudulent applications, the application server IPs of the fraudulent applications, the application server domain names of the fraudulent applications, the packaging service systems of the fraudulent applications, the customer service systems of the fraudulent applications and the push platforms of the fraudulent applications of any two fraud cases. If any one or more correlations exist, it is determined that any two fraud cases are both fraudulent cases in the first set of fraud cases, and the first clue feature is the clue of fraudulent application.

[0044] In this embodiment, when the package names and packaging information of the fraudulent applications of two fraudulent cases are related, it is necessary to further determine whether any of the MD5 values ​​of the corresponding fraudulent application files, the signatures of the fraudulent applications, and the MD5 values ​​of the fraudulent application icons are related. If so, it means that the two fraudulent cases use the same fraudulent application, which is regarded as a fraudulent case in the same fraudulent case set. Therefore, through multiple judgments, it is possible to accurately find fraudulent cases that use the same fraudulent application for combined processing.

[0045] In addition, when developing a front-end fraudulent application, the fraudulent user may change the information of the fraudulent application by certain means to avoid investigation. Therefore, in this embodiment, if it is detected that the package names and packaging information of the fraudulent applications of two fraudulent cases are not related, it is necessary to further confirm the background related information of the fraudulent application. For example, if any one or more of the distribution website of the fraudulent application, the distribution download address of the fraudulent application, the application server IP of the fraudulent application, the application server domain name of the fraudulent application, the packaging service system of the fraudulent application, the customer service system of the fraudulent application, and the push platform of the fraudulent application are related, it means that the fraudulent user uses the same fraudulent application, and there is a correlation between the fraudulent cases, and the corresponding fraudulent cases are all treated as fraudulent cases in the same fraudulent case set for serial and parallel case processing. Therefore, it is possible to improve the accuracy of screening fraudulent cases when investigating the same case.

[0046] In one embodiment, the above-mentioned intersection analysis of multiple clue features of each fraud-related case to determine a second fraud-related case set with associated clue features includes: intersection analysis of multiple clue features of each fraud-related case to determine multiple fraud-related cases with associated second clue features, and constructing a second fraud-related case set based on the multiple fraud-related cases with associated second clue features, wherein the second clue feature is any one or more of communication clues, fraud-related network behavior clues, and financial transaction clues.

[0047] In this embodiment, the second clue feature that is the same in the second fraud case set may be any one or more of the communication clue, the fraudulent network behavior clue, and the fund transaction clue. That is, when the first clue feature is the fraudulent application clue, the second clue feature is any other clue feature that is not a fraudulent application clue or has multiple clue features at the same time.

[0048] S208: If there are one or more identical fraud cases in the first fraud case set and the second fraud case set, it is determined that the first fraud case set and the second fraud case set are cases of the same fraud nature.

[0049] In this embodiment, the fraud case set in the first fraud case set all has the first clue feature, and the fraud case set in the second fraud case set all has the second clue feature. If the same fraud case exists in the two fraud case sets, it means that the fraud case has both the first clue feature and the second clue feature. Therefore, it can be determined that the fraud cases in the two fraud case sets are of the same fraud nature. For example, fraud case A and fraud case B have the same communication clues, and fraud case B and fraud case C have the same fund transaction clues, but there are no identical clue features between fraud case A and fraud case C. By having the same clue features with the same fraud case, that is, fraud case B, it can be considered that fraud case A and fraud case C are cases of the same fraud nature.

[0050] As described above, the first fraud case set and the second fraud case set are any two fraud case sets in multiple fraud case sets. By the existence of one or more identical fraud cases, it can be determined that the first fraud case set and the second fraud case set are in a relationship of cases of the same fraud nature. Furthermore, if there are one or more identical fraud cases in the third fraud case set and the second fraud case set or in the first fraud case set, then the third fraud case set and the first fraud case set and the second fraud case set are in a relationship of cases of the same fraud nature. By analogy, multiple fraud case sets that are in a relationship of cases of the same fraud nature can be screened out.

[0051] S210: If it is identified that the first fraud case set and the second fraud case set are cases of the same fraud nature, a transfer relationship between the first fraud case set and the second fraud case set is configured.

[0052] After determining in the above step S208 that the first fraud case set and the second fraud case set are cases of the same fraud nature, in this embodiment, a transfer relationship between the first fraud case set and the second fraud case set is configured. The transfer relationship indicates that the same fraud case exists in the two case sets, and the same fraud attribute can be transferred between the fraud cases when the cases are processed in series. By analogy, if there are multiple fraud case sets such as the third fraud case set and the fourth fraud case set that are cases of the same fraud nature with the first fraud case set and the second fraud case set, a transfer relationship between these fraud case sets is also configured.

[0053] S212, combining and processing the fraud cases in the first fraud case set and the fraud cases in the second fraud case set according to the transmission relationship between the first fraud case set and the second fraud case set.

[0054] In this embodiment, the processing of serial and combined cases refers to a processing method that combines serial and combined cases. Serial cases refer to solving a series of different cases that are related together through analysis of the means of committing the crime, traces, physical evidence, etc. Combined cases refer to solving two related cases together through analysis of the means of committing the crime, traces, physical evidence, etc. If there is a transitive relationship between any two fraud case sets, the fraud cases in the two fraud case sets will be processed in serial and combined cases. Similarly, if there is a transitive relationship between multiple fraud case sets, the fraud cases in the multiple fraud case sets will all be processed in serial and combined cases.

[0055] Specifically, the case numbers of the fraud cases are used as the correlation connection to process multiple fraud cases in series or the clue features of the overlap of the fraud cases are used as the correlation connection to process multiple fraud cases in series.

[0056] In one embodiment, after the above-mentioned step of combining the fraud cases in the first fraud case set and the fraud cases in the second fraud case set according to the transmission relationship between the first fraud case set and the second fraud case set, it also includes: obtaining the collection unit information of each target fraud case obtained by the combination processing; dividing the multiple target fraud cases according to the collection unit information of each target fraud case and according to the place of affiliation to obtain the target fraud case set for each place of affiliation.

[0057] In this embodiment, the collection unit information is used to indicate the unit that collects and manages the target fraud-related cases. For example, the collection unit information indicates that the collection unit of the target fraud-related cases is a public security bureau or an investigation agency of a fraud-related case. Then, the target fraud-related case set is divided according to the place of affiliation. In one implementation method, the place of affiliation can be divided according to administrative regions, for example, the place of affiliation can be divided into provinces, cities, districts and counties. Therefore, the investigation and analysis of fraud-related cases can be gradually refined in the province, city, district and county, revealing the distribution of criminal networks in the region, activity hotspots, and gang structure, and providing accurate information for localized governance.

[0058] In one embodiment, the first clue feature is one and the second clue feature is one; or, the first clue feature is multiple and the second clue feature is one and the second clue feature is different from any of the first clue features; or, the first clue feature is multiple and the second clue feature is multiple and any of the second clue features is different from any of the first clue features; after the above-mentioned step of processing the fraud cases in the first fraud case set and the fraud cases in the second fraud case set in series and in combination according to the transmission relationship between the first fraud case set and the second fraud case set, it also includes: configuring the search keywords of the first fraud case set according to the first clue feature, and configuring the search keywords of the second fraud case set according to the second clue feature; wherein, when the first clue feature is one, the search keyword of the first fraud case set is one, and when the first clue feature is multiple, the search keywords of the first fraud case set are multiple and the first fraud case set is retrieved by inputting multiple search keywords; when the second clue feature is one, the search keyword of the second fraud case set is one, and when the second clue feature is multiple, the search keywords of the second fraud case set are multiple and the second fraud case set is retrieved by inputting multiple search keywords.

[0059] Specifically, the first clue feature and the second clue feature are both one, or the first clue feature is multiple and the second clue feature is one, or the first clue feature and the second clue feature are both multiple. It is sufficient that there is no feature overlap between the first clue feature and the second clue feature. In addition, each fraud case set is configured with corresponding search keywords for querying and retrieving the fraud cases in the fraud case set. When the fraud case set is associated through a clue feature, a search keyword is determined by the clue feature. When the fraud case set is associated through multiple clue features, each search keyword is determined by each clue feature, and the second fraud case set is retrieved by inputting multiple search keywords. Therefore, the fraud cases in the corresponding fraud case set can be accurately retrieved.

[0060] The above-mentioned case stringing and merging method based on transitive relationship reasoning can automatically analyze multiple clue features of fraud cases, determine the first fraud case set and the second fraud case set with associated clue features, and preliminarily screen out fraud cases with the same clue features. Then, it is judged whether the first fraud case set and the second fraud case set contain the same fraud case. If so, it is inferred that the first fraud case set and the second fraud case set are cases of the same fraud nature. Then, the transitive relationship between the two is configured. Finally, when processing the fraud cases in stringing and merging, the fraud cases in the two case sets are processed in string and merging based on the transitive relationship between the two. The whole process does not require manual review and analysis, and can conduct in-depth analysis and effective merging of new fraud cases, realize intelligent merging of fraud cases, and improve the efficiency of detecting fraud cases.

[0061] In summary, this application can achieve the following effects:

[0062] 1. Improve the efficiency of case detection: Through the transitive relationship reasoning analysis of the elements involved in the case, it is possible to quickly identify the internal connections between seemingly independent cases, merge related cases for processing, and help investigators identify a series of cases that may be committed by the same criminal gang or individual, shorten the investigation cycle, and speed up the case detection process.

[0063] 2. Enhance the accuracy of investigation: Use big data and model algorithms to deeply explore crime patterns, compare multiple cases through transmission relationships, such as fraud tools, time involved in the case, location of the crime, etc., and the case connection and combined analysis can reveal the internal connection between cases.

[0064] 3. Optimize resource allocation: Integrate multi-source data, avoid duplicate investigations, focus on key points, achieve optimal resource allocation, and improve efficiency and cost-effectiveness.

[0065] 4. Promote cross-regional collaboration: Serial and parallel analysis transcends geographical restrictions, promotes cross-regional information sharing, enhances collaborative investigation capabilities, and responds to cross-regional criminal activities.

[0066] A specific example is provided below for a case concatenation method based on transitive relationship reasoning in this application:

[0067] First, set up the data integration module: design a highly compatible data integration framework, extract and dispatch through NiFi, and gather various case element feature data such as suspect accounts, APPs, website information, fraud-related server information, third-party service IDs, communication accounts, and payment transaction accounts. Specifically, the NiFi+Kafka combination method is used to complete the extraction, distribution, and data buffering of suspect number clues, fraud-related APP element clues, group member clues, and relationship networks collected based on fraud-related cases. SparkStreaming is used to subscribe to Kafka topic data, and the Kafka data consumption offset is maintained in the MySql database. The real-time data warehouse modeling layering technology and column storage engine technology are used, combined with natural language processing, machine learning and other technologies to automatically identify and extract key feature elements and build a feature element library.

[0068] Secondly, if Figure 3 As shown, the data integration module: designs a highly compatible data integration framework, extracts and schedules through NiFi, and aggregates various case element feature data such as suspect accounts, APPs, website information, fraud-related server information, third-party service IDs, communication accounts, and payment transaction accounts.

[0069] Serial and parallel models and analysis algorithms: We have designed a variety of complex models, including serial and parallel number, serial and parallel APP, serial and parallel network, and serial and parallel relationship, to serial and parallel cases, and analyze the modus operandi through serial and parallel cases. These models use real-time data warehouse modeling layering and column storage engine technology to automatically identify and extract key related clues in massive data, build a serial and parallel clue library, and use the clues of multiple cases for cross-verification to obtain more suspect clues and features such as "APP, number, bank card". We use the shortest path algorithm of the graph and the community discovery algorithm based on density to serialize and parallel cases in batches, identify potential indirect connections, dig out dens and gangs, expand the results, and accelerate the detection of cases.

[0070] Transitive relationship reasoning: that is, combine the two cases of fraud case A and fraud case B, and then combine the two cases of fraud case B and fraud case C, and then use transitive relationship reasoning to merge the fraud case A, fraud case B, and fraud case C into a series of cases.

[0071] Construction of visual relationship graph: Construct a case entity relationship graph, using entities such as cases, virtual accounts (translation of real people), crime tools, and financial accounts as nodes, and direct connections between entities (such as IP, domain name, financial transactions, server information, etc.) as edges, to form a multi-layer relationship network, which is convenient for investigators to quickly understand the structure of the criminal network and guide in-depth investigations.

[0072] For example, Figure 4 As shown in the figure, through the suspect's account, APP, website, application server information, virtual account, mobile phone number, social group number, payment account and other multi-dimensional information, more fraud cases are connected and merged. Figure 4 As shown, the first fraud case set contains fraud case A and fraud case B, which are connected in series. The second fraud case set contains fraud case B and fraud case C, which are connected in series. Then, using transitive relationship reasoning, fraud case A, fraud case B, and fraud case C in the first fraud case set and the second fraud case set are combined into a series of cases.

[0073] In summary, the above-mentioned case stringing and merging method based on transitive relationship reasoning adopts intelligent algorithms to quickly process and analyze massive data, construct clue features such as suspect accounts, APPs, websites, application server information, virtual accounts, mobile phone numbers, social group numbers, and payment accounts as network maps for case stringing and merging, intuitively display the structure of the criminal network, reveal hidden relationship links, make clues of complex cases clear, and help investigators quickly understand the full picture of the case. The technical features of this application are as follows:

[0074] 1. Enhance the identification of case correlation: By comparing multiple fraud cases, we can obtain cross-clue features, such as fraud tools, time involved in the case, location of the crime, etc., which can reveal the internal connection between fraud cases. Through transitive relationship reasoning, we can achieve the effect of combining cases, solving a series of cases, and digging deep into a group, helping investigators identify a series of cases that may be committed by the same criminal gang or individual.

[0075] 2. Optimize resource allocation: By combining and combining fraud-related cases, we can avoid repeated investigations of seemingly independent but actually related cases, concentrate human, material and financial resources on in-depth investigation of one or several core cases, and improve investigation efficiency and resource utilization.

[0076] 3. Promote information sharing: The joint handling of cases promotes information exchange and sharing between different regions and departments, which helps to build a cross-regional and cross-police cooperation mechanism and form a joint force to combat crime.

[0077] 4. Deepen the understanding of crime patterns: Analyzing multiple cases in a chain will help reveal the criminals' behavioral patterns, psychological characteristics and motivations, and provide a basis for formulating more effective prevention and combat strategies.

[0078] 5. Improve the ability to collect and use evidence: In a combined case, some information that may have been considered isolated or minor in a single case may become key clues after comprehensive analysis, which will help to discover more evidence and strengthen the integrity and persuasiveness of the chain of evidence.

[0079] 6. Speed ​​up case detection: By integrating information from multiple cases, suspects or criminal networks can often be identified more quickly, shortening the case detection cycle, responding to social concerns in a timely manner, and protecting public safety.

[0080] It should be understood that, although the steps in the flowchart are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0081] The present application also provides a case stringing and paralleling device based on transitive relationship reasoning. Figure 5As shown, a case serial and parallel device based on transitive relationship reasoning includes an acquisition module 502, an extraction module 504, an intersection analysis module 506, a determination module 508, a configuration module 510, and a serial and parallel processing module 512. Among them, the acquisition module 502 is used to obtain multiple fraud-related cases from multiple Internet-related cases; the extraction module 504 is used to extract multiple clue features of each fraud-related case, and the multiple clue features include any multiple of communication clues, fraud-related network behavior clues, financial transaction clues, and fraud-related application clues; the intersection analysis module 506 is used to perform intersection analysis on the multiple clue features of each fraud-related case to determine a first fraud-related case set and a second fraud-related case set with associated clue features, wherein there is an intersection of the first clue features between the fraud-related cases in the first fraud-related case set, and there is an intersection of the second clue features between the fraud-related cases in the second fraud-related case set, and the first clue features and The second clue features are not the same; a determination module 508 is used to determine that the first fraud case set and the second fraud case set are related as cases of the same fraud nature if there are one or more identical fraud cases in the first fraud case set and the second fraud case set; a configuration module 510 is used to configure the transmission relationship between the first fraud case set and the second fraud case set if it is identified that the first fraud case set and the second fraud case set are related as cases of the same fraud nature; a serial and parallel processing module 512 is used to serially and parallelly process the fraud cases in the first fraud case set and the fraud cases in the second fraud case set according to the transmission relationship between the first fraud case set and the second fraud case set.

[0082] In one embodiment, the communication clues include any one or more of a mobile phone number and the communication contacts in the mobile phone number, an instant messaging number and the communication contacts in the instant messaging number, an email number and the email contacts in the email number; and / or, the financial transaction clues include a financial transaction account and a transfer account; and / or, the fraudulent network behavior clues include one or more of the fraudulent website domain name, the fraudulent website IP address and the third-party service ID.

[0083] In one of the embodiments, the clues of the fraudulent application include information of the fraudulent application and associated information of the fraudulent application. The information of the fraudulent application includes the package name and packaging information of the fraudulent application, the MD5 value of the fraudulent application file, the signature of the fraudulent application and the MD5 value of the fraudulent application icon. The associated information of the fraudulent application includes the distribution URL of the fraudulent application, the distribution download address of the fraudulent application, the application server IP of the fraudulent application, the application server domain name of the fraudulent application, the packaging service system of the fraudulent application, the customer service system of the fraudulent application and the push platform of the fraudulent application.

[0084] In one of the embodiments, multiple clue features of each fraud case are subjected to intersection analysis to determine a first fraud case set with associated clue features, including: performing intersection analysis on information of fraud applications of each fraud case and associated information of fraud applications; if the package names and packaging information of fraud applications of any two fraud cases are associated, determining whether any of the MD5 values ​​of the fraud application files, the signatures of the fraud applications, and the MD5 values ​​of the fraud application icons of any two fraud cases are associated; if any one or more of the associations exist, determining that any two fraud cases are both fraud cases in the first fraud case set, and the The first clue feature is the clue of fraudulent application; if there is no correlation between the package names and packaging information of the fraudulent applications of any two fraud cases, then determine whether there is a correlation between any of the distribution URLs of the fraudulent applications, the distribution download addresses of the fraudulent applications, the application server IPs of the fraudulent applications, the application server domain names of the fraudulent applications, the packaging service systems of the fraudulent applications, the customer service systems of the fraudulent applications and the push platforms of the fraudulent applications of any two fraud cases; if any one or more correlations exist, then it is determined that any two fraud cases are both fraudulent cases in the first fraud case set, and the first clue feature is the clue of fraudulent application.

[0085] In one embodiment, an intersection analysis is performed on multiple clue features of each fraud-related case to determine a second set of fraud-related cases with associated clue features, including: an intersection analysis is performed on multiple clue features of each fraud-related case to determine multiple fraud-related cases with associated second clue features, and a second set of fraud-related cases is constructed based on the multiple fraud-related cases with associated second clue features, wherein the second clue feature is any one or more of communication clues, fraud-related network behavior clues, and financial transaction clues.

[0086] In one of the embodiments, after the fraud cases in the first fraud case set and the fraud cases in the second fraud case set are processed in series and in combination according to the transmission relationship between the first fraud case set and the second fraud case set, the process also includes: obtaining the collection unit information of each target fraud case obtained by the series and in combination processing; dividing the multiple target fraud cases according to the collection unit information of each target fraud case and according to the place of affiliation to obtain the target fraud case set for each place of affiliation.

[0087] In one embodiment, the first clue feature is one and the second clue feature is one; or, the first clue features are multiple and the second clue feature is one and the second clue feature is different from any of the first clue features; or, the first clue features are multiple and the second clue features are multiple and any of the second clue features is different from any of the first clue features;

[0088] A case stringing and paralleling device based on transitive relationship reasoning also includes a configuration module, which is used to configure the search keywords of the first set of fraud cases according to the first clue feature, and to configure the search keywords of the second set of fraud cases according to the second clue feature; wherein, when the first clue feature is one, the search keyword of the first set of fraud cases is one, and when the first clue feature is multiple, the search keywords of the first set of fraud cases are multiple and the first set of fraud cases is retrieved by inputting multiple search keywords; when the second clue feature is one, the search keyword of the second set of fraud cases is one, and when the second clue feature is multiple, the search keywords of the second set of fraud cases are multiple and the second set of fraud cases is retrieved by inputting multiple search keywords.

[0089] For the specific definition of a case stringing and paralleling device based on transitive relationship reasoning, please refer to the definition of a case stringing and paralleling method based on transitive relationship reasoning above, which will not be repeated here. Each module in the above-mentioned case stringing and paralleling device based on transitive relationship reasoning can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0090] In one embodiment, a computer device is provided, which may be Figure 1 The server shown in FIG. 1 may have an internal structure as shown in FIG. Figure 6 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store clue features of multiple fraud-related cases. The network interface of the computer device is used to communicate with an external system platform through a network connection. When the computer program is executed by the processor, a case stringing and paralleling method based on transitive relationship reasoning is implemented.

[0091] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the following steps are implemented: obtaining multiple fraud-related cases from multiple Internet-related cases; extracting multiple clue features of each fraud-related case, wherein the multiple clue features include any multiple of communication clues, fraud-related network behavior clues, fund transaction clues, and fraud-related application clues; performing intersection analysis on the multiple clue features of each fraud-related case to determine a first fraud-related case set and a second fraud-related case set with associated clue features, wherein the first fraud-related case set has an intersection of the first clue features between the fraud-related cases, There is an intersection of the second clue features between the fraud cases in the second fraud case set, and the first clue features are different from the second clue features; if there are one or more identical fraud cases in the first fraud case set and the second fraud case set, it is determined that the first fraud case set and the second fraud case set are related as cases of the same fraud nature; if it is identified that the first fraud case set and the second fraud case set are related as cases of the same fraud nature, a transmission relationship between the first fraud case set and the second fraud case set is configured; according to the transmission relationship between the first fraud case set and the second fraud case set, the fraud cases in the first fraud case set and the fraud cases in the second fraud case set are combined and processed.

[0092] In one embodiment, the communication clues include any one or more of a mobile phone number and the communication contacts in the mobile phone number, an instant messaging number and the communication contacts in the instant messaging number, an email number and the email contacts in the email number; and / or, the financial transaction clues include a financial transaction account and a transfer account; and / or, the fraudulent network behavior clues include one or more of the fraudulent website domain name, the fraudulent website IP address and the third-party service ID.

[0093] In one of the embodiments, the clues of the fraudulent application include information of the fraudulent application and associated information of the fraudulent application. The information of the fraudulent application includes the package name and packaging information of the fraudulent application, the MD5 value of the fraudulent application file, the signature of the fraudulent application and the MD5 value of the fraudulent application icon. The associated information of the fraudulent application includes the distribution URL of the fraudulent application, the distribution download address of the fraudulent application, the application server IP of the fraudulent application, the application server domain name of the fraudulent application, the packaging service system of the fraudulent application, the customer service system of the fraudulent application and the push platform of the fraudulent application.

[0094] In one embodiment, when the processor executes a computer program to implement the above-mentioned step of performing intersection analysis on multiple clue features of each fraud case to determine the first fraud case set with associated clue features, the following steps are specifically implemented: performing intersection analysis on the information of the fraud application programs of each fraud case and the associated information of the fraud application programs; if the package names and packaging information of the fraud application programs of any two fraud cases are associated, then determining whether any of the MD5 values ​​of the fraud application files, the signatures of the fraud application programs, and the MD5 values ​​of the fraud application icons of any two fraud cases are associated; if any one or more of the associations exist, then determining that any two fraud cases are the first fraud case set. The fraud cases in the fraud case set, wherein the first clue feature is the fraud application clue; if the package names and packaging information of the fraud applications of any two fraud cases are not related, then determine whether any of the distribution URLs of the fraud applications, the distribution download addresses of the fraud applications, the application server IPs of the fraud applications, the application server domain names of the fraud applications, the packaging service systems of the fraud applications, the customer service systems of the fraud applications and the push platforms of the fraud applications of any two fraud cases are related; if any one or more of the connections exist, then determine that any two fraud cases are both fraud cases in the first fraud case set, wherein the first clue feature is the fraud application clue.

[0095] In one of the embodiments, when the processor executes a computer program to implement the above-mentioned step of performing intersection analysis on multiple clue features of each fraud case to determine a second set of fraud cases with associated clue features, the following steps are specifically implemented: performing intersection analysis on multiple clue features of each fraud case to determine multiple fraud cases with associated second clue features, and constructing a second set of fraud cases based on the multiple fraud cases with associated second clue features, where the second clue feature is any one or more of communication clues, fraudulent network behavior clues, and financial transaction clues.

[0096] In one of the embodiments, the processor implements the following steps when executing the computer program: obtaining the collection unit information of each target fraud case obtained by serial and parallel case processing; dividing the multiple target fraud cases according to the collection unit information of each target fraud case and according to the place of origin, to obtain a set of target fraud cases in each place of origin.

[0097] In one embodiment, the first clue feature is one and the second clue feature is one; or, the first clue feature is multiple and the second clue feature is one and the second clue feature is different from any of the first clue features; or, the first clue feature is multiple and the second clue feature is multiple and any of the second clue features is different from any of the first clue features; when the processor executes the computer program, the following steps are implemented: according to the first clue feature, the search keywords of the first fraud case set are configured, and according to the second clue feature, the search keywords of the second fraud case set are configured; wherein, when the first clue feature is one, the search keyword of the first fraud case set is one, and when the first clue feature is multiple, the search keywords of the first fraud case set are multiple and the first fraud case set is retrieved by inputting multiple search keywords; when the second clue feature is one, the search keyword of the second fraud case set is one, and when the second clue feature is multiple, the search keywords of the second fraud case set are multiple and the second fraud case set is retrieved by inputting multiple search keywords.

[0098] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented: obtaining multiple fraud-related cases from multiple Internet-related cases; extracting multiple clue features of each fraud-related case, the multiple clue features including any multiple of communication clues, fraud-related network behavior clues, financial transaction clues, and fraud-related application clues; performing intersection analysis on the multiple clue features of each fraud-related case to determine a first fraud-related case set and a second fraud-related case set with associated clue features, wherein the first fraud-related case set has an intersection of the first clue features between the fraud-related cases, and the second fraud-related case set has an intersection of the first clue features between the fraud-related cases. There is an intersection of the second clue features between the fraud cases, and the first clue features and the second clue features are different; if there are one or more identical fraud cases in the first fraud case set and the second fraud case set, it is determined that the first fraud case set and the second fraud case set are related as cases of the same fraud nature; if it is identified that the first fraud case set and the second fraud case set are related as cases of the same fraud nature, a transmission relationship between the first fraud case set and the second fraud case set is configured; according to the transmission relationship between the first fraud case set and the second fraud case set, the fraud cases in the first fraud case set and the fraud cases in the second fraud case set are combined and processed.

[0099] In one embodiment, the communication clues include any one or more of a mobile phone number and the communication contacts in the mobile phone number, an instant messaging number and the communication contacts in the instant messaging number, an email number and the email contacts in the email number; and / or, the financial transaction clues include a financial transaction account and a transfer account; and / or, the fraudulent network behavior clues include one or more of the fraudulent website domain name, the fraudulent website IP address and the third-party service ID.

[0100] In one of the embodiments, the clues of the fraudulent application include information of the fraudulent application and associated information of the fraudulent application. The information of the fraudulent application includes the package name and packaging information of the fraudulent application, the MD5 value of the fraudulent application file, the signature of the fraudulent application and the MD5 value of the fraudulent application icon. The associated information of the fraudulent application includes the distribution URL of the fraudulent application, the distribution download address of the fraudulent application, the application server IP of the fraudulent application, the application server domain name of the fraudulent application, the packaging service system of the fraudulent application, the customer service system of the fraudulent application and the push platform of the fraudulent application.

[0101] In one embodiment, when a computer program is executed by a processor to implement the above-mentioned step of performing intersection analysis on multiple clue features of each fraud case to determine the first fraud case set with associated clue features, the following steps are specifically implemented: performing intersection analysis on the information of the fraud application programs of each fraud case and the associated information of the fraud application programs; if the package names and packaging information of the fraud application programs of any two fraud cases are associated, then determining whether any of the MD5 values ​​of the fraud application files, the signatures of the fraud application programs, and the MD5 values ​​of the fraud application icons of any two fraud cases are associated; if any one or more of the associations exist, then determining that any two fraud cases are the first fraud case set; Fraud cases in the fraud case set, wherein the first clue feature is the fraud application clue; if the package names and packaging information of the fraud applications of any two fraud cases are not related, then determine whether any of the distribution URLs of the fraud applications, the distribution download addresses of the fraud applications, the application server IPs of the fraud applications, the application server domain names of the fraud applications, the packaging service systems of the fraud applications, the customer service systems of the fraud applications and the push platforms of the fraud applications of any two fraud cases are related; if any one or more of the connections exist, then determine that any two fraud cases are both fraud cases in the first fraud case set, wherein the first clue feature is the fraud application clue.

[0102] In one embodiment, when a computer program is executed by a processor to implement the above-mentioned step of performing intersection analysis on multiple clue features of each fraud case to determine a second set of fraud cases with associated clue features, the following steps are specifically implemented: performing intersection analysis on multiple clue features of each fraud case to determine multiple fraud cases with associated second clue features, and constructing a second set of fraud cases based on the multiple fraud cases with associated second clue features, wherein the second clue feature is any one or more of communication clues, fraudulent network behavior clues, and financial transaction clues.

[0103] In one of the embodiments, when the computer program is executed by the processor, the following steps are implemented: obtaining the collection unit information of each target fraud case obtained by serial and parallel case processing; dividing multiple target fraud cases according to the collection unit information of each target fraud case and according to the place of origin, to obtain a set of target fraud cases in each place of origin.

[0104] In one embodiment, the first clue feature is one and the second clue feature is one; or, the first clue feature is multiple and the second clue feature is one and the second clue feature is different from any of the first clue features; or, the first clue feature is multiple and the second clue feature is multiple and any of the second clue features is different from any of the first clue features; when the computer program is executed by the processor, the following steps are implemented: according to the first clue feature, the search keywords of the first set of fraud-related cases are configured, and according to the second clue feature, the search keywords of the second set of fraud-related cases are configured; wherein, when the first clue feature is one, the search keyword of the first set of fraud-related cases is one, and when the first clue feature is multiple, the search keywords of the first set of fraud-related cases are multiple and the first set of fraud-related cases is retrieved by inputting multiple search keywords; when the second clue feature is one, the search keyword of the second set of fraud-related cases is one, and when the second clue feature is multiple, the search keywords of the second set of fraud-related cases are multiple and the second set of fraud-related cases is retrieved by inputting multiple search keywords.

[0105] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0106] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0107] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A case concatenation and merging method based on transitive relationship reasoning, characterized in that: The method comprises: Obtain multiple fraud-related cases from multiple Internet-related cases; Extracting multiple clue features of each fraud case, wherein the multiple clue features include any multiple of communication clues, fraudulent network behavior clues, fund transaction clues, and fraudulent application clues; Performing intersection analysis on multiple clue features of each fraud case to determine a first fraud case set and a second fraud case set with associated clue features, wherein the first fraud case set has an intersection of first clue features between the fraud cases, and the second fraud case set has an intersection of second clue features between the fraud cases, and the first clue features and the second clue features are different; If the first fraud case set and the second fraud case set have one or more identical fraud cases, then it is determined that the first fraud case set and the second fraud case set are cases of the same fraud nature; If it is identified that the first fraud case set and the second fraud case set belong to the same fraud case, then a transfer relationship between the first fraud case set and the second fraud case set is configured; The fraud cases in the first fraud case set and the fraud cases in the second fraud case set are linked together for case processing according to the transmission relationship between the first fraud case set and the second fraud case set.

2. The method according to claim 1, characterized in that The communication clues include any one or more of a mobile phone number and a communication contact in the mobile phone number, an instant messaging number and a communication contact in the instant messaging number, an email number and an email contact in the email number; and / or, The fund transaction clues include fund transaction account numbers and transfer account numbers; and / or, The clues of fraudulent network behavior include one or more of the fraudulent website domain name, the fraudulent website IP address and the third-party service ID.

3. The method according to claim 1, characterized in that The clues of the fraudulent application include information of the fraudulent application and associated information of the fraudulent application. The information of the fraudulent application includes the package name and packaging information of the fraudulent application, the MD5 value of the fraudulent application file, the signature of the fraudulent application and the MD5 value of the fraudulent application icon. The associated information of the fraudulent application includes the distribution URL of the fraudulent application, the distribution download address of the fraudulent application, the application server IP of the fraudulent application, the application server domain name of the fraudulent application, the packaging service system of the fraudulent application, the customer service system of the fraudulent application and the push platform of the fraudulent application.

4. The method according to claim 3, characterized in that The intersection analysis of multiple clue features of each fraud case is performed to determine the first fraud case set with associated clue features, including: Conduct intersection analysis on the information of fraudulent applications in each fraud case and the associated information of fraudulent applications; If the package names and packaging information of the fraudulent applications of any two fraudulent cases are associated, then determine whether any of the MD5 values ​​of the fraudulent application files, the signatures of the fraudulent applications, and the MD5 values ​​of the fraudulent application icons of the any two fraudulent cases are associated; if any one or more of the associations exist, then determine that the any two fraudulent cases are both fraudulent cases in the first set of fraudulent cases, and the first clue feature is the fraudulent application clue; If there is no correlation between the package names and packaging information of the fraudulent applications in any two fraud cases, then determine whether there is a correlation between any of the distribution URLs of the fraudulent applications, the distribution download addresses of the fraudulent applications, the application server IPs of the fraudulent applications, the application server domain names of the fraudulent applications, the packaging service systems of the fraudulent applications, the customer service systems of the fraudulent applications and the push platforms of the fraudulent applications in any two fraud cases. If there is any one or more correlations, then it is determined that the any two fraud cases are both fraudulent cases in the first fraud case concentration, and the first clue feature is the fraudulent application clue.

5. The method according to claim 4, characterized in that The intersection analysis of multiple clue features of each fraud case is performed to determine a second set of fraud cases with associated clue features, including: An intersection analysis is performed on multiple clue features of each fraud-related case to determine multiple fraud-related cases associated with a second clue feature, and the second fraud-related case set is constructed based on the multiple fraud-related cases associated with the second clue feature, where the second clue feature is any one or more of communication clues, fraud-related network behavior clues, and financial transaction clues.

6. The method according to claim 1, characterized in that After the step of combining the fraud cases in the first fraud case set and the fraud cases in the second fraud case set according to the transmission relationship between the first fraud case set and the second fraud case set, the method further includes: Obtain the information of the collecting units of each target fraud case obtained through case concatenation and case combining; According to the information of the collection unit of each target fraud case, the multiple target fraud cases are divided according to the location of attribution to obtain a set of target fraud cases in each location.

7. The method according to claim 1, characterized in that The first clue feature is one, and the second clue feature is one; or, the first clue features are multiple, and the second clue feature is one, and the second clue feature is different from any of the first clue features; or, the first clue features are multiple, and the second clue features are multiple, and any of the second clue features is different from any of the first clue features; The method further includes: configuring a search keyword for the first set of fraud-related cases according to the first clue feature, and configuring a search keyword for the second set of fraud-related cases according to the second clue feature; Wherein, when the first clue feature is one, the search keyword of the first fraud case set is one; when the first clue feature is multiple, the search keyword of the first fraud case set is multiple and the first fraud case set is searched by inputting multiple search keywords; When the second clue feature is one, the search keyword for the second set of fraud cases is one; when the second clue feature is multiple, the search keywords for the second set of fraud cases are multiple and the second set of fraud cases is searched by inputting multiple search keywords.

8. A case concatenation and parallelization device based on transitive relationship reasoning, characterized in that: The device comprises: An acquisition module, used to acquire multiple fraud-related cases from multiple Internet-related cases; An extraction module, used to extract multiple clue features of each fraud case, wherein the multiple clue features include any multiple of communication clues, fraudulent network behavior clues, fund transaction clues, and fraudulent application clues; An intersection analysis module is used to perform intersection analysis on multiple clue features of each fraud case to determine a first fraud case set and a second fraud case set with associated clue features, wherein the first fraud case set has an intersection of first clue features between the fraud cases, and the second fraud case set has an intersection of second clue features between the fraud cases, and the first clue feature and the second clue feature are different; a determination module, configured to determine that the first fraud case set and the second fraud case set are cases of the same fraud nature if there are one or more identical fraud cases in the first fraud case set and the second fraud case set; a configuration module, configured to configure a transfer relationship between the first fraud case set and the second fraud case set if it is identified that the first fraud case set and the second fraud case set belong to the same fraud case; A serial and parallel processing module is used to serially and parallelly process the fraud cases in the first fraud case set and the fraud cases in the second fraud case set according to the transmission relationship between the first fraud case set and the second fraud case set.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images