Group management method, related equipment and computer readable medium

Abstract

The embodiment of the invention discloses a group management method and device, electronic equipment, a computer readable medium and a computer program product, and the method comprises the steps: constructing each group in a plurality of groups as a group node, determining node features of corresponding group nodes based on the group attribute data of each group and the behavior attribute data of the group members contained in each group in the plurality of groups; for every two group nodes in the plurality of group nodes, based on group attribute data corresponding to every two group nodes and behavior attribute data generated by group members contained in two groups corresponding to every two group nodes in the two groups, constructing an edge between every two group nodes so as to obtain a group identical composition; and finally, performing security level identification on the to-be-identified group nodes in the group homograph based on the group homograph. According to the technical scheme of the embodiment of the invention, the identification accuracy of the security level of the group can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer and communication technology, and in particular, to a group management method, a data processing device, an electronic device, a computer-readable medium, and a computer program product. Background Art

[0002] With the development of the Internet, more and more unsafe behaviors such as fraud are being carried out through the Internet. Unsafe elements have gradually changed from carrying out unsafe behaviors through a single account to carrying out unsafe behaviors in an organized manner through groups; therefore, it is often necessary to identify whether a group is a safe group in order to supervise groups with unsafe behaviors. In the related art, the method for identifying whether a group is a safe group is mainly: first identify an account with a lower security level, and then determine the group in which the account is active as a group with a lower security level. However, since groups in which accounts with lower security levels are active are not necessarily groups used to carry out unsafe behaviors, the recognition accuracy of this method is not high. Therefore, how to improve the accuracy of identifying the security level of a group is a problem that needs to be solved urgently. Summary of the invention

[0003] The embodiments of the present application provide a group management method, a group management device, an electronic device, a computer-readable medium, and a computer program product, which can improve the accuracy of identifying the security level of a group.

[0004] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0005] In a first aspect, an embodiment of the present application provides a group management method, including:

[0006] For each of the multiple groups, obtain group attribute data of each group and behavior attribute data generated by members of each group in the multiple groups;

[0007] constructing each of the groups into a group node, and determining the node characteristics of the corresponding group node based on the group attribute data of each of the groups and the behavior attribute data corresponding to the group members contained in each of the groups;

[0008] For every two group nodes among the plurality of group nodes, based on the group attribute data respectively corresponding to the every two group nodes and the behavior attribute data generated by the members contained in the two groups corresponding to the every two group nodes in the two groups, construct an edge between the every two group nodes to obtain a group isomorphism graph;

[0009] Based on the group isomorphism graph, security level identification is performed on the to-be-identified group nodes in the group isomorphism graph.

[0010] In a second aspect, an embodiment of the present application provides a group management device, the device comprising an acquisition unit, a construction unit, and an identification unit, wherein:

[0011] The acquisition unit is used to acquire, for each of the multiple groups, group attribute data of each group and behavior attribute data generated by members of each group in the multiple groups;

[0012] The construction unit is used to construct each of the groups into a group node, and determine the node characteristics of the corresponding group node based on the group attribute data of each group and the behavior attribute data corresponding to the group members contained in each group;

[0013] The construction unit is further configured to construct, for each two group nodes among the plurality of group nodes, an edge between the each two group nodes based on the group attribute data respectively corresponding to the each two group nodes and the behavior attribute data generated by the members contained in the two groups corresponding to the each two group nodes in the two groups, so as to obtain a group isomorphism graph;

[0014] The identification unit is used to identify the security level of the to-be-identified group nodes in the group isomorphism graph based on the group isomorphism graph.

[0015] In a third aspect, an embodiment of the present application provides an electronic device, comprising one or more processors; a storage device for storing one or more computer programs, wherein when the one or more computer programs are executed by the one or more processors, the electronic device implements the group management method as described above.

[0016] In a fourth aspect, an embodiment of the present application provides a computer-readable medium having a computer program stored thereon. When the computer program is executed by a processor of an electronic device, the electronic device executes the group management method as described above.

[0017] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, wherein the computer program is stored in a computer-readable storage medium, and a processor of an electronic device reads and executes the computer program from the computer-readable storage medium, so that the electronic device performs the group management method as described above.

[0018] In the technical solution provided in the embodiment of the present application, by constructing a group isomorphism graph, connections between group nodes can be established from the two aspects of group member behavior and group attributes, thereby clarifying the relationship between groups. At the same time, the node features of each group node in the group isomorphism graph can characterize the behavior and content of the group. It can be seen that the embodiment of the present application uses the group isomorphism graph to identify the security level of the group node to be identified. On the one hand, based on the node features of each group node in the group isomorphism graph, the security level of the corresponding group can be evaluated from the dimensions of behavior and content; on the other hand, the security level of the corresponding group can be evaluated based on the relationship between groups; therefore, the embodiment of the present application can evaluate the security level of the group from multiple aspects and dimensions, which is conducive to improving the accuracy of identifying the security level of the group; at the same time, because the relationship between the groups is inescapable, the accuracy of identifying the security level of the group can be greatly improved.

[0019] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0021] Figure 1 It is a structural diagram of a group management system provided by an embodiment of the present application;

[0022] Figure 2 It is a flowchart of a group management method provided in an embodiment of the present application;

[0023] Figure 3 This is a schematic diagram of an output interface for risk warning information provided in an embodiment of the present application;

[0024] Figure 4 is a flowchart of another group management method provided in an embodiment of the present application;

[0025] Figure 5 This is a schematic diagram of edge connections between group nodes provided in an embodiment of the present application;

[0026] Figure 6 It is a flowchart of another group management method provided in an embodiment of the present application;

[0027] Figure 7 It is a flowchart of another group management method provided in an embodiment of the present application;

[0028] Figure 8 It is a schematic diagram of a model training process provided by an embodiment of the present application;

[0029] Fig. 9 is a schematic diagram of a security level identification process provided in an embodiment of the present application;

[0030] Fig.10 is a structural block diagram of a group management device provided in an embodiment of the present application;

[0031] Fig.11 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown. DETAILED DESCRIPTION

[0032] Here, exemplary embodiments will be described in detail, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0033] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0034] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all contents and operations, nor must they be executed in the order described. For example, some operations may be decomposed, while some operations may be combined or partially combined, so the actual execution order may change according to actual conditions.

[0035] It should also be noted that the "multiple" mentioned in this application refers to two or more than two. "And / or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship.

[0036] Artificial Intelligence (AI) refers to the theories, methods, techniques and application systems that use digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science; it mainly produces a new intelligent machine that can respond in a similar way to human intelligence by understanding the essence of intelligence, so that the intelligent machine has multiple functions such as perception, reasoning and decision-making. Accordingly, AI technology is a comprehensive discipline, which mainly includes several major directions such as computer vision technology (CV), speech technology, natural language processing technology and machine learning / deep learning.

[0037] The so-called machine learning is a multi-disciplinary cross-discipline involving probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and other disciplines. It specializes in studying how computers simulate or implement human learning behavior to acquire new knowledge or skills, and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of AI and the fundamental way to make computer devices intelligent; the so-called machine learning is a multi-disciplinary cross-discipline involving probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and other disciplines; it specializes in studying how computer devices simulate or implement human learning behavior to acquire new knowledge or skills, and reorganize existing knowledge structures to continuously improve their performance. Deep learning is a technology that uses deep neural network systems to perform machine learning; machine learning / deep learning can usually include artificial neural networks, reinforcement learning (RL), supervised learning, unsupervised learning and other technologies; the so-called supervised learning refers to the processing method of using training samples with known categories (with labeled categories) for model training, and unsupervised learning refers to the processing method of using training samples with unknown categories (not labeled) for model training.

[0038] In the related art, it is mainly to identify the accounts with lower security level first, and then identify the groups where the accounts with lower security level are active as the groups with lower security level, that is, the groups with unsafe behaviors. Among them, unsafe behaviors may include behaviors that are not in line with morality, behaviors that are not in line with laws, behaviors that are not in line with administrative regulations, behaviors that are not in line with the regulations of the application or website to which the group belongs, etc., which are not limited here.

[0039] Specifically, you can first obtain the security level label of the training account and the historical account data of the training account, where the security level label of the training account is used to indicate the actual security level of the training account; then call the neural network model to identify and process the historical account data of the training account to obtain the training security level of the training account; finally, train the neural network model based on the security level label of the training account and the training security level to obtain an account recognition model, so that the security level of the account can be identified through the account recognition model.

[0040] However, the actual security level of a group in which accounts with lower security levels are active is not necessarily low, and the security level of a group determined by a single account factor is inaccurate.

[0041] Based on this, the embodiment of the present application provides a group management solution, which introduces graph theory and regards a group as a group node; at the same time, based on the group attribute data of each group and the behavior attribute data generated by the members contained in each group in the multiple groups, the node features of the corresponding group nodes and the edges between the group nodes are constructed to obtain a group isomorphism graph. Finally, the security level of the group nodes to be identified in the group isomorphism graph can be identified based on the group isomorphism graph.

[0042] Among them, the group isomorphism graph refers to a graph with only group nodes, and no other types of nodes exist in the group isomorphism graph. The node characteristics of each group node are determined based on the group attribute data of each group and the behavioral attribute data generated by the members contained in each group in multiple groups. The edge between each two group nodes in the group isomorphism graph is determined based on the group attribute data corresponding to each two group nodes, and the behavioral attribute data generated by the members contained in the two groups corresponding to each two group nodes in the two groups.

[0043] In addition, group member refers to a member of a group, which can be an account. Group attribute data includes data received by the group, generated within the group, and related to the group itself. Behavior attribute data includes historical behavior data initiated by group members within the group.

[0044] When illegal organizations implement unsafe behaviors by forming groups, the group content and member behaviors can be disguised and adjusted to a certain extent; therefore, it is not accurate enough to identify the group's security level based solely on the group's behavior and content characteristics. Compared with behavior and content characteristics, the relationship between groups is difficult to disguise and change, and is inescapable. This solution, by constructing a group isomorphism graph, can establish connections between group nodes from two aspects: group member behavior and group attributes themselves, thereby clarifying the relationship between groups. At the same time, the node characteristics of each group node in the group isomorphism graph can characterize the group's behavior and content.

[0045] It can be seen that this scheme uses the group isomorphism graph to identify the security level of the group nodes to be identified. On the one hand, it can evaluate the security level of the corresponding group from the dimensions of behavior and content based on the node characteristics of each group node in the group isomorphism graph; on the other hand, it can evaluate the security level of the corresponding group based on the relationship between groups, which is conducive to improving the accuracy of identifying the security level of the group.

[0046] Based on the above group management solution, the present application embodiment provides a group management system, which can be seen in Figure 1 , Figure 1 The group management system shown may include multiple terminal devices 101 and multiple servers 102. Among them, a communication connection is established between any terminal device and any server. For example, the terminal device 101 may include any one or more of a smart phone, a tablet computer, a laptop computer, a desktop computer, a vehicle-mounted terminal, and a smart wearable device. Multimedia playback clients, social clients, browser clients, information stream clients, educational clients, etc. can be run in the terminal device 101. The server 102 can be a server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), and big data and artificial intelligence platforms. Any terminal device 101 and any server 102 can be directly or indirectly connected in communication via wired or wireless communication, and this application is not limited here.

[0047] In some embodiments, the above group management method can be performed by only Figure 1 The server 102 in the group management system shown is executed, and the specific execution process is: the server 102 can obtain the group attribute data of each group in the multiple groups, as well as the behavioral attribute data generated by the group members contained in each group in the multiple groups. Then, the server 102 can construct each group into a group node, and determine the node characteristics of the corresponding group node based on the group attribute data of each group and the behavioral attribute data corresponding to the group members contained in each group. Afterwards, the server 102 can construct the edge between each two group nodes in the multiple group nodes based on the group attribute data corresponding to each two group nodes, and the behavioral attribute data generated by the group members contained in the two groups corresponding to each two group nodes in the two groups, so as to obtain a group isomorphism graph. Finally, the server 102 can identify the security level of the group nodes to be identified in the group isomorphism graph based on the group isomorphism graph.

[0048] Optionally, after the server 102 identifies the security levels of the group nodes to be identified in the group isomorphism graph based on the group isomorphism graph, it can obtain the security level identification results of the group nodes to be identified, wherein the security level identification results are used to characterize the security level of the group corresponding to the group nodes to be identified; further, the server 102 can also output the security level of the group within the group corresponding to the group nodes to be identified, and can also send the security level of the group corresponding to the group nodes to be identified to the group members included in the group.

[0049] Optionally, the above group management method can also be performed by Figure 1 The terminal device 101 in the group management system shown is executed. The specific execution process can refer to the specific execution process of the server 102, which will not be repeated here.

[0050] In some other embodiments, the above group management method may be run in a group management system, which may include a terminal device and a server. Figure 1 The group management system shown is jointly completed by the terminal device 101 and the server 102 included in the group management system, and its specific execution process is: each terminal device 101 can determine the group joined by the group members logged in in each terminal device 101, and obtain the behavior attribute data generated by the group member in the group it joins, and send it to the server 102; then, the server 102 can obtain the group attribute data of each group in the multiple groups, and can obtain the behavior attribute data generated by the group members contained in each group in the multiple groups according to the received behavior attribute data sent by each terminal device 101.

[0051] Then, the server 102 can construct each group into a group node, and determine the node characteristics of the corresponding group node based on the group attribute data of each group and the behavior attribute data corresponding to the group members contained in each group. Afterwards, the server 102 can construct the edge between each two group nodes for each of the multiple group nodes based on the group attribute data corresponding to each of the two group nodes, and the behavior attribute data generated by the group members contained in the two groups corresponding to each of the two group nodes in the two groups, so as to obtain a group isomorphism graph. Finally, the server 102 can identify the security level of the group nodes to be identified in the group isomorphism graph based on the group isomorphism graph.

[0052] Optionally, after the server 102 identifies the security levels of the group nodes to be identified in the group isomorphism graph based on the group isomorphism graph, it can obtain the security level identification results of the group nodes to be identified; further, the server 102 can also send the security level identification results to the terminal device 101 that has logged in the members included in the corresponding group, so that the terminal device 101 outputs the security level of the group.

[0053] It should be noted that the embodiments of the present application can be used to identify the security level of any type of group and can be applied to various scenarios, including but not limited to cloud technology, AI (Artificial Intelligence), smart healthcare, smart home, smart driving and other scenarios. It can also be used in social applications, conference applications, shopping applications and other applications that can form groups, without limitation.

[0054] Specifically, the technical solution of the embodiment of the present application can be applied to conference applications, and the participants of each conference will form a conference group. The server can be a conference application server that provides data processing services for the conference application.

[0055] Among them, the conference application server can obtain the group attribute data of each conference group in the multiple conference groups, as well as the behavior attribute data generated by the members contained in each conference group in the multiple conference groups. Then, the conference application server can construct each conference group into a conference group node, and determine the node characteristics of the corresponding conference group node based on the group attribute data of each conference group and the behavior attribute data corresponding to the members contained in each conference group. Afterwards, the conference application server can construct the edge between each two conference group nodes in the multiple conference group nodes based on the group attribute data corresponding to each two conference group nodes, and the behavior attribute data generated by the members contained in the two conference groups corresponding to each two conference group nodes in the two conference groups, so as to obtain a group isomorphism graph about the conference group. Finally, the conference application server can identify the security level of the conference group node to be identified in the group isomorphism graph based on the obtained group isomorphism graph.

[0056] Optionally, after the conference application server identifies the security level of the conference group node to be identified in the above group isomorphism graph, it can obtain the security level of the conference group corresponding to the conference group node to be identified; the conference application server can output the security level of the conference group corresponding to the conference group node to be identified in the conference group. Optionally, the conference application server can also send the security level of the conference group corresponding to the conference group node to be identified to the group members included in the conference group corresponding to the conference group node to be identified.

[0057] For another example, the technical solution of the embodiment of the present application is applied to a social application, and the server may be a social application server that provides a data processing server for the social application. Among them, the social application server can obtain the group attribute data of each social group and the behavior attribute data generated by the members contained in each social group in the multiple social groups for each social group in the multiple social groups. Then, the social application server can construct each social group into a social group node, and determine the node characteristics of the corresponding social group node based on the group attribute data of each social group and the behavior attribute data corresponding to the members contained in each social group. After that, the social application server can construct the edge between each two social group nodes for each two social group nodes in the multiple social group nodes based on the group attribute data corresponding to each two social group nodes and the behavior attribute data generated by the members contained in the two social groups corresponding to each two social group nodes in the two social groups, so as to obtain a group isomorphism graph about the social group. Finally, the social application server can identify the security level of the social group node to be identified in the group isomorphism graph based on the obtained group isomorphism graph.

[0058] Optionally, after the social application server identifies the security level of the social group node to be identified in the group isomorphism graph, it can obtain the security level of the social group corresponding to the social group node to be identified; the social application server can output the security level of the social group corresponding to the social group node to be identified in the social group. Optionally, the social application server can also send the security level of the social group corresponding to the social group node to be identified to the members included in the social group corresponding to the social group node to be identified.

[0059] It should be noted that in the specific implementation of this application, if relevant data or information such as group attribute data, behavioral attribute data, etc. is related to an object, when the embodiment of this application is applied to a specific product or technology, it is necessary to obtain the object's permission or consent, and the collection, use and processing of relevant data or information must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0060] The following is a detailed description of various implementation details of the technical solution of the embodiment of the present application:

[0061] like Figure 2 As shown, Figure 2 is a flow chart of a group management method shown in an embodiment of the present application, which can be applied to Figure 1 The group management system shown in the figure, the method can be executed by the terminal device or the server, or can be executed by the terminal device and the server together. In the embodiment of the present application, the method is executed by the server as an example for explanation, wherein the group management method may include S201 to S204, which are described in detail as follows:

[0062] S201. For each of the multiple groups, obtain group attribute data of each group and behavior attribute data of the members contained in each group within the multiple groups.

[0063] In the embodiment of the present application, the multiple groups may be all groups in the corresponding application scenario, for example, the multiple groups may be all groups that already exist in a certain social application.

[0064] Optionally, in some applications or scenarios, a large number of new groups are created every day. If a corresponding group isomorphism graph is created based on all groups each time, a large amount of data needs to be processed, resulting in reduced recognition efficiency. At the same time, inactive groups created a long time ago are of limited help in identifying newly created groups. Therefore, multiple groups can also be partial groups in corresponding application scenarios, such as multiple groups created by a social application in the last three days.

[0065] In addition, members who manage the group (i.e., group owner or group administrator) are also group members. In addition, since some group members may have only joined some of the above-mentioned multiple groups, some group members may have only generated behavioral attribute data in some groups; therefore, the behavioral attribute data generated by any group member in multiple groups may specifically include: the behavioral attribute data generated by any group member in the group that the group member joined in the multiple groups.

[0066] In one embodiment, the group attribute data may include group attribute data of one or more characteristic types; for example, the group attribute data may include group member quantity data and group creation time data, wherein the group member quantity and group creation time may each be regarded as a characteristic type.

[0067] In one embodiment, the behavioral attribute data may include behavioral attribute data of one or more characteristic types; for example, the behavioral attribute data may include creation behavior data generated when a group member creates a group, red envelope sending behavior data of the group member, and group announcement sending behavior data of the group member, wherein creating a group, sending red envelopes, and sending group announcements can each be regarded as a characteristic type.

[0068] In one embodiment, the method for obtaining the group attribute data of each group may specifically be: sending a data acquisition request for the group attribute data to the group members who manage each group; receiving reply data returned by the corresponding group members; if the received reply data indicates agreement to obtain the group attribute data, then obtaining the group attribute data of each group.

[0069] In one embodiment, the method for acquiring the behavioral attribute data generated by any group member in multiple groups can specifically be: sending a data acquisition request for the behavioral attribute data to any group member; receiving reply data returned by any group member; if the received reply data indicates agreement to acquire the behavioral attribute data, then acquiring the behavioral attribute data generated by any group member in multiple groups.

[0070] S202: construct each group into a group node, and determine the node characteristics of the corresponding group node based on the group attribute data of each group and the behavior attribute data corresponding to the group members in each group.

[0071] In an embodiment of the present application, a specific method for determining the node characteristics of the corresponding group node based on the group attribute data of each group and the behavior attribute data corresponding to the group members contained in each group may be: performing feature extraction on the group attribute data of each group to obtain a group feature vector; performing feature extraction on the behavior attribute data generated by the members contained in each group in multiple groups to obtain a member feature vector; and concatenating the group feature vector with the member feature vector to obtain the node characteristics of the group node corresponding to each group.

[0072] Specifically, the specific method of feature extraction may include one or more feature encoding methods such as one-hot encoding, count encoding, and consolidation encoding.

[0073] For some features that can be distinguished by numerical values, feature encoding can be performed by single-value encoding. For example, group attribute data may include data on the number of group members. Since the number of group members is a numerical value, the data on the number of group members can be encoded by single-value encoding. When the data on the number of group members is 10, the element corresponding to the feature of the number of group members in the group feature vector can be encoded as 10; when the data on the number of group members is 56, the element corresponding to the feature of the number of group members in the group feature vector can be encoded as 56.

[0074] For example, the group attribute data may include group creation time data. If the current time is February 3, 2023, the group creation time data of group M is February 1, 2023, and the group creation time data of group N is February 2, 2023, the element corresponding to the group creation time in the group feature vector can be set to a value of 1 to indicate that the group creation time is 1 day before the current time, and a value of 2 to indicate that the group creation time is 2 days before the current time.

[0075] For features that need to be calculated, counting coding can be used to encode such features. For example, group attribute data can include group transfer times. For example, if the group leader of a group has changed three times, the element corresponding to the group migration times in the group feature vector can be encoded as 3. In addition, for attribute data that can be summarized into one category, it can be summarized into one feature and encoded, which will not be elaborated here.

[0076] S203. For every two group nodes among the multiple group nodes, based on the group attribute data corresponding to each two group nodes and the behavior attribute data generated by the members contained in the two groups corresponding to each two group nodes, construct an edge between each two group nodes to obtain a group isomorphism graph.

[0077] In an embodiment of the present application, the method of constructing an edge between every two group nodes can specifically be: obtaining the similarity between the group attribute data corresponding to every two group nodes; if the obtained similarity is greater than a preset similarity threshold, then constructing an edge between every two group nodes; if the two groups corresponding to every two group nodes contain the same group member, and the data similarity between the behavioral attribute data generated by the member in the aforementioned two groups is greater than the preset data threshold, then constructing an edge between every two group nodes.

[0078] Among them, the preset similarity threshold can be set manually or by the terminal device or server in the above-mentioned group management system, which is not limited here. Specifically, the preset similarity threshold can be set based on one or more similarities such as the similarity between the group attribute data of the groups with lower security levels, the similarity between the group attribute data of the groups with higher security levels, and the similarity between the group attribute data of the groups with lower security levels and the group attribute data of the groups with higher security levels. In addition, the preset data threshold can be set manually or by the terminal device or server in the above-mentioned group management system, which is not limited here.

[0079] In one embodiment, the specific method of obtaining the similarity between two group attribute data may be: performing feature extraction processing on the two group attribute data respectively to obtain two data features; determining the feature distance between the two data features; and determining the similarity between the two group attribute data based on the feature distance. Specifically, the feature distance between the two data features may be calculated using one or more algorithms such as Euclidean distance, Mahalanobis distance, and Manhattan distance. In addition, the feature distance is inversely proportional to the similarity, so the similarity may be directly converted based on the feature distance, which will not be elaborated here.

[0080] Optionally, when the group attribute data is text, one or more similarities such as voice similarity, semantic similarity, and text similarity between the two group attribute data can be calculated first, and then the similarity between the two group attribute data can be determined based on the one or more similarities. Among them, since the algorithms for calculating similarities such as voice similarity, semantic similarity, and text similarity are technical means commonly used by those skilled in the art, they will not be described in detail here.

[0081] Similarly, the specific method of obtaining the data similarity between two behavior attribute data can refer to the specific method of obtaining the similarity between two group attribute data mentioned above, which will not be described in detail here.

[0082] In one embodiment, since the group attribute data mentioned in step S201 may include group attribute data of one or more characteristic types, if the similarity between the group attribute data of the same characteristic type corresponding to each two group nodes is greater than the corresponding preset similarity threshold, an edge may be constructed between each two group nodes; wherein the preset similarity thresholds corresponding to different types of group attribute data may be the same or different, which is not limited here.

[0083] That is, if the similarities between the group attribute data of multiple feature types corresponding to two group nodes are all greater than the corresponding preset similarity threshold, multiple edges can be constructed between the two group nodes.

[0084] In one embodiment, since the behavior attribute data mentioned in step S201 may include one or more characteristic types of behavior attribute data. Then, if the two groups corresponding to each two group nodes contain the same member, and the data similarity between the behavior attribute data of the same characteristic type generated by the member in the aforementioned two groups is greater than the corresponding preset data threshold, an edge can be constructed between each two group nodes. Among them, the preset data thresholds corresponding to the behavior attribute data of different characteristic types may be the same or different, which is not limited here.

[0085] That is, if the similarities between the behavioral attribute data of multiple feature types generated by the same member in the two groups corresponding to the two group nodes in the two groups are greater than the corresponding preset data threshold, multiple edges can be constructed between the two group nodes.

[0086] In one possible implementation, since the multiple groups mentioned in step S201 may also be partial groups under corresponding application scenarios, such as the multiple groups may be groups created by a social application within the last three days, etc.; therefore, a group isomorphism graph may be constructed periodically, such as a new group isomorphism graph may be constructed every three days, and the group isomorphism graph is constructed based on the group attribute data of the groups created within the last three days, and the behavioral attribute data generated by the members of the groups created within the last three days in multiple groups.

[0087] S204: Based on the group isomorphism graph, security level identification is performed on the to-be-identified group nodes in the group isomorphism graph.

[0088] In an embodiment of the present application, a specific method for identifying the security level of the group nodes to be identified in the group isomorphism graph based on the group isomorphism graph may be: selecting the group nodes to be identified and the neighboring group nodes of the group nodes to be identified from the group isomorphism graph; performing feature aggregation processing on the node features of the neighboring group nodes and the node features of the group nodes to be identified to obtain the security level identification result of the group nodes to be identified; wherein the security level identification result is used to characterize the security level of the group corresponding to the group nodes to be identified.

[0089] Specifically, the security level of a group can be a number, field, symbol, etc., which is not limited here. For example, the security level of the group can be set to include 1 and 0. Among them, 0 indicates that there is no unsafe behavior in the group, and it is a safe group; 1 indicates that there is unsafe behavior in the group, and it is an unsafe group. For another example, the security level of the group can be set to include high, medium, and low. Among them, "high" indicates that there is no unsafe behavior in the group, and it is a high-security group; "medium" indicates that unsafe behavior is about to occur or may occur in the group, and it is a risky group; "low" indicates that unsafe behavior has occurred in the group, and it is an unsafe group.

[0090] In addition, the neighboring group nodes of the group node to be identified may include group nodes having direct edge connections with the group node to be identified and / or group nodes having indirect edge connections with the group node to be identified, which is not limited here.

[0091] In one embodiment, the specific method of performing feature aggregation processing on the node features of the neighboring group nodes and the node features of the group nodes to be identified may be: splicing the node features of the neighboring group nodes and the node features of the group nodes to be identified to obtain spliced ​​features; performing mean aggregation processing on the elements of each feature dimension in the spliced ​​features to obtain target features; performing classification and prediction processing on the target features to obtain security level identification results of the group nodes to be identified.

[0092] In a specific implementation, a security level identification model may be called to perform security level identification. The security level identification model may be trained by supervised learning, semi-supervised learning, or unsupervised learning.

[0093] In practical applications, the training process of the security level recognition model may include: first, calling the recognition model to be trained, and selecting the neighbor group nodes of the labeled group node from the group isomorphism graph; wherein the labeled group node refers to the group node labeled with a security level label in the group isomorphism graph. Then, feature aggregation processing is performed on the node features of the labeled group node and the node features of the neighbor group nodes of the labeled group node to obtain the training recognition result of the labeled group node; wherein the training recognition result is used to characterize the security level of the labeled group node. Finally, based on the training recognition result of the labeled group node and the security level label, the recognition model to be trained is trained to obtain the security level recognition model.

[0094] Specifically, the security level label can be manually labeled based on experience, or it can be labeled by the terminal device or server in the above-mentioned group management system, which is not limited here. For example, the security level label can be a corresponding security level label for a group that has been found to have unsafe behavior, suspected of having unsafe behavior, or determined to have no unsafe behavior. In addition, the training recognition model can be trained in the direction of reducing the gap between the security level label and the training security level recognition results.

[0095] Optionally, the security level identification model may include a fully connected layer, an activation function layer and a classification function layer. Then, the security level identification result may be obtained by: calling the fully connected layer of the security level identification model, calculating the mean of the elements of each feature dimension in the spliced ​​feature, and obtaining the mean feature; calling the activation function layer in the security level identification model, performing nonlinear transformation processing on the mean feature, and obtaining the target feature; calling the classification function layer in the security level identification model, performing classification prediction processing on the target feature, and obtaining the security level identification result of the group node to be identified.

[0096] The classification function may be sigmoid (a loss function for binary classification), cross entropy loss function, etc., without limitation. The activation function may be any of a variety of functions such as hyperbolic tangent function (i.e. Tanh function), S-shaped growth curve function (i.e. sigmoid function), linear rectification function (i.e. Relu function), parameter corrected linear function (i.e. PReLU function), etc., without limitation.

[0097] Optionally, the number of fully connected layers may include multiple, and the number of activation function layers may also include multiple; one fully connected layer and one activation function layer may be sequentially connected to form a pooling activation layer, and multiple pooling activation layers may be sequentially connected. Then, the concatenated features may be processed by the multiple sequentially connected pooling activation layers to obtain the target features.

[0098] Optionally, since it is mentioned in step S203 that a group isomorphism graph can be constructed periodically, a corresponding security level recognition model can be trained for each group isomorphism graph constructed periodically.

[0099] Optionally, one or more graph algorithms such as Graph Sampling and Aggregation (GraphSAGE, a node embedding learning algorithm for graph neural networks), graph convolutional neural network algorithm (GCN), graph isomorphism network model (Graph Isomorphism Network, GIN), DiffPool (Hierarchical Graph Representation) suitable for isomorphic graphs can also be used to select neighbor group nodes of the group nodes to be identified from the group isomorphic graph and perform feature aggregation processing to obtain the security level identification result of the group nodes to be identified, which is not limited here.

[0100] Furthermore, after obtaining the security level of the group corresponding to the group node to be identified, the server may output the security level of the group within the group corresponding to the group node to be identified; optionally, the server may also send the security level of the group corresponding to the group node to be identified to the members included in the group.

[0101] Furthermore, if the security level of the group corresponding to the group node to be identified is less than or equal to the pre-selected security level, the server can generate risk warning information for the group, wherein the risk warning information is used to warn that there may be unsafe behaviors in the group; thereafter, the server can output the risk warning information in the group corresponding to the group node to be identified or send the risk warning information to the group members included in the group. The pre-selected security level can be set manually or by the terminal device or server in the above-mentioned group management system, which is not limited here.

[0102] For example, see the attached Figure 3, showing a schematic diagram of the output interface of risk warning information. The security level can be set to high, medium, low, and the pre-selected security level is medium. Since the security level identification result obtained after the security level identification of the group node corresponding to the "xxx group chat" based on the group isomorphism graph indicates that the security level of the "xxx group chat" is "low", risk warning information can be generated. The content of the risk warning information may include "The security level of "xxx group chat" is "low", there is a risk of fraud, please stop clicking on external links, scanning QR codes, transferring money, etc." Then, as Figure 3 As shown, a risk warning box 302 may be displayed in the group chat interface 301 of the “xxx group chat”, and the risk warning box 302 may include risk warning information.

[0103] Optionally, if the security level of the group corresponding to the group node to be identified is less than or equal to the pre-selected security level, the server may report the group to a supervisor of unsafe behavior, who will review the group.

[0104] Optionally, if the security level of the group corresponding to the group node to be identified is less than or equal to the pre-selected security level, the server can also freeze the specified functions of the group, where the specified functions may include any functions that can assist in the implementation of unsafe behaviors, such as transferring money, sending red envelopes, sending pictures, sending links, etc., which are not limited here.

[0105] In an embodiment of the present application, by constructing a group isomorphism graph, connections between group nodes can be established from two aspects: the behavior of group members and the attributes of the group itself, so as to clarify the relationship between groups. At the same time, the node features of each group node in the group isomorphism graph can characterize the behavior and content of the group. It can be seen that the embodiment of the present application uses the group isomorphism graph to identify the security level of the group node to be identified. On the one hand, based on the node features of each group node in the group isomorphism graph, the security level of the corresponding group can be evaluated from the dimensions of behavior and content; on the other hand, the security level of the corresponding group can be evaluated based on the relationship between groups. Therefore, the embodiment of the present application can evaluate the security level of the group from multiple aspects and dimensions, which is conducive to improving the accuracy of identifying the security level of the group; at the same time, because the relationship between the groups is inescapable, the accuracy of identifying the security level of the group can be further improved.

[0106] In addition, when unsafe behaviors have not occurred in the group, it is difficult to identify the security level of the group through a behavior-based recognition algorithm. However, the embodiment of the present application can not only evaluate the security level of the group based on behavior and content, but also evaluate the security level of the corresponding group based on the relationship between groups; therefore, the embodiment of the present application can accurately identify the security level of groups created by the same organization but have not yet implemented unsafe behaviors, and then such groups can be supervised in advance, which is conducive to solving the cold start problem in the scenario where the group implements unsafe behaviors.

[0107] In addition, the group isomorphism graph in the embodiment of the present application can be constructed periodically, so that the edges between group nodes in the group isomorphism graph can be added or reduced in a timely manner according to the group attribute data and behavior attribute data of the latest unsafe behavior implementation organization, which has strong flexibility and scalability.

[0108] In one embodiment of the present application, another group management method is provided, which can be applied to Figure 1 The group management system shown in the figure can be executed by a terminal device or a server, or can be executed by a terminal device and a server together. In the embodiment of the present application, the method is executed by a server as an example for explanation. Figure 4 FIG. 1 is a flow chart showing another group management method. Figure 2 This is an extension of the method shown in .

[0109] Among them, S401 to S405 are described in detail as follows:

[0110] S401. For each of the multiple groups, obtain group attribute data of each group and behavior attribute data of the members of each group generated in the multiple groups.

[0111] In the embodiment of the present application, the specific implementation of step S401 can refer to the specific implementation of step S201 in the above embodiment, which will not be repeated here.

[0112] S402: construct each group into a group node, and determine the node characteristics of the corresponding group node based on the group attribute data of each group and the behavior attribute data corresponding to the group members in each group.

[0113] In the embodiment of the present application, the specific implementation of step S402 can refer to the specific implementation of step S202 in the above embodiment, which will not be repeated here.

[0114] S403: If the similarity between the group attribute data corresponding to every two group nodes is greater than a preset similarity threshold, an edge is constructed between every two group nodes.

[0115] In the embodiment of the present application, the specific implementation of obtaining the similarity between two group attribute data and presetting the similarity threshold can refer to the corresponding specific implementation in step S203, which will not be described in detail here.

[0116] In one embodiment, the group attribute data of each group may include the diversion data received in each group, and the diversion data includes the description information of the specified network address. Specifically, the purpose of the diversion data is to directly or indirectly guide the group members to enter the specified network address, so the diversion data includes the description information of the specified network address, so that the group members can understand the specified network address and its content.

[0117] The designated network address may include one or more forms such as a website link, a group code, a personal code, etc. The descriptive information of the designated network address may directly include the designated network address, or may indirectly introduce the designated network address. For example, the descriptive information of the designated network address may include one or more of the following: a jump link of the designated network address, a recommended soft article of the designated network address, an advertisement of the designated network address, etc.

[0118] Then, the similarity between the drainage data corresponding to the two groups corresponding to each two group nodes can be obtained; if the obtained similarity is greater than the first threshold, it is determined that the similarity between the group attribute data corresponding to each two group nodes is greater than the preset similarity threshold, so that an edge can be built between each two group nodes. Among them, the first threshold can be set manually or by the terminal device or server in the above group management system, which is not limited here.

[0119] Optionally, the drainage data may include drainage data of one or more feature types; therefore, the similarity between the drainage data of the same feature type corresponding to the two groups may be obtained; if the obtained similarity is greater than the corresponding first threshold, it may be determined that the similarity between the group attribute data corresponding to the two corresponding group nodes is greater than the preset similarity threshold, thereby constructing an edge between the two corresponding group nodes. The first thresholds corresponding to different feature types may be the same or different, which is not limited here.

[0120] For example, the feature types of traffic-generating data may include website links, group codes, and recommended soft articles. The server may obtain the similarity between the website link data in two groups. If the obtained similarity is greater than the corresponding first threshold, an edge may be constructed between the corresponding two group nodes. At the same time, the server may obtain the similarity between the group code data in the two groups. If the obtained similarity is greater than the corresponding first threshold, another edge may be constructed between the corresponding two group nodes. Also, the server may obtain the similarity between the recommended soft article data in the two groups. If the obtained similarity is greater than the corresponding first threshold, another edge may be constructed between the corresponding two group nodes.

[0121] Illegal organizations usually conduct unsafe behaviors by guiding group members to other network addresses. Through network addresses, illegal organizations can transfer group members layer by layer and disguise the group as a safe group. However, the number of links, QR codes and other network addresses that the same organization can create is limited. Therefore, by establishing edges between group nodes through similar drainage data, the relationship between groups controlled by the same organization can be clarified, which is conducive to accurately identifying the security level of the group, and thus facilitating the prior supervision of groups controlled by the same organization that have not yet conducted unsafe behaviors.

[0122] In one embodiment, the group attribute data of each group includes group description data of each group, and the group description data is used to describe the group content of a specified type in the corresponding group, wherein the specified type may include group name, group avatar, group announcement, etc.

[0123] Then, the similarity between the group description data corresponding to the two groups corresponding to each two group nodes can be obtained; if the obtained similarity is greater than the second threshold, it is determined that the similarity between the group attribute data corresponding to each two group nodes is greater than the preset similarity threshold, so that an edge can be constructed between each two group nodes. The second threshold can be set manually or by the terminal device or server in the above group management system, which is not limited here.

[0124] Optionally, the specified type may include one or more, and the group description data describing the group content of different specified types may be regarded as group description data of different feature types. Then, the similarity between the group description data corresponding to the two groups and used to describe the group content of the same specified type may be obtained; if the obtained similarity is greater than the corresponding second threshold, it may be determined that the similarity between the group attribute data corresponding to the two corresponding group nodes is greater than the preset similarity threshold, thereby constructing an edge between the two corresponding group nodes. Among them, the second threshold corresponding to the group description data used to describe the group content of different specified types may be the same or different, which is not limited here.

[0125] For example, the group description data may include two feature types of data, namely, group name data and group announcement data. The server may obtain the similarity between the group name data of two groups, and if the obtained similarity is greater than the corresponding second threshold, an edge may be constructed between the corresponding two group nodes; the server may obtain the similarity between the group announcement data of two groups, and if the obtained similarity is greater than the corresponding second threshold, another edge may be constructed between the corresponding two group nodes.

[0126] Specifically, since the same organization or the same type of illegal organization usually uses the same or similar descriptions or words when implementing unsafe behaviors in a group, therefore, by establishing edges between group nodes through similar group description data, the relationship between groups controlled by the same organization or the same type of organization can be clarified, which is conducive to accurately identifying the security level of the group, and thus facilitates prior supervision of groups controlled by the same organization or the same type of organization that have not yet implemented unsafe behaviors.

[0127] In one possible implementation, the edge between each two group nodes in the group isomorphism graph can be flexibly constructed according to different business scenarios. In addition to the drainage data and group description data, as the business scenario changes, the edge between the corresponding two group nodes can also be constructed by identifying the similarity between the group attribute data of other feature types of the two groups.

[0128] For example, in the health care product fraud scenario, online and offline methods are usually combined, such as letting the elderly go to offline meetings to experience the product, build initial trust, and then collect money online. Therefore, group attribute data can also include address data generated within the group.

[0129] Then, the similarity between the address data corresponding to the two groups corresponding to each two group nodes can be obtained; if the obtained similarity is greater than the third threshold, it can be determined that the similarity between the group attribute data corresponding to each two group nodes is greater than the preset similarity threshold, so that an edge can be constructed between each two group nodes. The third threshold can be set manually or by the terminal device or server in the above group management system, which is not limited here.

[0130] S404: If the two groups corresponding to every two group nodes contain the same member, and the behavior attribute data generated by the same member in the two groups matches the preset behavior type, an edge is constructed between every two group nodes.

[0131] In the embodiment of the present application, the number of preset behavior types may include one or more. Then, if the two groups corresponding to every two group nodes contain the same member, and the behavior attribute data generated by the same member in the two groups matches multiple preset behavior types, multiple edges can be constructed between every two group nodes.

[0132] The preset behavior type may include the type of behavior initiated by a member whose security level is lower than the preset security level in the group. Therefore, members whose behavior attribute data matches the preset behavior type may also be understood as members who play different roles and responsibilities in the illegal organization and assist in implementing unsafe behaviors.

[0133] In addition, the preset security level can be set manually or by a terminal device or server in the above group management system, which is not limited here. The level system of the security level of the group member can be the same as or different from the level system of the security level of the group, which is not limited here. For example, the security level of the group member can include high, medium, and low, and the security level of the group can include safe and unsafe, in which case the two level systems are different.

[0134] Specifically, when the same organization or the same type of illegal organization implements unsafe behaviors in a group, they usually adopt a set of planned, identical or similar behaviors to manage the group to ensure that the unsafe behaviors can be successfully implemented. Therefore, by constructing edges between group nodes with group members that match the preset behavior types, the relationship between groups controlled by the same organization or the same type of organization can be further clarified from the perspective of organizational responsibilities and roles, which is conducive to accurately identifying the security level of the group, and thus facilitating the prior supervision of groups controlled by the same organization or the same type of organization that have not yet implemented unsafe behaviors.

[0135] In one embodiment, the group members who actually implement or assist in implementing unsafe behaviors can be identified as group members whose safety level is lower than the preset safety level; then, the types of behaviors initiated by such group members in the group can be summarized to obtain the preset behavior types.

[0136] For example, since group members who implement or assist in implementing unsafe behaviors through groups usually initiate group creation, post group announcements, send multiple red envelopes, frequently invite people to join the group, send external links, frequently send pictures, etc.; therefore, the preset behavior types may include creating a group, sending group announcements, sending at least 25 red envelopes, inviting at least 5 people to join the group, sending at least 6 drainage data, sending at least 10 pictures, etc.

[0137] In one embodiment, the preset behavior type may include behaviors and / or behavior conditions. Then, if the behavior attribute data generated by the same member in two groups is the same as the behavior included in the preset behavior type and meets the behavior conditions indicated by the preset behavior type, it can be determined that the behavior attribute data generated by the same member in the two groups matches the preset behavior type.

[0138] For example, the preset behavior types include creating a group and adding at least 5 people to the group. If both Group A and Group B are created by member Y, since the preset behavior type of creating a group does not indicate a behavior condition, as long as member Y has the same group creation behavior in both Group A and Group B, an edge can be established between the two group nodes corresponding to Group A and Group B.

[0139] If member Z pulls 3 people into group A and 6 people into group B, then, although member Z's pulling behavior is the same as the behavior included in the preset behavior type, it does not meet the behavior condition of pulling at least 5 people indicated by the preset behavior type; therefore, an edge cannot be established between the two group nodes corresponding to group A and group B respectively.

[0140] For specific implementation, please refer to the attached Figure 5 , showing a schematic diagram of edge connection between group nodes. The edges between group nodes can be established in three ways: role group member association, drainage data association, and similar content association.

[0141] If the two groups corresponding to group node 501 and group node 502 respectively contain the same member, and the behavior attribute data generated by the same member in the two groups matches the preset behavior type, it can be determined that group node 501 and group node 502 have a role member association, so that an edge can be constructed between group node 501 and group node 502. The role member of a group refers to a member whose behavior attribute data generated in a group matches the preset behavior type.

[0142] In addition, the first threshold value may be set to 90%. Then, if the similarity between the drainage data of the two groups corresponding to the group node 501 and the group node 502 is greater than 90%, it can be determined that the group node 501 and the group node 502 have drainage data association, so that an edge can be constructed between the group node 501 and the group node 502.

[0143] In addition, the second threshold value may be set to 85%. If the similarity between the group description data of the two groups corresponding to group node 501 and group node 502 is greater than 85%, it can be determined that group node 501 and group node 502 have similar content associations, so that an edge can be constructed between group node 501 and group node 502.

[0144] S405 . Identify the security level of the to-be-identified group nodes in the group isomorphism graph based on the group isomorphism graph.

[0145] In the embodiment of the present application, the specific implementation of step S405 can refer to the specific implementation of step S204 in the above embodiment, which will not be repeated here.

[0146] When the same organization or the same type of illegal organization implements unsafe behaviors in different groups, although it will disguise the group in various ways, the adopted behavior, content, diversion scheme and other action strategies are still similar. Therefore, the embodiment of the present application uses the similarity between group attribute data to construct the edge between group nodes, which can clarify the relationship between groups controlled by the same organization or the same type of group from the perspective of action strategies of group attributes such as content and diversion schemes, which is conducive to accurately identifying the security level of the group; at the same time, the embodiment of the present application uses the method of constructing the edge between group nodes by group members matching the preset behavior type, which can further clarify the relationship between groups controlled by the same organization or the same type of organization from the perspective of action strategies in terms of organizational role behavior, which is conducive to further improving the accuracy of identifying the security level of the group, thereby facilitating the precise supervision of the groups controlled by the same organization or the same type of organization that have not yet implemented unsafe behaviors in advance.

[0147] In one embodiment of the present application, another group management method is provided. The group management method can be applied to Figure 2 The group management system shown in the figure, the method can be executed by the terminal device or the server, or can be executed by the terminal device and the server together. In the embodiment of the present application, the method is executed by the server as an example for explanation. Figure 6 FIG. 4 is a flow chart showing another group management method. Figure 2 and Figure 4 This is an extension of the method shown in .

[0148] Among them, S601 to S608 are described in detail as follows:

[0149] S601. For each of the multiple groups, obtain group attribute data of each group and behavior attribute data of the members of each group generated in the multiple groups.

[0150] In the embodiment of the present application, the specific implementation of step S601 can refer to the specific implementation of step S201 in the above embodiment, which will not be repeated here.

[0151] S602: construct each group into a group node.

[0152] In the embodiment of the present application, the specific implementation of step S602 can refer to the specific implementation of step S202 in the above embodiment, which will not be repeated here.

[0153] S603: Filter out target attribute data matching the preset group construction type from the group attribute data of each group.

[0154] In the embodiment of the present application, the preset group construction type refers to a feature type related to the group composition and group creation process. For example, the preset group construction type may include group creation time, number of group members, number of group migrations, and the like.

[0155] Specifically, since the main purpose of identifying the security level of a group is to identify groups that may have unsafe behaviors, so as to accurately supervise such groups. Groups with unsafe behaviors will have certain rules in their group composition and group creation. For example, the same organization will usually create a large number of groups at the same time or at a similar time to implement unsafe behaviors. In order to disguise and avoid exposure, the same organization will usually transfer the group owner or group management to other members many times, etc. Therefore, the target attribute data can be filtered out from the group attribute data of each group, so that a better node feature that can better characterize the characteristics of groups that may have unsafe behaviors can be constructed based on the target attribute data, which is conducive to improving the accuracy of identifying the security level of the group.

[0156] Optionally, the characteristics and rules of the groups managed by illegal organizations in different business scenarios are different; therefore, according to different business scenarios, attribute data matching the business feature type of the corresponding business scenario can be selected from the group attribute data of the group to construct the node characteristics of the corresponding group node.

[0157] S604: Extract features from target attribute data of each group to obtain a group feature vector of each group.

[0158] In the embodiment of the present application, the specific implementation of feature extraction can refer to the specific implementation of feature extraction in step S202, which will not be repeated here.

[0159] S605: Extract features of the behavior attribute data generated by the members in each group in multiple groups to obtain feature vectors of the members in each group.

[0160] In the embodiment of the present application, since the main purpose of identifying the security level of a group is to identify groups that may have unsafe behaviors so as to accurately supervise such groups. Therefore, in order to improve the accuracy of identifying groups with unsafe behaviors, members in each group whose behaviors match those of illegal organizations can be screened out, so that a better node feature that can better characterize the characteristics of groups that may have unsafe behaviors can be constructed based on the behavioral attribute data of such members.

[0161] Then, the specific method of obtaining the member feature vectors of each group can be: for the members contained in any group, the members whose behavioral attribute data generated in any group matches the preset behavior type are determined as target members; the features of the behavioral attribute data generated by the target members in multiple groups are extracted to obtain the member feature vectors of any group.

[0162] Optionally, since the number of group members or target group members contained in each group may include multiple; therefore, the specific method of extracting features from the behavioral attribute data generated by the members contained in each group in multiple groups to obtain the member feature vectors of each group may include: extracting features from the behavioral attribute data generated by each member contained in each group in multiple groups to obtain the feature vectors of each member; and performing feature fusion on the feature vectors of each member to obtain the member feature vectors of each group.

[0163] Among them, the specific method of feature extraction may include one or more coding methods such as single-value coding, counting coding and type induction coding. For example, based on the behavioral attribute data generated by member Y in multiple groups, it can be analyzed that member Y has joined 26 groups in total and created 12 groups. Then, the element corresponding to the number of times member Y joined a group in the feature vector of member Y can be encoded as 26, and the element corresponding to the number of times member Y created a group in the feature vector of member Y can be encoded as 12 by single-value coding.

[0164] In addition, the specific method of feature fusion can be to add the feature vectors of each member to obtain the member feature vectors of each group, or to perform vector averaging on the feature vectors of each member to obtain the member feature vectors of each group. Optionally, feature fusion can also be performed in other ways, which are not limited here.

[0165] S606: Concatenate the group feature vectors and group member feature vectors of each group to obtain node features of the corresponding group node.

[0166] In the embodiment of the present application, the specific method of splicing may be: horizontally splicing or vertically splicing the group feature vectors and group member feature vectors of each group to obtain the node features of the corresponding group node.

[0167] In practical applications, the formula (1-1) for constructing the node characteristics of any group of nodes is as follows:

[0168]

[0169] Among them, roomid featureRefers to the node feature of any group of nodes; roomidfeature refers to the group feature vector of any group of nodes corresponding to the group, which contains R elements, where R is a positive integer. i It refers to the feature vector of the i-th member in any group of nodes whose behavior attribute data matches the preset behavior type, which contains j elements, where j is a positive integer. P refers to the total number of members in any group of nodes whose behavior attribute data matches the preset behavior type, where i is less than or equal to P, and both i and P are positive integers.

[0170] The sum function can be used to add the feature vectors of P members in the group corresponding to any group of nodes, thereby obtaining the group feature vector of the group corresponding to any group of nodes.

[0171] S607. For every two group nodes among the multiple group nodes, based on the group attribute data corresponding to each two group nodes and the behavior attribute data generated by the members contained in the two groups corresponding to each two group nodes, construct an edge between each two group nodes to obtain a group isomorphism graph.

[0172] In the embodiment of the present application, the specific implementation of step S607 can refer to the specific implementation of step S203 and steps S403 to S404 in the above embodiment, which will not be repeated here.

[0173] S608 . Based on the group isomorphism graph, security level identification is performed on the to-be-identified group nodes in the group isomorphism graph.

[0174] In the embodiment of the present application, the specific implementation of step S608 can refer to the specific implementation of step S204 in the above embodiment, which will not be repeated here.

[0175] In an embodiment of the present application, by filtering out target attribute data from the group attribute data of each group, the data used to construct the group feature vector is data that can highlight the regularity of groups with unsafe behaviors, so that a better node feature that can better characterize the characteristics of groups that may have unsafe behaviors can be constructed based on the group feature vector, thereby facilitating improving the accuracy of identifying the safety level of the group.

[0176] In addition, when constructing the member feature vector of a group, the embodiment of the present application may also screen the target members and obtain the corresponding member feature vector based on the behavioral attribute data of the target members, so that the data used to construct the member feature vector is data reflecting the behavior of the members in the group where unsafe behavior exists, so that a better node feature that can better characterize the characteristics of the group that may have unsafe behavior can be constructed based on the member feature vector, thereby facilitating improving the accuracy of identifying the safety level of the group.

[0177] In one embodiment of the present application, another group management method is provided. The group management method can be applied to Figure 2 The group management system shown in the figure, the method can be executed by the terminal device or the server, or can be executed by the terminal device and the server together. In the embodiment of the present application, the method is executed by the server as an example for explanation. Figure 7 FIG. 4 is a flow chart showing another group management method. Figure 3 and Figure 5 The expectation maximization process is extended based on the method shown in .

[0178] Among them, S701 to S707 are described in detail as follows:

[0179] S701. For each of the multiple groups, obtain group attribute data of each group and behavior attribute data of the members of each group generated in the multiple groups.

[0180] In the embodiment of the present application, the specific implementation of step S701 can refer to the specific implementation of step S201 in the above embodiment, which will not be repeated here.

[0181] S702: construct each group into a group node, and determine the node characteristics of the corresponding group node based on the group attribute data of each group and the behavior attribute data corresponding to the group members in each group.

[0182] In the embodiment of the present application, the specific implementation of step S702 can refer to the specific implementation of step S202 and steps S603 to S606 in the above embodiment, which will not be repeated here.

[0183] S703. For every two group nodes among the multiple group nodes, based on the group attribute data corresponding to each two group nodes and the behavior attribute data generated by the members contained in the two groups corresponding to each two group nodes, construct an edge between each two group nodes to obtain a group isomorphism graph.

[0184] In the embodiment of the present application, the specific implementation of step S703 can refer to the specific implementation of step S203 and steps S403 to S404 in the above embodiment, which will not be repeated here.

[0185] S704: Select a group node to be identified from the group isomorphism graph.

[0186] In the embodiment of the present application, before selecting the group node to be identified from the group isomorphism graph, a labeled group node can also be selected from the group isomorphism graph, and a security level identification model can be obtained based on the labeled group node training. The labeled group node refers to a group node labeled with a security level label, and the security level label is used to indicate the security level of the group corresponding to the labeled group node.

[0187] Optionally, the specific process of obtaining a security level identification model based on training of labeled group nodes may include: calling the identification model to be trained to obtain multiple connected group nodes in the group isomorphism graph that have edge connections with the labeled group node; selecting neighbor group nodes of the labeled group node from the group nodes contained in the group isomorphism graph based on the connection weights between each connected group node and the labeled group node; performing feature aggregation processing on the node features of the neighbor group nodes of the labeled group node and the node features of the labeled group node to obtain a training security level identification result of the labeled group node; training the identification model to be trained based on the training security level identification result of the labeled group node and the security level label to obtain a security level identification model.

[0188] The connection weight between two group nodes is determined based on the number of edges connecting the two group nodes; the connection weight between two group nodes is proportional to the number of edges connecting the two group nodes. Specifically, the number of edges between two group nodes can be directly used as the connection weight between the two group nodes; or the number of edges between two group nodes can be divided by a preset value to obtain the connection weight between the two group nodes.

[0189] The preset value may be manually set or may be set by a terminal device or server in the group management system, and is not limited thereto. For example, the preset value may be 100, and the connection weight corresponding to 20 edges is 0.2. Optionally, the number of edges may be processed and calculated in other ways to obtain the connection weight, and is not limited thereto.

[0190] In one embodiment, the neighboring group nodes of the marked group node may include M-hop neighboring group nodes, where M is a positive integer, and M may be manually set or may be set by a terminal device or server in the above group management system, which is not limited here.

[0191] Then, based on the connection weights between each connected group node and the labeled group node, a specific method for selecting the neighbor group nodes of the labeled group node from the group nodes contained in the group isomorphism graph may be: based on the connection weights between each connected group node and the labeled group node, selecting the first-hop neighbor group node of the labeled group node from multiple connected group nodes; wherein the connection weight corresponding to the selected first-hop neighbor group node is greater than the connection weights corresponding to other connected group nodes; for the x-th-hop neighbor group node of the labeled group node, based on the connection weights between the adjacent group node having an edge connection with the x-th-hop neighbor group node and the x-th-hop neighbor group node, selecting the x+1-th-hop neighbor group node of the labeled group node from the adjacent group nodes; wherein x is a positive integer, and x is less than M.

[0192] In one embodiment, the number of neighbor group nodes of the labeled group node can be set to include Q, where Q is a positive integer. Then, based on the connection weight between each connection group node and the labeled group node, the specific method of selecting the neighbor group nodes of the labeled group node from the group nodes contained in the group isomorphism graph can be: sorting each connection group node in descending order of connection weight to obtain a connection group node sequence; when the number of connection group nodes is greater than or equal to Q, selecting the first Q connection group nodes from the connection group node sequence as the neighbor group nodes of the labeled group node; when the number of connection group nodes is less than Q, using each connection group node as the neighbor group node of the labeled group node, and traversing each connection group node in the connection group node sequence, and obtaining the group nodes that have edge connections with the currently traversed group node as the neighbor group nodes of the labeled group node, until the number of neighbor group nodes of the labeled group node reaches Q.

[0193] In one embodiment, since the neighbor group nodes of the labeled group node mentioned in the above embodiment may include M-hop neighbor group nodes. Therefore, the specific method of feature aggregation processing may include: calling the aggregation function to process the node features of the M-hop neighbor group nodes of the labeled group node to obtain the M-hop aggregation feature of the labeled group node, and use it as the M-hop fusion feature of the labeled group node; calling the aggregation function to process the node features of the k-hop neighbor group nodes of the labeled group node to obtain the k-hop aggregation feature of the labeled group node; concatenating the k-hop aggregation feature of the labeled group node and the k+1-hop fusion feature to obtain the k-hop fusion feature; performing classification prediction processing on the 1-hop fusion feature to obtain the training security level recognition result of the labeled group node.

[0194] In practical applications, the aggregation function may include one or more of a mean aggregation function, a pooling aggregation function, and a long short-term memory aggregation function, which are not limited here.

[0195] For specific implementation, please refer to the attached Figure 8 , which shows a schematic diagram of the model training process. Figure 8As shown, the model training process is mainly divided into three parts: data preparation, training and output. Among them, the data preparation module needs to prepare the group attribute data of multiple groups created in the last three days, the behavioral attribute data of the group members contained in each group created in the last three days, and the label data. Among them, the label data may include the security level labels of the banned groups and the whitelisted groups in the multiple groups created in the last three days. The banned group refers to a group that was created in the last three days and is confirmed to have unsafe behaviors, and the whitelisted group refers to a group that was created in the last three days and is confirmed not to have unsafe behaviors. Exemplarily, the security level label of the banned group can be 1, which is used to indicate an unsafe group; the security level label of the whitelisted group can be 0, which is used to indicate a safe group.

[0196] like Figure 8 As shown in the training part of , the group isomorphism graph and the node features of each group node in the group isomorphism graph can be constructed according to the group attribute data and the behavior attribute data by means of encoding construction. At the same time, the group nodes corresponding to the banned group and the whitelisted group can be confirmed as the labeled group nodes. Then, the recognition model to be trained can be called to first determine the neighboring group nodes of the labeled group node, and then perform feature aggregation processing on the node features of the labeled group node and its neighboring group nodes to obtain the training security level recognition result of the labeled group node; then, based on the training security level recognition result and the security level label of the labeled group node, the recognition model to be trained can be trained to obtain a security level recognition model.

[0197] In practical applications, the cross entropy loss function can be used to calculate the loss value between the training security level recognition results of the labeled group nodes and the security level labels, and then the initial recognition model can be trained in the direction of reducing the loss value to obtain a trained security level recognition model.

[0198] Among them, the cross entropy loss function is shown in formula (1-2):

[0199]

[0200] Where B refers to the number of labeled group nodes; s refers to the sth labeled group node, s is less than or equal to B, and s is a positive integer. s Refers to the safety level label of the group node; p s Refers to the training security level identification results of the group nodes.

[0201] Finally, if Figure 8As shown in the output part of , the trained security level recognition model can be output to identify the group nodes (i.e., the group nodes to be identified) with undetermined security levels in the above group isomorphism graph based on the security level recognition model. In practical applications, the trained security level recognition model can accurately identify the security level of the group up to 98%, and can also accurately identify groups that may have unsafe behaviors, so that the recognition coverage of the security level of the group is increased to 85 to 90%, greatly improving the recognition and supervision capabilities of related applications or websites for groups.

[0202] S705 , obtaining multiple target group nodes in the group isomorphism graph that are edge-connected to the group node to be identified.

[0203] In the embodiment of the present application, if there is at least one edge connecting any group node in the group isomorphism graph and the group node to be identified, then any group node can be determined as a target group node.

[0204] S706 : Based on the connection weights between each target group node and the group node to be identified, select neighbor group nodes of the group node to be identified from the group nodes contained in the group isomorphism graph.

[0205] In the embodiment of the present application, the specific method for selecting the neighboring group nodes of the group node to be identified may refer to the specific method for selecting the neighboring group nodes of the marked group node mentioned in step S704.

[0206] Specifically, the neighbor group nodes of the group node to be identified include M-hop neighbor group nodes, where M is a positive integer. Then, the specific selection method of the neighbor group nodes of the group node to be identified may include: based on the connection weights between each target group node and the group node to be identified, selecting the first-hop neighbor group node from multiple target group nodes; wherein the connection weight corresponding to the first-hop neighbor group node is greater than the connection weights corresponding to other target group nodes; based on the connection weight between the adjacent group node that has an edge connection with the x-hop neighbor group node and the x-hop neighbor group node, selecting the x+1-hop neighbor group node from the adjacent group node.

[0207] S707: Perform feature aggregation processing on the node features of the neighboring group nodes and the node features of the group nodes to be identified, and obtain a security level identification result of the group nodes to be identified.

[0208] In the embodiment of the present application, the specific implementation of the feature aggregation processing can refer to the specific implementation of the feature aggregation processing mentioned in step S704 and the specific implementation of the feature aggregation processing mentioned in step S204, which will not be repeated here.

[0209] In practical applications, please refer to the attached Fig. 9 , which shows a schematic diagram of a security level identification process. Fig. 9As shown in steps 901 to 902 in , a group isomorphism graph can be constructed first, and then model training can be performed to obtain a security level recognition model. The model training process can be referred to Figure 8 The examples shown are not described in detail here.

[0210] Afterwards, as shown in step 903, the security level identification model can be used to identify the security level of the group node to be identified in the group isomorphism graph, thereby obtaining the security level of the group corresponding to the group node to be identified. Then, as shown in step 904, it is determined whether the security level of the group is less than the pre-selected security level. If the security level of the group is less than the pre-selected security level, the group can be supervised or reminded as shown in step 905. The specific method of supervision or reminder can refer to the specific implementation method in step S204, which will not be repeated here.

[0211] In the embodiment of the present application, the connection weight between group nodes is proportional to the number of edges between group nodes, and the more edges connecting two group nodes, the closer the social relationship between the two groups corresponding to the two group nodes, that is, the greater the possibility that the two groups belong to the same organization. Therefore, the embodiment of the present application selects the neighbor group node of the group node to be identified by the connection weight, and can select the group node corresponding to the group that has a close social relationship with the group corresponding to the group node to be identified as the neighbor group node.

[0212] If the group corresponding to the group node to be identified is a group that has or may have unsafe behaviors, then the group with close social relations with the group is usually also a group that has or may have unsafe behaviors. Since node features can characterize the content and behavior of the group, by aggregating the node features of the group node to be identified and its neighboring group nodes, the unsafe content and unsafe behaviors in the group can be accumulated and amplified, which is conducive to the model and algorithm to distinguish between safe groups and unsafe groups, making the subsequent security level identification results more accurate.

[0213] Here, the device embodiment of the present application is introduced, which can be used to execute the group management method in the above embodiment of the present application. For details not disclosed in the device embodiment of the present application, please refer to the above embodiment of the group management method of the present application.

[0214] The present application embodiment provides a group management device, such as Fig.10 As shown, the device includes an acquisition unit 1001, a construction unit 1002 and an identification unit 1003, wherein:

[0215] The acquisition unit 1001 is used to acquire, for each of the multiple groups, group attribute data of each group and behavior attribute data generated by the members of each group in the multiple groups;

[0216] A construction unit 1002 is used to construct each group into a group node, and determine the node characteristics of the corresponding group node based on the group attribute data of each group and the behavior attribute data corresponding to the group members contained in each group;

[0217] The construction unit 1002 is further used to construct, for each two group nodes in the plurality of group nodes, an edge between each two group nodes based on the group attribute data corresponding to each two group nodes and the behavior attribute data generated by the members in the two groups corresponding to each two group nodes, so as to obtain a group isomorphism graph;

[0218] The identification unit 1003 is used to identify the security level of the to-be-identified group nodes in the group isomorphism graph based on the group isomorphism graph.

[0219] In one embodiment of the present application, based on the aforementioned scheme, when the construction unit 1002 constructs an edge between every two group nodes based on the group attribute data corresponding to each two group nodes and the behavior attribute data generated by the members contained in the two groups corresponding to each two group nodes in the two groups, it can be specifically used to: if the similarity between the group attribute data corresponding to each two group nodes is greater than a preset similarity threshold, then an edge is constructed between every two group nodes; if the two groups corresponding to each two group nodes contain the same member, and the behavior attribute data generated by the same member in the two groups matches the preset behavior type, then an edge is constructed between every two group nodes; wherein the preset behavior type includes the type of behavior initiated in the group by members whose security level is lower than the preset security level.

[0220] In one embodiment of the present application, the group attribute data of each group includes the diversion data received in each group, and the diversion data includes descriptive information of the specified network address; based on the aforementioned scheme, the construction unit 1002 can also be used to: obtain the similarity between the diversion data corresponding to each two groups; if the obtained similarity is greater than the first threshold, it is determined that the similarity between the group attribute data corresponding to each two group nodes is greater than the preset similarity threshold.

[0221] In one embodiment of the present application, the group attribute data of each group includes group description data of each group, and the group description data is used to describe the group content of a specified type within the corresponding group; based on the aforementioned scheme, the construction unit 1002 can also be used to: obtain the similarity between the group description data corresponding to each two groups; if the obtained similarity is greater than a second threshold, it is determined that the similarity between the group attribute data corresponding to each two group nodes is greater than a preset similarity threshold.

[0222] In one embodiment of the present application, based on the aforementioned scheme, when the construction unit 1002 determines the node characteristics of the corresponding group node based on the group attribute data of each group and the behavior attribute data corresponding to each group, it can be specifically used to: filter out target attribute data that matches the preset group construction type from the group attribute data of each group; perform feature extraction on the target attribute data of each group to obtain a group feature vector of each group; perform feature extraction on the behavior attribute data generated by the members contained in each group in multiple groups to obtain a member feature vector of each group; and concatenate the group feature vectors and member feature vectors of each group to obtain the node characteristics of the corresponding group node.

[0223] In one embodiment of the present application, based on the aforementioned scheme, when the construction unit 1002 performs feature extraction on the behavioral attribute data generated by the members contained in each group in multiple groups to obtain the member feature vectors of each group, it can be specifically used for: for the members contained in any group, the members whose behavioral attribute data generated in any group matches the preset behavior type are determined as target members; the behavioral attribute data generated by the target members in multiple groups are extracted to obtain the member feature vectors of any group.

[0224] In one embodiment of the present application, based on the aforementioned scheme, when the identification unit 1003 performs security level identification on the group nodes to be identified in the group isomorphism graph based on the group isomorphism graph, it can be specifically used to: select the group nodes to be identified and the neighboring group nodes of the group nodes to be identified from the group isomorphism graph; perform feature aggregation processing on the node features of the neighboring group nodes and the node features of the group nodes to be identified to obtain a security level identification result of the group nodes to be identified; wherein the security level identification result is used to characterize the security level of the group corresponding to the group nodes to be identified.

[0225] In one embodiment of the present application, based on the aforementioned scheme, when the identification unit 1003 selects the group node to be identified and the neighbor group nodes of the group node to be identified from the group isomorphism graph, it can be specifically used to: select the group node to be identified from the group isomorphism graph; obtain multiple target group nodes in the group isomorphism graph that have edge connections with the group node to be identified; based on the connection weights between each target group node and the group node to be identified, select the neighbor group nodes of the group node to be identified from the group nodes contained in the group isomorphism graph; wherein the connection weight between every two group nodes is obtained based on the number of edges between every two group nodes.

[0226] In one embodiment of the present application, the neighbor group nodes of the group node to be identified include M-hop neighbor group nodes, where M is a positive integer; based on the aforementioned scheme, when the identification unit 1003 determines the neighbor group nodes of the group node to be identified based on the connection weights between each target group node and the group node to be identified, it can be specifically used to: select the first-hop neighbor group node from multiple target group nodes based on the connection weights between each target group node and the group node to be identified; wherein the connection weight corresponding to the first-hop neighbor group node is greater than the connection weights corresponding to other target group nodes; based on the connection weight between the adjacent group node that has an edge connection with the x-hop neighbor group node and the x-hop neighbor group node, select the x+1th hop neighbor group node from the adjacent group node; wherein x is a positive integer, and x is less than M.

[0227] In one embodiment of the present application, based on the aforementioned scheme, the identification unit 1003 can specifically identify the security level of the group nodes to be identified in the group isomorphism graph based on the group isomorphism graph through the security level identification model; wherein the identification unit 1003 can further be used to: call the identification model to be trained, and select the neighbor group nodes of the marked group node from the group isomorphism graph; wherein the marked group node refers to the group node marked with a security level label in the group isomorphism graph; perform feature aggregation processing on the node features of the marked group node, and the node features of the neighbor group nodes of the marked group node, to obtain the training identification result of the marked group node; wherein the training identification result is used to characterize the security level of the group corresponding to the marked group node; based on the training identification result and the security level label of the marked group node, the identification model to be trained is trained to obtain a security level identification model.

[0228] It should be noted that the device provided in the above embodiment and the method provided in the above embodiment belong to the same concept, wherein the specific manner in which each module and unit performs the operation has been described in detail in the method embodiment and will not be repeated here.

[0229] The device provided in the above-mentioned embodiment can be arranged in a terminal device or in a server. The device provided in the embodiment of the present application can establish a connection between group nodes from the two aspects of the behavior of the group members and the attributes of the group itself by constructing a group isomorphism graph, thereby clarifying the relationship between the groups. At the same time, the node characteristics of each group node in the group isomorphism graph can characterize the behavior and content of the group. It can be seen that the embodiment of the present application uses the group isomorphism graph to identify the security level of the identified group node. On the one hand, it can evaluate the security level of the corresponding group from the dimensions of behavior and content based on the node characteristics of each group node in the group isomorphism graph; on the other hand, it can evaluate the security level of the corresponding group based on the relationship between the groups; therefore, the embodiment of the present application can evaluate the security level of the group from multiple aspects and dimensions, which is conducive to improving the accuracy of identifying the security level of the group; at the same time, because the relationship between the groups is inescapable, it can further improve the accuracy of identifying the security level of the group.

[0230] An embodiment of the present application also provides an electronic device, comprising one or more processors and a storage device, wherein the storage device is used to store one or more computer programs, and when the one or more computer programs are executed by one or more processors, the electronic device implements the above group management method.

[0231] Fig.11 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown.

[0232] It should be noted that Fig.11 The computer system 1100 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0233] like Fig.11 As shown, the computer system 1100 includes a processor (Central Processing Unit, CPU) 1101, which can perform various appropriate actions and processes according to the program stored in the read-only memory (Read-Only Memory, ROM) 1102 or the program loaded from the storage part 1108 to the random access memory (Random Access Memory, RAM) 1103, such as executing the method in the above embodiment. In the RAM 1103, various programs and data required for system operation are also stored. The CPU 1101, ROM 1102 and RAM 1103 are connected to each other through a bus 1104. An input / output (Input / Output, I / O) interface 1105 is also connected to the bus 1104.

[0234] In some embodiments, the following components are connected to the I / O interface 1105: an input section 1106 including a keyboard, a mouse, etc.; an output section 1107 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 1108 including a hard disk, etc.; and a communication section 1109 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 1109 performs communication processing via a network such as the Internet. A drive 1110 is also connected to the I / O interface 1105 as needed. A removable medium 1111, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1110 as needed, so that a computer program read therefrom is installed into the storage section 1108 as needed.

[0235] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 1109, and / or installed from a removable medium 1111. When the computer program is executed by a processor (CPU) 1101, various functions defined in the system of the present application are executed.

[0236] It should be noted that the computer-readable medium shown in the embodiment of the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (Erasable Programmable Read Only Memory), a flash memory, an optical fiber, a portable compact disk read-only memory (Compact Disc Read-Only Memory, CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable computer program is carried. This propagated data signal can take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. A computer program contained on a computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0237] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the devices, methods and computer program products according to various embodiments of the present application. Among them, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and a computer program.

[0238] The units or modules involved in the embodiments described in this application may be implemented by software or hardware, and the units or modules described may also be set in a processor. The names of these units or modules do not, in some cases, constitute limitations on the units or modules themselves.

[0239] Another aspect of the present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the group management method as described above is implemented. The computer-readable storage medium may be included in the electronic device described in the above embodiment, or may exist independently without being assembled into the electronic device.

[0240] Another aspect of the present application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. A processor of an electronic device reads the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the electronic device executes the group management method as described above in the above embodiments.

[0241] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0242] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the embodiments disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary technical means in the art that are not disclosed in the present application.

[0243] The above content is only a preferred exemplary embodiment of the present application and is not intended to limit the implementation scheme of the present application. A person of ordinary skill in the art can easily make corresponding changes or modifications based on the main concept and spirit of the present application. Therefore, the scope of protection of the present application shall be based on the scope of protection required by the claims.

Claims

1. A group management method, characterized in that: include: For each of the multiple groups, obtain group attribute data of each group and behavior attribute data generated by members of each group in the multiple groups; constructing each of the groups into a group node, and determining the node characteristics of the corresponding group node based on the group attribute data of each of the groups and the behavior attribute data corresponding to the group members contained in each of the groups; For every two group nodes among the plurality of group nodes, based on the group attribute data respectively corresponding to the every two group nodes and the behavior attribute data generated by the members contained in the two groups corresponding to the every two group nodes in the two groups, construct an edge between the every two group nodes to obtain a group isomorphism graph; Based on the group isomorphism graph, security level identification is performed on the to-be-identified group nodes in the group isomorphism graph.

2. The method according to claim 1, characterized in that The constructing the edge between each two group nodes based on the group attribute data respectively corresponding to each two group nodes and the behavior attribute data generated by the members contained in the two groups corresponding to each two group nodes in the two groups includes: If the similarity between the group attribute data corresponding to each two group nodes is greater than a preset similarity threshold, constructing an edge between each two group nodes; If the two groups corresponding to each two group nodes contain the same member, and the behavior attribute data generated by the same member in the two groups matches the preset behavior type, an edge is constructed between each two group nodes; wherein the preset behavior type includes the type of behavior initiated in the group by a member whose security level is lower than the preset security level.

3. The method according to claim 2, characterized in that The group attribute data of each group includes the traffic diversion data received in each group, and the traffic diversion data includes description information of a specified network address; the method further includes: Obtaining the similarity between the drainage data corresponding to each two groups; If the acquired similarity is greater than the first threshold, it is determined that the similarity between the group attribute data corresponding to each two group nodes is greater than the preset similarity threshold.

4. The method according to claim 2, characterized in that: The group attribute data of each group includes group description data of each group, and the group description data is used to describe the group content of a specified type in the corresponding group; the method further includes: Obtaining the similarity between the group description data corresponding to each two groups; If the acquired similarity is greater than the second threshold, it is determined that the similarity between the group attribute data corresponding to each two group nodes is greater than the preset similarity threshold.

5. The method according to claim 1, characterized in that The determining the node characteristics of the corresponding group nodes based on the group attribute data of each group and the behavior attribute data corresponding to each group includes: Filtering target attribute data matching a preset group construction type from the group attribute data of each group; Extracting features from the target attribute data of each group to obtain a group feature vector of each group; Extracting features of the behavior attribute data generated by the members of each group in the plurality of groups to obtain feature vectors of the members of each group; The group feature vectors and group member feature vectors of each group are concatenated to obtain the node features of the corresponding group nodes.

6. The method according to claim 5, characterized in that The step of extracting features from the behavior attribute data generated by the members of each group in the multiple groups to obtain feature vectors of the members of each group includes: For the members in any group, the members whose behavior attribute data generated in any group matches the preset behavior type are determined as target members; Feature extraction is performed on the behavior attribute data generated by the target group member in the multiple groups to obtain a member feature vector of any group.

7. The method according to any one of claims 1 to 6, characterized in that The step of identifying the security level of the to-be-identified group nodes in the group isomorphism graph based on the group isomorphism graph includes: Selecting a group node to be identified and neighboring group nodes of the group node to be identified from the group isomorphism graph; The node features of the neighbor group nodes and the node features of the group nodes to be identified are subjected to feature aggregation processing to obtain a security level identification result of the group nodes to be identified; wherein the security level identification result is used to characterize the security level of the group corresponding to the group nodes to be identified.

8. The method according to claim 7, characterized in that The step of selecting the to-be-identified group node and the neighboring group nodes of the to-be-identified group node from the group isomorphism graph includes: Selecting a group node to be identified from the group isomorphism graph; Acquire a plurality of target group nodes in the group isomorphism graph that are edge-connected with the group node to be identified; Based on the connection weights between each target group node and the group node to be identified, neighbor group nodes of the group node to be identified are selected from the group nodes contained in the group isomorphism graph; wherein the connection weight between every two group nodes is obtained based on the number of edges between the every two group nodes.

9. The method according to claim 8, characterized in that The neighboring group nodes of the group node to be identified include M-hop neighboring group nodes, where M is a positive integer; The step of determining neighboring group nodes of the group nodes to be identified based on the connection weights between each target group node and the group nodes to be identified includes: Based on the connection weights between each target group node and the group node to be identified, selecting a first-hop neighbor group node from the multiple target group nodes; wherein the connection weight corresponding to the first-hop neighbor group node is greater than the connection weights corresponding to other target group nodes; Based on the connection weight between the adjacent group node having an edge connection with the x-hop neighbor group node and the x-hop neighbor group node, the x+1-hop neighbor group node is selected from the adjacent group nodes; wherein x is a positive integer and x is less than M.

10. The method according to any one of claims 1 to 6, characterized in that The security level identification model is used to identify the security level of the group nodes to be identified in the group isomorphism graph based on the group isomorphism graph; the training process of the security level identification model includes: Calling the recognition model to be trained, and selecting neighboring group nodes of the marked group node from the group isomorphism graph; wherein the marked group node refers to the group node marked with a security level label in the group isomorphism graph; Performing feature aggregation processing on the node features of the annotated group node and the node features of the neighboring group nodes of the annotated group node to obtain a training recognition result of the annotated group node; wherein the training recognition result is used to characterize the security level of the group corresponding to the annotated group node; Based on the training recognition results and security level labels of the labeled group nodes, the recognition model to be trained is trained to obtain the security level recognition model.

11. A group management device, characterized in that: It includes an acquisition unit, a construction unit, and an identification unit, wherein: The acquisition unit is used to acquire, for each of the multiple groups, group attribute data of each group and behavior attribute data generated by members of each group in the multiple groups; The construction unit is used to construct each of the groups into a group node, and determine the node characteristics of the corresponding group node based on the group attribute data of each group and the behavior attribute data corresponding to the group members contained in each group; The construction unit is further configured to construct, for each two group nodes among the plurality of group nodes, an edge between the each two group nodes based on the group attribute data respectively corresponding to the each two group nodes and the behavior attribute data generated by the members contained in the two groups corresponding to the each two group nodes in the two groups, so as to obtain a group isomorphism graph; The identification unit is used to identify the security level of the to-be-identified group nodes in the group isomorphism graph based on the group isomorphism graph.

12. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the group management method according to any one of claims 1 to 10 is implemented.

13. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, enables the one or more processors to implement the group management method according to any one of claims 1 to 10.

14. A computer program product, characterized in that The computer program product comprises a computer program, wherein the computer program is suitable for being loaded by a processor and executing the group management method according to any one of claims 1 to 10.

Images