Team user identification method and device, electronic equipment, medium and program product

Abstract

The invention provides a team user identification method and device, electronic equipment, a medium and a program product, which can be used in the field of data processing. The method comprises the following steps: acquiring target information of a plurality of first accounts; determining a risk relationship between the first accounts according to the target information, and constructing an initial network diagram according to the risk relationship, the initial network diagram including the first accounts as nodes, and a connection line between the two nodes being used for indicating the risk relationship between the first accounts corresponding to the two nodes; performing attribute change on nodes meeting attribute change conditions in the initial network diagram to obtain a target network diagram; and in response to the fact that the first accounts corresponding to the nodes belonging to the same attribute in the target network diagram comprise risk accounts, determining users of the same risk team from the users associated with the first accounts corresponding to the nodes belonging to the same attribute. According to the invention, the determination accuracy of the risk team user is improved.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to a team user identification method, device, electronic device, medium and program product. Background Art

[0002] Team arbitrage hinders the development of Internet marketing, preventing businesses from obtaining expected profit results, and causing them to suffer many losses including financial and reputational losses. How to accurately identify members of arbitrage teams is an issue that needs to be addressed urgently.

[0003] In the exemplary technology, each mobile phone number is constructed as a user entity, and users in the same risk team are determined through online information such as the peer number, number of calls, and number of calls of each mobile phone number.

[0004] However, the above only utilizes online information and ignores information other than online information, which will result in low accuracy in determining team users. Summary of the invention

[0005] The present application provides a team user identification method, device, electronic device, medium and program product, which solves the problem of low accuracy in determining team users.

[0006] In a first aspect, the present application provides a team user identification method, comprising:

[0007] Acquire target information of multiple first accounts, the target information including a location of a device logged in by the first account, network information corresponding to a network connected to the device, and transaction information of the first account;

[0008] Determine the risk relationship between each of the first accounts according to the target information, and construct an initial network diagram according to the risk relationship, wherein the initial network diagram includes the first accounts as nodes, and a connecting line between two of the nodes is used to indicate the risk relationship between the first accounts corresponding to the two nodes;

[0009] Perform attribute changes on nodes in the initial network graph that meet attribute change conditions to obtain a target network graph;

[0010] In response to the first accounts corresponding to the nodes with the same attribute in the target network graph including risk accounts, users associated with the first accounts corresponding to the nodes with the same attribute are determined as users of the same risk team.

[0011] In some embodiments, determining the risk relationship between the first accounts according to the target information includes:

[0012] Determine, according to the target information of the second account, one or more association relationships between the second account and the third account, where the second account is any one of the first accounts, and the third account is a first account other than the second account;

[0013] Determine target parameters of the association relationships, wherein the target parameters include the number of occurrences of each of the association relationships and / or the type of the association relationships;

[0014] A risk relationship between the second account and the third account is determined according to the target parameter.

[0015] In some embodiments, the target parameter includes the type of the association relationship, and determining the risk relationship between the second account and the third account according to the target parameter includes:

[0016] In response to the type being a preset type, determining that the risk relationship between the second account and the third account is a high-risk relationship;

[0017] In response to the type not being a preset type, determining that the risk relationship between the second account and the third account is a low risk relationship.

[0018] In some embodiments, the target parameter includes the number of occurrences of each of the association relationships, and determining the risk relationship between the second account and the third account according to the target parameter includes:

[0019] In response to the occurrence number of any one of the association relationships being greater than the corresponding preset number, determining that the risk relationship between the second account and the third account is a high-risk relationship;

[0020] In response to the occurrence number of each association relationship being less than or equal to the corresponding preset number, it is determined that the risk relationship between the second account and the third account is a low-risk relationship.

[0021] In some embodiments, the risk relationships include high-risk relationships and low-risk relationships, and constructing an initial network diagram according to the risk relationships includes:

[0022] Set a node corresponding to each of the first accounts in the configuration diagram;

[0023] According to the risk relationship between the two first accounts, configuring a connection line between the nodes corresponding to the two first accounts in the configuration diagram to obtain a first intermediate network diagram;

[0024] Determining a ternary node group in the first intermediate network graph, wherein the ternary node group includes three nodes, and the connection lines between the three nodes form a triangle;

[0025] In response to two connection lines in the triple node group representing high-risk relationships and one connection line representing low-risk relationships, the connection line representing the low-risk relationship is changed to a connection line representing the high-risk relationship to obtain an initial network graph.

[0026] In some embodiments, the step of changing the attributes of nodes in the initial network graph that meet the attribute change condition to obtain the target network graph includes:

[0027] Determine, among the nodes in the initial network graph, a target node that satisfies the attribute change condition;

[0028] In the initial network graph, the target node is subjected to target attribute change to obtain a second intermediate network graph;

[0029] Merging nodes with the same attribute in the second intermediate network graph into one node with the same attribute to obtain a third intermediate network graph;

[0030] In response to the third intermediate network graph not having any node satisfying the attribute change condition, the third intermediate network graph is determined as the target network graph.

[0031] In some embodiments, determining a target node that satisfies a property change condition among the nodes in the initial network graph includes:

[0032] Determine a first attribute value of a node to be changed in the initial network graph on a first attribute, and determine a second attribute value of the node to be changed on a second attribute, wherein the first attribute is a current attribute of the node to be changed, and the second attribute is an attribute to be changed of the node to be changed;

[0033] Determine the attribute gain of the changed attribute of the node to be changed according to the first attribute value and the second attribute value;

[0034] In response to the attribute gain being greater than a preset threshold, it is determined that the node to be changed meets an attribute change condition, and the node to be changed is determined as the target node.

[0035] In some embodiments, before determining the second attribute value of the to-be-changed node on the second attribute, the method further includes:

[0036] Determine neighbor nodes that are connected to the node to be changed;

[0037] The attribute corresponding to the neighbor node is determined as the second attribute.

[0038] In some embodiments, there are multiple neighbor nodes, and determining the attribute gain of the attribute to be changed of the node to be changed according to the first attribute value and the second attribute value includes:

[0039] determining an attribute gain between the first attribute value and a second attribute value corresponding to each of the second attributes;

[0040] The step of changing the target attribute of the target node in the initial network graph includes:

[0041] The second attribute corresponding to the maximum attribute gain is determined as the target attribute corresponding to the node to be changed, and the first attribute of each target node in the initial network graph is changed to the target attribute corresponding to the target node.

[0042] In some embodiments, determining a first attribute value of a node to be changed in the initial network graph at a first attribute, and determining a second attribute value of the node to be changed at a second attribute, comprises:

[0043] Determine a first weight between the node to be changed and each of the neighboring nodes based on the risk relationship represented by the connection line between the node to be changed and each of the neighboring nodes, each of the neighboring nodes being used to indicate a node having a connection line with the node to be changed;

[0044] Determining a second weight between the node to be changed and the node corresponding to the second attribute;

[0045] A first attribute value of the node to be changed on the corresponding first attribute is determined according to each of the first weights, and a second attribute value of the node to be changed on the second attribute is determined according to the second weight and each of the first weights.

[0046] In one embodiment, determining a first weight between the node to be changed and each of the neighboring nodes based on the risk relationship represented by the connection line between the node to be changed and each of the neighboring nodes includes:

[0047] Based on the risk relationship represented by the connection line between the node to be changed and each neighboring node, determine a target connection line among the connection lines between the node to be changed and each neighboring node, wherein the target connection line is a connection line representing a high-risk relationship;

[0048] The weight of each target link is determined as a first weight.

[0049] In some embodiments, determining a first attribute value of a node to be changed in the initial network graph on a first attribute includes:

[0050] Add node identifiers corresponding to some nodes in the initial network graph to a queue;

[0051] Extracting a node identifier from the head of the queue as a target identifier, determining a node corresponding to the target identifier as a node to be changed, and determining a first attribute value of the node to be changed on a first attribute;

[0052] The step of changing the target attribute of the target node in the initial network graph includes:

[0053] Adding node identifiers corresponding to nodes connected to the target node in all initial network graphs to the queue, configuring a connection line between the target node and the node corresponding to the target attribute, and changing the first attribute of the target node to the target attribute;

[0054] Return to execute the step of extracting the node identifier from the header of the queue as the target identifier, wherein the queue does not contain the node identifier, complete the attribute change of all target nodes in the initial network graph, and obtain the second intermediate network graph.

[0055] In some embodiments, after merging the nodes with the same attribute in the second intermediate network graph into one node with the same attribute, the method further includes:

[0056] In response to the presence of a node satisfying the attribute change condition in the third intermediate network graph, updating the third intermediate network graph to an initial network graph;

[0057] Return to the step of determining each target node that meets the attribute change condition among each node in the initial network graph.

[0058] In some embodiments, constructing an initial network diagram according to the risk relationship includes:

[0059] Determine a plurality of fourth accounts in each of the first accounts, wherein the fourth accounts are used to indicate accounts of known risk team users;

[0060] A sub-network graph corresponding to each of the fourth accounts is constructed according to the risk relationship, and each of the sub-network graphs is merged to obtain an initial network graph.

[0061] In a second aspect, the present application provides a team user identification method and device, including:

[0062] an acquisition module, configured to acquire target information of a plurality of first accounts, the target information including a location of a device logged in by the first account, network information corresponding to a network connected to the device, and transaction information of the first account;

[0063] a first determination module, configured to determine the risk relationship between the first accounts according to the target information, and to construct an initial network diagram according to the risk relationship, wherein the initial network diagram includes the first accounts as nodes, and a connection line between two nodes is used to indicate the risk relationship between the first accounts corresponding to the two nodes;

[0064] A processing module, used for changing the attributes of the nodes in the initial network graph that meet the attribute change conditions to obtain a target network graph;

[0065] The second determination module is used to determine users of the same risk team from users associated with the first accounts corresponding to the nodes with the same attribute in the target network diagram in response to the first accounts corresponding to the nodes with the same attribute in the target network diagram including risk accounts.

[0066] In a third aspect, the present application provides an electronic device, comprising: a processor, and a memory and a communication interface communicatively connected to the processor;

[0067] The communication interface is used to communicate with other communication devices;

[0068] The memory is used to store computer-executable instructions;

[0069] The processor is used to execute the computer-executable instructions stored in the memory to implement the team user identification method provided in the first aspect.

[0070] In a fourth aspect, the present application provides a computer-readable storage medium, which stores computer execution instructions. When the computer execution instructions are executed by a processor, the team user identification method provided in the first aspect is implemented.

[0071] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the team user identification method provided in the first aspect.

[0072] The team user identification method, device, electronic device, medium and program product provided in this application obtain target information such as the location of multiple account login devices, the network connected to the devices, and the transaction information of the accounts, determine the risk relationship between the accounts based on the target information to construct an initial network diagram, and change the attributes of the nodes that meet the attribute change conditions in the initial network diagram to obtain the target network diagram. When the accounts corresponding to the nodes with the same attributes in the target network diagram contain risky accounts, the users associated with the accounts corresponding to the nodes with the same attributes are determined as users of the same risk team. In this application, a network diagram representing the connection between users in the online world and the real world is constructed through online information such as the transaction information of the account, the network connected to the device where the account is located, and offline information such as the location of the account, so as to accurately discover risky team users based on the network diagram and improve the accuracy of determining risky team users. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0074] Figure 1 A schematic diagram of the scenarios involved in the user identification method of the application team;

[0075] Figure 2 The following is a schematic diagram of the steps of the team user identification method in the embodiment of the present application: Figure 1 ;

[0076] Figure 3 The following is a schematic diagram of the steps of the team user identification method in the embodiment of the present application: Figure 2 ;

[0077] Figure 4 This is a schematic diagram of a process for determining a risk relationship between accounts involved in an embodiment of the present application;

[0078] Figure 5 The following is a schematic diagram of the steps of the team user identification method in the embodiment of the present application: Figure 3 ;

[0079] Figure 6 This is a schematic diagram of converting a low-risk relationship into a high-risk relationship according to an embodiment of the present application;

[0080] Figure 7 The following is a schematic diagram of the steps of the team user identification method in the embodiment of the present application: Figure 4 ;

[0081] Figure 8 The following is a schematic diagram of the steps of the team user identification method in the embodiment of the present application: Figure 5 ;

[0082] Fig. 9 This is a schematic diagram of a process for determining a target network diagram according to an embodiment of the present application;

[0083] Fig.10 The following is a schematic diagram of the steps of the team user identification method in the embodiment of the present application: Figure 6 ;

[0084] Fig.11 A brief flowchart of the team user identification method involved in this application;

[0085] Fig.12 A schematic diagram of a program module of a team user identification device provided in an embodiment of the present application;

[0086] Fig.13 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application.

[0087] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0088] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application. In addition, although the disclosure in the present application is introduced according to one or several exemplary examples, it should be understood that each aspect of these disclosures can also constitute a complete implementation method separately.

[0089] It should be noted that the brief description of terms in this application is only for the convenience of understanding the embodiments described below, and is not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their common and usual meanings.

[0090] In addition, the terms "include" and "have" and any variations thereof are intended to cover but not exclude inclusion, for example, a product or device comprising a list of components is not necessarily limited to those components expressly listed but may include other components not expressly listed or inherent to such products or devices.

[0091] The term "module" used in the embodiments of the present application refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic, or a combination of hardware and / or software code that can perform the functions associated with the element.

[0092] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0093] Team arbitrage hinders the development of Internet marketing, preventing businesses from obtaining expected profit results, and causing them to suffer many losses including financial and reputational losses. How to accurately identify members of arbitrage teams is an issue that needs to be addressed urgently.

[0094] In the exemplary technology, each mobile phone number is constructed as a user entity, and users in the same risk team are determined through online information such as the peer number, number of calls, and number of calls of each mobile phone number.

[0095] The inventors of the present application have discovered that the method for determining the users of the risk team described above utilizes only online information and ignores information other than the online information, which results in a low accuracy in determining the team users.

[0096] The inventor of the present application therefore came up with the idea of ​​constructing a network graph that represents the connections between users in the online world and the real world through online information such as the account's transaction information, the network connection of the device where the account is located, and offline information such as the location of the account, so as to accurately discover risk team users based on the network graph and improve the accuracy of determining risk team users.

[0097] Reference Figure 1 , Figure 1The schematic diagram of the scenario of the team user identification method of the present application. The team user identification device 100 obtains target information of multiple accounts, and the target information includes the location of the device where the account is logged in, the network connected to the device, and the transaction information of the account. The target information can be obtained from the database 200. The team user identification device 100 determines the risk relationship between each first account based on the target information, and constructs an initial network diagram based on each risk relationship. The initial network diagram includes multiple nodes, each node represents a corresponding account, and the connecting lines between the nodes are used to represent the risk relationship between the accounts corresponding to the nodes. The team user identification device 100 changes the attributes of the nodes that meet the attribute change conditions in the initial network diagram to obtain a target network diagram. When the accounts corresponding to the nodes of the same attribute in the target network diagram include risk accounts, the users associated with the accounts corresponding to the nodes of the same attribute are determined as users of the same risk team. The team user identification device 100 then outputs prompt information, and the prompt information includes identification information of users of the same risk team, such as the user's name, ID number, mobile phone number, account nickname, etc.

[0098] The following combination Figure 1 , in order to explain the technical solution shown in the present application in detail through embodiments. It should be noted that the following embodiments can exist independently or in combination with each other, and the same or similar contents will not be repeatedly described in different embodiments.

[0099] Reference Figure 2 , Figure 2 The process diagram of the team user identification method provided in the embodiment of the present application is as follows: Figure 1 , team user identification methods include:

[0100] Step S201, obtaining target information of multiple first accounts, the target information including the location of the device logged in by the first account, the network information corresponding to the network connected to the device, and the transaction information of the first account.

[0101] In this embodiment, the execution subject is a team user identification device. For the convenience of description, the device is used below to refer to the team user identification device. The device can be a server or a terminal device with a team user identification function.

[0102] The device obtains target information of multiple accounts, where the account is defined as a first account, and the first account is an account of the user at a financial institution, and the user can use the amount in the account to conduct online transactions. The target information includes the location of the device logged in by the first account, and the location refers to the geographical location of the device when the first account logs in to the device. The target information also includes network information corresponding to the network connected to the device logged in by the first account, and the network information is, for example, a network identifier. In addition, the target information also includes transaction information of the first account.

[0103] Step S202, determine the risk relationship between each first account according to the target information, and construct an initial network diagram according to the risk relationship. The initial network diagram includes the first account as a node, and the connecting line between two nodes is used to indicate the risk relationship between the first accounts corresponding to the two nodes.

[0104] After obtaining the target information of each first account, the device determines the risk relationship between the first accounts based on the respective target information.

[0105] In one example, the target information includes the location of the device logged in by the first account, and the device can determine the risk relationship between the first accounts based on the location. Specifically, the device divides the electronic map into multiple areas, and the device obtains the locations of the devices logged in by the two first accounts. If the two locations are located in the same area, it can be determined that the devices logged in by the two first accounts are collinear in the same area, and the two first accounts have a risk relationship. Furthermore, the risk relationship includes a high-risk relationship and a low-risk relationship. The above-mentioned area is divided into multiple sub-areas. When two locations are located in the same area, but one location is in one sub-area and the other location is in another sub-area, the two first accounts are in a low-risk relationship; if the two locations are located in the same sub-area, the two first accounts are in a high-risk relationship. In addition, the time and location can be combined to determine the high-risk or low-risk relationship between the two first accounts. For example, when two first accounts log in to the device and appear together in an area within a short period, it can be determined that the two first accounts have a low-risk relationship, and the shorter period is, for example, one month or a week; when the devices logged in by the two first accounts appear together in a sub-area within a short period, the two first accounts have a high-risk relationship; when the devices logged in by the two first accounts appear together in a sub-area within a longer period, the two first accounts have a low-risk relationship, and the longer period is, for example, more than three months.

[0106] In another example, the target information includes network information corresponding to the network connected to the device logged in by the first account. Specifically, the network information may be a network identifier. When the network identifiers corresponding to the networks connected to the devices logged in by the two first accounts are the same, it can be determined that the two first accounts have a risk relationship.

[0107] In another example, the target information includes transaction information of the first account. When the device determines that two first accounts have transfer records based on the transaction information, it can be determined that the two first accounts have a risk relationship; when it is determined that the two first accounts have purchased goods in the same store based on the transaction information, the two first accounts have a risk relationship; when the account with which one first account has a transaction and the account with which the other first account has a transaction are the same user's account, the two first accounts have a risk relationship.

[0108] After determining the risk relationships between the first accounts, an initial network diagram is constructed based on the risk relationships.

[0109] Exemplarily, multiple nodes are configured in the configuration diagram, each node corresponds to a first account, and if two first accounts have a risk relationship, a connection line is directly configured at the nodes corresponding to the two first accounts. For example, there is a risk relationship between first account A and first account B, the node of first account A in the configuration diagram is node a, and the node of first account B in the configuration diagram is node b, then a connection line is configured for node a and node b. In this way, connection lines are configured for nodes with risk relationships in the configuration diagram. In this way, a network diagram can be constructed as an initial network diagram.

[0110] Step S203, changing the attributes of the nodes in the initial network graph that meet the attribute change conditions to obtain a target network graph.

[0111] After constructing the initial network diagram, the device determines the nodes that meet the attribute change conditions among the nodes in the initial network diagram.

[0112] Exemplarily, each node in the initial network diagram is regarded as an independent community, and the community is the attribute of the node. There are connecting lines between the nodes in the initial network diagram. The modularity parameter of the node in its own community is determined through the connecting lines between the node and the neighboring nodes. The modularity parameter of the community is the attribute value of the node on its own attribute, and the attribute value is defined as the first attribute value. Specifically, the connecting lines between nodes can represent strong connections and weak connections. Strong connections refer to high-risk relationships, while weak connections refer to low-risk relationships. The device first determines the type of connecting line between the node and the neighboring node. If the type is a strong connection, the weight of the connecting line is configured to 1; if the type is a weak connection, the weight of the connecting line is configured to 0.5. The first attribute value can be calculated by the weight represented by the connecting line between the node and each neighboring node. The calculation method of the first attribute value Q is as follows:

[0113]

[0114] Among them, A ij represents the weight of the connection line between node i and node j; k i =∑ j A ij represents the sum of the weights of all the connection lines of node j connected to node i; c i represents the community to which node i belongs; represents the sum of the weights of all edges. Node i and node j belong to the same module, then δ(c i ,c j) is m, node i and node j belong to the same module, then δ(c i ,c j ) is n, and m is greater than n. In the initial network diagram, each node is an independent module, that is, each node belongs to a different module.

[0115] The device determines the community to which the node needs to migrate, that is, determines the attribute that the node needs to change. For example, the attribute of node a needs to be changed to the attribute of node b, that is, the community of node a is migrated to the community of node b. The attribute that needs to be changed is defined as the second attribute. The device determines the second attribute value of the node on the second attribute, and node a changes the attribute to the second attribute. Then, a connection line needs to be configured between node a and node b, so that node a will obtain the second attribute value after changing the attribute. When the second attribute value of node a after migration minus the first attribute value before migration is a positive value, the attribute change of node a has a gain, and node a can be regarded as meeting the attribute change condition.

[0116] After determining the nodes in the initial network diagram that meet the attribute change conditions, the attributes of the nodes in the initial network diagram that meet the attribute change conditions are changed, that is, the first attribute of the node is changed to the second attribute in the above attribute change conditions. The first attribute of the node that does not meet the attribute change remains unchanged. It should be noted that the attribute change of the node is characterized by configuring a connection line between the node and the node where the second attribute is located.

[0117] It should be noted that after the first round of node attribute changes in the initial network diagram, the second round of node attribute changes are performed, and the second round of node attribute change process is the same as the first round of node attribute change process. It can be understood that the initial network diagram performs multiple rounds of node attribute changes until all nodes in the network diagram no longer meet the attribute change conditions, and then the target network diagram can be obtained.

[0118] Step S204, in response to the first accounts corresponding to the nodes with the same attribute in the target network graph including risk accounts, the users associated with the first accounts corresponding to the nodes with the same attribute are determined as users in the same risk team.

[0119] After obtaining the target network map, the device adds risk accounts to each first account. These risk accounts are accounts that have been determined to be risky. Risk accounts are, for example, accounts that log into risky devices, accounts that trade with risky accounts, and accounts that trade with accounts of risky users. Risky devices are, for example, devices that connect to risky networks. In addition, devices that appear in the same area as risky devices are also risky devices.

[0120] There are nodes with the same attributes in the target network graph. If the first accounts corresponding to the nodes include risk accounts, the first accounts corresponding to the nodes with the same attributes can be determined as accounts in the same risk team, that is, the users associated with the nodes with the same attributes are all users in a risk team.

[0121] In this embodiment, target information such as the location of multiple account login devices, the network connected to the devices, and the transaction information of the accounts is obtained, and the risk relationship between the accounts is determined based on the target information to construct an initial network diagram, and the attributes of the nodes that meet the attribute change conditions in the initial network diagram are changed to obtain the target network diagram. When the accounts corresponding to the nodes with the same attributes in the target network diagram include risky accounts, the users associated with the accounts corresponding to the nodes with the same attributes are determined as users of the same risk team. In this embodiment, a network diagram representing the connection between users in the online world and the real world is constructed through online information such as the transaction information of the accounts, the network connected to the devices where the accounts are located, and offline information such as the location of the accounts, so as to accurately discover risk team users based on the network diagram and improve the accuracy of determining risk team users.

[0122] Reference Figure 3 , Figure 3 This is a schematic diagram of the process of user identification method for this application team Figure 2 ,based on Figure 2 In the illustrated embodiment, step S202 includes:

[0123] Step S301, determining one or more association relationships between the second account and a third account according to target information of the second account, the second account being any first account, and the third account being a first account other than the second account.

[0124] In this embodiment, taking two first accounts as an example, the determination of the risk relationship between the first accounts is described in detail. The device first determines one or more associations between the second account and the third account based on the target information of the second account. The second account is any first account, and the third account is a first account other than the second account.

[0125] Step S302: determining target parameters of the association relationship, where the target parameters include the number of occurrences of each association relationship and / or the type of the association relationship.

[0126] After determining the association relationship, the device determines a target parameter for each association relationship, where the target parameter includes at least one of the number of times the second account and the third account are associated, and the type of the association relationship.

[0127] Step S303: determining the risk relationship between the second account and the third account according to the target parameter.

[0128] After determining the target parameters of each association relationship, the risk relationship between the second account and the third account is determined based on the target parameters. The risk relationship includes a high-risk relationship and a low-risk relationship. It should be noted that a high-risk relationship refers to an association relationship with a risk level higher than or equal to a threshold, and a low-risk relationship refers to an association relationship with a risk level lower than a threshold.

[0129] In one example, the target parameter includes the type of association relationship, and the risk relationship can be determined based on the type. Specifically, when the type of association relationship is a preset type, it can be determined that the risk level of the association relationship between the second account and the third account is greater than or equal to a threshold, and the risk relationship between the second account and the third account is determined as a high-risk relationship. The preset type is, for example:

[0130] 1. The first device logged in by the second account and the second device logged in by the third account are the same device, and both the first device and the second device are risk devices, that is, the third account and the second account log in to the same risk device;

[0131] 2. There is transaction record information between the third account and the second account, and at least one of the second account and the third account has transaction record information with the risk account;

[0132] 3. The first device, the second device and the risk device are all in the same area;

[0133] 4. The network to which the first device and the second device are connected is a risk network;

[0134] 5. The same products purchased by the second and third accounts are products sold by the risk account.

[0135] If the type of the association relationship is not a preset type, it can be determined that the risk level of the association relationship between the second account and the third account is lower than the threshold, and the risk relationship between the second account and the third account is determined to be a low-risk relationship. Non-preset types of association relationships include:

[0136] 1. There is transaction record information between the second account and the third account;

[0137] 2. The first device logged in by the second account and the second device logged in by the third account are in the same area;

[0138] 3. The network to which the first device is connected is the same network as the network to which the second device is connected;

[0139] 4. The first device and the second device are the same device;

[0140] 5. The second account and the third account purchase the same product.

[0141] In another example, the device obtains the number of occurrences of the second account and the third account in each association relationship. When the number of occurrences of any association relationship is greater than the corresponding preset number, the risk relationship between the second account and the third account is determined to be a high-risk relationship; when the number of occurrences of each association relationship is less than or equal to the corresponding preset number, the risk relationship between the second account and the third account is determined to be a low-risk relationship.

[0142] In a sub-example, when the association relationship is that the third account and the second account are in the same area for more than 2 times, it can be determined that the risk relationship between the third account and the second account is a high-risk relationship. Figure 4 , the electronic map is divided into 12 areas, device 1 logged in by the second account and device 2 logged in by the third account appear together in area 1, and device 2 and device 1 appear together in area 12, then the risk relationship between the third account and the second account is a high-risk relationship.

[0143] In another sub-example, when the number of transfers between the third account and the second account exceeds 2 times, and the second account or the third account is a risk account, it can be determined that the risk relationship between the third account and the second account is a high-risk relationship; if the number of transfers between the third account and the second account is only 1 time, the risk relationship between the third account and the second account is a low-risk relationship. In addition, when the number of transfers between the third account and the second account exceeds 3 times, and the second account or the third account is an account that has transactions or transactions with the risk account, it can be determined that the risk relationship between the third account and the second account is a high-risk relationship; if the number of transfers between the third account and the second account is 2 times or 1 time, the risk relationship between the third account and the second account is a low-risk relationship.

[0144] In another sub-example, when the device logged in by the third account and the device logged in by the second account are in the same area more than 2 times, the risk relationship between the third account and the second account can be determined to be a high-risk relationship; when the device logged in by the third account and the device logged in by the second account are in the same area once, the risk relationship between the third account and the second account can be determined to be a low-risk relationship. Furthermore, if the area of ​​the same area is different, the risk relationship is also different. For example, if the device logged in by the second account and the device logged in by the third account are in the same area, if the area of ​​the area is greater than or equal to the preset area, the risk relationship between the third account and the second account is a low-risk relationship; if the area of ​​the area is less than the preset area, the risk relationship between the third account and the second account is a high-risk relationship.

[0145] In this embodiment, the association relationship between the accounts is determined through the target information of the accounts, so that the risk relationship between the accounts can be accurately determined through the number of occurrences of each association relationship and the type of the association relationship.

[0146] Reference Figure 5 , Figure 5 This is a schematic diagram of the process of user identification method for this application team Figure 3 ,based on Figure 3 In the illustrated embodiment, step S202 includes:

[0147] Step S501: setting a node corresponding to each first account in the configuration diagram.

[0148] In this embodiment, the device first sets a configuration diagram, which is a blank image. The device configures nodes corresponding to each first account in the configuration diagram, and each node is regarded as an independent community, which is used as an attribute of the node.

[0149] Step S502: According to the risk relationship between the two first accounts, connecting lines between the nodes corresponding to the two first accounts are configured in the configuration diagram to obtain a first intermediate network diagram.

[0150] There is a risk relationship between each first account. When nodes are configured in the configuration diagram, the nodes corresponding to the two first accounts with risk relationships are connected in the configuration diagram, that is, a connection line is configured for the two nodes. Risk relationships include high-risk relationships and low-risk relationships. A high-risk relationship indicates that there is a high confidence level of risk between the two first accounts, so the high-risk relationship can be regarded as a high-confidence relationship; while a low-risk relationship indicates that there is a low confidence level of risk between the two first accounts, and the low-risk relationship can be regarded as a low-confidence relationship. When the risk relationship between the two first accounts is a high-confidence relationship, a solid line is configured for the two nodes corresponding to the two first accounts; when the risk relationship between the two first accounts is a low-confidence relationship, a dotted line is configured for the two nodes corresponding to the two first accounts. It can be understood that different types of connection lines between nodes represent different risk relationships, and this embodiment is not limited to using solid lines and dotted lines to distinguish the risk relationship between the two first accounts.

[0151] After completing the configuration of the connection lines between all nodes, the device can obtain an intermediate network graph, which is defined as a first intermediate network graph.

[0152] Step S503, determining a ternary node group in the first intermediate network graph, wherein the ternary node group includes three nodes, and the connection lines between the three nodes form a triangle.

[0153] In the first intermediate network diagram, there is a ternary node group, which includes three nodes, and the three nodes are provided with three connecting lines. For example, there is a connecting line between node a and node b, there is a connecting line between node b and node c, and there is a connecting line between node c and node a, so node a, node b and node c constitute a ternary node group. It can be understood that the ternary node group includes three nodes, and the connecting lines between the three nodes constitute a triangle.

[0154] Step S504 , in response to two connection lines in the triple node group representing high-risk relationships and one connection line representing low-risk relationships, the connection line representing the low-risk relationship is changed to a connection line representing the high-risk relationship to obtain an initial network diagram.

[0155] When two connection lines in the triple node group represent high-risk relationships and one connection line represents a low-risk relationship, the connection line representing the low-risk relationship is changed to a connection line of the high-risk relationship, and the initial network diagram can be obtained.

[0156] It should be noted that since the connection line representing the low-risk relationship is changed to the connection line of the high-risk relationship, new triplet nodes that meet the conversion conditions may appear in the network diagram. The triplet node group that meets the conversion conditions refers to the triplet node group in which two connection lines represent high-risk relationships and one connection line represents low-risk relationships.

[0157] Specifically, refer to Figure 6 The first intermediate network diagram includes four nodes, namely a, b, c, and d, wherein the connection line between node a and node b represents a high-risk relationship, the connection line between node b and node d represents a high-risk relationship, the connection line between node a and node c represents a high-risk relationship, the connection line between node a and node d represents a low-risk relationship, and the connection line between node c and node d represents a low-risk relationship. In the ternary node group composed of node a, node b, and node d, there are two connection lines ab and bd representing high-risk relationships, and one connection line ad representing low-risk relationships. Therefore, ad can be converted from a dotted line to a solid line, that is, the connection line between node a and node d is represented as a high-risk relationship; since ad is converted to a solid line, the ternary group composed of node a, node c, and node d has two connection lines ac and ad representing high-risk relationships, and one connection line cd representing low-risk relationships. Therefore, cd can be converted from a dotted line to a solid line, that is, the connection line between node c and node d is represented as a high-risk relationship. It can be understood that after the current round of low-risk relationships are converted to high-risk relationships, the next round of low-risk relationships are converted to high-risk relationships until there are no ternary node groups that meet the conversion conditions in the network diagram, and the network diagram can be used as the initial network diagram.

[0158] In this embodiment, the corresponding high-risk relationship is defined as a high-confidence relationship. In essence, the network graph is convolved with a custom relationship to realize the identification of the user relationship of the risk group on the entire network graph. At the same time, "triangular diffusion" (ternary node group) is used to maximize the use of limited information and reduce "false positives". At the same time, high-confidence relationships are supplemented and expanded to mine all users of the risk team as much as possible, which significantly improves the recall rate of mining.

[0159] In this embodiment, by transforming and diffusing the solid line low-risk relationship of the ternary node group in the intermediate network diagram to the high-risk relationship, the complex network is simplified, and the risk relationship between each node in the network diagram is enriched and supplemented, thereby improving the determination accuracy of the risk team users.

[0160] Reference Figure 7 , Figure 7 This is a schematic diagram of the process of user identification method for this application team Figure 4 ,based on Figure 2 , Figure 3 or Figure 5 In the illustrated embodiment, step S203 includes:

[0161] Step S701: Determine a target node that meets the attribute change condition among the nodes in the initial network diagram.

[0162] Step S702, changing the target attribute of the target node in the initial network graph to obtain a second intermediate network graph.

[0163] In this embodiment, the device first determines the target node that meets the attribute change condition among the nodes in the initial network diagram, and changes the target attribute of the target node in the initial network diagram to obtain the second intermediate network diagram. The method for determining the node that meets the attribute change condition can be Figure 2 The description of the illustrated embodiment will not be repeated here, and the target attribute refers to the second attribute involved in the attribute change condition, and the specific details are referred to the above description.

[0164] Step S703: merge the nodes with the same attribute in the second intermediate network graph into one node with the same attribute to obtain a third intermediate network graph.

[0165] After obtaining the second intermediate network diagram, the nodes with the same attributes in the second intermediate network diagram are merged and compressed into one node corresponding to the same attribute, that is, new nodes corresponding to the same attribute are obtained, the weights of the edges (connecting lines) between nodes with the same attribute are converted into the weights of the rings of the new nodes, and the weights of the edges with different attributes are converted into the edge weights between the new nodes, and the third intermediate network diagram can be obtained. Compared with the second intermediate network diagram, the third intermediate network diagram has fewer nodes.

[0166] Step S704: In response to the fact that the third intermediate network graph does not have any nodes that meet the attribute change condition, the third intermediate network graph is determined as the target network graph.

[0167] The node on the third intermediate network diagram is a new node, and the device determines whether there is a new node that meets the attribute change condition in the third intermediate network diagram. If there is no new node that meets the attribute change condition in the third intermediate network diagram, the attributes of each node in the network diagram are changed, and the third intermediate network diagram can be determined as the target network diagram.

[0168] When there are nodes that meet the attribute change conditions in the third intermediate network diagram, the third intermediate network diagram is updated to the initial network diagram, and the step of determining each target node that meets the attribute change conditions among the nodes in the initial network diagram is returned to execute, that is, steps S701 to S703 are repeated until there are no nodes that meet the attribute change conditions in the network diagram.

[0169] In this embodiment, after the attributes of the nodes that meet the attribute change conditions in the network diagram are changed, the nodes with the same attributes are merged into new nodes in the network diagram, thereby simplifying the network diagram, reducing the amount of calculation, and improving the determination efficiency of risk team users.

[0170] Reference Figure 8 , Figure 8 This is a schematic diagram of the process of user identification method for this application team Figure 5 ,based on Figure 7 In the illustrated embodiment, step S701 includes:

[0171] Step S801, determine the first attribute value of the node to be changed in the initial network diagram on the first attribute, and determine the second attribute value of the node to be changed on the second attribute, the first attribute is the current attribute of the node to be changed, and the second attribute is the attribute to be changed of the node to be changed.

[0172] In this embodiment, after constructing the initial network graph, the device determines nodes satisfying the attribute change condition among the nodes in the initial network graph.

[0173] Exemplarily, each node in the initial network diagram is regarded as an independent community, and the community is the attribute of the node. There are connecting lines between the nodes in the initial network diagram. The modularity parameter of the node in its own community is determined through the connecting lines between the node and the node and the neighboring node. The modularity parameter of the community is the attribute value of the node on its own attribute, and the attribute value is defined as the first attribute value. Specifically, the connecting lines between nodes can represent strong connections and weak connections. Strong connections refer to high-risk relationships, while weak connections refer to low-risk relationships.

[0174] The device first determines the node whose attribute needs to be changed, and the node is defined as the node to be changed, and then determines the first attribute value of the node to be changed on the first attribute. Specifically, the device determines the first weight between the node to be changed and each neighbor node based on the risk relationship represented by the connection line between the node to be changed and each neighbor node. The neighbor node specifies the node that has a connection line with the node to be changed. For example, if the risk relationship represented by the connection line is a high-risk relationship, the first weight of the connection line is configured to 1; if the risk relationship represented by the connection line is a low-risk relationship, the first weight of the connection line is configured to 0.5. The device then determines the second weight between the node to be changed and the node corresponding to the second attribute. For example, assuming that the node to be changed changes its attribute to the second attribute, a hypothetical connection line is configured for the node to be changed and the node corresponding to the second attribute. Compared with the node to be changed whose attribute has not been changed, the node to be changed whose attribute has been changed has one more connection line, and the second weight is configured for the extra connection line. The second weight can be any composite value. The device determines the first attribute value based on each first weight, and the calculation method of the first attribute value Q is as follows:

[0175]

[0176] Among them, A ij represents the weight of the connection line between node i and node j; k i =∑ j A ij represents the sum of the first weights of all the links connecting node j to node i; c i represents the community to which node i belongs; represents the sum of the first weights of all edges. Node i and node j belong to the same module, then δ(c i ,c j ) is m, node i and node j belong to the same module, then δ(c i ,c j ) is n, and m is greater than n. In the initial network diagram, each node is an independent module, that is, each node belongs to a different module. The device then calculates the second attribute value based on the second weight and each first weight. That is, the second attribute value is calculated by the above formula.

[0177] For example, the device determines the community to which the node to be changed needs to migrate, that is, determines the attribute that needs to be changed for the node to be changed. For example, the attribute of node a needs to be changed to the attribute of node b, that is, the community of node a is migrated to the community of node b. The attribute that needs to be changed is defined as the second attribute, and the device determines the second attribute value of the node to be changed on the second attribute. Specifically, assuming that the node a to be changed changes its attribute to the second attribute, a hypothetical connection line is configured for the node a to be changed and the node b. Compared with the node a to be changed whose attribute has not been changed, the node a with the changed attribute has one more connection line. The second attribute value calculated by the above formula is different from the first attribute value. Furthermore, before determining the second attribute value on the second attribute of the node to be changed, the device determines the neighbor node that has a connection line with the node to be changed, thereby determining the attribute corresponding to the neighbor node as the second attribute, that is, the attribute that needs to be changed of the node to be changed is the attribute of the node adjacent to the node to be changed.

[0178] Further, when the initial network diagram is obtained through triangular diffusion, in order to reduce the amount of calculation of the attribute values ​​of the nodes in the initial network diagram before and after the migration, the low-risk relationship is not used as input. Exemplarily, the device determines the target connection line among the connection lines between the node to be changed and each neighboring node based on the risk relationship represented by the connection line between the node to be changed and each neighboring node, and the target connection line is the connection line representing the high-risk relationship. For example, the connection line 1 between the node a to be changed and the node b represents the low-risk relationship, the connection line 2 between the node a to be changed and the node c represents the low-risk relationship, and the connection line 3 between the node a to be changed and the node d represents the high-risk relationship, then the connection line 3 is used as the target connection line. After determining each target connection line, the device determines the weight of each target connection line as the first weight. It can be understood that the first weights involved in the calculation of the first attribute value and the second attribute value are all the weights of the target connection line, and the weights configured for the low-risk relationship will not participate in the calculation of the first attribute value and the second attribute value, thereby reducing the amount of calculation of the first attribute value and the second attribute value of each node in the network diagram, and improving the efficiency of the device in determining the risk team users.

[0179] Step S802: determining the attribute gain of the modified attribute of the node to be changed according to the first attribute value and the second attribute value.

[0180] After determining the first attribute value and the second attribute value, the device determines the attribute gain amount brought by changing the attribute of the node to be changed. If yes, the attribute gain amount is obtained by subtracting the first attribute value from the second attribute value.

[0181] Step S803: in response to the attribute gain being greater than a preset threshold, determining that the node to be changed meets the attribute change condition, and determining the node to be changed as a target node.

[0182] When the attribute gain is greater than the preset threshold, the node to be changed meets the attribute change condition, and the node to be changed is determined as the target node. When the attribute gain is less than or equal to the preset threshold, the node to be changed does not meet the attribute change condition, that is, the node to be changed will not undergo attribute change.

[0183] Furthermore, when the node to be changed has multiple neighboring nodes, the device determines the attribute gain between the first attribute value and each second attribute value, and when any attribute gain is greater than a preset threshold, the second attribute corresponding to the largest attribute gain is determined as the target attribute corresponding to the node to be changed, thereby changing the attribute of the target node to the target attribute in the initial network diagram. It can be understood that the target node changes its own attribute to the attribute of the neighboring node with the largest attribute gain.

[0184] In this embodiment, the device accurately determines the node that meets the attribute change condition based on the attribute value of the node before the attribute is changed and the attribute value of the node after the attribute is changed.

[0185] In one embodiment, the attribute change of the node can be performed in a queue manner. When it is necessary to determine the first attribute value of the node to be changed in the initial network diagram, the device adds the node identifiers corresponding to some nodes in the initial network diagram to the queue, and the node identifiers of some nodes in the initial network can be added to the queue in a random manner. Each node identifier in the queue has a corresponding order. The device extracts the node corresponding to the node identifier from the head of the queue as the node to be changed, and determines the first attribute value of the node to be changed on the first attribute.

[0186] When the node to be changed meets the attribute change condition, the node to be changed is used as the target node, and when the attribute of the target node is changed in the initial network diagram, the device adds the node identifier corresponding to the node connected to the target node in the initial network diagram to the queue, configures the connection line between the target node and the node corresponding to the target attribute, and changes the first attribute of the target node to the target attribute. Since a new node identifier is added to the queue, there are more node identifiers in the queue, and the device needs to determine whether the node corresponding to each node identifier in the queue meets the attribute change condition, that is, the device returns to execute the extraction of the node identifier from the header of the queue as the target identifier, that is, repeatedly determining the attribute change condition of the node corresponding to the node identifier in the queue and changing the attribute of the target node, until there is no node identifier in the queue, the attribute change of all target nodes in the initial network diagram can be completed, and the second intermediate network diagram is obtained.

[0187] Reference Fig. 9 , Fig. 9 The color of the node in the network represents the community of the node. The device changes the attributes of the target node in the initial network graph in three steps as follows:

[0188] Step 1: Local mobile node, corresponding to Fig. 9 From a to b, this step is divided into several small steps;

[0189] 1.1. Randomly add nodes (node ​​identifiers) in the network graph to the queue, and remove a node from the front of the queue;

[0190] 1.2. Assign the removed node to the community (attribute) that can obtain the maximum modularity gain (modularity gain corresponds to attribute gain). If any community degree to which it is assigned cannot obtain a gain greater than 0, then keep the node in the original community, that is, the node's attributes remain unchanged;

[0191] 1.3. If the node is moved to another community (changes its attributes), add the neighbor nodes of the node that do not belong to the new community of the node and are not in the queue to the end of the queue, that is, add the nodes to which the node was connected before it was moved to the end of the queue;

[0192] Step 2: Optimize the communities obtained in step 1 to ensure that all communities have good connectivity. Community optimization can be regarded as determining nodes with the same attributes, such as Fig. 9 From b to c in the above example, multiple communities are obtained by optimization, for example: Fig. 9 c in;

[0193] Step 3: Fig. 9 The nodes belonging to the same community in the image are compressed to obtain multiple new nodes. Since there may be fewer nodes with a certain attribute during community optimization, these nodes will be regarded as a community. For example, the lower area in Figure c is composed of nodes with multiple attributes. Therefore, when the nodes in the lower area in Figure c are compressed, multiple new nodes will appear, that is, the nodes with the same attribute are compressed into a new node. After the node compression is completed, the loop Fig. 9 Steps a to c in are repeated until the maximum modularity is reached, that is, there are no nodes in the network graph that meet the attribute change conditions.

[0194] In this embodiment, potential risk team users are mined through attribute changes of nodes, and thus hidden risk team users are comprehensively mined in the network graph based on the characteristics of risk team users, thereby accurately determining all risk team users.

[0195] In this embodiment, the target nodes that meet the attribute change conditions can be determined quickly and orderly by means of a queue, thereby improving the determination efficiency of risk team users.

[0196] Reference Fig.10 , Fig.10 This is a schematic diagram of the process of user identification method for this application team Figure 6 ,based on Figures 2 to 9In any of the embodiments shown in , step S201 includes:

[0197] Step S1001: determine a plurality of fourth accounts in each first account, where the fourth accounts are used to indicate accounts of known risk team users.

[0198] In this embodiment, the device determines multiple fourth accounts in each first account, and the fourth account is an account of a known risk team user. Exemplarily, the fourth account is an account associated with a black sample device, the fourth account is an account associated with a black card, the fourth account is an account associated with a black sample WIFI, and the fourth account is an account associated with a black sample LBS.

[0199] Black sample devices refer to risky devices. If the fourth account logs into the risky device, it can be determined that the fourth account is associated with the black sample device. Black cards represent risky financial cards. If the fourth account has made transactions with risky financial cards, it can be determined that the fourth account is associated with the black card; black sample WIFI (mobile hotspot) refers to risky mobile hotspots. If the device where the fourth account is located has been connected to a risky mobile hotspot, the fourth account is associated with black sample WIFI; black sample LBS (Location Based Services) refers to the location provided by the service where a black sample device has appeared. If the device logged in by the fourth account uses the location provided by the black sample LBS, it can be determined that the fourth account is associated with the black sample LBS.

[0200] Step S1002, construct a sub-network diagram corresponding to each fourth account according to the risk relationship, and merge the sub-network diagrams to obtain an initial network diagram.

[0201] After determining each fourth account, the fourth account is used as the source, and the sub-network diagram corresponding to each fourth account is constructed based on the risk relationship. Then, each sub-network diagram is merged to obtain the initial network diagram. In addition, when merging each sub-network, it is necessary to cross-validate the relationship. For example, if node F in the sub-network diagram that is associated with the black card and node G in the sub-network diagram that is associated with the black sample LBS have a risk relationship, then confirm whether node F and node G really have a risk relationship. If so, configure the connection line between node F and node G.

[0202] In this embodiment, a risky fourth account is determined in each first account, and a sub-network graph corresponding to each fourth account is constructed based on the risk relationship, and then each sub-network is merged to quickly obtain an initial network graph.

[0203] In one embodiment, it is costly and difficult to mine global risk team users in massive data. Considering that a single risk team user is represented as a local structure on the network, the distance between users in the same circle on the network will not be too far. It is generally believed that the diameter of the circle (the maximum value of the shortest distance between any node in the circle) does not exceed 2. Convert the mining of the global circle into mining the circle to which it belongs in the local subgraph of each node. When constructing the entire network graph, a single user is taken as a single node (primary key: account), and the connection edges between nodes are divided into risk levels according to different risk relationships. In this embodiment, combined with the known accounts associated with black samples, with a black sample account as the center, the initial connection edges are first defined to discover the user's connection in the real world, and further define high and low risk relationships to construct an account relationship network diagram, distinguish the closeness of the relationship edges, and mine the accounts jointly held by risk team users.

[0204] Combination Fig.11 The steps of the user identification method for this application team are briefly described as follows:

[0205] Step 1: Using black sample accounts as the source, build a local subnet based on the defined high- and low-risk relationships through subnet merging and relationship cross-validation;

[0206] Step 2: enrich and supplement the network diagram through triangular diffusion, that is, low-confidence relationships (low-risk relationships) are transformed into high-confidence relationships (high-confidence relationships);

[0207] Step 3: Use the community mining method and community mining algorithm to further mine all risky users in the network graph constructed in step 2. The specific parameters are Fig. 9 Example shown.

[0208] Based on the contents described in the above embodiments, a team user identification device is also provided in the embodiments of the present application. Fig.12 , Fig.12 This is a schematic diagram of a program module of a team user identification device provided in an embodiment of the present application. In some implementations, the team user identification device 1200 includes:

[0209] An acquisition module 1210 is used to acquire target information of multiple first accounts, where the target information includes a location of a device logged in by the first account, network information corresponding to a network connected to the device, and transaction information of the first account;

[0210] A first determination module 1220 is used to determine the risk relationship between the first accounts according to the target information, and to construct an initial network diagram according to the risk relationship, wherein the initial network diagram includes the first accounts as nodes, and a connection line between two nodes is used to indicate the risk relationship between the first accounts corresponding to the two nodes;

[0211] The processing module 1230 is used to change the attributes of the nodes in the initial network diagram that meet the attribute change conditions to obtain a target network diagram;

[0212] The second determination module 1240 is used to determine users of the same risk team from users associated with the first accounts corresponding to the nodes with the same attribute in the target network graph in response to the first accounts corresponding to the nodes with the same attribute in the target network graph including risk accounts.

[0213] In some embodiments, the team user identification device 1200 is specifically used for:

[0214] Determine one or more associations between the second account and a third account according to the target information of the second account, where the second account is any one of the first accounts, and the third account is any first account other than the second account;

[0215] Determine target parameters of the association relationships, the target parameters including the number of occurrences of each association relationship and / or the type of the association relationship;

[0216] A risk relationship between the second account and the third account is determined based on the target parameter.

[0217] In some embodiments, the team user identification device 1200 is specifically used for:

[0218] In response to the type being a preset type, determining that the risk relationship between the second account and the third account is a high-risk relationship;

[0219] In response to the type not being a preset type, determining that the risk relationship between the second account and the third account is a low risk relationship.

[0220] In some embodiments, the team user identification device 1200 is specifically used for:

[0221] In response to the occurrence number of any one of the association relationships being greater than the corresponding preset number, determining that the risk relationship between the second account and the third account is a high-risk relationship;

[0222] In response to the occurrence number of each association relationship being less than or equal to the corresponding preset number, it is determined that the risk relationship between the second account and the third account is a low risk relationship.

[0223] In some embodiments, the team user identification device 1200 is specifically used for:

[0224] Set the node corresponding to each first account in the configuration diagram;

[0225] According to the risk relationship between the two first accounts, a connection line between the nodes corresponding to the two first accounts is configured in the configuration diagram to obtain a first intermediate network diagram;

[0226] Determining a ternary node group in the first intermediate network graph, wherein the ternary node group includes three nodes, and the connection lines between the three nodes form a triangle;

[0227] In response to two connection lines in the triple node group representing high-risk relationships and one connection line representing low-risk relationships, the connection line representing the low-risk relationship is changed to a connection line representing the high-risk relationship to obtain an initial network graph.

[0228] In some embodiments, the team user identification device 1200 is specifically used for:

[0229] Among the nodes in the initial network graph, determine the target node that meets the attribute change condition;

[0230] In the initial network graph, target attributes of the target nodes are changed to obtain a second intermediate network graph;

[0231] Merge the nodes with the same attribute in the second intermediate network graph into one node with the same attribute to obtain a third intermediate network graph;

[0232] In response to the third intermediate network graph not having any node satisfying the attribute change condition, the third intermediate network graph is determined as the target network graph.

[0233] In some embodiments, the team user identification device 1200 is specifically used for:

[0234] Determine a first attribute value of a node to be changed in the initial network graph on a first attribute, and determine a second attribute value of the node to be changed on a second attribute, wherein the first attribute is a current attribute of the node to be changed, and the second attribute is an attribute to be changed of the node to be changed;

[0235] Determine the attribute gain of the changed attribute of the node to be changed according to the first attribute value and the second attribute value;

[0236] In response to the attribute gain being greater than a preset threshold, it is determined that the node to be changed meets the attribute change condition, and the node to be changed is determined as a target node.

[0237] In some embodiments, the team user identification device 1200 is specifically used for:

[0238] Determine neighbor nodes that are connected to the node to be changed;

[0239] The attribute corresponding to the neighbor node is determined as the second attribute.

[0240] In some embodiments, the team user identification device 1200 is specifically used for:

[0241] determining an attribute gain amount between the first attribute value and a second attribute value corresponding to each second attribute;

[0242] In the initial network diagram, the target node is modified to have target attributes, including:

[0243] The second attribute corresponding to the maximum attribute gain is determined as the target attribute corresponding to the node to be changed, and the first attribute of each target node in the initial network graph is changed to the target attribute corresponding to the target node.

[0244] In some embodiments, the team user identification device 1200 is specifically used for:

[0245] Determine a first weight between the node to be changed and each neighboring node based on the risk relationship represented by the connection line between the node to be changed and each neighboring node, wherein each neighboring node is used to indicate a node that has a connection line with the node to be changed;

[0246] Determining a second weight between the node to be changed and the node corresponding to the second attribute;

[0247] The first attribute value of the node to be changed on the corresponding first attribute is determined according to each first weight, and the second attribute value of the node to be changed on the second attribute is determined according to the second weight and each first weight.

[0248] In some embodiments, the team user identification device 1200 is specifically used for:

[0249] Determining a first weight between the node to be changed and each neighboring node based on a risk relationship represented by a connection line between the node to be changed and each neighboring node includes:

[0250] Based on the risk relationship represented by the connection line between the node to be changed and each neighboring node, a target connection line is determined among the connection lines between the node to be changed and each neighboring node, where the target connection line is a connection line representing a high risk relationship;

[0251] The weight of each target link is determined as the first weight.

[0252] In some embodiments, the team user identification device 1200 is specifically used for:

[0253] Add node identifiers corresponding to some nodes in the initial network graph to the queue;

[0254] Extracting a node identifier from the head of the queue as a target identifier, determining a node corresponding to the target identifier as a node to be changed, and determining a first attribute value of the node to be changed on a first attribute;

[0255] In the initial network diagram, the target node is modified to have target attributes, including:

[0256] Add the node identifiers corresponding to the nodes connected to the target node in the initial network diagram to the queue, configure the connection line between the target node and the node corresponding to the target attribute, and change the first attribute of the target node to the target attribute;

[0257] Return to execute and extract the node identifier from the head of the queue as the target identifier, wherein the queue does not contain the node identifier, complete the attribute change of all target nodes in the initial network graph, and obtain the second intermediate network graph.

[0258] In some embodiments, the team user identification device 1200 is specifically used for:

[0259] In response to the presence of a node satisfying the attribute change condition in the third intermediate network graph, updating the third intermediate network graph to the initial network graph;

[0260] Return to the step of determining each target node that meets the attribute change condition in each node in the initial network graph.

[0261] In some embodiments, the team user identification device 1200 is specifically used for:

[0262] Determine a plurality of fourth accounts in each of the first accounts, where the fourth accounts are used to indicate accounts of known risk team users;

[0263] A sub-network graph corresponding to each fourth account is constructed according to the risk relationship, and each sub-network graph is merged to obtain an initial network graph.

[0264] It should be noted that the various steps in the team user identification method executed by the team user identification device refer to the above embodiments for details, which will not be described in detail here.

[0265] Furthermore, based on the contents described in the above embodiments, an electronic device is also provided in an embodiment of the present application, which includes at least one processor, and a communication interface and a memory connected to the processor; wherein the communication interface is used to communicate with other communication devices, and the memory stores computer execution instructions; the above at least one processor executes the computer execution instructions stored in the memory to implement each step in the team user identification method described in the above embodiments.

[0266] In order to better understand the embodiments of the present application, refer to Fig.13 , Fig.13 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application.

[0267] like Fig.13 As shown, the electronic device 1300 of this embodiment includes: a processor 1301, a memory 1302, and a communication interface 1304; wherein:

[0268] Memory 1302, used to store computer-executable instructions;

[0269] The communication interface 1304 is used to communicate with other communication devices;

[0270] The processor 1301 is used to execute the computer-executable instructions stored in the memory to implement the various steps in the query optimization method described in the above embodiment.

[0271] Optionally, the memory 1302 may be independent or integrated with the processor 1301 .

[0272] When the memory 1302 is independently provided, the device further includes a bus 1303 for connecting the memory 1302 , the communication interface 1304 and the processor 1301 .

[0273] An embodiment of the present application provides a computer-readable storage medium, which stores computer-executable instructions. When a processor executes the computer-executable instructions, each step of the team user identification method described in the above embodiment is implemented.

[0274] An embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the various steps in the team user identification method described in the above embodiment.

[0275] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0276] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0277] In addition, each functional module in each embodiment of the present application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The above-mentioned module-composed unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0278] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the methods of various embodiments of the present application.

[0279] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the application may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0280] The memory may include high-speed memory, and may also include non-volatile storage, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk, etc.

[0281] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0282] The storage medium may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic memory, flash memory, magnetic disk or optical disk. The storage medium may be any available medium that can be accessed by a general or special purpose computer.

[0283] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A team user identification method, characterized in that: include: Acquire target information of multiple first accounts, the target information including a location of a device logged in by the first account, network information corresponding to a network connected to the device, and transaction information of the first account; Determine the risk relationship between each of the first accounts according to the target information, and construct an initial network diagram according to the risk relationship, wherein the initial network diagram includes the first accounts as nodes, and a connecting line between two of the nodes is used to indicate the risk relationship between the first accounts corresponding to the two nodes; Perform attribute changes on nodes in the initial network graph that meet attribute change conditions to obtain a target network graph; In response to the first accounts corresponding to the nodes with the same attribute in the target network graph including risk accounts, users associated with the first accounts corresponding to the nodes with the same attribute are determined as users of the same risk team.

2. The method according to claim 1, characterized in that The determining the risk relationship between the first accounts according to the target information includes: Determine, according to the target information of the second account, one or more association relationships between the second account and the third account, where the second account is any one of the first accounts, and the third account is a first account other than the second account; Determine target parameters of the association relationships, wherein the target parameters include the number of occurrences of each of the association relationships and / or the type of the association relationships; A risk relationship between the second account and the third account is determined according to the target parameter.

3. The method according to claim 2, characterized in that The target parameter includes the type of the association relationship, and determining the risk relationship between the second account and the third account according to the target parameter includes: In response to the type being a preset type, determining that the risk relationship between the second account and the third account is a high-risk relationship; In response to the type not being a preset type, determining that the risk relationship between the second account and the third account is a low risk relationship.

4. The method according to claim 2, characterized in that: The target parameter includes the number of occurrences of each of the association relationships, and determining the risk relationship between the second account and the third account according to the target parameter includes: In response to the occurrence number of any one of the association relationships being greater than the corresponding preset number, determining that the risk relationship between the second account and the third account is a high-risk relationship; In response to the occurrence number of each association relationship being less than or equal to the corresponding preset number, it is determined that the risk relationship between the second account and the third account is a low-risk relationship.

5. The method according to claim 1, characterized in that The risk relationships include high-risk relationships and low-risk relationships, and constructing an initial network diagram according to the risk relationships includes: Set a node corresponding to each of the first accounts in the configuration diagram; According to the risk relationship between the two first accounts, configuring a connection line between the nodes corresponding to the two first accounts in the configuration diagram to obtain a first intermediate network diagram; Determining a ternary node group in the first intermediate network graph, wherein the ternary node group includes three nodes, and the connection lines between the three nodes form a triangle; In response to two connection lines in the triple node group representing high-risk relationships and one connection line representing low-risk relationships, the connection line representing the low-risk relationship is changed to a connection line representing the high-risk relationship to obtain an initial network graph.

6. The method according to any one of claims 1 to 5, characterized in that The step of changing the attributes of the nodes in the initial network graph that meet the attribute change conditions to obtain the target network graph includes: Determine, among the nodes in the initial network graph, a target node that satisfies the attribute change condition; In the initial network graph, the target node is subjected to target attribute change to obtain a second intermediate network graph; Merging nodes with the same attribute in the second intermediate network graph into one node with the same attribute to obtain a third intermediate network graph; In response to the third intermediate network graph not having any node satisfying the attribute change condition, the third intermediate network graph is determined as the target network graph.

7. The method according to claim 6, characterized in that Determining, among the nodes in the initial network graph, a target node that meets the attribute change condition comprises: Determine a first attribute value of a node to be changed in the initial network graph on a first attribute, and determine a second attribute value of the node to be changed on a second attribute, wherein the first attribute is a current attribute of the node to be changed, and the second attribute is an attribute to be changed of the node to be changed; Determine the attribute gain of the changed attribute of the node to be changed according to the first attribute value and the second attribute value; In response to the attribute gain being greater than a preset threshold, it is determined that the node to be changed meets an attribute change condition, and the node to be changed is determined as the target node.

8. The method according to claim 7, characterized in that Before determining the second attribute value of the to-be-changed node on the second attribute, the method further includes: Determine neighbor nodes that are connected to the node to be changed; The attribute corresponding to the neighbor node is determined as the second attribute.

9. The method according to claim 8, characterized in that There are multiple neighboring nodes, and determining the attribute gain of the attribute to be changed of the node to be changed according to the first attribute value and the second attribute value includes: determining an attribute gain between the first attribute value and a second attribute value corresponding to each of the second attributes; The step of changing the target attribute of the target node in the initial network graph includes: The second attribute corresponding to the maximum attribute gain is determined as the target attribute corresponding to the node to be changed, and the first attribute of each target node in the initial network graph is changed to the target attribute corresponding to the target node.

10. The method according to claim 7, characterized in that The step of determining a first attribute value of a node to be changed in the initial network graph on a first attribute, and determining a second attribute value of the node to be changed on a second attribute, comprises: Determine a first weight between the node to be changed and each of the neighboring nodes based on the risk relationship represented by the connection line between the node to be changed and each of the neighboring nodes, wherein each of the neighboring nodes is used to indicate a node that has a connection line with the node to be changed; Determining a second weight between the node to be changed and the node corresponding to the second attribute; A first attribute value of the node to be changed on the corresponding first attribute is determined according to each of the first weights, and a second attribute value of the node to be changed on the second attribute is determined according to the second weight and each of the first weights.

11. The method according to claim 10, characterized in that The determining, based on the risk relationship represented by the connection line between the node to be changed and each neighboring node, a first weight between the node to be changed and each neighboring node includes: Based on the risk relationship represented by the connection line between the node to be changed and each neighboring node, determine a target connection line among the connection lines between the node to be changed and each neighboring node, wherein the target connection line is a connection line representing a high-risk relationship; The weight of each target link is determined as a first weight.

12. The method according to claim 7, characterized in that The step of determining a first attribute value of a node to be changed in the initial network graph on a first attribute includes: Add node identifiers corresponding to some nodes in the initial network graph to a queue; Extracting a node identifier from the head of the queue as a target identifier, determining a node corresponding to the target identifier as a node to be changed, and determining a first attribute value of the node to be changed on a first attribute; The step of changing the target attribute of the target node in the initial network graph includes: Adding node identifiers corresponding to nodes connected to the target node in all initial network graphs to the queue, configuring a connection line between the target node and the node corresponding to the target attribute, and changing the first attribute of the target node to the target attribute; Return to execute the step of extracting the node identifier from the header of the queue as the target identifier, wherein the queue does not contain the node identifier, complete the attribute change of all target nodes in the initial network graph, and obtain the second intermediate network graph.

13. The method according to claim 6, characterized in that After merging the nodes with the same attribute in the second intermediate network graph into one node with the same attribute, the method further includes: In response to the presence of a node satisfying the attribute change condition in the third intermediate network graph, updating the third intermediate network graph to an initial network graph; Return to the step of determining each target node that meets the attribute change condition among each node in the initial network graph.

14. The team user identification method according to claim 1, characterized in that: The step of constructing an initial network diagram according to the risk relationship comprises: Determine a plurality of fourth accounts in each of the first accounts, wherein the fourth accounts are used to indicate accounts of known risk team users; A sub-network graph corresponding to each of the fourth accounts is constructed according to the risk relationship, and each of the sub-network graphs is merged to obtain an initial network graph.

15. A team user identification method and device, characterized in that: include: an acquisition module, configured to acquire target information of a plurality of first accounts, the target information including a location of a device logged in by the first account, network information corresponding to a network connected to the device, and transaction information of the first account; a first determination module, configured to determine the risk relationship between the first accounts according to the target information, and to construct an initial network diagram according to the risk relationship, wherein the initial network diagram includes the first accounts as nodes, and a connection line between two nodes is used to indicate the risk relationship between the first accounts corresponding to the two nodes; A processing module, used for changing the attributes of the nodes in the initial network graph that meet the attribute change conditions to obtain a target network graph; The second determination module is used to determine users of the same risk team from users associated with the first accounts corresponding to the nodes with the same attribute in the target network diagram in response to the first accounts corresponding to the nodes with the same attribute in the target network diagram including risk accounts.

16. An electronic device, characterized in that: include: A processor, and a memory and a communication interface communicatively connected to the processor; The communication interface is used to communicate with other communication devices; The memory is used to store computer-executable instructions; The processor is used to execute the computer-executable instructions stored in the memory to implement the team user identification method as described in any one of claims 1-14.

17. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, the team user identification method as described in any one of claims 1-14 is implemented.

18. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the team user identification method as described in any one of claims 1-14 is implemented.

Images