Multi-dimensional visualization method and device based on data extraction and intelligence research and judgment

Abstract

The invention discloses a multi-dimensional visualization method and device based on data extraction and intelligence research and judgment, and the method comprises the steps: obtaining a plurality of clues, and respectively extracting and converting the clues to obtain standardized attributes of each clue, the attributes comprise basic attributes and extended attributes, the basic attributes comprise clue IDs, clue topics, clue descriptions, entities, event time and positions, and the extended attributes comprise clue IDs, clue topics, clue descriptions, entities, event time and positions; the extension attribute comprises a clue type; constructing a tree structure of all clues according to the clue types and the clue topics or entities, and generating a mind map; sorting all the clues according to a time sequence, dynamically creating groups according to a grouping mode, and filtering all the clues by using a sliding time window to generate a timeline graph; an entity relation graph is constructed by taking entities as nodes and taking clue topics, clue descriptions or event time as edges. According to the method, multi-dimensional visual analysis can be realized, and clue management efficiency and association analysis capability are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of data analysis, and in particular to a multidimensional visualization method and device based on data extraction and intelligence analysis. Background Art

[0002] In today's information age, data analysis and visualization tools play an important role in all fields. However, although there are many data analysis software and mind map and relationship diagram drawing tools on the market, they are often independent in function and lack effective integration and interoperability. Especially in case investigation and judgment work, users often need to use data analysis software to analyze data, and then manually move and organize data, and manually draw mind maps, relationship diagrams, event timelines and trajectory diagrams.

[0003] Existing data analysis software usually focuses on data statistics and analysis. Although it can process large amounts of data, it still has limitations in sorting out and displaying key case information and in-depth mining from the data. Mind mapping and relationship diagram software are more often used to organize and express key case information. They perform well in providing beautiful graphical displays, but often ignore the needs of in-depth data analysis and actual application scenarios.

[0004] Most of the data analysis tools currently available on the market are limited to single-dimensional display and lack dynamic integration and visualization support for multi-attribute clues. For example, traditional tools have difficulty effectively associating dimensions such as time, space, and people, resulting in the relationship between clues being less intuitive. In addition, the generation of mind maps, timeline diagrams, and character relationship diagrams usually requires manual operation, which is inefficient and cannot penetrate back to the original data like BI tools.

[0005] At the same time, the existing system does not provide sufficient support for attributes such as confidence and priority of clues, making it difficult to meet the needs of investigators to quickly focus on key clues. Summary of the invention

[0006] The purpose of this application is to propose a multidimensional visualization method and device based on data extraction and intelligence analysis to address the above-mentioned technical problems.

[0007] In a first aspect, the present invention provides a multidimensional visualization method based on data extraction and intelligence analysis, comprising the following steps:

[0008] Obtain a number of clues and extract and convert them respectively to obtain standardized attributes of each clue, the attributes including basic attributes and extended attributes, the basic attributes including clue ID, clue subject, clue description, entity, event time and location, and the extended attributes including clue type;

[0009] Build a tree structure of all clues according to clue types and clue topics or entities to generate a mind map;

[0010] Sort all leads in chronological order, dynamically create groups according to the grouping method, and use a sliding time window to filter all leads to generate a timeline graph;

[0011] An entity relationship graph is constructed with entities as nodes and clue topics, clue descriptions, or event times as edges.

[0012] As a preference, a tree structure of all clues is constructed according to clue types and clue topics or entities to generate a mind map, specifically including:

[0013] Create a parent node based on the clue type. The level of the parent node is 0. Create a child node based on the clue topic or entity. The level of the child node is equal to the level of its parent node plus 1. A tree structure is formed between the parent node and its associated child nodes.

[0014] The radial layout formula is used to calculate the position of each node on the mind map, and the nodes are evenly distributed on concentric circles according to the level;

[0015] Use d3.js for visual expression to get a mind map.

[0016] As a preferred method, a radial layout formula is used to calculate the position of each node on the mind map, and the nodes are evenly distributed on concentric circles according to the level, specifically including:

[0017] Calculate the radius R of the level where the current node is located, as shown in the following formula:

[0018] R = Depth * D;

[0019] Among them, Depth is the level of the current node, and D represents the level distance;

[0020] Calculate the angle of the current node as shown below:

[0021]

[0022] Among them, θ i represents the angle of the current node, i represents the index number of the current node at the level, and NL represents the total number of nodes at the current level;

[0023] Calculate the position of the current node on the mind map as shown below:

[0024] x i =R·cos(θ i ), y i =R·sin(θ i );

[0025] Among them, x iIndicates the horizontal coordinate of the current node on the mind map, y i Indicates the vertical coordinate of the current node on the mind map.

[0026] Preferably, the extended attributes also include priority, clue status, source, confidence, evidence support, label, risk assessment, timeliness, related events, data type, scope of impact, recording time and / or extractor.

[0027] Preferably, all clues are sorted in chronological order, groups are dynamically created according to the grouping method, and all clues are filtered using a sliding time window to generate a timeline diagram, specifically including:

[0028] Normalize the event time or record time to a unified time axis, as shown in the following formula:

[0029]

[0030] Among them, T j Indicates the event time of the current thread or the recording time of the current thread, T min represents the minimum value of the event time of all clues or the minimum value of the recording time of all clues, T max Represents the maximum value of the event time of all clues or the maximum value of the recording time of all clues, T′ j represents the normalized time;

[0031] Group the clues according to the selected grouping method and sort them by time;

[0032] Use the sliding time window and node spacing adjustment algorithm for visualization optimization, as shown in the following formula:

[0033] x j =T′ j ·W,y j =Δj;

[0034] Where W represents the length of the time axis, Δj represents the vertical offset; x j Indicates the horizontal axis of the current clue in the timeline graph, y j Indicates the vertical coordinate of the current clue in the timeline graph;

[0035] Dynamically adjust based on priority and use timeline.js for timeline rendering.

[0036] Preferably, an entity relationship diagram is constructed with entities as nodes and clue topics, clue descriptions or event times as edges, specifically including:

[0037] Entities are taken as nodes in an entity-relationship graph, and clue topics, clue descriptions or event times are taken as edges in the entity-relationship graph;

[0038] The relationship weight is calculated based on the number of mentions or association strength of the entity in all clues, as shown in the following formula:

[0039]

[0040] Among them, w represents the relationship weight, α and β represent the weight coefficient of the number of mentions and the weight coefficient of the association strength respectively, and C pq represents the number of times entity p and entity q are mentioned together in all clues, C max represents the maximum number of times all entity pairs are mentioned together, R k represents the confidence of the kth clue, P k represents the priority of the kth search, and n represents the total number of clues;

[0041] Use the force-directed layout algorithm to dynamically adjust the node spacing, apply the relationship graph layout algorithm to adjust the thickness of the edge between two nodes in the entity relationship graph according to the relationship weight, and use OGMA.JS to render the entity relationship graph.

[0042] In a second aspect, the present invention provides a multi-dimensional visualization device based on data extraction and intelligence analysis, comprising:

[0043] A standardization module is configured to obtain a number of clues and extract and convert the standardized attributes of each clue respectively, wherein the attributes include basic attributes and extended attributes, wherein the basic attributes include clue ID, clue subject, clue description, entity, event time and location, and the extended attributes include clue type;

[0044] A mind map generation module is configured to construct a tree structure of all clues according to clue types and clue topics or entities to generate a mind map;

[0045] A timeline graph generation module is configured to sort all clues in chronological order, dynamically create groups according to the grouping method, and filter all clues using a sliding time window to generate a timeline graph;

[0046] The entity relationship graph generation module is configured to construct an entity relationship graph with entities as nodes and clue topics, clue descriptions or event times as edges.

[0047] In a third aspect, the present invention provides an electronic device comprising one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation manner in the first aspect.

[0048] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in any implementation manner in the first aspect.

[0049] In a fifth aspect, the present invention provides a computer program product, comprising a computer program, which, when executed by a processor, implements the method described in any implementation manner in the first aspect.

[0050] Compared with the prior art, the present invention has the following beneficial effects:

[0051] (1) The multidimensional visualization method based on data extraction and intelligence analysis proposed in the present invention helps investigators to organize and classify abnormal clues, and automatically forms multidimensional, dynamic visualization analysis charts, thereby improving the insight into the relationship between clues and the work efficiency of investigators, and meeting the diverse investigation needs.

[0052] (2) The multidimensional visualization method based on data extraction and intelligence analysis proposed in the present invention standardizes the clues so that they can simultaneously meet the needs of multidimensional charts and perform multidimensional visualization analysis, thereby significantly improving the efficiency of clue management and correlation analysis capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0054] Figure 1 A flowchart of a multi-dimensional visualization method based on data extraction and intelligence analysis according to an embodiment of the present application;

[0055] Figure 2 A flowchart of a multi-dimensional visualization method based on data extraction and intelligence analysis according to an embodiment of the present application;

[0056] Figure 3 A schematic diagram of a multi-dimensional visualization device based on data extraction and intelligence analysis according to an embodiment of the present application;

[0057] Figure 4 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0059] Figure 1 A multidimensional visualization method based on data extraction and intelligence analysis provided by an embodiment of the present application is shown, comprising the following steps:

[0060] S1, obtain several clues and extract and convert them respectively to obtain the standardized attributes of each clue, the attributes include basic attributes and extended attributes, the basic attributes include clue ID, clue subject, clue description, entity, event time and location, and the extended attributes include clue type.

[0061] In a specific embodiment, the extended attributes also include priority, clue status, source, confidence, evidence support, label, risk assessment, timeliness, related events, data type, scope of impact, recording time and / or extractor.

[0062] refer to Figure 2 , extract the abnormal data found by the investigator during the data analysis process as clues, and support multi-dimensional visual analysis. Investigators can check the original data and add it as clues for abnormal information found in the process of using various functional modules of the system. At this time, the system automatically extracts relevant main information based on the content of the checked data, and the investigators manually supplement it. The added clues are saved in the clue library. The main person in charge of the case / incident can view the clues extracted by each investigator from the clue library, and limit the clues to have the system automatically generate various charts. The acquisition of clues can be achieved in the following ways: automatically import and parse massive raw data, extract potential anomalies (based on rule models / machine learning algorithms); provide data analysis functions and manual marking functions, allowing investigators to supplement or modify automatically extracted clues during the data browsing process.

[0063] After obtaining the clues, the basic attributes of the clues are extracted as follows:

[0064] 1. Lead ID: used to uniquely identify a lead.

[0065] 2. Clue theme: The core content or keywords of the clue, which is also the name of the card on the mind map.

[0066] 3. Clue description: detailed description of the clue.

[0067] 4. Entity: An object associated with a clue, such as a person, place, organization, etc.

[0068] 5. Event time: the time when the event occurred.

[0069] 6. Location: The geographical location where the event occurred or is related to, including the latitude and longitude of the relevant location and a description of the location.

[0070] Furthermore, in order to enhance the usability of clues and support multi-dimensional analysis, the following extended attributes are added:

[0071] 1. Priority: Mark the importance of clues for task focus. Priorities are divided into high, medium, and low.

[0072] 2. Lead status: indicates the progress of lead processing.

[0073] 3. Source: channels for obtaining clues, such as manual entry, AI automatic recommendation, risk model warning, etc.

[0074] 4. Confidence: A rating of the authenticity or relevance of the clue, with confidence levels ranging from high, medium, and low.

[0075] 5. Evidence support: documents, pictures, videos and other attachments related to the clues.

[0076] 6. Label: An identifier that classifies clue features.

[0077] 7. Risk assessment: Quantitative analysis of the potential risks involved in the clues.

[0078] 8. Timeliness: The effective time range of the marked clue.

[0079] 9. Related events: specific event records related to clues.

[0080] 10. Data type: The format of the clue data.

[0081] 11. Lead classification: Define lead types based on scenarios (such as "abnormal transactions", "related to a certain contract project").

[0082] 12. Scope of impact: The geographical or business scope that the lead may affect.

[0083] 13. Recording time: the time when the clue was recorded.

[0084] 14. Abstractor: An investigator who records clues.

[0085] Create indexes based on key information such as the entity, time, and location of the clue to facilitate subsequent screening.

[0086] The clues are structured and converted into standardized attributes to meet the needs of visualization generation, and the missing attributes are initialized and filled.

[0087] {

[0088] "ID":"001",

[0089] "title":"Abnormal transfer",

[0090] "describe":"Zhang San transferred 50,000 yuan to Li Si",

[0091] "user":"Investigator 001",

[0092] "entity":["Zhang San","Li Si"],

[0093] "datetime":"2024-12-01T10:00:00",

[0094] "position":{describe:"Shanghai Xuhui District",lon:"182.2142",lat:"42.2332"},

[0095] "status":"Verified",

[0096] "source":"Manually extracted",

[0097] "confidence":85,

[0098] "attachment":["transfer record.pdf"],

[0099] "tag":["Financial Abnormality"],

[0100] "class":"Abnormal transaction",

[0101] "updatetime":"2024-12-02T08:30:00", .....

[0103] }

[0104] S2, constructs a tree structure of all clues according to clue types and clue topics or entities to generate a mind map.

[0105] In a specific embodiment, step S2 specifically includes:

[0106] Create a parent node based on the clue type. The level of the parent node is 0. Create a child node based on the clue topic or entity. The level of the child node is equal to the level of its parent node plus 1. A tree structure is formed between the parent node and its associated child nodes.

[0107] The radial layout formula is used to calculate the position of each node on the mind map, and the nodes are evenly distributed on concentric circles according to the level;

[0108] Use d3.js for visual expression to get a mind map.

[0109] In a specific embodiment, a radial layout formula is used to calculate the position of each node on the mind map, and the nodes are evenly distributed on concentric circles according to the level, specifically including:

[0110] Calculate the radius R of the level where the current node is located, as shown in the following formula:

[0111] R = Depth * D;

[0112] Among them, Depth is the level of the current node, and D represents the level distance;

[0113] Calculate the angle of the current node as shown below:

[0114]

[0115] Among them, θ i represents the angle of the current node, i represents the index number of the current node at the level, and NL represents the total number of nodes at the current level;

[0116] Calculate the position of the current node on the mind map as shown below:

[0117] x i =R·cos(θ i ), y i =R·sin(θ i );

[0118] Among them, x i Indicates the horizontal coordinate of the current node on the mind map, y i Indicates the vertical coordinate of the current node on the mind map.

[0119] Specifically, a mind map is dynamically generated based on the clue type and clue theme or entity. It supports users to customize and add new nodes to assist in improving the mind map. Clicking on the node generated by the excerpt clue can penetrate to the original data.

[0120] First, create a parent node based on the clue type, and then generate child nodes based on the clue subject or entity, for example:

[0121] The clue type is "abnormal transfer", under which there are multiple clues, namely "Zhang San transferred 50,000 yuan to Li Si on X / X / 2024, with the remark of repayment"; "Zhang San transferred 4 times to Wan Wu from X / X / 2024, totaling 500,000 yuan".

[0122] The specific node data for generating a mind map is as follows:

[0123]

[0124]

[0125] S3, sorts all clues in chronological order, dynamically creates groups according to the grouping method, and uses a sliding time window to filter all clues to generate a timeline graph.

[0126] In a specific embodiment, step S3 specifically includes:

[0127] Normalize the event time or record time to a unified time axis, as shown in the following formula:

[0128]

[0129] Among them, T j Indicates the event time of the current thread or the recording time of the current thread, T min represents the minimum value of the event time of all clues or the minimum value of the recording time of all clues, T max Represents the maximum value of the event time of all clues or the maximum value of the recording time of all clues, T′ j represents the normalized time;

[0130] Group the clues according to the selected grouping method and sort them by time;

[0131] Use the sliding time window and node spacing adjustment algorithm for visualization optimization, as shown in the following formula:

[0132] x j =T′ j ·W,y j =Δj;

[0133] Where W represents the length of the time axis, Δj represents the vertical offset; x j Indicates the horizontal axis of the current clue in the timeline graph, y j Indicates the vertical coordinate of the current clue in the timeline graph;

[0134] Dynamically adjust based on priority and use timeline.js for timeline rendering.

[0135] Specifically, the clues are arranged in chronological order, and groups are dynamically created according to entities or clue types. The window time sliding mechanism is used, and users are allowed to specify the start and end time to filter clues. Therefore, clues can be displayed in chronological order, dynamic time filtering is supported, and event grouping can be supported according to different dimensions such as entities or clue types.

[0136] The specific examples of node data generated by grouping according to clue types are as follows:

[0137]

[0138]

[0139] The specific examples of node data generated according to entity grouping are as follows:

[0140]

[0141] It should be noted that when a clue is associated with multiple entities at the same time, this clue needs to appear in multiple groups.

[0142] After the grouping is completed, the clues are segmented by time, and users can dynamically filter the clues by adjusting the range of the sliding time window.

[0143] 1. Sliding time window initialization: Set the initial time range (such as 1 day, 1 week). Users can modify the size of the sliding time window.

[0144] 2. Dynamic adjustment: The user controls the start and end time of the sliding time window through the slider and updates the display range.

[0145] 3. Data update: Re-query the qualified clue data according to the adjusted sliding time window range. The query conditions are:

[0146] (T start ≤T' end ≤T end )OR(T start ≤T' begin ≤T end )OR(T' begin ≤T start AND T' end ≥T end );

[0147] Among them, T start , T end Indicates the start and end time of the sliding time window, T' begin and T' end Indicates the start time and end time of the clue.

[0148] S4, constructs an entity relationship graph with entities as nodes and clue topics, clue descriptions or event times as edges.

[0149] In a specific embodiment, step S4 specifically includes:

[0150] Entities are taken as nodes in an entity-relationship graph, and clue topics, clue descriptions or event times are taken as edges in the entity-relationship graph;

[0151] Calculate the relationship weight based on the number of mentions or the strength of association of entities in all clues, as shown in the following formula:

[0152]

[0153] where w represents the relationship weight, α and β represent the weight coefficients of the number of mentions and the strength of association respectively, and C pq represents the number of times entities p and q are co - mentioned in all clues, C max represents the maximum value of the number of times all entity pairs are co - mentioned, R k represents the confidence of the k - th clue, P k represents the priority of the k - th retrieval, and n represents the total number of clues;

[0154] Use the force - directed layout algorithm to dynamically adjust the node spacing, apply the relationship graph layout algorithm to adjust the thickness of the edge between two nodes in the entity relationship graph according to the relationship weight, and use OGMA.JS to render the entity relationship graph.

[0155] Specifically, extract the entities in the clues as nodes, and use the clue theme, clue description, or event time as edges to construct an entity network based on the graph model, as shown in the following formula:

[0156] Graph=(V, E);

[0157] where V represents the set of nodes and E represents the set of edges.

[0158] The entity relationship graph shows the entities involved in different clues and their relationship strengths. One can directly select an entity or the relationship between entities to penetrate to the original data.

[0159] Specific examples of the data for generating the entity relationship graph are as follows:

[0160]

[0161]

[0162] Calculate the relationship weight using the number of mentions or the strength of association of entities in the clues. When calculating the relationship weight, the default values of α and β are both 0.5. If "Zhang San" and "Li Si" are mentioned simultaneously in 5 clues, then C pq =5. If the pair of entities with the most mentions in all clues (such as "Zhang San" and "Wang Wu") is mentioned 10 times, then C max =10. Calculate the overall strength of association by accumulating the product of the confidence R k and the priority P k . Among them, high, medium, and low in the confidence correspond to R kare 0.9, 0.6, and 0.3; the high, medium, and low priorities correspond to P k Are 0.9, 0.6, and 0.3.

[0163] Use the Force-Directed Layout algorithm to dynamically adjust the node spacing. The specific process is as follows:

[0164] Calculate the gravitational force between two nodes:

[0165] F attraction =k1·ln(dl);

[0166] Among them, F attraction represents the gravitational force, k1 represents the spring constant, d represents the actual distance between the two nodes, and l represents the natural length of the spring.

[0167] Calculate the repulsive force between two nodes:

[0168]

[0169] Among them, F repulsion is the repulsive force, k2 is the repulsive force constant, and repulsion is used to prevent nodes from overlapping.

[0170] Substitute the calculated value into the force-directed layout algorithm function, apply the relationship graph layout algorithm, and use OGMA.JS to render the relationship graph, in which the relationship weight is used to represent the thickness of the connection between nodes, so that users can quickly identify the closeness of the relationship between people.

[0171] The multidimensional visualization method based on data extraction and intelligence analysis proposed in the embodiment of the present application also has the following extended functions:

[0172] 1. Dynamic interaction: supports dragging nodes, clicking to view detailed clues, and penetrating to view the original data of clues.

[0173] 2. Real-time update: After a new clue is entered, the chart will be automatically updated, and you can switch between the three charts.

[0174] 3. Filtering and screening: Allow users to filter visualization content by priority, time, and other conditions.

[0175] Further references Figure 3 As an implementation of the methods shown in the above figures, the present application provides an embodiment of a multi-dimensional visualization device based on data extraction and intelligence analysis. Figure 1 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0176] The embodiment of the present application provides a multi-dimensional visualization device based on data extraction and intelligence analysis, including:

[0177] The standardization module 1 is configured to obtain a number of clues and extract and convert the standardized attributes of each clue respectively, wherein the attributes include basic attributes and extended attributes, the basic attributes include clue ID, clue subject, clue description, entity, event time and location, and the extended attributes include clue type;

[0178] The mind map generation module 2 is configured to construct a tree structure of all clues according to clue types and clue topics to generate a mind map;

[0179] The timeline graph generation module 3 is configured to sort all clues in chronological order, dynamically create groups according to the grouping method, and filter all clues using a sliding time window to generate a timeline graph;

[0180] The entity relationship graph generation module 4 is configured to construct an entity relationship graph with entities as nodes and clue topics, clue descriptions or event times as edges.

[0181] Figure 4 Schematic diagram of the hardware structure of the electronic device provided by the embodiment of the present invention. Figure 4 As shown, the electronic device of this embodiment includes: a processor 401 and a memory 402; wherein the memory 402 is used to store computer-executable instructions; the processor 401 is used to execute the computer-executable instructions stored in the memory to implement the various steps performed by the electronic device in the above embodiment. For details, please refer to the relevant description in the above method embodiment.

[0182] Optionally, the memory 402 may be independent or integrated with the processor 401 .

[0183] When the memory 402 is independently provided, the electronic device further includes a bus 403 for connecting the memory 402 and the processor 401 .

[0184] The embodiment of the present invention further provides a computer storage medium, in which computer execution instructions are stored. When the processor 401 executes the computer execution instructions, the above method is implemented.

[0185] The embodiment of the present invention further provides a computer program product, including a computer program. When the computer program is executed by the processor 401, the above method is implemented.

[0186] In the embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0187] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to implement the solution of this embodiment.

[0188] In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, each module may exist physically separately, or two or more modules may be integrated into one unit. The unit formed by the above modules may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0189] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor 401 to perform some steps of the methods of various embodiments of the present application.

[0190] It should be understood that the processor 401 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or the processor 401 may be any conventional processor 401, etc. The steps of the method disclosed in the invention may be directly embodied in the hardware processor 401 for execution, or may be executed by a combination of hardware and software modules in the processor 401.

[0191] The memory 402 may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk, or an optical disk.

[0192] The bus 403 may be an Industry Standard Architecture (ISA), a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus 403 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus 403 in the drawings of the present application is not limited to only one bus 403 or one type of bus 403.

[0193] The above storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0194] An exemplary storage medium is coupled to the processor 401, so that the processor 401 can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor 401. The processor 401 and the storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor 401 and the storage medium can also exist as discrete components in an electronic device or a main control device.

[0195] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0196] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A multidimensional visualization method based on data extraction and intelligence analysis, characterized in that: The following steps are involved: Acquire a number of clues and extract and convert them respectively to obtain standardized attributes of each clue, wherein the attributes include basic attributes and extended attributes, wherein the basic attributes include clue ID, clue subject, clue description, entity, event time and location, and the extended attributes include clue type; Constructing a tree structure of all clues according to the clue types and clue topics or entities to generate a mind map; Sort all leads in chronological order, dynamically create groups according to the grouping method, and use a sliding time window to filter all leads to generate a timeline graph; An entity relationship graph is constructed with the entities as nodes and the clue topics, clue descriptions or event times as edges.

2. The multidimensional visualization method based on data extraction and intelligence analysis according to claim 1 is characterized in that: A tree structure of all clues is constructed according to the clue types and clue topics or entities to generate a mind map, including: A parent node is created according to the clue type, the level of the parent node is 0, and a child node is created according to the clue subject or entity, the level of the child node is equal to the level of its parent node plus 1, and a tree structure is formed between the parent node and its associated child nodes; The radial layout formula is used to calculate the position of each node on the mind map, and the nodes are evenly distributed on concentric circles according to the level; Use d3.js for visual expression to get a mind map.

3. The multidimensional visualization method based on data extraction and intelligence analysis according to claim 2 is characterized in that: The radial layout formula is used to calculate the position of each node on the mind map, and the nodes are evenly distributed on concentric circles according to the level, including: Calculate the radius R of the level where the current node is located, as shown in the following formula: R = Depth * D; Among them, Depth is the level of the current node, and D represents the level distance; Calculate the angle of the current node as shown below: Among them, θ i represents the angle of the current node, i represents the index number of the current node at the level, and NL represents the total number of nodes at the current level; Calculate the position of the current node on the mind map as shown below: x i =R·cos(θ i ),y i =R·sin(θ i ); Among them, x i Indicates the horizontal coordinate of the current node on the mind map, y i Indicates the vertical coordinate of the current node on the mind map.

4. The multidimensional visualization method based on data extraction and intelligence analysis according to claim 1 is characterized in that: The extended attributes also include priority, clue status, source, confidence, evidence support, label, risk assessment, timeliness, related events, data type, scope of impact, recording time and / or extractor.

5. The multidimensional visualization method based on data extraction and intelligence analysis according to claim 4 is characterized in that: Sort all leads in chronological order, dynamically create groups according to the grouping method, and use a sliding time window to filter all leads to generate a timeline diagram, including: Normalize the event time or record time to a unified time axis, as shown in the following formula: Among them, T j Indicates the event time of the current thread or the recording time of the current thread, T min represents the minimum value of the event time of all clues or the minimum value of the recording time of all clues, T max Represents the maximum value of the event time of all clues or the maximum value of the recording time of all clues, T′ j represents the normalized time; Group the clues according to the selected grouping method and sort them by time; Use the sliding time window and node spacing adjustment algorithm for visualization optimization, as shown in the following formula: x j =T′ j ·W,y j =Δj; Where W represents the length of the time axis, Δj represents the vertical offset; x j Indicates the horizontal axis of the current clue in the timeline graph, y j Indicates the vertical coordinate of the current clue in the timeline graph; The priority is dynamically adjusted according to the priority, and timeline.js is used for timeline rendering.

6. The multidimensional visualization method based on data extraction and intelligence analysis according to claim 4 is characterized in that: An entity relationship diagram is constructed with the entities as nodes and clue topics, clue descriptions or event times as edges, including: The entity is used as a node in the entity relationship graph, and the clue topic, clue description or event time is used as an edge in the entity relationship graph; The relationship weight is calculated based on the number of mentions or association strength of the entity in all clues, as shown in the following formula: Among them, w represents the relationship weight, α and β represent the weight coefficient of the number of mentions and the weight coefficient of the association strength respectively, and C pq represents the number of times entity p and entity q are mentioned together in all clues, C max represents the maximum number of times all entity pairs are mentioned together, R k represents the confidence of the kth clue, P k represents the priority of the kth search, and n represents the total number of clues; A force-directed layout algorithm is used to dynamically adjust the node spacing, a relationship graph layout algorithm is applied to adjust the thickness of the edge between two nodes in the entity relationship graph according to the relationship weight, and OGMA.JS is used to render the entity relationship graph.

7. A multi-dimensional visualization device based on data extraction and intelligence analysis, characterized in that: include: A standardization module is configured to obtain a number of clues and extract and convert them to obtain standardized attributes of each clue, wherein the attributes include basic attributes and extended attributes, wherein the basic attributes include clue ID, clue subject, clue description, entity, event time and location, and the extended attributes include clue type; A mind map generation module is configured to construct a tree structure of all clues according to the clue types and clue topics or entities to generate a mind map; A timeline graph generation module is configured to sort all clues in chronological order, dynamically create groups according to the grouping method, and filter all clues using a sliding time window to generate a timeline graph; The entity relationship diagram generation module is configured to construct an entity relationship diagram with the entities as nodes and clue topics, clue descriptions or event times as edges.

8. An electronic device comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images