Dense subgraph detection method and system for multi-cascade network

Abstract

The invention discloses a dense subgraph detection method and system for a multi-cascade network, and the method comprises the steps: carrying out the initialization definition of the priority and network association density of a plurality of networks and nodes in a plurality of networks based on financial transactions, introducing a non-null constraint, and carrying out the initialization definition of conditions satisfied by the detection of abnormal nodes; the method comprises the following steps: modeling cross-part interaction information of a plurality of networks into affiliated information of a same adjacency relationship, decomposing through a coupling matrix sharing association constraints to obtain a low-rank factor matrix of each node of the plurality of networks, and primarily screening a plurality of groups of candidate solutions after truncation according to a preset threshold value; aggregating a plurality of sub-networks formed by each group of candidate solutions, and then solving by using a dense sub-graph solver; the dense subgraph association density is optimized through a neighborhood expansion method; and selecting the solution with the maximum correlation density from the multiple groups of feasible solutions, and outputting a final detection result. According to the method, the correlation density of multiple networks is provided, and the method has effectiveness, anti-interference performance and good expandability.

Description

Technical Field

[0001] The present invention relates to the field of data mining, and in particular to a method and system for detecting dense subgraphs of a multi-part cascade network. Background Art

[0002] Multipartite networks are widely present in natural, social, and information sciences. By fusing related data from different sources, we can obtain richer structural information and knowledge. However, modeling and detecting dense substructures in multipartite networks has not been effectively explored and is a very challenging task.

[0003] Dense substructures in multi-partite networks represent high-information, high-value patterns, such as suspected money laundering rings in financial transaction networks. Detecting dense substructures in multi-partite networks has broad applications and is of great significance. Current methods for detecting dense subgraphs in multi-partite networks include:

[0004] The first is dense subgraph detection algorithms applicable to single networks. These algorithms detect dense subgraph structures in a single network by optimizing metrics such as average degree density and edge surplus density. For multi-network scenarios, these algorithms aggregate the multi-network as a single network input.

[0005] The second is clustering, community detection, and maximum and minimum density based on multiple networks. These methods usually optimize some proxy indicators to achieve the mining of dense substructures.

[0006] The third is to mine meta-paths based on heterogeneous information networks. Through pre-set meta-paths, specific patterns are mined to detect dense substructures. Multiple networks are treated as heterogeneous information networks.

[0007] None of the above methods capture the dense patterns of associations in multi-part networks, nor can they provide theoretical guarantees, and there is no clear, unified definition of the problem. Most current methods are limited to detecting dense subgraphs in single networks and multi-view networks, which ignores the rich cross-domain interaction information in the network. In the actual detection process, the nodes of the subgraph are easily confined to certain domains, which is reflected in the network structure as the collapse of the multi-part network. In addition, meta-path-based algorithms require carefully designed meta-paths, and meta-paths have a great impact on the detection results. Such methods are not universal. Furthermore, existing methods are limited to the detection of dense substructures, ignoring the discussion of cross-domain associations, and cannot deal with the complex problem of detecting dense subgraphs of multi-part networks. Summary of the Invention

[0008] In order to solve the above problems, the present invention proposes a method and system for detecting correlated dense subgraphs in multi-part networks.

[0009] In a first aspect, embodiments of the present application provide a dense subgraph detection method for a multi-part cascade network, characterized in that it is applied to detect suspicious money laundering gangs in a financial transaction network, and the method includes:

[0010] Initialization definition step: In a multi-part network based on financial transactions, the priority and network association density of the multi-part network and its nodes are initially defined, and non-emptiness constraints are introduced to initially define the conditions that a set of abnormal nodes to be detected and output in the association dense subgraph detection must meet;

[0011] Candidate solution screening step: Model the cross-partition interaction information of the multi-part network as the subsidiary information of the same-part adjacency. Through the coupling matrix decomposition with shared association constraints, a low-dimensional factor matrix of each part node of the multi-part network is obtained. After truncation according to the preset threshold, multiple groups of candidate solutions are initially screened.

[0012] Dense subgraph detection steps: For each set of candidate solutions, the multiple subnetworks are aggregated and then solved using a dense subgraph solver to obtain multiple feasible solutions. The dense subgraph association density is optimized using the neighborhood expansion method. The solution with the largest association density is selected from the multiple feasible solutions, and the final detection result of the suspected money laundering gang is output.

[0013] In an embodiment of the present invention, the initialization definition step includes:

[0014] Initialize and define multiple networks in a collective manner as follows: Where A is the set of all same-domain adjacency matrices; C is the set of all cross-domain interaction matrices; G is the structure matrix of the multi-domain network, and V represents the set of all nodes in the network;

[0015] Introducing hyperparameters to define the priority of nodes and network connection density in multi-part networks;

[0016] Based on the average weighted sum of nodes, a non-emptiness constraint is introduced, and the dense subgraph detection problem of multi-partite networks is defined as finding a set of nodes that meet the conditions. The finding condition is to select the solution with the largest association density as the optimal solution node output.

[0017] In an embodiment of the present invention, the candidate solution screening step includes:

[0018] Based on non-negative coupling matrix decomposition, all cross-domain interaction information of multiple networks is modeled as coupling terms of the same-part adjacency relationship, sharing decomposition factors; and based on the weight multiplication update method, an iterative update module of the factor matrix is generated;

[0019] Iteratively run the iterative update module, design a truncation strategy based on the value of the factor matrix, and select a set of candidate nodes.

[0020] In an embodiment of the present invention, the dense subgraph detection step includes:

[0021] The dense sub-network composed of the candidate node set is aggregated into a network according to the preset hyperparameters, and then solved using the dense sub-graph solver to generate a solution set;

[0022] Adopting the neighborhood expansion algorithm, the node with the largest priority is selected from the neighborhood of the solution set of the current subgraph. If adding the node to the current subgraph can increase the density of the subgraph, the subgraph is expanded, the priority of the neighboring nodes is updated, and the neighborhood expansion algorithm is repeated to generate an updated subgraph.

[0023] From the obtained k groups of feasible solutions, the updated subgraph is selected and the solution with the largest correlation density is output as the optimal detection result;

[0024] For the final detection results of suspected money laundering gangs, the minimum density strategy, geometric mean density strategy and arithmetic mean density strategy are used respectively to evaluate the normalized density of multiple networks of the detection results, as well as the correlation and density of multiple networks.

[0025] In a second aspect, embodiments of this aspect provide a dense subgraph detection system for multi-part cascade networks, which employs the above-described dense subgraph detection method for multi-part cascade networks and is applied to the detection of suspicious money laundering gangs in financial transaction networks. The system includes:

[0026] Initialization definition module: In a multi-part network based on financial transactions, the priority and network association density of the multi-part network and its nodes are initially defined, and non-emptiness constraints are introduced to initialize the conditions that a set of abnormal nodes to be detected and output in the detection of densely associated subgraphs must meet.

[0027] Candidate solution screening module: This module models the cross-partition interaction information of multiple networks as the subsidiary information of the same-part adjacency. Through the coupling matrix decomposition with shared association constraints, it obtains the low-dimensional factor matrix of each node in the multi-partition network. After truncating according to the preset threshold, it preliminarily screens multiple groups of candidate solutions.

[0028] Dense subgraph detection module: For each set of candidate solutions, the multiple subnetworks are aggregated and then solved using a dense subgraph solver to obtain multiple feasible solutions. The dense subgraph association density is optimized using the neighborhood expansion method. The solution with the largest association density is selected from the multiple feasible solutions, and the final detection result of the suspected money laundering gang is output.

[0029] In an embodiment of the present invention, the initialization definition module executes the following steps:

[0030] Initialize and define multiple networks in a collective manner as follows: Where A is the set of all same-domain adjacency matrices; C is the set of all cross-domain interaction matrices; G is the structure matrix of the multi-domain network, and V represents the set of all nodes in the network;

[0031] Introducing hyperparameters to define the priority of nodes and network connection density in multi-part networks;

[0032] Based on the average weighted sum of nodes, a non-emptiness constraint is introduced, and the dense subgraph detection problem of multi-partite networks is defined as finding a set of nodes that meet the conditions. The finding condition is to select the solution with the largest association density as the optimal solution node output.

[0033] In an embodiment of the present invention, the candidate solution screening module executes the following steps:

[0034] Based on non-negative coupling matrix decomposition, all cross-domain interaction information of multiple networks is modeled as coupling terms of the same-part adjacency relationship, sharing decomposition factors; and based on the weight multiplication update method, an iterative update module of the factor matrix is generated;

[0035] Iteratively run the iterative update module, design a truncation strategy based on the value of the factor matrix, and select a set of candidate nodes.

[0036] In an embodiment of the present invention, the dense subgraph detection module performs the following steps:

[0037] The dense sub-network composed of the candidate node set is aggregated into a network according to the preset hyperparameters, and then solved using the dense sub-graph solver to generate a solution set;

[0038] Adopting the neighborhood expansion algorithm, the node with the largest priority is selected from the neighborhood of the solution set of the current subgraph. If adding the node to the current subgraph can increase the density of the subgraph, the subgraph is expanded, the priority of the neighboring nodes is updated, and the neighborhood expansion algorithm is repeated to generate an updated subgraph.

[0039] From the obtained k groups of feasible solutions, the updated subgraph is selected and the solution with the largest correlation density is output as the optimal detection result;

[0040] For the final detection results of suspected money laundering gangs, the minimum density strategy, geometric mean density strategy and arithmetic mean density strategy are used respectively to evaluate the normalized density of multiple networks of the detection results, as well as the correlation and density of multiple networks.

[0041] In a third aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of a dense subgraph detection method for a multi-part cascade network when the program is executed by a processor.

[0042] In a fourth aspect, an embodiment of the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the dense subgraph detection method for a multi-part cascade network are implemented.

[0043] Compared with the related existing technologies, it has the following outstanding beneficial effects:

[0044] (1) This paper proposes the concept of correlation density in multi-part networks: This paper defines the correlation density of multi-part networks and formally defines the problem of detecting dense subgraphs in multi-part networks for the first time. It also proves that the correlation density is compatible with several existing methods. By adjusting hyperparameters, the correlation density can control the intra-partition density or cross-partition density pattern.

[0045] (2) The present invention is effective and resistant to interference: the detection performance of the present invention is better than the most advanced algorithms in various multi-network settings, and in the presence of fraudulent interference or partial loss of network structure, the present invention can still effectively detect the associated dense subgraph.

[0046] (3) The present invention has good scalability: the algorithm complexity of the present invention is approximately linearly related to the number of edges in the network (number of same-part edges + number of cross-part edges), and has good scalability; and under the same data scale, the present invention is at least 35 times faster than the most advanced method Destine. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0048] Figure 1 Schematic diagram of a dense subgraph detection method for multi-part cascaded networks according to the present invention;

[0049] Figure 2 Schematic diagram of a dense subgraph detection system for multi-part cascade networks according to the present invention;

[0050] Figure 3 Schematic diagram of computer hardware of the present invention. DETAILED DESCRIPTION

[0051] In this disclosure, "at least one" means one or more, and "plurality" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, "at least one of a, b, or c" can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or plural.

[0052] It should also be understood that the term "and / or" in this document simply describes an association between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A alone, A and B together, or B alone. A and B can be singular or plural. Furthermore, the character " / " in this document generally indicates an "or" relationship between the related objects, but it may also indicate an "and / or" relationship. For specific understanding, please refer to the context.

[0053] It should also be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0054] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interface, indirect coupling or communication connection of the device or unit, which can be electrical, mechanical or other forms.

[0055] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0056] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0057] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0058] To illustrate the above-mentioned features and effects of the present invention more clearly and easily, the following embodiments are specifically described below with reference to the accompanying drawings. This specification discloses one or more embodiments incorporating the features of the present invention. The disclosed embodiments are for illustrative purposes only. The scope of protection of the present invention is not limited to the disclosed embodiments; the present invention is defined by the appended claims.

[0059] The following is a system embodiment corresponding to the above method embodiment. This embodiment can be implemented in conjunction with the above embodiment. The relevant technical details mentioned in the above embodiment are still valid in this embodiment and will not be repeated here to reduce repetition. Accordingly, the relevant technical details mentioned in this embodiment can also be applied to the above embodiment.

[0060] The present invention aims to propose a method for detecting the associated dense subgraphs of a multi-part network, which specifically includes: in a multi-part network, we first define the priority of a node as the weighted sum of its intra-part degree and cross-part degree. On the basis of the average weighted sum of the nodes, we introduce the non-emptiness constraint of each part and define the association density of the network. The problem of detecting the associated dense subgraphs of a multi-part network is to find a set of nodes in each part to maximize the association density of the subnetwork. This method uses non-negative coupling matrix decomposition to model the cross-part interaction relationship in the network as a coupling term of the intra-part adjacency relationship and share the decomposition factor. Then, according to the threshold truncation in the decomposition factor, the nodes with larger scores are screened out to construct multiple groups of high-quality candidate solutions. Subsequently, the association density of the candidate solutions is optimized by greedy optimization and neighborhood expansion methods, and the solution with the largest density is selected from multiple groups of feasible solutions as the optimal solution output.

[0061] These include:

[0062] Step 1: In a multi-partition network, the priority of a node is defined as the weighted sum of its same-domain degree and cross-domain degree. Then, the network's association density is defined, and the partition constraint is introduced to formally propose the problem of detecting densely associated subgraphs.

[0063] Step 2: Model the cross-domain interaction information of multiple networks as subsidiary information of the same-domain neighbors. Through the coupling matrix decomposition of shared association constraints, a low-dimensional factor matrix of each node is obtained. After truncating according to the preset threshold, multiple groups of candidate solutions are preliminarily screened.

[0064] Step 3: The multiple subnetworks formed by each candidate solution are aggregated and solved using a dense subgraph solver. The neighborhood expansion method is then used to further optimize their association density. Finally, the solution with the highest association density is selected from the multiple feasible solutions and output as the test result.

[0065] The multi-part network referred to in the present invention represents a network in which nodes can be divided into multiple domains, and does not require that there cannot be same-domain links in the network.

[0066] The following describes the method of the embodiment of the present application in detail with reference to specific embodiments:

[0067] Example 1

[0068] like Figure 1 As shown, the embodiment of the present application proposes a dense subgraph detection method for multi-part cascade networks, characterized in that it is applied to detect suspicious money laundering gangs in financial transaction networks, and the method includes:

[0069] Initialization definition step 101: in a multi-part network based on financial transactions, the multi-part network and the priorities and network association density of the nodes in the multi-part network are initially defined, and non-emptiness constraints are introduced to initially define conditions that a group of abnormal nodes to be detected and output in the association dense subgraph detection must meet;

[0070] Candidate solution screening step 102: Modeling the cross-partition interaction information of the multi-partition network as the subsidiary information of the same-partition adjacency, and obtaining a low-dimensional factor matrix of each part node of the multi-partition network through coupling matrix decomposition with shared association constraints. After truncating according to a preset threshold, multiple groups of candidate solutions are initially screened;

[0071] Dense subgraph detection step 103: For each set of candidate solutions, the multiple subnetworks are aggregated and then solved using a dense subgraph solver to obtain multiple feasible solutions. The dense subgraph association density is optimized using a neighborhood expansion method. The solution with the largest association density is selected from the multiple feasible solutions, and the final result of detecting a suspected money laundering gang is output.

[0072] In an embodiment of the present invention, the initialization definition step 101 includes:

[0073] Initialize and define multiple networks in a collective manner as follows: Where A is the set of all same-domain adjacency matrices; C is the set of all cross-domain interaction matrices; G is the structure matrix of the multi-domain network, and V represents the set of all nodes in the network;

[0074] Introducing hyperparameters to define the priority of nodes and network connection density in multi-part networks;

[0075] Based on the average weighted sum of nodes, a non-emptiness constraint is introduced, and the dense subgraph detection problem of multi-partite networks is defined as finding a set of nodes that meet the conditions. The finding condition is to select the solution with the largest association density as the optimal solution node output.

[0076] More specifically, in the embodiment of the present invention, multiple networks Where A is the set of all homology adjacency matrices, A i represents the adjacency matrix of the i-th network, A i (u,v)=1 indicates that there is an edge between node u and node v in the i-th part, with a weight of 1; C is the set of all cross-domain interaction matrices, C i,j represents the cross-domain interaction matrix between the i-th and j-th nodes, C i,j (x,y)=1 indicates that there is an edge between node x in the i-th part and node y in the j-th part, with a weight of 1. G is the structural matrix of the multi-part network, indicating whether there is interaction between the nodes in each part. G(i,j0=1) indicates that there is a cross-domain interaction relationship between the nodes in the i-th part and the nodes in the j-th part. V represents the set of all nodes in the network.

[0077] The detection method of multiple network association dense subgraphs, wherein the priority of the nodes and the network association density in step 1 are defined as follows: In order to be compatible with the same-domain adjacency relationship and the cross-domain interaction relationship, the hyperparameter γ is introduced i,j , define the priority of node u in the i-th part as

[0078] prior(u)=Σ v A i (u,v)+∑ j>i ∑ k γ i,j ·C i,j (u,k) (Formula 1)

[0079] The meaning of this formula is the edge weight and Σ of node u in the i-th network. v A i (u,v), together with node u in all cross-layer networks C i,j The edge weights and ∑ k C i,j (u,k), hyperparameter γ i,jRepresents the importance of the cross-layer edge weights compared to the same-layer edge weights. The average priority density of the network is the sum of the priorities of each department node divided by the total number of nodes, where the same-department edges contribute to the density of the same department, and cross-department edges contribute to the cross-departmental connectivity. However, multi-department networks are easily dominated by dense substructures in a department, so the non-emptiness constraint is introduced. If the node of a department in the detected subgraph is an empty set Then the density is penalized to 0. The association density of a multi-part network is defined as follows:

[0080]

[0081] Subsequently, the dense subgraph detection problem of multiple networks is defined. In the example, given the hyperparameter γs, we find a set of nodes S * , so that ρ corr (S * ; γs) is maximized. This problem can be formalized as Formula 3:

[0082]

[0083] In the embodiment of the present invention, the candidate solution screening step 102 includes:

[0084] Based on non-negative coupling matrix decomposition, all cross-domain interaction information of multiple networks is modeled as coupling terms of the same-part adjacency relationship, sharing decomposition factors; and based on the weight multiplication update method, an iterative update module of the factor matrix is generated;

[0085] Iteratively run the iterative update module, design a truncation strategy based on the value of the factor matrix, and select a set of candidate nodes.

[0086] In this embodiment of the present invention, all cross-department interaction information is modeled as coupling terms of intra-department adjacency relationships based on non-negative coupling matrix decomposition, sharing decomposition factors. Based on the weight multiplication update method, the iterative update equation of the factor matrix is derived:

[0087]

[0088] Among them, β i,j Represents the cross-layer interaction matrix C i,j Contribution intensity in the coupled decomposition process, U i represents the low-rank factor matrix of the i-th node, Σ i,j Is a diagonal matrix responsible for absorbing the norm to achieve the normalization of the factor matrix, J i is a matrix of all ones with U i Same shape. Represents matrix element-by-element multiplication, and the power outside the brackets represents the square operation of all elements in the matrix. Formula 4 is run iteratively until convergence. After verification, the scores of the factor matrix show a highly skewed distribution and a steep decreasing trend. Therefore, according to U i The numerical value of , design the truncation strategy: As shown in Formula 5, the i-th node set of the k-th group of candidate solutions For the matrix U i All values in the kth column are greater than A collection of row indices. i Represents the number of nodes in the i-th network. This truncation screening strategy can select key nodes in the structure, significantly reducing the size of the candidate solution while ensuring the integrity of the target solution.

[0089]

[0090] The kth candidate solution of the multi-part network is Generally, Only 5% to 15% of the size of the node set V.

[0091] In the embodiment of the present invention, the dense subgraph detection step 103 includes:

[0092] The dense sub-network composed of the candidate node set is aggregated into a network according to the preset hyperparameters, and then solved using the dense sub-graph solver to generate a solution set;

[0093] Adopting the neighborhood expansion algorithm, the node with the largest priority is selected from the neighborhood of the solution set of the current subgraph. If adding the node to the current subgraph can increase the density of the subgraph, the subgraph is expanded, the priority of the neighboring nodes is updated, and the neighborhood expansion algorithm is repeated to generate an updated subgraph.

[0094] From the obtained k groups of feasible solutions, the updated subgraph is selected and the solution with the largest correlation density is output as the optimal detection result;

[0095] For the final detection results of suspected money laundering gangs, the minimum density strategy, geometric mean density strategy and arithmetic mean density strategy are used respectively to evaluate the normalized density of multiple networks of the detection results, as well as the correlation and density of multiple networks.

[0096] More specifically, in the embodiment of the present invention, the post-aggregation solution includes: The sub-network is composed according to the preset γ i,j , aggregated into a network, and then call the dense subgraph solver to solve. Dense subgraph solvers can be selected from Maxflow, Greedy, OQC, SpecGreedy and other solvers. The default solver is Greedy. For the kth group of candidate solutions Applying the dense subgraph solver yields

[0097] Neighborhood expansion includes the following steps: considering the approximate solution obtained by coupling matrix decomposition and dense subgraph solution process, using the solution set returned by it Specifically, a neighborhood expansion algorithm is designed to improve the detection effect. In the neighborhood of , select the node v with the largest priority. If it is added to the current subgraph, the subgraph can be made As the density of increases, the subgraph expands. Update the priority of the neighboring nodes and repeat this process; otherwise, the algorithm stops. The subgraph output by this process is denoted as

[0098] Output the optimal approximate solution: k groups of feasible solutions obtained from the above process In the output, the solution with the largest correlation density is selected as the optimal solution, that is, This method ends.

[0099] Detection subgraph quality evaluation: In order to fairly compare the cross-part association density and the same-part adjacency density of the detected subgraph, this method designs three different density strategies, namely, minimum density d min , geometric mean density d geo and the arithmetic mean density d ari For the i-th network, Represents the normalized density of the network. For the cross-domain interaction matrix between the i-th and j-th parts, Represents the normalized density of the cross-domain network. The minimum density is the multi-domain network The minimum value of the normalized density of all the same-department networks and cross-department networks in; the arithmetic average density is the multi-department network The arithmetic mean of the normalized densities of all networks in ; the geometric mean density, that is, the density of multiple networks The geometric mean of the normalized density of all networks in . The arithmetic mean density is easily affected by the maximum or minimum values. The larger the minimum density and geometric mean density, the greater the normalized density of all networks. The minimum density and geometric mean density can better reflect the correlation and density of multiple networks.

[0100]

[0101] As described above, the method of the present invention can be better implemented.

[0102] Example 2

[0103] like Figure 2As shown, an embodiment of the present application provides a dense subgraph detection system for multi-part cascade networks, which adopts the above-mentioned dense subgraph detection method for multi-part cascade networks and is applied to the detection of suspicious money laundering gangs in financial transaction networks. The system includes:

[0104] Initialization definition module 201: In a multi-part network based on financial transactions, the multi-part network and the priority and network association density of the nodes in the multi-part network are initially defined, and non-emptiness constraints are introduced to initially define the conditions that a group of abnormal nodes to be detected and output in the association dense subgraph detection must meet;

[0105] Candidate solution screening module 202: Models the cross-part interaction information of the multi-part network as the subsidiary information of the same-part adjacency, obtains the low-dimensional factor matrix of each part node of the multi-part network through the coupling matrix decomposition with shared association constraints, and preliminarily screens multiple groups of candidate solutions after truncating according to a preset threshold;

[0106] Dense subgraph detection module 203: For each set of candidate solutions, multiple sub-networks are aggregated and then solved using a dense subgraph solver to obtain multiple feasible solutions. The dense subgraph association density is optimized using a neighborhood expansion method. The solution with the largest association density is selected from the multiple feasible solutions and the final result of detecting a suspected money laundering gang is output.

[0107] In the embodiment of the present invention, the initialization definition module 201 executes the following steps:

[0108] Initialize and define multiple networks in a collective manner as follows: Where A is the set of all same-domain adjacency matrices; C is the set of all cross-domain interaction matrices; G is the structure matrix of the multi-domain network, and V represents the set of all nodes in the network;

[0109] Introducing hyperparameters to define the priority of nodes and network connection density in multi-part networks;

[0110] Based on the average weighted sum of nodes, a non-emptiness constraint is introduced to define a set of nodes that meet the search conditions in the dense subgraph detection of multi-part networks. The search condition is to select the solution with the largest association density as the optimal solution node output.

[0111] In the embodiment of the present invention, the candidate solution screening module 202 executes the following steps:

[0112] Based on non-negative coupling matrix decomposition, all cross-domain interaction information of multiple networks is modeled as coupling terms of the same-part adjacency relationship, sharing decomposition factors; and based on the weight multiplication update method, an iterative update module of the factor matrix is generated;

[0113] Iteratively run the iterative update module, design a truncation strategy based on the value of the factor matrix, and select a set of candidate nodes.

[0114] In the embodiment of the present invention, the dense subgraph detection module 203 performs the following steps:

[0115] The dense sub-network composed of the candidate node set is aggregated into a network according to the preset hyperparameters, and then solved using the dense sub-graph solver to generate a solution set;

[0116] Adopting the neighborhood expansion algorithm, the node with the largest priority is selected from the neighborhood of the solution set of the current subgraph. If adding the node to the current subgraph can increase the density of the subgraph, the subgraph is expanded, the priority of the neighboring nodes is updated, and the neighborhood expansion algorithm is repeated to generate an updated subgraph.

[0117] From the obtained k groups of feasible solutions, the updated subgraph is selected and the solution with the largest correlation density is output as the optimal detection result;

[0118] For the final detection results of suspected money laundering gangs, the minimum density strategy, geometric mean density strategy and arithmetic mean density strategy are used respectively to evaluate the normalized density of multiple networks of the detection results, as well as the correlation and density of multiple networks.

[0119] Example 3

[0120] An embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the steps of the dense subgraph detection method for a multi-part cascade network are implemented.

[0121] Example 4

[0122] An embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps of the dense subgraph detection method for a multi-part cascade network are implemented.

[0123] In addition, combined Figure 1 The dense subgraph detection method for a multi-part cascade network described in the embodiment of the present application can be implemented by an electronic device, such as a computer device. Figure 3 Schematic diagram of the hardware structure of a computer device according to an embodiment of the present application.

[0124] In some embodiments, the computer device may further include a communication interface 83 and a bus 80. Figure 3 As shown, the processor 81, the memory 82, and the communication interface 83 are connected via a bus 80 and communicate with each other.

[0125] Specifically, the processor 81 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0126] The memory 82 may be used to store or cache various data files required for processing and / or communication, as well as possible computer program instructions executed by the processor 81 .

[0127] The processor 81 reads and executes computer program instructions stored in the memory 82 to implement any one of the dense subgraph detection methods for multi-part cascade networks in the above embodiments.

[0128] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0129] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A dense subgraph detection method for multi-part cascade networks, characterized in that: Applied to detecting suspicious money laundering gangs in financial transaction networks, the method includes: Initialization definition step: in a multi-part network based on financial transactions, the multi-part network and the priorities and network association density of the multi-part network and the nodes in the multi-part network are initially defined, and non-emptiness constraints are introduced to initially define conditions satisfied by a group of abnormal nodes to be detected and output in the association dense subgraph detection; Candidate solution screening step: modeling the cross-partition interaction information of the multi-partition network as the subsidiary information of the same-partition adjacency relationship, obtaining the low-rank factor matrix of each part node of the multi-partition network through coupling matrix decomposition with shared association constraints, and preliminarily screening multiple groups of candidate solutions after truncation according to a preset threshold; Dense subgraph detection step: For each group of candidate solutions consisting of multiple sub-networks, after aggregation, use a dense subgraph solver to solve multiple groups of feasible solutions; and optimize the association density of the dense subgraph through the neighborhood expansion method; select the solution with the largest association density from the multiple groups of feasible solutions, and output the final detection result of the suspected money laundering gang.

2. The dense subgraph detection method for multi-part cascaded networks according to claim 1, characterized in that: The initialization definition step includes: Initialize and define the multiple networks in a collective manner as follows: Where A is the set of all same-part adjacency matrices; C is the set of all cross-domain interaction matrices; G is the structure indicator matrix of the multi-part network, and V represents the set of all nodes in the network; Introducing hyperparameters to define the priorities of nodes in the multi-part network and the network association density; Based on the average weighted sum of nodes, a non-emptiness constraint is introduced, and the dense subgraph detection problem of multi-partite networks is defined as finding a set of nodes that meet the conditions, where the search condition is to select the solution with the largest association density as the optimal solution node output.

3. The dense subgraph detection method for multi-part cascaded networks according to claim 1, characterized in that: The candidate solution screening step includes: Based on non-negative coupling matrix decomposition, all cross-domain interaction information of the multiple networks is modeled as coupling terms of the same-part adjacency relationship, sharing decomposition factors; and based on the weight multiplication update method, an iterative update module of the factor matrix is generated; The iterative update module is iteratively run, and a truncation strategy is designed according to the value of the factor matrix to select a set of candidate nodes.

4. The dense subgraph detection method for multi-part cascaded networks according to claim 1, characterized in that: The dense subgraph detection step includes: The dense sub-network formed by the candidate node set is aggregated into a network according to the preset hyperparameters, and then solved by a dense sub-graph solver to generate a solution set; A neighborhood expansion algorithm is used to select a node with the highest priority from the neighborhood of the solution set of the current subgraph. If adding the node to the current subgraph can increase the density of the subgraph, the subgraph is expanded, the priorities of the neighboring nodes are updated, and the neighborhood expansion algorithm is repeatedly executed to generate an updated subgraph. From the obtained k groups of feasible solutions in the updated subgraph, the solution with the largest correlation density is selected as the optimal detection result output; For the final detection results of the suspected money laundering gang, the minimum density strategy, geometric mean density strategy and arithmetic mean density strategy are respectively adopted to evaluate the normalized density of the multiple networks of the detection results, as well as the correlation and density of the multiple networks.

5. A dense subgraph detection system for multi-part cascaded networks, using the dense subgraph detection method for multi-part cascaded networks as described in claims 1-4, characterized in that: Applied to the detection of suspicious money laundering gangs in financial transaction networks, the system includes: Initialization definition module: In a multi-part network based on financial transactions, the module initializes and defines the priorities and network association density of the multi-part network and the nodes in the multi-part network, introduces non-emptiness constraints, and initializes and defines the conditions satisfied by a group of abnormal nodes to be detected and output in the detection of densely associated subgraphs; Candidate solution screening module: Models the cross-part interaction information of the multi-part network as the subsidiary information of the same-part adjacency, obtains the low-dimensional factor matrix of each part node of the multi-part network through coupling matrix decomposition with shared association constraints, and preliminarily screens multiple groups of candidate solutions after truncating according to a preset threshold; Dense subgraph detection module: For each group of candidate solutions, the multiple sub-networks are aggregated and then solved using a dense subgraph solver to obtain multiple groups of feasible solutions. The association density of the dense subgraph is optimized using the neighborhood expansion method. The solution with the largest association density is selected from the multiple groups of feasible solutions, and the final detection result of the suspected money laundering gang is output.

6. The dense subgraph detection system for multi-part cascaded networks according to claim 5, characterized in that: The initialization definition module executes the steps including: Initialize and define the multiple networks in a collective manner as follows: Where A is the set of all same-domain adjacency matrices; C is the set of all cross-domain interaction matrices; G is the structure matrix of the multi-domain network, and V represents the set of all nodes in the network; Introducing hyperparameters to define the priorities of nodes in the multi-part network and the network association density; Based on the average weighted sum of nodes, a non-emptiness constraint is introduced, and the dense subgraph detection problem of multi-partite networks is defined as finding a set of nodes that meet the conditions, where the search condition is to select the solution with the largest association density as the optimal solution node output.

7. The dense subgraph detection system for multi-part cascaded networks according to claim 5, characterized in that: The candidate solution screening module executes the following steps: Based on non-negative coupling matrix decomposition, all cross-domain interaction information of the multiple networks is modeled as coupling terms of the same-part adjacency relationship, sharing decomposition factors; and based on the weight multiplication update method, an iterative update module of the factor matrix is generated; The iterative update module is iteratively run, and a truncation strategy is designed according to the value of the factor matrix to select a set of candidate nodes.

8. The dense subgraph detection system for multi-part cascaded networks according to claim 5, characterized in that: The dense subgraph detection module executes the following steps: The dense sub-network formed by the candidate node set is aggregated into a network according to the preset hyperparameters, and then solved by a dense sub-graph solver to generate a solution set; A neighborhood expansion algorithm is used to select a node with the highest priority from the neighborhood of the solution set of the current subgraph. If adding the node to the current subgraph can increase the density of the subgraph, the subgraph is expanded, the priorities of the neighboring nodes are updated, and the neighborhood expansion algorithm is repeatedly executed to generate an updated subgraph. From the obtained k groups of feasible solutions in the updated subgraph, the solution with the largest correlation density is selected as the optimal detection result output; For the final detection results of the suspected money laundering gang, the minimum density strategy, geometric mean density strategy and arithmetic mean density strategy are respectively adopted to evaluate the normalized density of the multiple networks of the detection results, as well as the correlation and density of the multiple networks.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the dense subgraph detection method for a multi-part cascade network according to any one of claims 1 to 4 are implemented.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the processor implements the steps of the dense subgraph detection method for a multi-part cascade network according to any one of claims 1 to 4.

Images