Abnormal object recognition method and device, electronic equipment, medium and program product

Abstract

The invention discloses an abnormal object recognition method and device, electronic equipment, a medium and a program product, and relates to the technical field of computers.The method comprises the steps that a graph model is constructed based on a graph structure corresponding to at least one time dimension, the graph structure comprises a plurality of nodes and a plurality of edges, the plurality of nodes comprise a user node, a device node, a website node and an application APP node; determining a plurality of first target nodes from the graph structure corresponding to the at least one target time dimension, wherein the first target nodes are device nodes in the graph structure corresponding to the target time dimension in the at least one time dimension; inputting the multiple pieces of first feature information into a preset decision tree model to determine at least one second target node; constructing a target graph structure based on the plurality of first target nodes, the at least one second target node and the user node associated with each first target node; and identifying abnormal user nodes in the target graph structure. According to the invention, the accuracy of abnormal object recognition can be effectively improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to an abnormal object identification method, apparatus, electronic device, medium, and program product. Background Technology

[0002] With the development and popularization of the internet, fintech has provided convenient, efficient, and low-cost financial services, greatly facilitating people's travel, shopping, and work. However, related financial irregularities have also increased in recent years, causing huge financial losses to individuals and financial institutions. In response to current financial irregularities, on the one hand, machine learning-based online lending fraud identification technology has been widely used. However, this approach is limited by training data, has weak generalization ability, and struggles to uncover deep connections between users. On the other hand, abnormal transaction group identification methods rely on transaction information to build account associations. This method has a single data dimension and does not integrate multi-dimensional data such as device usage, call social circles, and internet behavior, making it unable to identify clustered connections formed by black market entities through covert means such as identity forgery and fabricated provident fund information. It is evident that none of these technologies can effectively address the challenge of abnormal entities using multi-dimensional disguises to evade risk control, resulting in low identification accuracy. Summary of the Invention

[0003] This application provides an abnormal object identification method, device, electronic device, medium, and program product that can adapt to complex and ever-changing payment scenarios and improve the accuracy of abnormal object identification.

[0004] In a first aspect, embodiments of this application provide a method for identifying abnormal objects, including: A graph model is constructed based on a graph structure corresponding to at least one time dimension. The graph structure includes multiple nodes and multiple edges. The multiple nodes include user nodes, device nodes, website nodes, and application (APP) nodes. The edges are used to represent the association relationship between any two nodes among the multiple nodes. Multiple first target nodes are determined from the graph structure corresponding to at least one target time dimension, wherein the at least one time dimension includes the target time dimension, and the first target node is the device node in the graph structure corresponding to the target time dimension; Multiple first feature information is input into a preset decision tree model to determine at least one second target node; wherein, the multiple first feature information are feature information corresponding to multiple third target nodes in the at least one target time dimension, the third target node is the website node or the APP node in the graph structure corresponding to the target time dimension, the second target node is one of the multiple third target nodes, and the second target node has the association relationship with at least one of the multiple first target nodes; A target graph structure is constructed based on the plurality of first target nodes, the at least one second target node, and the user node associated with each of the first target nodes; Identify abnormal user nodes in the target graph structure.

[0005] Optionally, constructing the graph model based on the graph structure corresponding to at least one time dimension includes: Extract the multiple nodes and multiple feature information from the user behavior information, and determine at least one feature information corresponding to each node in each time dimension; Based on the feature information corresponding to each node in each time dimension, determine the first sequence information corresponding to each node in each time dimension, and the weight of the edge between any two nodes in each time dimension. Based on the first sequence information corresponding to each node in each time dimension, determine the node feature matrix corresponding to the plurality of nodes in each time dimension; The graph model is constructed based on the weight of the edge between any two nodes in each time dimension and the node feature matrix corresponding to each time dimension.

[0006] Optionally, determining multiple first target nodes from the graph structure corresponding to at least one target time dimension includes: Obtain the graph structure corresponding to the at least one target time dimension from the graph model; Based on the PageRank algorithm, determine the first parameter corresponding to each first device node in the graph structure corresponding to the at least one target time dimension; Based on the first parameter corresponding to each first device node in the at least one target time dimension, determine the second parameter corresponding to each first device node; Based on the second parameter corresponding to each first device node, sort each first device node to determine the node arrangement sequence; Determine at least one first target node that is arranged before a preset position from the node arrangement sequence.

[0007] Optionally, the step of inputting multiple first feature information into a preset decision tree model to determine the at least one second target node includes: The multiple first feature information is input into the preset decision tree model to obtain the distinction threshold; The plurality of first feature information is divided based on the discrimination threshold to obtain at least one second feature information among the plurality of first feature information; Based on the at least one second feature information, the corresponding at least one second target node is determined.

[0008] Optionally, before inputting the plurality of first feature information into the preset decision tree model to obtain the discrimination threshold, the method further includes: Obtain user historical behavior data, which includes multiple feature information in at least two time dimensions; Based on the preset Gini index, the user's historical behavior data is divided into a first dataset and a second dataset. The first dataset includes the abnormal user nodes and their corresponding feature information, and the second dataset includes the non-abnormal user nodes and their corresponding feature information. The first dataset and the second dataset are input into the initial decision tree model, and the initial decision tree model is pre-pruned according to a preset depth to obtain the preset decision tree model.

[0009] Optionally, constructing the target graph structure based on the plurality of first target nodes, the at least one second target node, and the user node associated with each first target node includes: A first graph structure is constructed based on the plurality of first target nodes, the at least one second target node, and the user nodes that have the association relationship with each of the first target nodes; At least one first user node is removed from the first target graph structure to obtain a second graph structure; wherein, the first user node is a user node whose edge weight to the first target node is less than a preset threshold and greater than zero; The second graph structure is searched based on the Tarjan algorithm to determine the target graph structure, which includes at least three second user nodes and at least three edges, and the at least three second user nodes are connected by the at least three edges to form a closed loop.

[0010] Optionally, the plurality of nodes further includes a residing node, and the identification of abnormal user nodes in the target graph structure includes: Based on the feature information corresponding to the user nodes in the target graph structure, at least one target residence node is determined; The target graph structure is updated based on the at least one target dwelling node; Remove at least one third user node from the updated target graph structure. The third user node is the user node that has resided in the target residency node for a duration shorter than a preset duration. Identify and remove the abnormal user nodes in the target graph structure from the at least one third user node.

[0011] Secondly, embodiments of this application also provide an abnormal object identification device, including: The first construction module is used to construct a graph model based on a graph structure corresponding to at least one time dimension. The graph structure includes multiple nodes and multiple edges. The multiple nodes include user nodes, device nodes, website nodes, and application (APP) nodes. The edges are used to represent the association relationship between any two nodes among the multiple nodes. A first determining module is configured to determine a plurality of first target nodes from the graph structure corresponding to at least one target time dimension, wherein the at least one time dimension includes the target time dimension, and the first target node is the device node in the graph structure corresponding to the target time dimension; The second determining module is used to input multiple first feature information into a preset decision tree model to determine the at least one second target node; wherein, the multiple first feature information are feature information corresponding to multiple third target nodes in the at least one target time dimension, the third target node is the website node or the APP node in the graph structure corresponding to the target time dimension, the second target node is one of the multiple third target nodes, and the second target node has the association relationship with at least one of the multiple first target nodes; The second construction module is used to construct a target graph structure based on the plurality of first target nodes, the at least one second target node, and the user node associated with each first target node; The first identification module is used to identify abnormal user nodes in the target graph structure.

[0012] Thirdly, embodiments of this application provide an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of the abnormal object identification method as described in any one of the first aspects.

[0013] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the abnormal object identification method as described in any one of the first aspects.

[0014] Fifthly, embodiments of this application also provide a computer program product, which is stored in a storage medium and executed by at least one processor to implement the steps of the abnormal object identification method as described in any one of the first aspects.

[0015] This application's embodiments achieve efficient and accurate anomaly user identification through multi-dimensional modeling and precise screening. First, a graph model containing various types of nodes, including users and devices, and associated edges, is constructed based on multiple time dimensions. This comprehensively captures the dynamic relationships between different nodes, laying a complete data foundation for subsequent analysis. Next, the first target node in the target time dimension, i.e., the device node, is determined, and its associated second target nodes, i.e., website nodes or APP nodes, are screened. This allows focusing on key interaction nodes and reducing interference from irrelevant data. Then, a target graph structure is constructed by combining associated user nodes, further narrowing the analysis scope and making the identification more targeted. Finally, anomaly user nodes in the target graph structure are identified. Based on the real relationships between nodes, anomalies can be accurately located, avoiding the one-sidedness of single-dimensional identification and significantly improving the efficiency and accuracy of anomaly user identification. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart of an abnormal object identification method in an embodiment of this application; Figure 2 This is an overall architecture diagram of an abnormal object recognition system according to an embodiment of this application; Figure 3 This is a schematic diagram illustrating the acquisition of multiple nodes in an embodiment of this application; Figure 4 yes Figure 1 A schematic diagram showing the determination of multiple first target nodes; Figure 5 yes Figure 1 A schematic diagram for determining at least one second target node; Figure 6 yes Figure 1 A schematic diagram of constructing the target graph structure in the middle; Figure 7 This is a schematic diagram of the structure of an abnormal object identification device according to an embodiment of this application; Figure 8 This is a schematic diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0018] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0019] Existing technologies have significant shortcomings in fraud detection for online lending platforms without physical cards, struggling to address the covert and diverse methods used by malicious actors. This application proposes an abnormal object identification method specifically to address this issue. Existing technologies primarily revolve around two approaches: "machine learning algorithms" and "transaction data correlation," but both have key flaws and cannot meet the practical needs of identifying malicious online lending activities. Firstly, anomaly detection based on machine learning algorithms primarily involves training machine learning models to classify user behavior and thus identify anomalous objects. However, this approach suffers from several drawbacks. First, its generalization ability is weak, and model performance is highly dependent on the diversity and representativeness of the training dataset. In specific scenarios such as online loan applications or with new user groups, it is prone to failure due to data mismatch. Second, this approach also faces challenges related to samples and training. There is a lack of black market samples (data on black market behavior) in anomaly detection, and the behavior of black market entities is highly variable and complex, easily leading to model overfitting. Furthermore, it has poor noise resistance and a high false positive rate. Finally, interpretability and relationship mining are insufficient. The algorithm can only output the identification result and cannot explain why it was judged as an anomaly. It also struggles to uncover deep correlations between users, devices, and behaviors, making it impossible to trace the hidden links of black market entities.

[0020] Secondly, the identification of abnormal trading groups based on transaction data mainly relies on user transaction information. By analyzing the transaction relationships between accounts, abnormal trading groups can be discovered. However, this technical solution has a single data dimension, using only transaction data, and cannot cover the related behaviors of black market entities outside of transactions, such as multiple users sharing a single device to apply for online loans or frequently accessing illegal online lending platforms. In addition, this technical solution also lacks key data support, failing to integrate device data and daily behavior data, and cannot identify the clustering characteristics of black market entities from multiple dimensions, resulting in a narrow identification scope and a high false negative rate.

[0021] Therefore, considering the actual characteristics of online lending illicit activities, the shortcomings of existing technology directly lead to the inability to overcome the following problems: First, there is insufficient countermeasure against the concealment of these activities. These activities often involve stealing others' identity information, forging data, and applying for loans in multiple tranches to conceal their actions. Existing technology, limited by data dimensions or model capabilities, cannot identify these disguises. Second, the processing efficiency of massive amounts of data is low. Telecom operators possess massive amounts of user call, internet access, and device data, but existing technology lacks adapted and efficient algorithms, making it difficult to quickly locate abnormal correlations within this massive dataset, resulting in high computational costs and slow response times.

[0022] To address the above technical problems, this application provides an abnormal object identification method, apparatus, electronic device, medium, and program product. The embodiments of this application will be described in detail below with reference to the accompanying drawings and specific embodiments and application scenarios.

[0023] Please see Figure 1 and Figure 2 , Figure 1 This is a flowchart of an abnormal object identification method provided in an embodiment of this application. The method includes the following steps: Step 101: Construct a graph model based on a graph structure corresponding to at least one time dimension. The graph structure includes multiple nodes and multiple edges. The multiple nodes include user nodes, device nodes, website nodes, and application (APP) nodes. The edges are used to represent the association relationship between any two nodes among the multiple nodes.

[0024] It should be noted that the time dimension can correspond to a time interval or a time receptive field. It can be understood as different time intervals divided to mine the dynamic behaviors of black market targets, such as short-term concentrated operations and long-term dormant activation. For example, the time dimension or time receptive field can be divided into short-term (the past 7 days), medium-term (the past 30 days), and long-term (the past 3 months). In some embodiments of this application, time-series graph snapshots are used to track the trajectory of black market behavior, such as patterns like "multiple users using the same device to apply for online loans in a short period" or "sudden access to lending apps after a long period of inactivity." Therefore, the embodiments of this application can avoid the problem of incomplete behavioral characteristics under a single time dimension, allowing the graph model to cover the criminal habits of black market targets at different periods, thus improving generalization ability.

[0025] It is understood that the aforementioned nodes can be entities extracted from operator data that reflect user behavior relationships, and are the basic building blocks of the graph structure. In some embodiments, such as Figure 3 As shown, nodes can be divided into user nodes, website nodes, APP nodes, device nodes, and work location nodes (or residence location nodes). For specific node types, please refer to the examples in Table 1.

[0026] Table 1

[0027] The aforementioned edges can represent logical connections between multiple nodes, reflecting behavioral interactions between entities. For example, a call relationship edge connects "user nodes - user nodes," recording call duration and frequency, representing user social circle connections, and helping to identify high-frequency coordinated calls within black market entities. An access relationship edge connects "user nodes - website / app nodes," recording access frequency, duration, and traffic, representing user online behavior, and helping to identify frequent access to lending apps / websites by black market entities. A device usage relationship edge connects user nodes - device nodes, recording device usage time, representing the binding relationship between users and terminals, and helping to identify multiple users sharing the same device to apply for online loans by black market entities. A workplace stay relationship edge connects user nodes - workplace nodes, recording stay time on weekdays, representing user offline gathering relationships, and helping to identify multiple people applying for online loans near the same workplace by black market entities.

[0028] The graph structure described above can be a network composed of multiple "node-edge-node" pairs within a single time dimension. For example, within a certain time dimension (e.g., the last 30 days), it can be a static network composed of multiple nodes and edges. In this embodiment, the graph structure serves as a time slice of the graph model, with each time dimension corresponding to an independent graph structure, providing a foundation for subsequent dynamic behavior analysis.

[0029] As can be seen, the graph model in this embodiment can be a collection of multi-time-dimensional graph structures, which can be understood as a dynamic network formed by integrating the graph structures corresponding to all time dimensions (short-term, medium-term, and long-term), i.e., a discrete-time dynamic graph G={ },in Corresponding to the short-term chart structure, Corresponding to the mid-term, For the long term, by constructing a graph model, features from different receptive fields at different times (t) can be fused. For example, combining "abnormal device usage in the past 7 days" and "social circle associations in the past 3 months" can comprehensively determine suspected black market activities. Thus, this embodiment can accurately capture the dynamic behavior of black market targets, covering multiple time dimensions and completely tracking their behavioral trajectories. Ultimately, through the dynamic graph model, an upgrade from static behavior recognition to dynamic group discovery is achieved, providing full-cycle correlation data support for subsequent steps (such as screening risky devices and identifying abnormal users).

[0030] Step 102: Determine a plurality of first target nodes from the graph structure corresponding to at least one target time dimension, wherein the at least one time dimension includes the target time dimension, and the first target node is the device node in the graph structure corresponding to the target time dimension.

[0031] The aforementioned target time dimension can be a specific time range that best reflects the abnormal device behavior, selected from multiple time dimensions in the graph model (short-term 7 days, medium-term 30 days, long-term 3 months) based on the characteristics of cybercrime. This time range serves as the time filter condition for subsequent screening of device nodes. For example, to identify cybercrime involving short-term, sudden attacks, a short-term 7-day period would be selected as the target time dimension. To identify cybercrime involving the long-term reuse of devices, a medium-term 30-day period or a long-term 3-month period might be selected.

[0032] It's important to note that black market targets concealed identities and often apply for online loans by sharing a single device with multiple phone numbers. Therefore, the device node is a crucial link connecting multiple black market users. The aforementioned primary target node exhibits this characteristic, with multiple user nodes associated with it within the target timeframe. For example, if a device is used by 10 different phone numbers within 7 days, and all of them accessed lending apps, that device is the primary target node. Therefore, the primary target node can be a device node in the graph structure corresponding to the target timeframe that matches the characteristics of a black market device, such as a phone shared by multiple users or an emulator.

[0033] In specific embodiments, based on business needs and black market behavior patterns, one or more target time dimensions can be determined from the time dimension of the graph model. For example, to quickly identify recent black market raids, a short-term 7-day period can be selected as the target time dimension. To investigate long-term, latent black market activities, both a medium-term 30-day period and a long-term 3-month period can be selected as target time dimensions to cross-validate long-term device anomalies. Subsequently, from the constructed graph model, the spatial graph corresponding to the target time dimension (i.e., the network of connections between nodes and edges within that time range) can be extracted. For example, if a short-term 7-day period is selected as the target time dimension, the user-device-website / app association data within these 7 days can be extracted. Specifically, this may include: usage records of all device nodes within the 7 days (e.g., device ID, number of associated users), and edge weights between devices and users (e.g., the duration of user device usage). Finally, based on the device node characteristics in the target time dimension graph structure, filtering rules are set. A specific example of the filtering rules is as follows: (1) Filter the first target node based on the threshold of the number of associated users. For example, within the target time dimension, the number of associated user nodes is greater than or equal to the preset threshold (e.g., more than or equal to 5 different users are associated within 7 days). (2) Filter the first target node according to the edge weight sum threshold. For example, the edge weight sum of the device node and all associated user nodes is greater than or equal to the preset threshold (for example, the weighted sum of the duration of all users using the device within 7 days is greater than or equal to 100 hours), which reflects the high frequency of device use. (3) Filter the first target node based on the associated behavior. For example, if two or more users have visited “loan” or “housing fund” websites / apps in the same period among the user nodes associated with the device node, then normal shared devices (such as family shared devices) can be further excluded. In summary, the device node that can satisfy any one or more of the above filtering rules is the first target node.

[0034] In this way, by filtering the target time dimension, the embodiments of this application can exclude normal devices that are not in abnormal cycles (for example, if a device was used by multiple users only one month ago and has no abnormalities recently, it will not be included in the first target node), and only focus on devices that have abnormal behavior within a specific time period, thereby reducing misjudgments.

[0035] Step 103: Input multiple first feature information into a preset decision tree model to determine the at least one second target node; wherein, the multiple first feature information are feature information corresponding to multiple third target nodes in the at least one target time dimension, the third target node is the website node or the APP node in the graph structure corresponding to the target time dimension, the second target node is one of the multiple third target nodes, and the second target node has the association relationship with at least one of the multiple first target nodes.

[0036] It should be noted that the third target node can be any website node or APP node in the graph structure corresponding to the target time dimension that is associated with the first target node (i.e., the risk device). It is the carrier of the black market target's online operations (such as applying for online loans or forging information).

[0037] The aforementioned first feature information can be the behavioral feature data of the third target node (website / APP) within the target time dimension, used to quantify its black market relevance, and is the core feature input into the decision tree model.

[0038] In applications, since illicit devices may frequently access the same online lending platform, the first characteristic information may include access frequency characteristics, such as the total number of times the platform has been accessed by devices associated with the first target node in the past 7 days. In some embodiments, the first characteristic information may also include access duration characteristics, i.e., the average duration of a single access and the total duration. In other embodiments, the first characteristic information may also include platform type characteristics, such as whether it belongs to the "high-risk lending platform" or "provident fund inquiry" tags. In still other embodiments, since illicit platforms are often accessed by users of multiple risky devices, the first characteristic information may also include associated user characteristics, such as the proportion of users accessing the platform who are associated with other risky devices.

[0039] In a specific embodiment, the aforementioned preset decision tree model can refer to a decision tree model (such as the CART algorithm) trained based on historical black market case data, used to determine whether the third target node is a black market-related platform and output the second target node. The model training data can come from website / app characteristics (e.g., "a certain online lending platform is accessed by more than 30% of risky devices") and normal platform characteristics (e.g., "the average access time of a legitimate bank's app is ≥5 minutes") from known black market cases. The model can also generate decision rules through multiple iterations (e.g., "if the number of visits in the past 7 days is ≥50 and belongs to the high-risk lending category, then it is determined to be a risky platform"), solving the problem of incomplete coverage by traditional manual rules.

[0040] The aforementioned second target node can refer to a website node or APP node that is determined by a preset decision tree model to be "highly related to black market activities" and has an access relationship with at least one first target node (i.e., connected via an edge). The second target node is one of multiple third target nodes and possesses characteristics such as "frequent access by risky devices" and "high-risk platform type".

[0041] In a specific embodiment, all website nodes and app nodes that have access relationships with the first target node (risk device) can be filtered from the graph structure along the target time dimension and used as third target nodes. For example, if the first target node is "Device A (associated with 5 users within 7 days)," then all websites / apps visited by users of Device A within 7 days (e.g., "Online Lending Platform X," "Housing Provident Fund Inquiry App Y," etc.) are extracted as third target nodes. For each third target node, its characteristic indicators (i.e., first characteristic information) within the target time dimension can be calculated, specifically including: (1) Basic characteristics, such as the number of visits (user A of device A visited the online lending platform X a total of 30 times in 7 days), average visit duration (2 minutes each time), etc.; (2) Derivative features, such as platform risk labels (e.g., P2P lending platform X is marked as "high risk"), cross-device access rate (e.g., the proportion of P2P lending platform X being accessed by devices A, B, and C at the same time reaches 80%), etc.

[0042] Subsequently, the first feature information of each third target node can be input into the decision tree model. The decision tree model can output a "risk probability" based on the trained rules (e.g., the risk probability of P2P lending platform X is 90%). Finally, a preset decision tree model is used to determine the second target node. If the platform type is high-risk lending, it proceeds to the next branch; if it has been accessed by risky devices ≥ 20 times in the past 7 days, it proceeds to the next branch. If the cross-device access rate is greater than or equal to a certain preset threshold, a higher risk probability is output, and it is judged as a risky platform. If a risk probability threshold is set (e.g., ≥ 80%), the third target node that the model judges as high-risk and is associated with the first target node is determined as the second target node.

[0043] Therefore, in this embodiment, even if a platform appears compliant, if it is frequently accessed by multiple risky devices and exhibits abnormal behavior (e.g., submitting multiple applications in a short period), it can be accurately identified as a second target node. This addresses the problem of compliant platforms being abused by malicious actors and improves identification accuracy. Simultaneously, it enables the target graph structure constructed in subsequent steps to accurately focus on the complete chain of malicious operations, avoiding interference from irrelevant nodes and improving the efficiency and accuracy of subsequent abnormal user identification.

[0044] Step 104: Construct a target graph structure based on the plurality of first target nodes, the at least one second target node, and the user node associated with each of the first target nodes.

[0045] In this embodiment, three types of key nodes are extracted from the original graph model and set together. Specifically, a risk device set can be formed based on all determined first target nodes, a black market platform set can be formed based on all determined second target nodes (e.g., P2P lending platform X, fake housing provident fund APP Y), and an associated user set can be formed based on user nodes that have usage relationship edges with each device node in the risk device set (e.g., user 1 and user 2 using device A, user 3 using device B). In this process, only users directly associated with risk devices can be retained, excluding isolated user nodes without device association, thus avoiding interference from irrelevant users in the analysis.

[0046] Simultaneously, matching related edges can be filtered. For example, based on the filtered core node set, related edges that "only connect core nodes" in the original graph model can be extracted to form an edge set, retaining the usage relationship edges between the related user set and the risky device set. Furthermore, access relationship edges from the related user set to the black market platform set can be retained. Finally, all edges that do not involve core nodes are removed.

[0047] In some other embodiments, all filtered edges may retain their original calculated weight values ​​(e.g., the weight of the duration of user 1's use of device A is 0.8, and the weight of the number of times the user visits the online lending platform X is 0.9), providing a basis for subsequent node importance calculations.

[0048] Therefore, this application can integrate the node set and the associated edge set according to the node-edge correspondence to form a visualized target graph structure. This clearly presents the complete connection chain of "user-device-black market platform".

[0049] In this way, this embodiment of the application reduces the amount of data by filtering core nodes and edges, retaining only the key link of "risky device - associated user - black market platform". By retaining only the node associated with the risky device, normal users, normal devices and legitimate platforms are directly eliminated, so that the target graph structure focuses on the black market related links. Subsequent analysis is only for users who are suspected of having both device and platform risks, reducing the false positive rate and achieving accurate discovery of abnormal objects.

[0050] Step 105: Identify abnormal user nodes in the target graph structure.

[0051] It should be noted that abnormal user nodes refer to user nodes in the target graph structure that simultaneously possess "device association risk", "platform access risk" and "social / spatial aggregation risk", and whose behavior patterns conform to the characteristics of black market crimes (identified by encrypted mobile phone numbers). They are the core implementing entities of black market groups involved in online loan applications.

[0052] In some embodiments, abnormal user nodes in the target graph structure can be identified based on their characteristics. For example, they can be identified based on the following three categories of characteristics: (1) Device association characteristics, such as the association strength between the user and the first target node (risk device) (e.g., usage duration, whether multiple risk devices are shared). (2) Platform access characteristics, such as the user's access behavior with the second target node (black market platform) (e.g., whether the access frequency and duration conform to the black market operation mode). (3) Clustering and association features, such as social associations between users and other users (e.g., call frequency) and offline residence associations (e.g., whether the workplace is clustered).

[0053] In a specific embodiment, thresholds can be set for all associated user nodes in the target graph structure, combining "device association characteristics" and "platform access characteristics," to filter out suspected black market users: The device association threshold is defined as follows: within the target time dimension, the total time a user uses the first target node (risk device) is greater than or equal to a preset threshold (e.g., ≥10 hours in the past 7 days), or the user is associated with ≥2 risk devices at the same time (black market operations often apply across multiple devices). The platform access threshold is defined as follows: within the target time dimension, the number of times a user accesses the second target node (black market platform) is greater than or equal to a preset threshold (e.g., accessing lending platforms ≥ 15 times in the past 7 days), or the duration of a single access is less than or equal to a preset threshold (e.g., less than 2 minutes, which meets the characteristics of black market rapid application submission).

[0054] Users who meet both of the above thresholds can be included in the suspected black market user set, excluding normal users who are abnormal in only one dimension (such as users who occasionally use other people's risky devices but do not access black market platforms).

[0055] Subsequently, for the set of suspected cybercriminal users, the PageRank algorithm can be used to calculate the importance of user nodes in the target graph structure and identify core suspected users. The PageRank value of a user node is positively correlated with the number of risky devices associated with it, the number of cybercriminal platforms associated with it, and the strength of its association with other suspected users. For example, a user who is associated with 3 risky devices, accesses 5 cybercriminal platforms, and is associated with 10 suspected users through phone calls will have a higher PageRank value. Therefore, based on a set PageRank threshold, the top N% (e.g., the top 20%) of users are included in the core set of suspected cybercriminal users. These users are typically organizers or high-frequency operators of cybercriminal groups.

[0056] In some embodiments, isolated suspected users can be excluded from the core set of suspected black market users. Specifically, social cluster verification can be used, for example, by using the Tarjan algorithm to construct a call relationship subgraph for user nodes (including core suspected users and other related users) in the target graph structure, and to mine strongly connected subgraphs (i.e., user groups with high call frequency and close relationships). If the core suspected user belongs to a strongly connected subgraph (and the number of users in the subgraph is ≥3), then it is determined that there is a social cluster risk. Alternatively, workplace cluster verification can be performed, obtaining the workplace of the core suspected user (the latitude and longitude of the base station where the user spent the longest time between 9 am and 6 pm on weekdays in the past 30 days). If the latitude and longitude deviation of the workplaces of ≥3 core suspected users is ≤ a preset range (e.g., ≤1 kilometer), then it is determined that there is an offline cluster risk. In this way, suspected users with "social cluster risk" or "offline cluster risk" can be included in the set of suspected users associated with the gang, excluding isolated abnormal users without cluster characteristics (e.g., individuals who violate the rules occasionally and are not gang members).

[0057] Finally, multi-dimensional features of each user in the suspected user set associated with the gang (such as usage time of risky devices, number of visits to black market platforms, social clustering strength, and workplace clustering strength) are extracted and input into the CART decision tree model. The model is then judged as abnormal based on preset rules (such as "if the usage time of risky devices is ≥15 hours, the number of visits to black market platforms is ≥20 times, and the social clustering strength is ≥0.8"), and outputs the abnormal probability of each user. According to the preset abnormal probability threshold (such as ≥80%), user nodes that meet the probability threshold are determined as the final abnormal user nodes, i.e., members of the black market targets for online loan applications.

[0058] Therefore, the embodiments of this application use a three-dimensional collaborative verification of "device, platform and aggregation", and each layer of screening is equipped with thresholds and algorithm filtering, which can effectively exclude the occasional anomalies of normal users, while capturing the collaborative characteristics of black market gangs and reducing the false positive rate.

[0059] Optionally, constructing the graph model based on the graph structure corresponding to at least one time dimension includes: Extract the multiple nodes and multiple feature information from the user behavior information, and determine at least one feature information corresponding to each node in each time dimension; Based on the feature information corresponding to each node in each time dimension, determine the first sequence information corresponding to each node in each time dimension, and the weight of the edge between any two nodes in each time dimension. Based on the first sequence information corresponding to each node in each time dimension, determine the node feature matrix corresponding to the plurality of nodes in each time dimension; The graph model is constructed based on the weight of the edge between any two nodes in each time dimension and the node feature matrix corresponding to each time dimension.

[0060] In some embodiments, four types of nodes (users, devices, websites, and apps) can be extracted from operator data, and feature information of each node can be collected in different time dimensions (e.g., short-term 7 days, medium-term 30 days).

[0061] For example, the extracted nodes may include: user node U1 (encrypted mobile phone number), device node D1 (device ID), APP node A1 (a lending APP), etc. The time dimension can be set to short-term 7 days (T1), medium-term 30 days (T2), etc. Therefore, the obtained feature information may include: U1's features in T1, such as usage time on D1 for 10 hours and access to A1 15 times; U1's features in T2, such as usage time on D1 for 40 hours and access to A1 60 times; D1's features in T1, such as the number of associated users being 5; and A1's features in T1, such as the proportion of accessed by risky devices being 80%.

[0062] In a specific embodiment, the weighted adjacency matrix comprehensively describes the connection structure and connection strength information between nodes in the graph. The weighted adjacency matrix provides a clear understanding of the connections between nodes and the strength of those connections. In community detection algorithms, the connection weights between nodes affect the community partitioning results; nodes with strong connections (high weights) are more likely to be assigned to the same community. The elements in the weighted adjacency matrix A... This represents the weight of the edge connecting node i and node j; if there is no connection, it is 0. =0.

[0063] In a specific embodiment of this application, numbers using the same device can be considered to have high connection strength, and the edge weight between the user entity and the device entity is considered to be high. The edge weights between users are directly proportional to the duration of use. The edge weight is directly proportional to the social call relationship. The specific calculation formula is as follows: ; in, .

[0064] Specifically, the first sequence information can be a sequence formed by arranging the feature information of nodes in each time dimension in chronological order (reflecting the changes of features over time). For example, the "duration of using D1" sequence of U1 is [T1: 10 hours, T2: 40 hours]; the "number of visits to A1" sequence is [T1: 15 times, T2: 60 times]. Therefore, the edge weight can be understood as calculating the weight of the edge between any two nodes based on the node features (quantifying the strength of the association).

[0065] It should be noted that the weight calculation rules are different for different association types. For example, the weight of the "usage relationship edge" between U1 and D1 is as follows: at T1, according to the formula weight = usage time / total time, it is 0.8 (10 hours accounts for 80% of the total usage time of 12.5 hours for the same period of the device); at T2, the weight is 0.7 (40 hours accounts for 70% of the total time of 57 hours). The weight of the "access relationship edge" between U1 and A1 is as follows: at T1, according to the formula weight = number of accesses / total accesses of the platform, it is 0.6 (15 times accounts for 60% of the total accesses of 25 times for A1 in the same period).

[0066] Subsequently, the first sequence information (feature values) of all nodes in each time dimension can be integrated into a matrix, with rows representing nodes and columns representing feature dimensions. The "node feature matrix" corresponding to each time dimension is then associated with the "edge weight matrix" (recording the weights between all nodes) to form the graph structure for that time dimension. Finally, the graph structures of all time dimensions are integrated to form a complete graph model.

[0067] In this way, by recording the temporal changes of node characteristics through the first sequence information (e.g., "the number of associated users of a certain device increased from 2 people 7 days ago to 5 people 30 days ago"), the problem that traditional static graph models cannot reflect behavioral trends is solved, and the model can adapt to the dynamic pattern of black market or abnormal objects "short-term incubation to mid-term outbreak".

[0068] Optionally, determining multiple first target nodes from the graph structure corresponding to at least one target time dimension includes: Obtain the graph structure corresponding to the at least one target time dimension from the graph model; Based on the PageRank algorithm, determine the first parameter corresponding to each first device node in the graph structure corresponding to the at least one target time dimension; Based on the first parameter corresponding to each first device node in the at least one target time dimension, determine the second parameter corresponding to each first device node; Based on the second parameter corresponding to each first device node, sort each first device node to determine the node arrangement sequence; Determine at least one first target node that is arranged before a preset position from the node arrangement sequence.

[0069] It should be noted that the phone numbers of accounts controlled by black market operators are not connected subgraphs, making traditional community detection algorithms inapplicable. Furthermore, even when traditional methods use connected subgraphs, their goal is to discover general patterns and rules. However, this application focuses on uncovering black market groups involved in online loan applications. To evade regulation, these groups employ various methods to conceal their activities. The phone numbers controlled by these groups deliberately avoid obvious connections, instead communicating through dispersed and indirect means. This renders the traditional connected subgraph assumption invalid.

[0070] Therefore, in the scenario of mining devices used to control phone numbers controlled by illicit entities, the data shows a large number of user entities pointing to the same device entity. Based on this, and considering the characteristics of the scenario, this application embodiment uses node importance rather than the proximity between user entities to mine numbers with device clustering.

[0071] In some specific embodiments, such as Figure 4 As shown, by using the phone numbers of users who accessed online lending websites or apps on the same day based on the time dimension, we can reverse-engineer user phone numbers connected to device nodes at different times in the user experience field. We use PageRank to calculate the importance of each device node, defining it as a "device community" with a size score of S_1. The order of magnitude of community discovery is controlled by adjusting a threshold. The value of device k can be expressed as: ; in, Indicates pointing to a node nodes PageRank value; For nodes With nodes The weights of the edges between user nodes and device nodes, as indicated in step two.

[0072] express The out-degree is the number of edges originating from this node. A larger out-degree indicates a greater number of edges pointing from this node to other nodes in this scenario.

[0073] The damping coefficient; N is the number of nodes.

[0074] In the above formula That is, the size fraction of the device community k. Three different time periods can be used to experience the field. The weighted average of the PageRank values ​​of the central device nodes is calculated below.

[0075] Specifically, the three time receptive fields are short-term, medium-term, and long-term, representing the number of user numbers using the device during these three different time periods. Further, such as... Figure 4 As shown, a threshold can be set for this score. By comparing the value of device k with the threshold, at least one first target node can be obtained, thus achieving order-of-magnitude control of the community.

[0076] Optionally, the step of inputting multiple first feature information into a preset decision tree model to determine the at least one second target node includes: The multiple first feature information is input into the preset decision tree model to obtain the distinction threshold; The plurality of first feature information is divided based on the discrimination threshold to obtain at least one second feature information among the plurality of first feature information; Based on the at least one second feature information, the corresponding at least one second target node is determined.

[0077] In some embodiments, pre-acquired sample data can be used, divided into test and validation sets. These sets are then input into a pre-defined decision tree model for training, and the CART (Decision Tree Arrangement) algorithm is employed for machine learning. The CART algorithm, with its intuitive and easily understood tree structure, effectively handles classification and regression problems. During algorithm execution, the pre-defined decision tree model, based on given feature data, continuously splits nodes to find the optimal splitting conditions. The decision tree learns from the sample data, fitting and determining thresholds for each feature based on the Gini index.

[0078] Specifically, for dataset A, the Gini index is ,in, This represents the proportion of samples of class k in dataset A; This indicates the total number of categories. The samples in this scenario are divided into two categories: normal users and black market groups (users with black tags).

[0079] For attribute X, the Gini index is: ,in and These are two subsets obtained after partitioning based on attribute X.

[0080] In the training of the pre-defined decision tree model, the decision tree is pre-pruned by limiting its maximum depth (max_depth), resulting in an accuracy of 75% on the training set. The accuracy is: True Positive (TP): The number of samples that the model predicts as positive and are actually positive; False Positive (FP): The number of samples that the model predicts as positive but are actually negative. The trained model can then be used to set thresholds to distinguish between good and bad user activity on apps and websites.

[0081] Therefore, in this embodiment, the preset decision tree model uses the CART algorithm, trained based on historical black market case data (known characteristics of black market platforms and normal platforms), divides nodes using the Gini index, fits sample behavior, and finally outputs the discrimination threshold for each feature. For example, the preset decision tree model can generate discrimination thresholds such as "accessed by risky devices ≥ 20 times in the past 7 days" and "platform type is high-risk lending" for the first feature information such as "number of visits in the past 7 days" and "platform risk label", clearly defining the rule that a platform is judged as high-risk if it meets the threshold, replacing the traditional single standard set manually.

[0082] In the above embodiments of this application, such as Figure 5 As shown, when the feature information of the third target node is classified as the second feature information, it possesses black market association attributes such as "frequently accessed by risky devices" and "high-risk platform type." Furthermore, because the third target node itself has an access relationship edge with the first target node (e.g., a user of a risky device has accessed the platform), it can be directly identified as the second target node. For example, if "P2P lending platform X" has "30 visits in the last 7 days" and "80% cross-device access rate" (second feature information), and has an access association with risky device A, then "P2P lending platform X" is identified as the second target node.

[0083] In this way, the model constructed using the receptive fields of the past 7 days' visits is trained in the same manner, combining features and thresholds from both receptive fields. Based on the data, features ranked higher in importance are selected. Therefore, the embodiments of this application can reduce algorithm complexity to minimize overfitting issues caused by model training.

[0084] In other embodiments, the training data for the model can be further subdivided into secondary categories such as banking, credit cards, consumer finance, auto finance, lending, insurance, wealth management, payment, housing provident fund, credit union, and fund, securities and stock categories. The domain names of the apps and websites are then categorized to build a knowledge base, which is maintained regularly.

[0085] Subsequently, based on the operator's access data, feature variables for accessing the aforementioned financial apps and websites were designed and developed, including the number of visits, visit duration, and number of days visited. It's important to note that this technical solution uses three different time-length receptive fields, representing short, medium, and long-term periods: short-term (the past 7 days), medium-term (the past 30 days), and long-term (the past three months). The same features are used throughout, differing only in the duration of the backtesting receptive field. By setting different time-length receptive fields for in-depth behavioral analysis, the model can learn user behavior from multiple dimensions, learning the behavioral patterns of black market activities from different time-length receptive field perspectives to uncover hidden activity characteristics.

[0086] For example, taking access data from the past 30 days as an example, feature list 2 is as follows: Table 2

[0087] Optionally, before inputting the plurality of first feature information into the preset decision tree model to obtain the discrimination threshold, the method further includes: Obtain user historical behavior data, which includes multiple feature information in at least two time dimensions; Based on the preset Gini index, the user's historical behavior data is divided into a first dataset and a second dataset. The first dataset includes the abnormal user nodes and their corresponding feature information, and the second dataset includes the non-abnormal user nodes and their corresponding feature information. The first dataset and the second dataset are input into the initial decision tree model, and the initial decision tree model is pre-pruned according to a preset depth to obtain the preset decision tree model.

[0088] It is understandable that the operational model of online loan application black market gangs allows them to possess a large amount of access data to financial apps and websites, thus enabling them to make behavioral judgments based on internet access data from mobile operators. In some embodiments, a knowledge base of financial apps and websites is constructed, combined with access data from mobile operators, to design and develop feature variables. Then, based on labeled samples, a decision tree is used to fit the behavior of the samples and output the corresponding threshold.

[0089] In some implementations, user historical behavior data serves as the core input for model training and must meet two key requirements: multiple features and multiple time dimensions. The multiple features must cover core indicators reflecting user behavior patterns, and specific features need to be defined in conjunction with the business scenario. For example, in risk control scenarios: login IP address location (whether it matches the user's usual location), transaction amount fluctuations, daily operation frequency, number of device changes, etc.; in product operation scenarios: page dwell time, function click sequence, retention interval, content interaction depth, etc. The multiple time dimensions must include data from at least two time periods (e.g., "yesterday + the last 7 days" or "this month + last month") to capture dynamic changes in behavior. Abnormal users often exhibit abrupt behavioral changes over time (e.g., sudden high-frequency operations, a surge in login frequency late at night), and single-time dimension data cannot effectively identify these patterns.

[0090] Following the acquisition of raw data, it needs to be cleaned to ensure the validity of the input model. For handling missing values, the missing feature values ​​can be filled using the mean / median (for numerical features) or the mode (for categorical features). Additionally, feature standardization can be performed, normalizing numerical features such as transaction amount and operation frequency to avoid affecting the Gini index calculation due to differences in magnitude. Labeling is also necessary, requiring manual or rule-based pre-labeling of "abnormal user nodes" (such as users confirmed to have engaged in fraudulent behavior) and "non-abnormal user nodes" (normal active users) in the dataset; this is the foundation of supervised learning.

[0091] It should be noted that the Gini Index is a key indicator for measuring data purity, with a value range of [0,1]: Gini Index = 0: The dataset is completely pure (all anomalous or all non-nominal users); Gini Index = 1: The dataset is extremely chaotic (the proportion of anomalous and non-nominal users is equal). In this embodiment, the role of the Gini Index is to find the optimal splitting features and splitting points, so that the purity of the two datasets (dataset 1 and dataset 2) is maximized, that is, "abnormal users are concentrated in one dataset as much as possible, and non-nominal users are concentrated in the other dataset".

[0092] In the above embodiments, all features can be traversed, and each preprocessed feature, such as the number of logins per day, can be sequentially used as a candidate splitting feature. The Gini index before and after splitting is calculated: the Gini index G(D) of the overall dataset before splitting is calculated; for each possible value of a candidate feature (e.g., "number of logins per day = 5"), the data is divided into two parts, and the weighted sum of the Gini indices of the two parts, G(D,A), is calculated (the weights are the proportions of the two parts); the optimal splitting scheme is selected, choosing the feature and value with the largest "G(D) - G(D,A)" as the splitting basis. The larger this difference, the more significant the improvement in data purity after splitting. Finally, the target dataset is generated, and the original data is split into a first dataset of "abnormal user nodes + corresponding features" and a second dataset of "non-abnormal user nodes + corresponding features" using the optimal splitting scheme.

[0093] For example, if the original data contains 1000 users, of which 200 are abnormal users, when the criterion is "daily login count > 10", the result after segmentation is: Left subset (≤10 times): 850 users, 50 abnormal users, Gini index G1; Right subset (>10 times): 150 users, 150 abnormal users, Gini index G2; At this point, the weighted sum G(D, A) is minimized, the partitioning scheme is optimal, the right subset is the first dataset, and the left subset is the second dataset.

[0094] Finally, after inputting the first dataset (labeled: anomaly) and the second dataset (labeled: non-anomaly) into the initial decision tree model, the model automatically performs recursive partitioning: starting from the root node (the entire dataset), it selects features for splitting with the goal of minimizing the Gini index; the splitting process is repeated for each child node until all leaf nodes have a single label (anomaly / non-anomaly) or the stopping condition is met. Without pruning, the model will overfit to noise in the training data (such as occasional high-frequency operations by individual normal users), leading to a decrease in the accuracy of recognizing new data.

[0095] It's important to note that pre-pruning is a technique that terminates splitting early during the growth of a decision tree. Presetting a depth limit is the most common and efficient implementation: setting a preset depth parameter, i.e., setting the maximum depth of the decision tree according to the business scenario (e.g., max_depth=3). The smaller the depth, the simpler the model and the stronger its ability to avoid overfitting. When the decision tree grows to the preset depth, regardless of whether the leaf node still has splitting space (e.g., still contains a small number of mixed labels), splitting is forcibly stopped, and the node is marked as a leaf node (labeled as the category of the majority of samples within the node). Finally, a preset decision tree model is generated. After depth-limited pruning, a final model with a simplified structure and stronger generalization ability is obtained.

[0096] Optionally, constructing the target graph structure based on the plurality of first target nodes, the at least one second target node, and the user node associated with each first target node includes: A first graph structure is constructed based on the plurality of first target nodes, the at least one second target node, and the user nodes that have the association relationship with each of the first target nodes; At least one first user node is removed from the first target graph structure to obtain a second graph structure; wherein, the first user node is a user node whose edge weight to the first target node is less than a preset threshold and greater than zero; The second graph structure is searched based on the Tarjan algorithm to determine the target graph structure, which includes at least three second user nodes and at least three edges, and the at least three second user nodes are connected by the at least three edges to form a closed loop.

[0097] In some embodiments, an initial network containing three types of core entities is constructed based on the identified risky devices (first target nodes), black market platforms (second target nodes), and user nodes directly associated with the risky devices.

[0098] The node set includes: Risky device nodes (such as device A and device B, which are associated with more than 5 users within 7 days); Black market platform nodes (such as P2P lending platform X, fake housing provident fund APP Y, which are judged as high risk by the decision tree); Associate user nodes (e.g., user 1 and user 2 using device A, user 3 using device B).

[0099] The edge set includes: Preserve the "usage relationship edge" between users and risky devices (weighted by the percentage of usage time). Preserve the "access relationship edge" between users and black market platforms (weighted by the percentage of access times); Remove edges that are not related to the core nodes (such as the association between normal devices and users, and the access between users and legitimate platforms).

[0100] For example, if device A is associated with users 1-5, and these users have all visited the online lending platform X, then the first graph structure includes nodes {device A, online lending platform X, users 1-5}, and edges {users 1-5 → device A, users 1-5 → online lending platform X}.

[0101] In some implementations, weakly associated users can be filtered out using edge weight thresholds to reduce noise interference: The definition of the first user node mentioned above refers to users whose edge weight with the risky device is "greater than 0 but less than a preset threshold" (i.e., there is a correlation but the strength is low). For example, if the preset threshold is 0.1 (usage time percentage < 10%), and user 5's usage time with device A accounts for only 5% of the total usage time on that device, then user 5 is marked as the first user node.

[0102] In addition, members of criminal gangs typically use risky devices frequently (high weight), while normal users who occasionally borrow devices (low weight) do not belong to the target group and can be excluded. The resulting second graph structure only retains strongly related users. For example, after removing user 5 in the example above, the nodes are simplified to {Device A, P2P lending platform X, Users 1-4}.

[0103] Finally, this embodiment of the application can utilize the Tarjan algorithm to search for strongly connected components (SCCs) in the second graph structure to extract user groups forming closed loops. It should be noted that the Tarjan algorithm can efficiently identify strongly connected subgraphs (closed loops) in directed graphs where "every node is reachable from each other." In black market scenarios, closed loops are characterized by "bidirectional connections between users" (such as high-frequency calls or shared device usage), a typical feature of coordinated group operations.

[0104] The target graph structure can be determined by filtering strongly connected subgraphs containing "≥3 second user nodes" and "≥3 edges". For example, users 1-3 form a closed loop through the following relationships: user 1 and user 2 frequently talk (edge ​​weight 0.8); user 2 and user 3 share device B (edge ​​weight 0.9); user 3 assists user 1 in operating the online lending platform X (edge ​​weight 0.7). This subgraph satisfies the conditions of "3 nodes + 3 edges + closed loop" and is therefore identified as the target graph structure.

[0105] Thus, in this embodiment, after removing weakly associated users (first user nodes), the second graph structure retains only strongly associated entities, avoiding interference from normal users who accidentally come into contact with risky devices and reducing the false positive rate. Furthermore, in the above embodiments, the target graph structure can both retain the core association features of the black market group and remove irrelevant noise, providing accurate and efficient data support for the final identification of abnormal users.

[0106] Optionally, the plurality of nodes further includes a residing node, and the identification of abnormal user nodes in the target graph structure includes: Based on the feature information corresponding to the user nodes in the target graph structure, at least one target residence node is determined; The target graph structure is updated based on the at least one target dwelling node; Remove at least one third user node from the updated target graph structure. The third user node is the user node that has resided in the target residency node for a duration shorter than a preset duration. Identify and remove the abnormal user nodes in the target graph structure from the at least one third user node.

[0107] In some embodiments, based on the feature information of user nodes in the target graph structure (such as login IP address, GPS location records, frequently used delivery addresses, etc.), geographical locations with significant clustering are extracted as target residence nodes: Firstly, feature information analysis can be performed, focusing on the spatiotemporal distribution characteristics of users. For example, network features can be used, such as the cities / regions where login IPs are concentrated in the past 30 days (e.g., 80% of user login IPs belong to YY City, XX Province); physical features can be high-frequency offline addresses (e.g., delivery addresses in the same residential area or office building); the target residence location determination rule can be that if more than 50% of user nodes have activity records in a certain geographical area (e.g., XX Street), and the user activity (average daily number of operations) in that area is more than 3 times that of other areas, then it is marked as a target residence location node.

[0108] For example, if 8 out of 10 user nodes in the target graph structure frequently log in from the IP address of "Building A, Development Zone, XX City", and the average daily operation frequency reaches 20 times (compared to an average of 5 times for users in other areas), then "Building A, Development Zone, XX City" is identified as the target residence node.

[0109] Subsequently, the target location nodes can be incorporated into the original target graph structure, supplementing new relationships to form a more complete multi-dimensional network. New nodes can be established target location nodes added to the graph structure (e.g., node "Loc_A" represents Building A in the XX City Development Zone). New edge relationships can be the residency relationship between user nodes and target location nodes, with weights based on the percentage of time a user spends in that area (e.g., if user 1's login time in Loc_A accounts for 70% of the total time, then the edge weight is 0.7). Relationships between target location nodes and existing nodes can also be established (e.g., the physical binding edge between Loc_A and risky device nodes; if device A is used in the Loc_A area for a long time, then the weight is 0.9). Thus, the updated data structure can include: a graph containing four types of entities: user nodes, risky device nodes, black market platform nodes, and target location nodes, as well as multiple edge types such as user-device, user-platform, and user-location.

[0110] Furthermore, at least one third-party user node can be removed. Users with weak associations to the target location can be filtered out using a preset duration threshold, reducing interference from non-core groups. This third-party user node can be one whose dwell time at the target location node is less than the preset duration. For example, if the preset duration threshold is "cumulative stay ≥ 15 days in the past 30 days," and user 6's cumulative stay at Loc_A is only 5 days, then it is marked as a third-party user node. The dwell time calculation method can combine IP attribution duration, offline address usage frequency, etc., such as "IP attribution duration at Loc_A × 0.6 + frequency of delivery address at Loc_A × 0.4".

[0111] The above exclusion logic can be based on the fact that criminal gangs typically operate from fixed locations for extended periods (long stays), while users who only pass through or have occasional contact (such as business travelers) are not considered part of the core gang. After exclusion, the graph structure only retains users strongly associated with the target's location.

[0112] Finally, the final abnormal user nodes are identified, and the target graph structure after removing the third user node is analyzed. Abnormal users are determined through multi-dimensional feature fusion. The core criteria for this determination may include: (1) Stay characteristics: The length of stay at the target stay location accounts for ≥60% (strong binding); (2) Association characteristics: forming a closed loop with other user nodes (such as more than 3 people using the device in a cross-use manner); (3) Behavioral characteristics: Frequent access to black market platforms (e.g., logging into fake loan apps ≥ 5 times per day); For example, users 1-3 can be identified as abnormal user nodes if they meet the following conditions: all reside in Loc_A for ≥20 days (accounting for more than 70%); form a closed loop of shared devices from user 1 to user 2 to user 3 to user 1; and access the online lending platform X ≥8 times per day on average, with highly similar transaction behaviors (e.g., all operations are performed at 3 AM).

[0113] Therefore, by introducing the location node in this embodiment, the two-dimensional association between users, devices, and platforms is upgraded to a three-dimensional network of space, entities, and behaviors, thus addressing the shortcomings of traditional methods that neglect geographical location features. Clustering analysis of target locations can capture the characteristics of criminal gangs operating from specific locations (such as fraud gangs concentrated in a particular neighborhood), increasing the spatial coverage of gang identification. By introducing the location dimension and combining it with spatiotemporal feature filtering, this embodiment can more accurately pinpoint criminal gangs with physical clustering, providing a more realistic decision-making basis for risk prevention and control.

[0114] In some embodiments, such as Figure 6 As shown, a second-level analysis of the activity and behavior of numbers in the device community is conducted to identify users with social circle connections and workplace clustering across different device communities.

[0115] Specifically, a time receptive field t is set, and edge weights are assigned to calls within time t. A threshold is used to eliminate low-frequency calls representing low-social-relationship interactions. The Tarjan algorithm is used to perform a depth-first search of the graph to find strongly connected subgraphs representing call relationships. Each strongly connected component of the graph is a subtree in a Depth-First Search (DFS) tree; therefore, finding the root node of the subtree of a strongly connected component in the DFS tree is sufficient. Since v is an ancestor of u in the DFS tree when a reverse edge (u, v) occurs, the vertices between u and v in the DFS tree form a connected subgraph. The Tarjan algorithm aims to maximize this connected subgraph.

[0116] Therefore, the subgraph obtained by the algorithm is defined as a 'black market social circle', and noise from irrelevant black market activities needs to be removed from it. The clustering of personnel at work locations is used to screen black market individuals to control false positives. The latitude and longitude of the communication base station with the longest dwell time during weekday working hours (9-18) in the 30-day work location usage history are calculated.

[0117] Valid users: Those who spend more than 15 days out of 30 days staying in one city for more than 10 hours each day; Valid time period: Working hours on weekdays (9:00-18:00); Therefore, the effective users are calculated. Within a 30-day effective period, the duration of user stay at each base station's LC (Local Capacity) is calculated, and the base station with the longest stay is selected. Then, effective users residing at that location during the effective period are grouped together based on latitude and longitude. The longest dwell time for a base station is the dwell time within the 30-day effective period:

[0118] Where LC stands for base station node. For valid users Staying at the base station during the effective period The duration. (This refers to) community members with the risky devices identified above. The clustered base stations (LC) are considered high-risk geographical locations. Therefore, high-risk individuals involved in cybercrime are further screened using social circles and geographic location data to exclude legitimate users unrelated to these activities.

[0119] Ultimately, based on device usage, internet browsing behavior, social circles, and work location, high-risk black market loan application and fraud gangs can be accurately identified. This technical solution not only uses multi-dimensional data to improve the accuracy of combating black market activities, but also provides high interpretability and traceability, offering greater convenience for business technicians and having room for future expansion.

[0120] Please refer to Figure 7 , Figure 7 This is a schematic diagram of an abnormal object identification device according to an embodiment of this application. The abnormal object identification device 300 specifically includes: The first construction module 201 is used to construct a graph model based on a graph structure corresponding to at least one time dimension. The graph structure includes multiple nodes and multiple edges. The multiple nodes include user nodes, device nodes, website nodes, and application (APP) nodes. The edges are used to represent the association relationship between any two nodes among the multiple nodes. The first determining module 202 is configured to determine a plurality of first target nodes from the graph structure corresponding to at least one target time dimension, wherein the at least one time dimension includes the target time dimension, and the first target node is the device node in the graph structure corresponding to the target time dimension. The second determining module 203 is used to input multiple first feature information into a preset decision tree model to determine the at least one second target node; wherein, the multiple first feature information are feature information corresponding to multiple third target nodes in the at least one target time dimension, the third target node is the website node or the APP node in the graph structure corresponding to the target time dimension, the second target node is one of the multiple third target nodes, and the second target node has the association relationship with at least one of the multiple first target nodes; The second construction module 204 is used to construct a target graph structure based on the plurality of first target nodes, the at least one second target node, and the user node associated with each first target node; The first identification module 205 is used to identify abnormal user nodes in the target graph structure.

[0121] Optionally, the first building module 201 is used for: Extract the multiple nodes and multiple feature information from the user behavior information, and determine at least one feature information corresponding to each node in each time dimension; Based on the feature information corresponding to each node in each time dimension, determine the first sequence information corresponding to each node in each time dimension, and the weight of the edge between any two nodes in each time dimension. Based on the first sequence information corresponding to each node in each time dimension, determine the node feature matrix corresponding to the plurality of nodes in each time dimension; The graph model is constructed based on the weight of the edge between any two nodes in each time dimension and the node feature matrix corresponding to each time dimension.

[0122] Optionally, the first determining module 202 is used to: Obtain the graph structure corresponding to the at least one target time dimension from the graph model; Based on the PageRank algorithm, determine the first parameter corresponding to each first device node in the graph structure corresponding to the at least one target time dimension; Based on the first parameter corresponding to each first device node in the at least one target time dimension, determine the second parameter corresponding to each first device node; Based on the second parameter corresponding to each first device node, sort each first device node to determine the node arrangement sequence; Determine at least one first target node that is arranged before a preset position from the node arrangement sequence.

[0123] Optionally, the second determining module 203 is used to: The multiple first feature information is input into the preset decision tree model to obtain the distinction threshold; The plurality of first feature information is divided based on the discrimination threshold to obtain at least one second feature information among the plurality of first feature information; Based on the at least one second feature information, the corresponding at least one second target node is determined.

[0124] Optionally, the abnormal object identification device 300 is further configured to: Obtain user historical behavior data, which includes multiple feature information in at least two time dimensions; Based on the preset Gini index, the user's historical behavior data is divided into a first dataset and a second dataset. The first dataset includes the abnormal user nodes and their corresponding feature information, and the second dataset includes the non-abnormal user nodes and their corresponding feature information. The first dataset and the second dataset are input into the initial decision tree model, and the initial decision tree model is pre-pruned according to a preset depth to obtain the preset decision tree model.

[0125] Optionally, the second building module 204 is used for: A first graph structure is constructed based on the plurality of first target nodes, the at least one second target node, and the user nodes that have the association relationship with each of the first target nodes; At least one first user node is removed from the first target graph structure to obtain a second graph structure; wherein, the first user node is a user node whose edge weight to the first target node is less than a preset threshold and greater than zero; The second graph structure is searched based on the Tarjan algorithm to determine the target graph structure, which includes at least three second user nodes and at least three edges, and the at least three second user nodes are connected by the at least three edges to form a closed loop.

[0126] Optionally, the plurality of nodes further includes a residing node, and the first identification module 205 is used for: Based on the feature information corresponding to the user nodes in the target graph structure, at least one target residence node is determined; The target graph structure is updated based on the at least one target dwelling node; Remove at least one third user node from the updated target graph structure. The third user node is the user node that has resided in the target residency node for a duration shorter than a preset duration. Identify and remove the abnormal user nodes in the target graph structure from the at least one third user node.

[0127] The abnormal object identification device 300 provided in this application embodiment can perform the above-described... Figure 1 The method embodiments shown are similar in principle and technical effect, and will not be described again here.

[0128] This application also provides an electronic device. Since the principle by which this electronic device solves the problem is similar to the image detection model training method in this application, the implementation of this electronic device can be found elsewhere. Figure 1 The implementation of the method shown will not be repeated here. Figure 8 As shown, the electronic device according to an embodiment of this application includes: a processor 410, configured to read a program from a memory 420 and execute the following processes: A graph model is constructed based on a graph structure corresponding to at least one time dimension. The graph structure includes multiple nodes and multiple edges. The multiple nodes include user nodes, device nodes, website nodes, and application (APP) nodes. The edges are used to represent the association relationship between any two nodes among the multiple nodes. Multiple first target nodes are determined from the graph structure corresponding to at least one target time dimension, wherein the at least one time dimension includes the target time dimension, and the first target node is the device node in the graph structure corresponding to the target time dimension; Multiple first feature information is input into a preset decision tree model to determine at least one second target node; wherein, the multiple first feature information are feature information corresponding to multiple third target nodes in the at least one target time dimension, the third target node is the website node or the APP node in the graph structure corresponding to the target time dimension, the second target node is one of the multiple third target nodes, and the second target node has the association relationship with at least one of the multiple first target nodes; A target graph structure is constructed based on the plurality of first target nodes, the at least one second target node, and the user node associated with each of the first target nodes; Identify abnormal user nodes in the target graph structure.

[0129] Among them, Figure 8 In this context, the bus architecture can include any number of interconnected buses and bridges, specifically linking various circuits of one or more processors represented by processor 410 and memory represented by memory 420 together. The bus architecture can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides the interface.

[0130] Optionally, the processor 410 is also used to read the program from the memory 420 and perform the following steps: Extract the multiple nodes and multiple feature information from the user behavior information, and determine at least one feature information corresponding to each node in each time dimension; Based on the feature information corresponding to each node in each time dimension, determine the first sequence information corresponding to each node in each time dimension, and the weight of the edge between any two nodes in each time dimension. Based on the first sequence information corresponding to each node in each time dimension, determine the node feature matrix corresponding to the plurality of nodes in each time dimension; The graph model is constructed based on the weight of the edge between any two nodes in each time dimension and the node feature matrix corresponding to each time dimension.

[0131] Optionally, the processor 410 is also used to read the program from the memory 420 and perform the following steps: Obtain the graph structure corresponding to the at least one target time dimension from the graph model; Based on the PageRank algorithm, determine the first parameter corresponding to each first device node in the graph structure corresponding to the at least one target time dimension; Based on the first parameter corresponding to each first device node in the at least one target time dimension, determine the second parameter corresponding to each first device node; Based on the second parameter corresponding to each first device node, sort each first device node to determine the node arrangement sequence; Determine at least one first target node that is arranged before a preset position from the node arrangement sequence.

[0132] Optionally, the processor 410 is also used to read the program from the memory 420 and perform the following steps: The multiple first feature information is input into the preset decision tree model to obtain the distinction threshold; The plurality of first feature information is divided based on the discrimination threshold to obtain at least one second feature information among the plurality of first feature information; Based on the at least one second feature information, the corresponding at least one second target node is determined.

[0133] Optionally, the processor 410 is also used to read the program from the memory 420 and perform the following steps: Obtain user historical behavior data, which includes multiple feature information in at least two time dimensions; Based on the preset Gini index, the user's historical behavior data is divided into a first dataset and a second dataset. The first dataset includes the abnormal user nodes and their corresponding feature information, and the second dataset includes the non-abnormal user nodes and their corresponding feature information. The first dataset and the second dataset are input into the initial decision tree model, and the initial decision tree model is pre-pruned according to a preset depth to obtain the preset decision tree model.

[0134] Optionally, the processor 410 is also used to read the program from the memory 420 and perform the following steps: A first graph structure is constructed based on the plurality of first target nodes, the at least one second target node, and the user nodes that have the association relationship with each of the first target nodes; At least one first user node is removed from the first target graph structure to obtain a second graph structure; wherein, the first user node is a user node whose edge weight to the first target node is less than a preset threshold and greater than zero; The second graph structure is searched based on the Tarjan algorithm to determine the target graph structure, which includes at least three second user nodes and at least three edges, and the at least three second user nodes are connected by the at least three edges to form a closed loop.

[0135] Optionally, the plurality of nodes further includes a resident node, and the processor 410 is further configured to read the program in the memory 420 and perform the following steps: Based on the feature information corresponding to the user nodes in the target graph structure, at least one target residence node is determined; The target graph structure is updated based on the at least one target dwelling node; Remove at least one third user node from the updated target graph structure. The third user node is the user node that has resided in the target residency node for a duration shorter than a preset duration. Identify and remove the abnormal user nodes in the target graph structure from the at least one third user node.

[0136] The electronic device 400 provided in this application embodiment can perform the above-described... Figure 1 The method embodiments shown are similar in principle and technical effect, and will not be described again here.

[0137] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the above-described... Figure 1 The various processes in the embodiments of the abnormal object identification method are all the same and can achieve the same technical effect, so they will not be described again here to avoid repetition. The computer-readable storage medium mentioned therein includes, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0138] This application embodiment also provides a computer program / program product, which is stored in a storage medium and executed by at least one processor to implement the above. Figure 1 The various processes of the abnormal object identification method embodiment described herein can achieve the same technical effect, and will not be repeated here to avoid duplication.

[0139] In the several embodiments provided in this application, it should be understood that the disclosed methods and apparatus can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0140] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can be physically included separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0141] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute some steps of the transmission and reception methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0142] The above description is the preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principles described in this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. An abnormal object recognition method characterized by comprising: The method comprises: constructing a graph model based on a graph structure corresponding to at least one time dimension, the graph structure comprising a plurality of nodes and a plurality of edges, the plurality of nodes comprising user nodes, device nodes, website nodes, and application APP nodes, and the edges representing an association relationship between any two nodes in the plurality of nodes; determining a plurality of first target nodes from the graph structure corresponding to at least one target time dimension, the at least one time dimension comprising the target time dimension, and the first target nodes being the device nodes in the graph structure corresponding to the target time dimension; inputting a plurality of first feature information into a preset decision tree model to determine at least one second target node, wherein the plurality of first feature information is feature information of a plurality of third target nodes corresponding to the at least one target time dimension, the third target nodes being the website nodes or the APP nodes in the graph structure corresponding to the target time dimension, the second target node being one of the plurality of third target nodes, and the second target node having the association relationship with at least one node in the plurality of first target nodes; constructing a target graph structure based on the plurality of first target nodes, the at least one second target node, and a user node associated with each of the first target nodes; identifying an abnormal user node in the target graph structure.

2. The method of claim 1, wherein, The method of constructing a graph model based on a graph structure corresponding to at least one time dimension comprises: extracting the plurality of nodes and a plurality of feature information from user behavior information, and determining at least one feature information of each node corresponding to each time dimension; determining first sequence information of each node corresponding to each time dimension and a weight of an edge between any two nodes in the plurality of nodes according to the feature information of each node corresponding to each time dimension; determining a node feature matrix of the plurality of nodes corresponding to each time dimension based on the first sequence information of each node corresponding to each time dimension; constructing the graph model according to the weight of the edge between any two nodes in the plurality of nodes in each time dimension and the node feature matrix of the plurality of nodes corresponding to each time dimension.

3. The method of claim 1, wherein, The method of determining a plurality of first target nodes from the graph structure corresponding to at least one target time dimension comprises: obtaining the graph structure corresponding to the at least one target time dimension from the graph model; determining a first parameter corresponding to each first device node in the graph structure corresponding to the at least one target time dimension based on a PageRank algorithm; determining a second parameter corresponding to each first device node according to the first parameter of each first device node corresponding to the at least one target time dimension; sorting each first device node according to the second parameter corresponding to each first device node to determine a node arrangement sequence; determining, from the node arrangement sequence, at least one first target node arranged before a preset position.

4. The method of claim 1, wherein, The method further comprises, before the inputting the plurality of first characteristic information into the preset decision tree model to obtain a discrimination threshold value: inputting the plurality of first characteristic information into the preset decision tree model to obtain a discrimination threshold value; dividing the plurality of first characteristic information based on the discrimination threshold value to obtain at least one second characteristic information from the plurality of first characteristic information; determining the at least one second target node corresponding to the at least one second characteristic information.

5. The method of claim 4, wherein, The method further comprises, before the inputting the plurality of first characteristic information into the preset decision tree model to obtain a discrimination threshold value: obtaining user historical behavior data, the user historical behavior data comprising a plurality of characteristic information in at least two time dimensions; dividing the user historical behavior data into a first data set and a second data set based on a preset Gini index, the first data set comprising the abnormal user node and the characteristic information corresponding thereto, and the second data set comprising a non-abnormal user node and the characteristic information corresponding thereto; inputting the first data set and the second data set into an initial decision tree model, and performing pre-pruning on the initial decision tree model according to a preset depth to obtain the preset decision tree model.

6. The method of claim 1, wherein, The method further comprises, before the constructing the target graph structure based on the plurality of first target nodes, the at least one second target node, and the user node associated with each of the first target nodes: constructing a first graph structure based on the plurality of first target nodes, the at least one second target node, and the user node associated with each of the first target nodes; removing at least one first user node from the first target graph structure to obtain a second graph structure, wherein the first user node is a user node whose edge weight with the first target node is less than a preset threshold value and greater than zero; searching the second graph structure based on a Tarjan algorithm to determine the target graph structure, the target graph structure comprising at least three second user nodes and at least three edges, the at least three second user nodes being connected to form a closed loop through the at least three edges.

7. The method according to any one of claims 1 to 6, characterized in that, The plurality of nodes further comprises a residence node, and the method further comprises: determining at least one target residence node according to the characteristic information corresponding to the user node in the target graph structure; updating the target graph structure based on the at least one target residence node; removing at least one third user node from the updated target graph structure, the third user node being a user node whose residence time in the target residence node is less than a preset time length; identifying the abnormal user node in the target graph structure from which the at least one third user node is removed. 8.An abnormal object recognition device, characterized by comprising: The method further comprises: The first construction module is configured to construct a graph model based on a graph structure corresponding to at least one time dimension, the graph structure comprising a plurality of nodes and a plurality of edges, the plurality of nodes comprising user nodes, device nodes, website nodes, and application APP nodes, and the plurality of edges being used to represent an association relationship between any two nodes in the plurality of nodes; The first determination module is configured to determine a plurality of first target nodes from the graph structure corresponding to at least one target time dimension, the at least one time dimension comprising the target time dimension, and the first target nodes being the device nodes in the graph structure corresponding to the target time dimension; The second determination module is configured to input a plurality of first feature information into a preset decision tree model to determine a plurality of second target nodes, wherein the plurality of first feature information is feature information of a plurality of third target nodes corresponding to the at least one target time dimension, the third target nodes being the website nodes or the APP nodes in the graph structure corresponding to the target time dimension, the second target nodes being one of the plurality of third target nodes, and the second target nodes having the association relationship with at least one node in the plurality of first target nodes; The second construction module is configured to construct a target graph structure based on the plurality of first target nodes, the plurality of second target nodes, and user nodes associated with each of the first target nodes; The first identification module is configured to identify an abnormal user node in the target graph structure.

9. An electronic device, comprising: The computer program is executed by the processor to implement the steps in the abnormal object identification method according to any one of claims 1 to 8. The computer program is executed by the processor to implement the steps in the abnormal object identification method according to any one of claims 1 to 8.

10. A computer readable storage medium for storing a computer program, characterized in that, The computer program is executed by the processor to implement the steps in the abnormal object identification method according to any one of claims 1 to 8.

11. A computer program product, characterised in that, ​

Images