Abnormal merchant identification method, device and equipment and computer readable storage medium

Abstract

The embodiment of the invention provides an abnormal merchant identification method, device and equipment and a computer readable storage medium. The method comprises the following steps: constructing an initial network diagram according to feature data of a plurality of retailers; wherein the initial network graph is a weighted and directed graph, nodes of the initial network graph represent identifications of retailers, edges of the initial network graph represent a transaction relationship between two connected retailers, and weights of the edges represent the transaction closeness degree between the two retailers; acquiring specified analysis features, inputting the initial network graph and the analysis features into a community discovery algorithm, generating a new relation graph through the community discovery algorithm, and performing community division based on the new relation graph to obtain a plurality of communities; wherein the association strength among the nodes in the new relational graph depends on the transaction closeness and the similarity of the nodes on analysis characteristics; and determining an abnormal community from the plurality of communities, and determining an abnormal retailer in the plurality of retailers based on the abnormal community. According to the scheme, the abnormal retailer identification efficiency and accuracy are improved.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of data processing, in particular to an abnormal merchant identification method and device, equipment and a computer readable storage medium. BACKGROUND

[0002] At present, in the process of supervision of tobacco retailers, the tobacco administration mainly determines whether the tobacco retailers have behaviors that do not conform to the regulations by means of manual investigation. This method not only consumes a large amount of labor cost, but also may lead to unstable purchase data of the retailers due to population flow, thus resulting in inaccurate identification of abnormal retailers. SUMMARY

[0003] Embodiments of the present application provide an abnormal merchant identification method, device, equipment and a computer readable storage medium, aiming to solve the problem that manual investigation to determine whether the tobacco retailers have behaviors that do not conform to the regulations consumes a large amount of labor cost and is inaccurate.

[0004] In a first aspect, embodiments of the present application provide an abnormal merchant identification method, comprising:

[0005] According to the feature data of a plurality of retailers, an initial network graph is constructed; wherein the initial network graph is a weighted directed graph, the nodes of the initial network graph represent the identities of the retailers, the edges represent the existence of transaction relationship between the two connected retailers, and the weight of the edge represents the transaction closeness between the two retailers;

[0006] A specified analysis feature is obtained, and the initial network graph and the analysis feature are input into a community discovery algorithm, a new relationship graph is generated by the community discovery algorithm, and community division is performed based on the new relationship graph to obtain a plurality of communities; wherein the association strength between the nodes in the new relationship graph depends on the transaction closeness and the similarity of the nodes in the analysis feature;

[0007] An abnormal community is determined from the plurality of communities, and an abnormal retailer is determined among the plurality of retailers based on the abnormal community.

[0008] In a second aspect, embodiments of the present application provide an abnormal merchant identification device, comprising:

[0009] A graph construction module is configured to construct an initial network graph according to the feature data of a plurality of retailers; wherein the initial network graph is a weighted directed graph, the nodes of the initial network graph represent the identities of the retailers, the edges represent the existence of transaction relationship between the two connected retailers, and the weight of the edge represents the transaction closeness between the two retailers;

[0010] a community division module configured to obtain a specified analysis feature, input the initial network graph and the analysis feature into a community discovery algorithm, generate a new relationship graph by using the community discovery algorithm, and divide the communities based on the new relationship graph, to obtain a plurality of communities; wherein the association strength between nodes in the new relationship graph depends on the transaction closeness and the similarity of the nodes in the analysis feature;

[0011] an anomaly identification module configured to determine an anomaly community from the plurality of communities, and determine an anomaly retail outlet from the plurality of retail outlets based on the anomaly community.

[0012] In a third aspect, an embodiment of the present application provides a computer device, including a memory and a processor, the memory stores a computer program, and the processor implements the steps of the anomaly retail outlet identification method provided in the first aspect of the present application when executing the computer program.

[0013] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, which stores a computer program, and the computer program implements the steps of the anomaly retail outlet identification method provided in the first aspect of the present application when executed by a processor.

[0014] In a fifth aspect, an embodiment of the present application provides a computer program product, which stores a computer program, and the computer program implements the steps of the anomaly retail outlet identification method provided in the first aspect of the present application when executed by a processor.

[0015] The technical solution provided in the embodiments of the present application constructs an initial network graph based on the feature data of a plurality of retail outlets, and combines a specified analysis feature to perform fusion processing on the initial network graph by using a community discovery algorithm, to generate a new relationship graph, and divide the communities based on the new relationship graph, so that the divided communities not only consider the transaction closeness between nodes, but also comprehensively consider the similarity of the nodes in the analysis feature, that is, the association strength between nodes is fused with multi-dimensional features, based on the deep association of multi-dimensional features, it is able to discover anomaly retail groups that have no direct transaction but are associated through other feature dimensions, and the accuracy of identifying hidden and complex anomaly retail outlets is improved; in addition, it does not need manual on-site investigation, and saves the labor cost, and provides the efficiency of anomaly retail outlet identification. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 FIG. 1 is a flowchart of an anomaly retail outlet identification method provided in an embodiment of the present application;

[0017] Figure 2 FIG. 2 is another flowchart of an anomaly retail outlet identification method provided in an embodiment of the present application;

[0018] Figure 3A flowchart of a process of a node abnormal risk score calculation process provided by an embodiment of the present application is shown in the figure;

[0019] Figure 4 A structural diagram of an abnormal merchant identification device provided by an embodiment of the present application is shown in the figure.

[0020] Figure 5 A structural diagram of a computer device provided by an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions in the embodiments of the present application are further described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only used to explain the present application and not to limit the present application, and those skilled in the art can make adjustments as needed to adapt to specific application occasions. In addition, it should be noted that, in order to facilitate description, only parts related to the present application are shown in the drawings, not all structures.

[0022] First, some of the terms in the embodiments of the present application are explained below to facilitate understanding by those skilled in the art.

[0023] A graph is a figure composed of a number of given vertices and edges connecting two vertices. Such a figure is often used to describe a certain specific relationship between certain entities. The vertices are used to represent entities, and the edges connecting two vertices are used to represent that the two entities have such a specific relationship.

[0024] Community discovery reflects the locality of individual behavior in the network and the correlation between them. Studying the community in the network plays a crucial role in understanding the structure and function of the entire network and helps to analyze and predict the interaction between elements in the entire network. It can be based on a community discovery algorithm optimized by modularity to divide the community.

[0025] In the existing tobacco supervision process, the abnormal retail outlets are usually found by manual investigation, but this method not only consumes labor costs, but also has low identification accuracy. Therefore, the technical solutions provided by the embodiments of the present application construct an initial network graph of transactions between retail outlets through feature data of the retail outlets, divide the retail outlets into communities in combination with the initial network graph, specified analysis features and a community discovery algorithm, identify abnormal communities from the abnormal communities, and identify abnormal retail outlets from the abnormal communities, thereby reducing the labor cost input and improving the efficiency and accuracy of abnormal retail outlet identification.

[0026] Figure 1 A flowchart of an abnormal merchant identification method provided by an embodiment of the present application is shown in the figure. Figure 1 As shown in the figure, the method can include:

[0027] S101, constructing an initial network graph according to feature data of a plurality of retailers.

[0028] The initial network graph is a weighted directed graph, the nodes of the initial network graph represent the identities of the retailers, the edges represent the existence of a transaction relationship between two connected retailers, and the weight of the edge represents the transaction closeness between the two retailers.

[0029] The feature data of the plurality of retailers related to tobacco is obtained from various data sources (for example, a tobacco monopoly system, a marketing system, and an internal management system), and the feature data includes but is not limited to operating feature data, purchase feature data, location feature data, and case investigation feature data.

[0030] For example, the operating feature data can include retailer code, retailer name, operating area, operating time, consumer group positioning, payment method, historical monthly sales, license information, whether it is a key management household, etc. The purchase feature data can include purchase quantity, purchase amount, cigarette brands involved in purchase, cigarette barcodes, cigarette specifications, order satisfaction rate, order unit price, order status, order date, order number, etc. The location feature data can include whether it is an offline store address, store address, store latitude and longitude, etc. The case investigation feature data refers to the result information of the retailer investigation in the market supervision activities, including the involved cigarette brands, quantity, authenticity, amount, source, involved object, and handling measures, etc.

[0031] After obtaining the feature data of the plurality of retailers, the feature data is cleaned, and the cleaning methods include but are not limited to missing filling, deduplication, error correction, and standardization operations, etc. to eliminate feature data noise and unify format specifications, providing an accurate data basis for subsequent construction of a social relationship network (i.e., the initial network graph described below).

[0032] In combination with the feature data of the plurality of retailers, the retailers with a transaction relationship are determined, the retailer identity is taken as a node, an edge is connected between the nodes corresponding to the retailers with a transaction relationship, and an initial network graph is generated according to all nodes and edges. The initial network graph is a weighted directed graph, and the weight of the edge can be calculated by the frequency and amount of transactions to represent the transaction closeness between the two retailers connected by the edge. In addition, the remaining features other than the features of the nodes and edges (for example, device identity, case identity, timestamp, IP address, transfer account, etc.) can be taken as attributes of the edge.

[0033] S102, obtaining a specified analysis feature, and inputting the initial network graph and the analysis feature into a community discovery algorithm, generating a new relationship graph through the community discovery algorithm, and dividing the community based on the new relationship graph to obtain a plurality of communities.

[0034] The initial network graph is fused based on the analysis features by a community discovery algorithm to generate a new relationship graph. The association strength between nodes in the new relationship graph is determined by the transaction closeness in the initial network graph and the similarity of the nodes in the analysis features. Then, community division is performed based on the new relationship graph to obtain multiple communities. In this way, the community discovery algorithm can discover groups that are not only closely related in transaction relationships but also highly similar in specified analysis features. For example, even if some retail outlets do not have a direct transaction relationship, the community discovery algorithm can identify potential abnormal groups by enhancing the association strength between them and dividing them into the same community, because they use the same transfer account (analysis feature).

[0035] Optionally, the analysis features include, but are not limited to, at least one of the following: device identification, geographic location information, logistics information, IP address, transfer account, case investigation information. That is, the community discovery algorithm divides retail outlets that use the same transaction device, are in the same cigarette investigation case, and are highly similar in the dimensions of geographic location, logistics information, IP address, and / or fund channel into the same community through analysis features, to identify potential abnormal retail outlets.

[0036] The community discovery algorithm described above can be a label propagation algorithm (LPA), Louvain community discovery, fast community discovery algorithm (Fast Unfolding), etc. Other graph clustering or community discovery algorithms such as weighted LPA algorithm, community discovery algorithm (GN) can also be used, and the embodiments of the present application do not limit this.

[0037] S103, determining an abnormal community from the multiple communities, and determining an abnormal retail outlet from the multiple retail outlets based on the abnormal community.

[0038] In some embodiments, known historical abnormal retail outlets can be obtained from historical case investigation information, and a community containing at least one historical abnormal retail outlet is marked as an abnormal community. Further, for each node in the abnormal community, the association strength between the node and the historical abnormal retail outlet in the new relationship graph is calculated, and a retail outlet corresponding to a node with an association strength higher than a preset strength threshold is determined as an abnormal retail outlet.

[0039] In this way, the system can use known abnormal retail outlets as "seeds" to accurately locate other closely related and behaviorally similar suspects in the community where the known abnormal retail outlets are located. For example, even if a retail outlet B is not recorded in historical cases, it shows a high association strength (such as frequent transactions and use of the same device) with a known abnormal retail outlet A in the new relationship graph, i.e., the retail outlet B is identified as a new abnormal retail outlet.

[0040] The abnormal merchant identification method provided by the embodiments of the present application, through the feature data of a plurality of retail merchants, constructs an initial network graph, and combines a specified analysis feature to perform fusion processing on the initial network graph through a community discovery algorithm, generates a new relationship graph, and performs community division based on the new relationship graph, so that the divided community not only considers the transaction closeness between nodes, but also comprehensively considers the similarity of each node in the analysis feature, that is, the association strength between nodes is fused with multi-dimensional features. Based on the deep association of multi-dimensional features, it can discover abnormal retail gangs that have no direct transaction but are associated through other feature dimensions, thereby improving the accuracy of identifying hidden and complex abnormal retail merchants. In addition, without manual on-site investigation, the cost of manpower is saved, and the efficiency of identifying abnormal retail merchants is improved.

[0041] In one embodiment, optionally, before constructing an initial network graph according to the feature data of a plurality of retail merchants, the method further comprises:

[0042] Obtain original features from a data source, and calculate the missing rate of each original feature; filter a candidate feature set from all original features based on the missing rate; calculate the contribution score of each candidate feature in the candidate feature set to a preset prediction target using the SHAP method; the preset prediction target is used to identify whether a retail merchant is an abnormal retail merchant; determine an initial core feature set based on the contribution score of each candidate feature; calculate the association degree between each two features in the initial core feature set; for any two features with an association degree exceeding a preset threshold, delete the one with a lower contribution score from the two features, and determine the remaining features in the initial core feature set as feature data used to construct the initial network graph.

[0043] Specifically, original features are obtained from each data source, for example, a plurality of retail merchant and tobacco related original feature data are obtained from a tobacco monopoly system, a marketing system and an internal control system; the missing rate of each original feature data is counted, and the original feature data with a missing rate less than or equal to a preset threshold is taken as candidate feature data, and the original feature data with a higher missing rate is discarded, thereby obtaining a candidate feature set; further, the SHAP method is used to calculate the contribution score of each candidate feature in the candidate feature set to the abnormal retail merchant identification task / target, and the top preset number of candidate features with the highest contribution score are selected and added to the initial core feature set; further, the association degree between each two features in the initial core feature set can be calculated based on the Pearson correlation coefficient, for any two features with an association degree exceeding a preset threshold, the one with a lower contribution score is deleted from the two features, and if the contribution scores of the two features are the same, only one of the two features is retained, and the redundant feature is deleted, and the remaining features in the initial core feature set are determined as feature data used to construct the initial network graph.

[0044] Through the screening process of the feature data, the quality of the feature data can be improved, and thus the accuracy of identifying the abnormal retail outlet can be further improved.

[0045] In one embodiment, as shown in FIG. 1A, S103 can include: Figure 2

[0046] S201, for each community, calculating an abnormal risk score of each node in the community, and determining an abnormal risk score of the community based on the abnormal risk score of each node.

[0047] In some examples, based on the new relationship graph, a vectorized representation of each node in the community can be obtained, and an arithmetic mean of the vectorized representations of all nodes in the community is calculated to obtain a community center vector representing the overall properties of the community; for each node in the community, the spatial distance (e.g., Euclidean distance or cosine distance, etc.) between its vectorized representation and the community center vector is calculated; and based on the obtained spatial distance, the abnormal risk score of the node is determined. It can be understood that the greater the distance value, the more the node deviates from the collective mode of the community it belongs to in terms of transaction behavior and analysis features, i.e., the more “unfitting”, and thus the higher the abnormal risk score of the node.

[0048] S202, based on the abnormal risk scores of the communities, determining an abnormal community in the plurality of communities.

[0049] S203, determining a retail outlet in the abnormal community whose abnormal risk score is greater than a preset threshold as an abnormal retail outlet.

[0050] Optionally, as shown in FIG. 1A, the abnormal risk score of each node in the community can be determined through the following process: Figure 3

[0051] S301, for each current node, determining a feature deviation value based on the feature data of the current node, the feature data of the out-edge neighbor node of the current node, and the out-edge weight from the current node to the out-edge neighbor node.

[0052] The feature deviation value is used to represent the degree of feature difference between the current node and the out-edge neighbor node. The out-edge neighbor node refers to a node that has an edge with the current node and is pointed to by the current node. Optionally, the feature deviation value between the current node and the out-edge neighbor node can be determined by the following formula or variations of the formula :

[0053] ;

[0054] wherein, represents a set of out-edge neighbor nodes of the current node i, represents the numerical feature data of the current node i,​​ denotes the numerical feature data of the out-neighbor node j, denotes the out-edge weight between the current node i and the out-neighbor node j.

[0055] S302, determine the mean and standard deviation of all out-edge weights of the current node, and determine the weight deviation value based on the mean and the standard deviation.

[0056] The weight deviation value is used to represent the fluctuation degree of the out-edge weight of the current node. Optionally, the weight deviation value of the current node can be determined by the following formula or a variant of the formula :

[0057] ;

[0058] wherein, denotes the mean of all out-edge weights of the current node, denotes the standard deviation of all out-edge weights of the current node.

[0059] S303, determine the abnormal risk score of the current node according to the feature deviation value and the weight deviation value.

[0060] The greater the feature deviation value between the current node and the out-neighbor node, the higher the abnormal risk of the current node, and the higher the abnormal risk score thereof. The greater the weight deviation value of the current node, the more uneven the distribution of the out-edge weight thereof, which may imply that the current node has abnormal behavior, and the higher the abnormal risk score thereof.

[0061] Therefore, the feature deviation value between the current node and the out-neighbor node and the weight deviation value of the current node can be comprehensively considered to determine the abnormal risk score of the current node. Optionally, the feature deviation value between the current node and the out-neighbor node and the weight deviation value of the current node can be weighted and summed, and the weighted sum result is determined as the abnormal risk score of the current node. The weighting weight can be set in combination with expert experience.

[0062] After determining the abnormal risk score of each node in the community, the mean of the abnormal risk scores of the nodes can be taken as the abnormal risk score of the community, and the community with an abnormal risk score greater than a preset threshold is determined as an abnormal community.

[0063] Further, a preset number of retail outlets with the highest abnormal risk score in the abnormal community are determined as abnormal retail outlets, or the retail outlets with an abnormal risk score greater than a preset threshold in the abnormal community are determined as abnormal retail outlets.

[0064] Optionally, after determining the abnormal retail outlet, the risk level of the abnormal retail outlet can also be determined based on the abnormal risk score of the abnormal retail outlet, and the corresponding risk control processing strategy is triggered according to the risk level of the abnormal retail outlet.

[0065] In some examples, the risk level of the abnormal retail outlet in which the abnormal risk score of the abnormal retail outlet is located can be determined in combination with a preset mapping relationship between the abnormal risk score and the risk level. For the abnormal retail outlet with a higher risk level, a high-risk-level processing strategy is directly triggered, for example, the ordering authority of the abnormal retail outlet is suspended, and an emergency inspection procedure is simultaneously started. For the abnormal retail outlet with a lower risk level, a low-risk-level processing strategy is triggered, for example, tobacco monopoly related knowledge is pushed to the abnormal retail outlet through a message platform or warning reminder information for operation is sent.

[0066] By differentiating management of abnormal retail outlets with different risk levels, the inspection resources are saved, and the response speed of risk events is improved by automatically triggering the risk control processing strategy.

[0067] Figure 4 A structural schematic diagram of an abnormal retail outlet identification device provided by an embodiment of the present application is shown in FIG. 1. Figure 4 As shown in the figure, the device can include a graph construction module 401, a community division module 402, and an abnormality identification module 403.

[0068] Specifically, the graph construction module 401 is configured to construct an initial network graph according to feature data of a plurality of retail outlets; the initial network graph is a weighted directed graph, a node of the initial network graph represents an identifier of a retail outlet, an edge represents that there is a transaction relationship between two connected retail outlets, and a weight of the edge represents a transaction closeness between the two retail outlets.

[0069] The community division module 402 is configured to obtain a specified analysis feature, input the initial network graph and the analysis feature into a community discovery algorithm, generate a new relationship graph through the community discovery algorithm, and divide the communities based on the new relationship graph to obtain a plurality of communities; the association strength between nodes in the new relationship graph depends on the transaction closeness and the similarity of the nodes in the analysis feature.

[0070] The abnormality identification module 403 is configured to determine an abnormal community from the plurality of communities, and determine an abnormal retail outlet in the plurality of retail outlets based on the abnormal community.

[0071] On the basis of the above-mentioned embodiments, the analysis feature can include but is not limited to at least one of the following:

[0072] device identifier, geographic location information, logistics information, IP address, transfer account, case inspection information.

[0073] On the basis of the above-mentioned embodiments, optionally, the anomaly identification module 403 is further configured to calculate, for each community, an anomaly risk score of each node in the community, and determine an anomaly risk score of the community based on the anomaly risk scores of the nodes; and determine an anomaly community in the plurality of communities based on the anomaly risk scores of the communities.

[0074] On the basis of the above-mentioned embodiments, optionally, the anomaly identification module 403 is further configured to, for each current node, determine a feature deviation value according to the feature data of the current node, the feature data of the out-edge neighbor nodes of the current node, and the out-edge weights from the current node to the out-edge neighbor nodes; the feature deviation value is used to represent the feature difference degree between the current node and the out-edge neighbor nodes; determine the mean value and the standard deviation of all out-edge weights of the current node, and determine a weight deviation value based on the mean value and the standard deviation; the weight deviation value is used to represent the fluctuation degree of the out-edge weights of the current node; and determine the anomaly risk score of the current node according to the feature deviation value and the weight deviation value.

[0075] On the basis of the above-mentioned embodiments, optionally, the anomaly identification module 403 is further configured to determine a retail outlet with an anomaly risk score greater than a preset threshold in the anomaly community as an anomaly retail outlet.

[0076] On the basis of the above-mentioned embodiments, optionally, the device further comprises a risk warning module.

[0077] Specifically, the risk warning module is further configured to determine a risk level of the anomaly retail outlet based on the anomaly risk score of the anomaly retail outlet; and trigger a corresponding risk control disposal strategy according to the risk level.

[0078] On the basis of the above-mentioned embodiments, optionally, the device further comprises a data acquisition module.

[0079] Specifically, the data acquisition module is further configured to acquire original features from a data source, and calculate the missing rates of the original features; select a candidate feature set from all the original features based on the missing rates; calculate the contribution scores of each candidate feature in the candidate feature set to a preset prediction target using a SHAP method; the preset prediction target is used to identify whether a retail outlet is an anomaly retail outlet; determine an initial core feature set based on the contribution scores of the candidate features; calculate the correlation degrees between two features in the initial core feature set; for any two features with a correlation degree exceeding a preset threshold, delete the feature with a lower contribution score from the two features, and determine the remaining features in the initial core feature set as feature data used to construct an initial network graph.

[0080] Figure 5 A structural schematic diagram of a computer device provided by the embodiments of the present application is shown in FIG. 1. Figure 5As shown, the computer device includes a processor 50, a memory 51, an input device 52 and an output device 53; the number of processors 50 in the computer device can be one or more, Figure 5 The processor 50 in the computer device is taken as an example in this embodiment; the processor 50, the memory 51, the input device 52 and the output device 53 in the computer device can be connected through a bus or other means, Figure 5 The connection through the bus is taken as an example in this embodiment.

[0081] The memory 51 as a computer readable storage medium can be used to store software programs, computer executable programs and modules, such as program instructions / modules (such as the graph construction module 401, the community division module 402 and the abnormality identification module 403) corresponding to the abnormal merchant identification method in the embodiment of the present application. The processor 50 executes the software programs, instructions and modules stored in the memory 51, thereby performing various functional applications and data processing of the device, i.e. implementing the abnormal merchant identification method provided in any of the above embodiments.

[0082] The memory 51 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system and application programs required by at least one function; the data storage area can store data involved in the abnormal merchant identification process provided in the above embodiments and the like. In addition, the memory 51 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device or other non-volatile solid-state storage device. In some examples, the memory 51 can further include a memory remotely arranged with respect to the processor 50, which can be connected to the device / terminal / server through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network and a combination thereof.

[0083] The input device 52 can be used to receive input digital or character information, and generate key signal input related to user settings and function control of the computer device. The output device 53 can include a display device such as a display screen.

[0084] In one embodiment, a computer readable storage medium having a computer program stored thereon is also provided, and the computer program is executed by a processor to implement the steps of the abnormal merchant identification method provided in any of the above embodiments.

[0085] In one embodiment, a computer program product having a computer program stored thereon is also provided, and the computer program is executed by a processor to implement the steps of the abnormal merchant identification method provided in any of the above embodiments.

[0086] The abnormal merchant identification device, the computer device, the computer readable storage medium and the computer program product provided in the above embodiments can execute the abnormal merchant identification method provided in any embodiment of the present application, and have the corresponding function modules and beneficial effects of executing the method. Technical details not described in detail in the above embodiments can be referred to the abnormal merchant identification method provided in any embodiment of the present application.

[0087] Through the above description of the embodiments, those skilled in the art can clearly understand that the present application can be realized by means of software and necessary general hardware, and of course can also be realized by hardware, but in many cases the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product can be stored in a computer readable storage medium, such as a floppy disk, a read-only memory (ROM), a random access memory (RAM), a FLASH memory, a hard disk or an optical disk, etc., including a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of various embodiments of the present application.

[0088] It is worth noting that each unit and module included in the above embodiments is only divided according to the function logic, but is not limited to the above division, as long as the corresponding function can be realized; in addition, the specific name of each functional unit is only for easy mutual distinction, and does not limit the protection scope of the present application.

[0089] Note that the above are only preferred embodiments of the present application and the technical principles applied. Those skilled in the art will understand that the present application is not limited to the specific embodiments herein, and those skilled in the art can make various obvious changes, readjustments and substitutions without departing from the scope of the present application. Therefore, although the present application has been described in more detail through the above embodiments, the present application is not limited to the above embodiments, and can include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the appended claims.

Claims

1. A method for identifying abnormal merchants, characterized in that, include: An initial network graph is constructed based on the characteristic data of multiple retailers; wherein, the initial network graph is a weighted and directed graph, the nodes of the initial network graph represent the identifiers of retailers, the edges represent the transaction relationship between two connected retailers, and the weight of the edges represents the degree of transaction closeness between the two retailers; The algorithm acquires specified analytical features and inputs the initial network graph and the analytical features into a community discovery algorithm. The algorithm generates a new relationship graph and performs community segmentation based on the new relationship graph to obtain multiple communities. The correlation strength between nodes in the new relationship graph depends on the transaction closeness and the similarity of nodes on the analytical features. Identify anomalous communities from the plurality of communities, and identify anomalous retailers from the plurality of retailers based on the anomalous communities.

2. The method according to claim 1, characterized in that, The analytical features include, but are not limited to, at least one of the following: Equipment identification, geographical location information, logistics information, IP address, bank transfer account, and case investigation information.

3. The method according to claim 1, characterized in that, Identify anomalous communities from the aforementioned communities, including: For each community, calculate the abnormal risk score of each node in the community, and determine the abnormal risk score of the community based on the abnormal risk score of each node. Based on the abnormal risk scores of each community, abnormal communities among the multiple communities are identified.

4. The method according to claim 3, characterized in that, The calculation of the abnormal risk score for each node in the community includes: For each current node, a feature deviation value is determined based on the feature data of the current node, the feature data of the outgoing neighbor nodes of the current node, and the outgoing edge weight from the current node to the outgoing neighbor node; the feature deviation value is used to represent the degree of feature difference between the current node and the outgoing neighbor node. Determine the average and standard deviation of all outgoing edge weights of the current node, and determine the weight deviation value based on the average and standard deviation; the weight deviation value is used to characterize the degree of fluctuation of the outgoing edge weights of the current node; The abnormal risk score of the current node is determined based on the feature deviation value and the weight deviation value.

5. The method according to claim 3, characterized in that, Based on the identification of abnormal retailers among the multiple retailers, the following abnormal retailers are identified: Retailers in the abnormal community whose abnormal risk score is greater than a preset threshold are identified as abnormal retailers.

6. The method according to claim 5, characterized in that, Also includes: Based on the abnormal risk score of the abnormal retailer, the risk level of the abnormal retailer is determined; Based on the risk level, the corresponding risk control and response strategy will be triggered.

7. The method according to claim 1, characterized in that, Before constructing the initial network graph based on the characteristic data of multiple retailers, the following steps are also included: Obtain the original features from the data source and calculate the missing rate of each original feature; Based on the missing rate, a candidate feature set is selected from all the original features; The contribution score of each candidate feature in the candidate feature set to a preset prediction target is calculated using the SHAP method; the preset prediction target is used to identify whether a retailer is an abnormal retailer. Based on the contribution scores of each candidate feature, the initial core feature set is determined; Calculate the correlation degree between each pair of features in the initial core feature set; For any two features whose correlation exceeds a preset threshold, the feature with the lower contribution score is removed from the two features, and the remaining features in the initial core feature set are determined as feature data for constructing the initial network graph.

8. An abnormal merchant identification device, characterized in that, include: The graph construction module is used to construct an initial network graph based on the feature data of multiple retailers. The initial network graph is a weighted and directed graph, where the nodes represent the identifiers of retailers, the edges represent the transaction relationship between two connected retailers, and the weight of the edges represents the degree of transaction closeness between the two retailers. The community segmentation module is used to acquire specified analytical features, input the initial network graph and the analytical features into the community discovery algorithm, generate a new relationship graph through the community discovery algorithm, and perform community segmentation based on the new relationship graph to obtain multiple communities; wherein, the correlation strength between nodes in the new relationship graph depends on the transaction closeness and the similarity of nodes on the analytical features; An anomaly identification module is used to identify abnormal communities from the multiple communities, and to identify abnormal retailers from the multiple retailers based on the abnormal communities.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images