A method for identifying abnormal nodes based on node association relationships

Abstract

This invention relates to the field of data processing technology, and in particular to an abnormal node judgment method based on node association relationships. The method aggregates enterprise nodes into comprehensive nodes based on association hierarchy and first association degree, and constructs an enterprise-level knowledge graph containing connection relationships and second association degrees. This abstracts the complex relationships of massive enterprise nodes into a hierarchical structure, reducing graph complexity and quantifying the association strength between nodes. By combining node connection relationships and second association degrees, the method filters target paths from abnormal enterprise nodes to target enterprise nodes, improving the efficiency and accuracy of enterprise node anomaly judgment. By comprehensively considering the reference anomaly degree of abnormal enterprise nodes, the importance of each comprehensive node in the target path, and the second association degree between comprehensive nodes, the target anomaly degree is calculated to determine the node type, achieving rapid and accurate anomaly judgment of target enterprise nodes.

Description

[0001] This application claims priority to Chinese patent application filed on August 12, 2025 (application number: 202511120617.1, invention title: A method and system for judging enterprise node anomalies based on knowledge graph), the entire contents of which are incorporated herein by reference. Technical Field

[0002] This invention relates to the field of data processing technology, and in particular to a method for judging abnormal nodes based on node association relationships. Background Technology

[0003] Existing methods for anomaly detection based on node relationships typically construct graphs directly on a per-enterprise-node basis when performing path planning and anomaly detection on massive amounts of enterprise node data. The number of edges increases quadratically with the number of nodes. When dealing with millions of enterprise nodes, path planning requires traversing billions of edges, resulting in excessively long computation times and an inability to meet the needs of anomaly detection in a timely manner. Furthermore, the graphs constructed by existing methods do not effectively quantify the strength of relationships between enterprises, which may lead to path planning results that select long-distance, low-value indirect paths, reducing the effectiveness and reliability of anomaly detection.

[0004] Therefore, improving the efficiency and accuracy of anomaly detection for enterprise nodes based on knowledge graphs has become an urgent problem to be solved. Summary of the Invention

[0005] To address the aforementioned technical problems, the present invention provides a method for identifying abnormal nodes based on node association relationships. This method includes the following steps: S10. Based on the association hierarchy between each enterprise node and other enterprise nodes in the enterprise node set, and the first association degree between each enterprise node and other enterprise nodes with the corresponding association hierarchy of level 1, an enterprise-level knowledge graph is obtained. The association hierarchy includes levels 1 to N. The enterprise-level knowledge graph is constructed from several comprehensive nodes, the connection relationship between comprehensive nodes and the second association degree. Each comprehensive node is composed of several enterprise nodes. The second association degree is based on the first association degree. The connection relationship is either connected or non-connected.

[0006] S20: Identify the enterprise nodes that have anomalies in the enterprise node set as abnormal enterprise nodes, and identify the enterprise nodes to be detected as target enterprise nodes.

[0007] S30: Based on the connection relationships and second degree of association between nodes in the enterprise-level knowledge graph, obtain the target path between the abnormal enterprise node and the target enterprise node.

[0008] S40: Based on the reference anomaly degree of the abnormal enterprise node, several comprehensive nodes in the target path, and all the second association degrees corresponding to the target path, obtain the target anomaly degree corresponding to the target enterprise node.

[0009] S50: Based on the target abnormality level and the preset abnormality level threshold corresponding to the target enterprise node, obtain the node type corresponding to the target enterprise node, wherein the node type is an abnormal node or a non-abnormal node.

[0010] The present invention also provides an abnormal node judgment system based on node association relationships, the abnormal node judgment system based on node association relationships includes: The knowledge graph construction module is used to obtain an enterprise-level knowledge graph based on the association hierarchy between each enterprise node and other enterprise nodes in the enterprise node set, and the first degree of association between each enterprise node and other enterprise nodes with the corresponding association hierarchy of level 1. The association hierarchy includes level 1 to level N. The enterprise-level knowledge graph is constructed from several comprehensive nodes, the connection relationship between comprehensive nodes and the second degree of association. Each comprehensive node is composed of several enterprise nodes. The second degree of association is based on the first degree of association. The connection relationship is either connected or non-connected.

[0011] The enterprise node extraction module is used to identify abnormal enterprise nodes in the enterprise node set as abnormal enterprise nodes and to identify enterprise nodes to be detected as target enterprise nodes.

[0012] The target path acquisition module is used to obtain the target path between the abnormal enterprise node and the target enterprise node based on the connection relationship and second degree of association between the comprehensive nodes in the enterprise-level knowledge graph.

[0013] The target anomaly degree acquisition module is used to obtain the target anomaly degree corresponding to the target enterprise node based on the reference anomaly degree of the anomaly enterprise node, several comprehensive nodes in the target path, and all the second association degrees corresponding to the target path.

[0014] The node type determination module is used to obtain the node type corresponding to the target enterprise node based on the target abnormality level and the preset abnormality level threshold. The node type is either an abnormal node or a non-abnormal node.

[0015] This invention has at least the following beneficial effects: By aggregating enterprise nodes based on association hierarchy and first degree of association to form comprehensive nodes, and constructing an enterprise-level knowledge graph containing connection relationships and second degree of association, it enables the abstraction of the complex relationships of massive enterprise nodes into a hierarchical structure, significantly reducing graph complexity and path planning computation, while quantifying the association strength between nodes, providing a data foundation for accurate path planning and anomaly detection; by clearly distinguishing between abnormal enterprise nodes and target enterprise nodes, it transforms indiscriminate global anomaly detection into local analysis focusing on specific nodes, reducing invalid computation, clarifying anomaly detection targets, and improving the efficiency and targeting of anomaly analysis; by using comprehensive nodes as units and combining node connection relationships and second degree of association to filter abnormal enterprise nodes to target nodes... The target path for enterprise nodes enables rapid location of high-value paths within a hierarchical knowledge graph, avoiding blind searches and improving the efficiency and accuracy of path planning. By comprehensively considering the reference anomaly degree of abnormal enterprise nodes, the importance of each comprehensive node in the target path, and the degree of secondary association between comprehensive nodes, it is possible to accurately quantify the transmission of anomalies along the target path based on multi-dimensional factors, and quantify the target anomaly degree of the target enterprise node, avoiding single-factor assessment errors and providing enterprises with more reliable risk assessment data. By comparing the target anomaly degree of the target enterprise node with a preset threshold to determine the node type, the complex risk assessment results are transformed into intuitive and standardized decision signals, enabling rapid and accurate anomaly judgment of the target enterprise node. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A flowchart of an abnormal node judgment method based on node association relationship provided in Embodiment 1 of the present invention; Figure 2 This is a schematic diagram of an abnormal node judgment system based on node association relationship provided in Embodiment 2 of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It is understood that, where appropriate, the terms used to distinguish similar objects can be interchanged so that the invention can also be implemented in other embodiments besides the illustrated or described embodiments. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products, or devices.

[0020] Example 1 This first embodiment provides a method for judging abnormal nodes based on node association relationships, such as... Figure 1 As shown, the abnormal node detection method based on node association includes the following steps: S10. Based on the association hierarchy between each enterprise node and other enterprise nodes in the enterprise node set, and the first association degree between each enterprise node and other enterprise nodes with the corresponding association hierarchy of level 1, an enterprise-level knowledge graph is obtained. The association hierarchy includes levels 1 to N. The enterprise-level knowledge graph is constructed from several comprehensive nodes, the connection relationship between comprehensive nodes and the second association degree. Each comprehensive node is composed of several enterprise nodes. The second association degree is based on the first association degree. The connection relationship is either connected or non-connected.

[0021] Enterprise nodes are digital abstractions of real-world enterprises. Enterprises of all sizes are represented as nodes in the enterprise-level knowledge graph and are distinguished by unique identifiers (such as the enterprise's unified social credit code or enterprise name).

[0022] Association hierarchy is a hierarchical concept used to describe the closeness of relationships or the depth of business dealings between enterprise nodes. Level 1 represents enterprise nodes directly associated with the current enterprise node (e.g., having direct business cooperation, direct equity relationships, etc.). Level 2 represents enterprise nodes directly associated with the Level 1 enterprise nodes corresponding to the current enterprise node, and those indirectly associated, and so on, until all enterprise nodes in the set of enterprise nodes directly associated with the current enterprise node at level N are found to have an association hierarchy less than or equal to N. Then, the maximum value N of the association hierarchy corresponding to the current enterprise node is determined, and the enterprise nodes with level N association with the current enterprise node are identified. The larger the association hierarchy value, the more indirect and looser the relationship between the enterprise nodes.

[0023] The degree of first association is used to quantify the closeness of the business relationship between two first nodes. It can be calculated based on various factors, such as the volume of business transactions between the enterprises, the frequency of cooperation, and the equity ratio. For example, the larger the volume of business transactions, the higher the frequency of cooperation, and the larger the equity ratio between the two enterprises, the higher the degree of closeness between the two enterprise nodes, that is, the higher the degree of first association.

[0024] Based on the number of first nodes corresponding to the first-level relationships in the enterprise node set, the central node is determined, which represents the enterprise with strong direct influence in the enterprise network. By extracting core nodes layer by layer, it helps to build a comprehensive node system with clear hierarchy and no redundancy.

[0025] Then, using the central node as the core, based on the first degree of association between each enterprise node and other enterprise nodes at the first level of association, the connection relationship and second degree of association between the current comprehensive node and all other comprehensive nodes are obtained. An enterprise-level knowledge graph is constructed using the connection relationship and second degree of association between comprehensive nodes, which is used for path planning and abnormal node identification among all enterprise nodes. The second degree of association is used to quantify the tightness of the business relationship between two comprehensive nodes.

[0026] In one specific embodiment, S10 includes the following steps: S110, Based on the association hierarchy between each enterprise node and other enterprise nodes in the enterprise node set, select the central node from the enterprise node set and obtain the target hierarchy value M corresponding to the central node. Here, the target hierarchy value M is the largest association hierarchy covered when constructing a comprehensive node with the central node as the core, 1≤M≤N. S120, based on the central node and all enterprise nodes in the association hierarchy with the central node from the 1st to the Mth layer, forms the comprehensive node corresponding to the central node.

[0027] S130: Remove all enterprise nodes from the enterprise node set in the integrated node set. Repeat step S110 based on the removed enterprise node set until the enterprise node set is empty, and obtain all integrated nodes.

[0028] S140, for each integrated node, based on the association level between each enterprise node in the current integrated node and other enterprise nodes in the current integrated node, and the first association degree between each enterprise node in the current integrated node and each other enterprise node whose corresponding association level is level 1 and belongs to other integrated nodes, the connection relationship and second association degree between the current integrated node and each other integrated node are obtained.

[0029] S150: Based on the connection relationships and second degree of association between each integrated node and all other integrated nodes, obtain the enterprise-level knowledge graph corresponding to all enterprise nodes.

[0030] Among them, the central node is the enterprise node that occupies a core position in the enterprise node set, and the number of enterprise nodes directly and indirectly associated with it in the enterprise node set meets the preset judgment conditions. It plays a key hub role in the enterprise network and has an important influence on the relationship and business dealings between enterprises.

[0031] The target level value M is the largest associated level covered when constructing a comprehensive node with the central node as the core. It determines the selection range of enterprise nodes associated with the central node and directly affects the composition of the comprehensive node and the structure of the knowledge graph.

[0032] By employing a recursive, hierarchical filtering mechanism, the combined nodes and their constituent enterprise nodes are gradually extracted from the enterprise node set. This ensures that each iteration recalculates the central node and the combined node based on the remaining uncombined enterprise nodes. Furthermore, the size of the nodes processed in each iteration gradually decreases, avoiding redundant calculations of the entire dataset and significantly reducing time and space complexity.

[0033] A connected relationship means that the two corresponding integrated nodes are directly connected; a non-connected relationship means that the two corresponding integrated nodes are not directly connected.

[0034] By using the comprehensive nodes as nodes of the enterprise-level knowledge graph, and constructing the connection edges of the enterprise-level knowledge graph based on the connection relationships and the degree of second association between the comprehensive nodes, the enterprise-level knowledge graph can be obtained.

[0035] As described above, by selecting central nodes based on association hierarchy and determining the target hierarchy value M, the core hub nodes in the enterprise node network are accurately identified, and a reasonable sphere of influence for the central nodes is defined. By integrating the central nodes and their associated enterprise nodes at levels 1 to M into comprehensive nodes, the complex enterprise relationship network is abstracted into a structured node cluster, effectively reducing graph complexity, improving data processing efficiency, and enhancing the knowledge graph's ability to express enterprise relationship structures, making the knowledge graph structure more compact and focused. By recursively deleting processed nodes and repeatedly constructing comprehensive nodes, the massive number of enterprise nodes are systematically divided into non-repeating nodes. The stacked set of comprehensive nodes forms a hierarchical graph structure, avoiding data redundancy and improving the interpretability and compactness of the knowledge graph. By analyzing the association levels and degrees between comprehensive nodes, the connection strength between different node clusters is quantified, establishing a macro-level relationship network. By mapping the degree of association to edge length and constructing an enterprise-level knowledge graph, abstract enterprise relationships are transformed into a visual, computable, simplified, and highly compact graph model. This provides accurate weighting for path planning between enterprise nodes, significantly improving the efficiency and accuracy of path planning. At the same time, it supports multi-dimensional abnormal node judgment, enhancing the decision support capability of the knowledge graph.

[0036] In one specific embodiment, S110 includes the following steps: S111: For any enterprise node in the enterprise node set, based on the association level between the current enterprise node and other enterprise nodes, obtain the number of i-th nodes corresponding to all enterprise nodes with an association level of i-th layer with the current enterprise node, where i=1,2,...,N.

[0037] S112, based on the number of first nodes corresponding to each enterprise node, determine the enterprise node with the largest number of first nodes in the enterprise node set as the central node.

[0038] S113. Based on the number of nodes from the 1st to the Nth node corresponding to the central node, obtain the node category corresponding to the central node, where the node category is either a super node or a non-super node.

[0039] S114. If the node category corresponding to the central node is a super node, then the target level value M corresponding to the central node is obtained according to the number of the first node to the Nth node corresponding to the central node. The number of the first node to the Mth node corresponding to the central node satisfies the preset judgment condition, 1 < M ≤ N.

[0040] S115, if the node category corresponding to the central node is a non-super node, then determine the target level value M=1 corresponding to the central node.

[0041] The number of nodes i is the total number of all enterprise nodes that are associated with the current enterprise node at the i-th level, reflecting the influence and connection breadth of the current enterprise node at the i-th level of association.

[0042] There are different levels of association between enterprise nodes. By traversing each enterprise node in the enterprise node set and counting the number of other enterprise nodes that are at the i-th level of association with the current enterprise node, we can quantify the connection scale of each enterprise node at different levels of association from a quantitative perspective, providing basic data for the subsequent selection of central nodes.

[0043] The number of first nodes represents the degree of direct association between the corresponding enterprise node and other enterprise nodes. The higher the degree of direct association, the more prominent the core position of the enterprise node in the enterprise network. Therefore, the enterprise node with the largest number of first nodes in the enterprise node set is identified as the central node, thereby quickly identifying the enterprise with the strongest direct influence in the enterprise network.

[0044] By analyzing the connections of central nodes across multiple association levels (from the number of nodes 1 to the number of nodes N), central nodes are categorized. Correspondingly, if a central node has a high number of nodes across multiple levels, it indicates that its influence extends beyond directly related enterprises to a wider range of indirectly related enterprises, and it is defined as a super node. The target level value M is determined based on the number of nodes to meet preset judgment conditions, ensuring that the central node's influence is within a reasonable and representative range from level 1 to level M. This covers major related enterprises without causing information redundancy due to excessive levels, serving as the basis for enterprise node integration. Conversely, a non-super node, whose influence is mainly concentrated in directly related enterprise nodes (level 1), has weaker influence at higher levels. Therefore, directly determining the target level value M=1 for the central node helps to further refine the attributes and influence range of the central node. While ensuring information integrity, it avoids introducing too much irrelevant information due to excessive levels, making the constructed comprehensive nodes more refined and the knowledge graph structure clearer. This is beneficial for improving the accuracy and efficiency of path planning between enterprise nodes and the judgment of abnormal nodes.

[0045] Supernodes represent enterprise nodes with broad influence and deep, multi-layered connections within the enterprise network. Non-supernodes, on the other hand, represent enterprise nodes with relatively limited influence.

[0046] The above analysis, by statistically analyzing the number of nodes at different levels for each enterprise, provides quantitative indicators for subsequent selection of central nodes, making node selection more objective and scientific, avoiding the arbitrariness of subjective judgment. Using the number of the first node as the selection criterion, core enterprises can be efficiently located from a massive number of enterprise nodes, highlighting the key points of the knowledge graph and laying a good foundation for the subsequent formation of comprehensive nodes and the construction of the entire knowledge graph. By classifying the central nodes, the status and role of the central nodes in the enterprise network can be more accurately described, providing a more detailed basis for determining the target level value M. This allows the knowledge graph to more accurately reflect the complex relationship structure between enterprises, enhancing the analytical and application value of the knowledge graph. Determining an appropriate target level value M based on the characteristics of the central nodes can accurately delineate the range of enterprise nodes closely related to the central nodes. While ensuring information integrity, it avoids introducing too much irrelevant information due to too many levels, making the constructed comprehensive nodes more refined and the knowledge graph structure clearer. This is conducive to improving the accuracy and efficiency of path planning between enterprise nodes and the judgment of abnormal nodes.

[0047] In one specific implementation, the preset judgment condition is: The sum of the number of nodes from the first node to the (M-1)th node corresponding to the central node is less than a preset threshold, and the sum of the number of nodes from the first node to the Mth node corresponding to the central node is greater than or equal to the preset threshold.

[0048] The preset quantity threshold is a numerical standard pre-set by the implementer based on factors such as the size of the enterprise network and the sophistication of the knowledge graph construction. It serves as a key indicator for measuring whether the influence coverage of the central node is sufficient. The preset quantity threshold can be adjusted according to actual needs in different enterprise network scenarios. For example, for larger enterprise networks with complex relationships, the preset quantity threshold can be set relatively high to ensure that a sufficient number of enterprise nodes closely related to the central node are selected. Conversely, for smaller enterprise networks with relatively simpler relationships, the preset quantity threshold can be appropriately lowered.

[0049] This preset judgment condition determines the target level value M by comparing the cumulative number of nodes of the central node at different levels with a preset threshold. Correspondingly, in an enterprise network, the influence of the central node gradually weakens as the associated levels extend. When the cumulative number of nodes reaches or exceeds the preset threshold, it means that the level and its sub-levels have covered a sufficient number of associated enterprises of the central node, which can well represent the scope of the central node's influence. If more levels are added, the newly added associated enterprises contribute little to the influence of the central node, and instead introduce redundant information. Therefore, determining M based on this condition can ensure coverage of the main associated enterprises of the central node while avoiding information complexity caused by excessive extension of levels.

[0050] The aforementioned clearly defined pre-defined judgment conditions provide a clear and quantifiable standard for determining the target level value M, making the determination process of M more objective and standardized. This allows the selected M to accurately define the scope of enterprise nodes closely related to the central node. The constructed comprehensive node not only fully retains the core association information of the central node but also effectively reduces unnecessary hierarchical expansion. This helps to optimize the structure of the knowledge graph, reduce its complexity, and improve the efficiency and accuracy of subsequent path planning and abnormal node judgment based on the knowledge graph. Ultimately, this enhances the practicality and effectiveness of the knowledge graph in actual enterprise applications.

[0051] In one specific embodiment, S120 includes the following steps: S121, all enterprise nodes with association levels from level 1 to level M between the central node and the central node are designated as the first node.

[0052] S122, for any first node, based on the first association degree between each first node with the association level of the first layer and the current first node, obtain the first side length corresponding to the first side between each first node with the association level of the first layer and the current first node, wherein the first side length is negatively correlated with the corresponding first association degree.

[0053] S123. Based on all the first nodes and the first edge lengths corresponding to the central node, construct the enterprise subgraph corresponding to the central node, and regard the enterprise subgraph corresponding to the central node as the comprehensive node corresponding to the central node.

[0054] The higher the degree of first association, the closer the business relationship between the two enterprises. The degree of first association between each first node and other first nodes at the first level of association is transformed into the length of the first edge. A higher degree of first association corresponds to a shorter first edge, indicating a stronger relationship between the two first nodes. Conversely, a lower degree of first association corresponds to a longer first edge, indicating a weaker relationship between the two first nodes. Transforming the abstract degree of first association into an intuitive geometric distance facilitates the subsequent construction and analysis of enterprise sub-graphies.

[0055] The enterprise subgraph is centered around a central node and connects directly related enterprise nodes with second sides of varying lengths, visually demonstrating the relationship network between the central node and its associated enterprise nodes.

[0056] The above describes a method that uses a central node as the core and connects it layer by layer with second edges of varying lengths, forming layers 1 to M. This constructs an enterprise subgraph corresponding to the central node and treats it as a comprehensive node. This simplifies the structure of the knowledge graph at a higher level, abstracting complex subnetworks into single nodes for easier overall analysis and processing. This reduces computational load and improves the efficiency of path planning and anomaly detection when dealing with massive numbers of enterprise nodes. Furthermore, the comprehensive node retains key relationship information of its internal nodes, allowing for further expansion of the subgraph when deeper analysis is needed. This enables flexible application of the knowledge graph at different levels of abstraction.

[0057] In one specific embodiment, S140 includes the following steps: S141, each enterprise node with an association level of the Mth layer with the central node in the current integrated node is treated as an edge node in the current integrated node.

[0058] S142, each enterprise node in other integrated nodes whose association level with each edge node is the first layer is determined as the relevant node corresponding to the current integrated node, and the node pair consisting of each edge node and each corresponding relevant node is obtained.

[0059] S143, for any related node corresponding to the current integrated node, determine the connection relationship between the current integrated node and the integrated node to which the current related node belongs as a connection relationship.

[0060] S144, for any integrated node that is connected to the current integrated node, based on all node pairs corresponding to the current integrated node and any integrated node that is connected to the current integrated node, and the first degree of association between edge nodes and related nodes in each node pair, obtain the second degree of association between the current integrated node and any integrated node that is connected to the current integrated node.

[0061] S145, the connection relationship between the current integrated node and any related node in the current integrated node that does not include the current integrated node is determined as a non-connected relationship.

[0062] S146, The preset degree value is determined as the second degree of association between the current integrated node and the integrated node whose connection relationship with the current integrated node is not connected.

[0063] The edge influence of a comprehensive node is reflected through its uppermost layer (M layer) of enterprise nodes. These edge nodes have a weaker connection to the central node but can serve as interfaces connecting to external comprehensive nodes. Therefore, the enterprise nodes corresponding to the first-layer associated nodes of an edge node in other comprehensive nodes are considered as related nodes of the current comprehensive node, directly reflecting the interaction between the current comprehensive node and other comprehensive nodes. Furthermore, each related node and its corresponding edge node form a node pair, which can be further viewed as a node pair between the current comprehensive node corresponding to that edge node and the comprehensive node corresponding to that related node.

[0064] Furthermore, since there may be several enterprise nodes with a connection level of Level 1 between each edge node, there may be several node pairs between the current integrated node and any integrated node with a connection relationship with the current integrated node. Based on the first degree of association between the edge node and the related node in each node pair, and the association level between the related node in the node pair and the central node in its affiliated integrated node, the second degree of association between the current integrated node and any integrated node with a connection relationship with the current integrated node is obtained.

[0065] Specifically, the influence weight of a node pair can be set according to the association level between related nodes in each node pair and the central node in its parent node system. This weight is used to characterize the difference in influence of the node pair in measuring the degree of association between parent nodes. Correspondingly, lower-level related nodes are closer to the central node of their parent node system, closer to the core resources or relationships of the whole, and have a stronger relationship with the central node of their parent node system, making them less prone to fluctuations. Therefore, the association between lower-level related nodes and external edge nodes better represents the overall interaction capability of the parent node system. Thus, the association level is negatively correlated with the influence weight, and the influence weight can be set within the range of (0, 1) to maintain consistency in the units of measurement.

[0066] Furthermore, the first degree of association between edge nodes and related nodes in a node pair can be weighted and summed according to the influence weight to obtain the second degree of association between the current integrated node and any integrated node whose connection relationship with the current integrated node is connected.

[0067] For example, if the edge node a of the composite node A m If there is a Level 1 association between A and B's enterprise node b1 and the integrated node B, then it is considered that A and B are connected through a. m A connecting bridge was established between b1 and b1.

[0068] The preset degree value is 0, which indicates that there is no direct relationship between the corresponding integrated nodes.

[0069] As described above, by analyzing the relationships between comprehensive nodes, the modeling of relationships between nodes is transformed into a direct analysis of the relationships between boundary nodes, which reduces computational complexity. Furthermore, by filtering out non-connected relationships, the number of edges in the subsequent knowledge graph is significantly reduced. While maintaining the accuracy of relationships, computational efficiency and graph interpretability are greatly improved, thereby reducing the path search space and improving the efficiency of subsequent path planning between enterprise nodes.

[0070] In one specific embodiment, S150 includes the following steps: S151, for any two integrated nodes whose connection relationship is connected, obtain the second side length corresponding to the second side between the two integrated nodes according to the second association degree between the two integrated nodes, wherein the second side length is negatively correlated with the corresponding second association degree.

[0071] S152, based on all comprehensive nodes and the second side length of the second side between any two second nodes that are connected, construct the enterprise-level knowledge graph corresponding to all enterprise nodes.

[0072] In this method, the negative correlation mapping is used to transform the second degree of association into geometric distance, so that the association strength and physical distance can be intuitively correlated. This transforms the abstract association strength into a measurable physical attribute in the graph, which makes it easier for the path planning algorithm to directly use the second side length as weight to calculate the shortest path, thus improving the rationality of subsequent path planning.

[0073] Correspondingly, the higher the degree of second association, the shorter the corresponding second side length, indicating that the two integrated nodes are spatially closer in the graph. The lower the degree of second association, the longer the corresponding second side length, indicating that the two integrated nodes are spatially farther apart in the graph.

[0074] Those skilled in the art will recognize that any path planning algorithm in the prior art falls within the protection scope of this invention, such as Dijkstra's algorithm, A* algorithm, BSF algorithm, and ant colony algorithm, which will not be elaborated here.

[0075] S20: Identify the enterprise nodes that have anomalies in the enterprise node set as abnormal enterprise nodes, and identify the enterprise nodes to be detected as target enterprise nodes.

[0076] Among them, abnormal enterprise nodes are nodes identified based on historical data, real-time monitoring, or external early warning systems, corresponding to enterprises currently facing operational risks, data anomalies, or violations. In this embodiment, an abnormal enterprise node is selected as the starting point for anomaly propagation analysis to trace the impact path of the anomaly on other enterprise nodes. For example, an enterprise exhibiting abnormal fluctuations in financial indicators, frequent default records, or cybersecurity vulnerabilities can be marked as an abnormal enterprise node.

[0077] Target enterprise nodes are selected based on business needs (such as risk control and supply chain stability analysis) to focus on detecting whether they are affected by anomalies. These nodes serve as the endpoint for anomaly detection. By analyzing the correlation paths with anomalous enterprise nodes, the system determines whether the target enterprise node poses an anomaly risk. For example, in a supply chain scenario, the target enterprise node might be a direct or indirect supplier or partner of the anomalous enterprise.

[0078] The above approach provides a clear objective for path planning by identifying abnormal enterprise nodes and target enterprise nodes, narrowing the detection scope to the set of nodes involved in the associated paths of the two, avoiding blind searches, significantly reducing computational load, and supporting real-time updates of abnormal enterprise nodes and target enterprise nodes to adapt to dynamic changes in the enterprise network.

[0079] S30: Based on the connection relationships and second degree of association between nodes in the enterprise-level knowledge graph, obtain the target path between the abnormal enterprise node and the target enterprise node.

[0080] In one specific embodiment, S30 includes the following steps: S310: Based on the several enterprise nodes included in each integrated node, take the integrated node to which the abnormal enterprise node belongs as the starting node and the integrated node to which the target enterprise node belongs as the ending node.

[0081] S320: Based on the connection relationship between comprehensive nodes in the enterprise-level knowledge graph, obtain several first candidate paths between the starting node and the ending node. Each first candidate path includes several comprehensive nodes with a sequential order.

[0082] S330: Based on the second degree of association between any two integrated nodes that are connected, obtain all the second degree of association included in each first candidate path.

[0083] S340, based on all the second association degrees included in each first candidate path, obtain the first priority corresponding to each first candidate path.

[0084] S350 determines the first candidate path corresponding to the highest first priority as the target path.

[0085] Specifically, abnormal enterprise nodes and target enterprise nodes are mapped to their respective aggregate nodes, transforming node-level path search into aggregate node-level path search. Since the aggregate nodes have already aggregated enterprise nodes, the number of nodes required for path searching is significantly reduced.

[0086] Based on the comprehensive connection relationships between nodes in an enterprise-level knowledge graph, a graph search algorithm is used to find all possible paths from the starting node to the ending node, forming a first candidate path set. Those skilled in the art will recognize that any existing graph search algorithm falls within the protection scope of this invention, such as breadth-first search (BFS) and depth-first search (DFS), and will not be elaborated upon here.

[0087] The second degree of correlation reflects the closeness of business connections between integrated nodes, providing a quantitative basis for path priority calculation.

[0088] Based on all the secondary correlation levels contained in each first candidate path, the first priority of each first candidate path is calculated using methods such as average calculation and weighted average. This facilitates the rapid selection of the optimal path among all nodes, improving the accuracy and efficiency of path planning between enterprise nodes. Correspondingly, the higher the average value of the secondary correlation level, the higher the first priority of the first candidate path.

[0089] As described above, by integrating path search and priority filtering at the node level, the computational complexity is significantly reduced compared to traditional methods that directly search for paths at the enterprise node level. Furthermore, by quantifying path priority based on the second degree of association, the planned target paths are more consistent with the actual business association strength of the enterprise, avoiding the selection of low-value, weakly associated paths and improving the accuracy of path planning results between enterprise nodes.

[0090] S40: Based on the reference anomaly degree of the abnormal enterprise node, several comprehensive nodes in the target path, and all the second association degrees corresponding to the target path, obtain the target anomaly degree corresponding to the target enterprise node.

[0091] Among them, the reference anomaly level is a quantitative value of the anomaly risk that has been determined for the abnormal enterprise node. It can be calculated based on multi-dimensional data such as financial indicators and violation records. In this embodiment, the reference anomaly level is directly obtained as the initial value for the propagation of anomaly risk, providing a starting point for the calculation of the anomaly level of the target enterprise node.

[0092] In one specific embodiment, S40 includes the following steps: S410: For any integrated node, based on the order of the integrated nodes in the target path, the integrated node preceding the current integrated node is determined as the first reference node, and the integrated node following the current integrated node is determined as the second reference node.

[0093] S420, each related node corresponding to the current integrated node in the first reference node is identified as the first critical node corresponding to the current integrated node.

[0094] S430, each related node corresponding to the current integrated node in the second reference node is identified as the corresponding edge node of the current integrated node as the second key node of the current integrated node.

[0095] S440: Based on the hierarchical relationship between the enterprise nodes included in the current integrated node, obtain several second candidate paths between each first key node and each second key node in the current integrated node, wherein each second candidate path includes several enterprise nodes with a sequential order.

[0096] S450: Based on the first association degree between each enterprise node in the current integrated node and other enterprise nodes with the corresponding association level of 1, obtain all the first association degrees included in each second candidate path corresponding to the current integrated node.

[0097] S460, based on all the first association degrees included in each second candidate path corresponding to the current integrated node, obtain the third association degree corresponding to each second candidate path corresponding to the current integrated node.

[0098] S470: The sum of all third-level association degrees corresponding to the current integrated node is determined as the importance degree corresponding to the current integrated node.

[0099] S480: Based on the reference anomaly degree of the abnormal enterprise node, the importance of each comprehensive node in the target path, and all the second association degrees corresponding to the target path, obtain the target anomaly degree corresponding to the target enterprise node.

[0100] In this process, according to the order of each integrated node in the target path, the first reference node preceding each integrated node and the second reference node following each integrated node are determined. By clarifying the sequential relationship between integrated nodes, a logical chain of anomaly propagation is constructed, providing a basic framework for subsequent analysis of the associated paths between integrated nodes.

[0101] The current synthesis node corresponds to several related nodes in the first reference node, and each related node in the first reference node corresponds to an edge node in the current synthesis node. Therefore, each first critical node is a key interface node for the propagation of anomalies from the first reference node to the current synthesis node. Similarly, the current synthesis node corresponds to several related nodes in the second reference node, and each related node in the second reference node corresponds to an edge node in the current synthesis node. Therefore, each second critical node is a key interface node for the propagation of anomalies from the current synthesis node to the second reference node.

[0102] The second candidate path is the possible path between the first and second critical nodes in the current integrated node. It is used to provide a set of path selections for anomaly propagation within the integrated node, thereby filtering out key propagation paths. Using a graph search algorithm, all possible paths between each first and second critical node are found. A second candidate path set is formed based on all possible paths between all first and second critical nodes. By mining potential propagation paths within nodes, the propagation possibilities of anomalies within the integrated node are comprehensively covered, avoiding the omission of important internal propagation paths, ensuring the completeness of anomaly propagation analysis, and providing sufficient data support for accurately assessing the severity of anomalies.

[0103] The third degree of association is a numerical value calculated based on the first degree of association between enterprise nodes in each second candidate path. It is used to quantify the efficiency of anomaly propagation in the second candidate path. For example, for any second candidate path, based on the first degree of association between several enterprise nodes with a sequential order in the current second candidate path, all the first degree of association contained in the current second candidate path are obtained. Through calculation methods such as average calculation and weighted average, the third degree of association corresponding to each second candidate path is calculated, which quantifies the path smoothness from the first key node (input interface) to the second key node (output interface) within the current integrated node, and characterizes the association strength of the path within the current integrated node.

[0104] The higher the correlation level, the less the anomalous signal attenuates within the integration node, the faster its propagation speed, and the higher its propagation efficiency. The more candidate paths there are, the more likely the anomaly can spread within the integration node through multiple paths, increasing global risk.

[0105] Therefore, the sum of all third-level associations within a single node is determined as the importance of the current node, representing its contribution to anomaly propagation in the target path.

[0106] The target anomaly level begins with the reference anomaly level of the anomalous enterprise node. After propagation through the target path, the final quantified anomaly risk value of the target enterprise node serves as the core result of anomaly detection and is used for subsequent node type determination. Specifically, the target anomaly level of the target enterprise node is derived by comprehensively considering the reference anomaly level of the anomalous enterprise node, the importance of each comprehensive node in the target path, and the secondary correlation between comprehensive nodes. By organically combining factors such as the anomaly source risk, the importance of path nodes, and the strength of correlation between nodes, accurate calculation of anomaly risk propagation is achieved.

[0107] The above analysis delves into the propagation path of anomalies within the integrated node, accurately capturing all key nodes and feasible paths of anomaly propagation within the integrated node. Furthermore, it quantifies the contribution of the integrated node to anomaly propagation through correlation analysis. By comprehensively considering multiple dimensions such as the anomaly source, the importance of the integrated node in the path, and the strength of correlation between nodes, the calculation of the target anomaly degree of the target enterprise node becomes more accurate.

[0108] In one specific embodiment, S480 includes the following steps: S481, based on the importance of each integrated node in the target path and all the second association degrees corresponding to the target path, obtain the degree of abnormal diffusion corresponding to the target path.

[0109] S482, based on the reference anomaly degree and anomaly propagation degree of the abnormal enterprise node, obtain the target anomaly degree corresponding to the target enterprise node.

[0110] Specifically, based on the importance of each integrated node in the target path and the secondary correlation between integrated nodes, the importance of nodes and the correlation strength are integrated to calculate the degree of anomaly diffusion corresponding to the target path. The importance reflects the contribution of integrated nodes to the anomaly propagation, while the secondary correlation reflects the tightness of risk transmission between integrated nodes. The combination of the two can quantify the risk diffusion capability along the entire target path.

[0111] The degree of abnormal diffusion is a quantitative indicator that measures the ability of abnormal risks to spread along the target path. It comprehensively reflects the impact of the importance of each node in the path and the strength of the correlation between nodes on the risk diffusion.

[0112] The initial magnitude of risk is determined by the reference anomaly level, while the degree of anomaly propagation determines the magnitude of risk variation along the path. Taking the reference anomaly level of the abnormal enterprise node as the source of risk, and combining it with the degree of anomaly propagation, the initial risk is propagated and calculated according to the propagation capability of the path, thereby deriving the target anomaly level corresponding to the target enterprise node.

[0113] For example, the target anomaly level W corresponding to the target enterprise node is W = W0 × KS, where W0 is the reference anomaly level of the anomaly enterprise node, and KS is the anomaly propagation level corresponding to the target path. Where Ф is the total number of integrated nodes in the target path, t=1,2,...,Ф-1,ZY t It represents the importance of the t-th integrated node in the target path, ZY t+1 It represents the importance of the (t+1)th integrated node in the target path, ZY 0 It is the maximum importance value corresponding to the Ф integrated nodes in the target path, GL t(t+1)It represents the second degree of association between the t-th integrated node and the (t+1)-th integrated node in the target path.

[0114] The above-mentioned method quantifies the abnormal transmission of the reference abnormality degree of abnormal enterprise nodes by comprehensively analyzing the node characteristics of nodes in the target path and the correlation characteristics between nodes, thereby achieving a refined assessment of the target abnormality degree of the target enterprise nodes and improving the accuracy of the target abnormality degree assessment.

[0115] S50: Based on the target abnormality level and the preset abnormality level threshold corresponding to the target enterprise node, obtain the node type corresponding to the target enterprise node, wherein the node type is an abnormal node or a non-abnormal node.

[0116] Among them, the preset abnormality threshold is a risk threshold set in advance based on the enterprise's business characteristics, industry standards or historical data. It can be dynamically adjusted by the implementer according to the actual situation and serves as a benchmark for classifying node types, clearly defining the boundary between normal and abnormal states.

[0117] If the target enterprise node's anomaly level is greater than or equal to a preset anomaly level threshold, then the node type corresponding to the target enterprise node is determined to be an anomalous node. If the target enterprise node's anomaly level is less than the preset anomaly level threshold, then the node type corresponding to the target enterprise node is determined to be a non-anomalous node.

[0118] By identifying the risk status of target enterprise nodes by node type, the system provides enterprises with intuitive risk classification results, making it easier to develop targeted management strategies.

[0119] The above-mentioned approach, by aggregating enterprise nodes based on association hierarchy and first degree of association to form comprehensive nodes, and constructing an enterprise-level knowledge graph containing connection relationships and second degree of association, enables the abstraction of complex relationships among massive enterprise nodes into a hierarchical structure. This significantly reduces graph complexity and path planning computation, while quantifying the strength of associations between nodes, providing a data foundation for accurate path planning and anomaly detection. By clearly distinguishing between anomalous enterprise nodes and target enterprise nodes, the approach transforms indiscriminate global anomaly detection into local analysis focused on specific nodes, reducing unnecessary computation, clarifying anomaly detection targets, and improving the efficiency and targeting of anomaly analysis. Furthermore, by using comprehensive nodes as units and combining node connection relationships and second degree of association to filter target paths from anomalous enterprise nodes to target enterprise nodes, the approach enables rapid identification of paths within the hierarchical knowledge graph. By identifying high-value paths and avoiding blind searches, the efficiency and accuracy of path planning are improved. By comprehensively considering the reference anomaly level of abnormal enterprise nodes, the importance of each comprehensive node in the target path, and the secondary correlation between comprehensive nodes, the transmission of anomalies along the target path can be accurately quantified based on multi-dimensional factors. This quantifies the target anomaly level of the target enterprise node, avoiding single-factor assessment errors and providing enterprises with more reliable risk assessment data. By comparing the target anomaly level of the target enterprise node with a preset threshold to determine the node type, complex risk assessment results are transformed into intuitive and standardized decision signals. This enables rapid and accurate anomaly judgment of the target enterprise node, supporting dynamic risk warnings and resource optimization, and improving the standardization and response efficiency of risk management.

[0120] Example 2 This second embodiment provides an abnormal node detection system based on node association relationships, such as... Figure 2 As shown, the abnormal node detection system based on node association relationships includes: The knowledge graph construction module 21 is used to obtain an enterprise-level knowledge graph based on the association level between each enterprise node and other enterprise nodes in the enterprise node set, and the first association degree between each enterprise node and other enterprise nodes with the corresponding association level of level 1. The association level includes level 1 to level N. The enterprise-level knowledge graph is constructed from several comprehensive nodes, the connection relationship between comprehensive nodes and the second association degree. Each comprehensive node is composed of several enterprise nodes. The second association degree is based on the first association degree. The connection relationship is either connected or non-connected.

[0121] The enterprise node extraction module 22 is used to identify abnormal enterprise nodes in the enterprise node set as abnormal enterprise nodes and to identify enterprise nodes to be detected as target enterprise nodes.

[0122] The target path acquisition module 23 is used to obtain the target path between the abnormal enterprise node and the target enterprise node based on the connection relationship and second correlation degree between the comprehensive nodes in the enterprise-level knowledge graph.

[0123] The target anomaly degree acquisition module 24 is used to obtain the target anomaly degree corresponding to the target enterprise node based on the reference anomaly degree of the anomaly enterprise node, several comprehensive nodes in the target path, and all the second association degrees corresponding to the target path.

[0124] The node type determination module 25 is used to obtain the node type corresponding to the target enterprise node based on the target abnormality level and the preset abnormality level threshold, wherein the node type is an abnormal node or a non-abnormal node.

[0125] In one specific implementation, the knowledge graph construction module 21 includes: The central node filtering submodule is used to filter out the central node from the enterprise node set based on the association level between each enterprise node and other enterprise nodes in the enterprise node set, and obtain the target level value M corresponding to the central node, where 1≤M≤N.

[0126] The first integrated node acquisition submodule is used to form the integrated node corresponding to the central node based on the central node and all enterprise nodes with the association hierarchy between the central node and the central node, from the first layer to the Mth layer.

[0127] The second integrated node acquisition submodule is used to remove all enterprise nodes from the enterprise node set in the integrated node, and then repeatedly execute the central node filtering submodule based on the enterprise node set after deletion until the enterprise node set is empty, thus obtaining all integrated nodes.

[0128] The integrated node relationship analysis submodule is used to obtain the connection relationship and second degree of association between the current integrated node and all other integrated nodes based on the association level between each enterprise node and other enterprise nodes in the current integrated node, and the first degree of association between each enterprise node and other enterprise nodes with the corresponding association level of 1.

[0129] The knowledge graph construction submodule is used to obtain the enterprise-level knowledge graph corresponding to all enterprise nodes based on the connection relationship and second degree of association between each comprehensive node and all other comprehensive nodes.

[0130] In one specific implementation, the central node filtering submodule includes: The node count unit is used to obtain the number of i-th nodes corresponding to all enterprise nodes with a relationship level of i-th layer with the current enterprise node, based on the relationship level between the current enterprise node and other enterprise nodes in the enterprise node set, where i≤N.

[0131] The central node acquisition unit is used to determine the enterprise node with the largest number of first nodes in the enterprise node set as the central node, based on the number of first nodes corresponding to each enterprise node.

[0132] The node category acquisition unit is used to obtain the node category corresponding to the central node based on the number of nodes from the 1st to the Nth node, wherein the node category is either a super node or a non-super node.

[0133] The first target level value acquisition unit is used to obtain the target level value M corresponding to the center node based on the number of the first to the Nth nodes corresponding to the center node if the node category corresponding to the center node is a super node. The number of the first to the Mth nodes corresponding to the center node satisfies the preset judgment condition that 1 < M ≤ N.

[0134] The second target level value acquisition unit is used to determine the target level value M=1 corresponding to the center node if the node category corresponding to the center node is a non-super node.

[0135] In one specific implementation, the first integration node acquisition submodule includes: The first node determination unit is used to determine the central node and all enterprise nodes with association levels from level 1 to level M as the first node.

[0136] The first side length acquisition unit is used to acquire, for any first node, the first side length corresponding to the first side between each first node with a relationship level of 1 and the current first node, based on the first relationship degree between each first node with a relationship level of 1 and the current first node, wherein the first side length is negatively correlated with the corresponding first relationship degree.

[0137] The integrated node acquisition unit is used to construct the enterprise subgraph corresponding to the central node based on all the first nodes and the first side lengths corresponding to all the first sides of the central node, and to regard the enterprise subgraph corresponding to the central node as the integrated node corresponding to the central node.

[0138] In one specific implementation, the comprehensive node relationship analysis submodule includes: The edge node acquisition unit is used to identify each enterprise node with an association level of the Mth layer with the central node in the current integrated node as an edge node in the current integrated node.

[0139] The related node acquisition unit is used to identify each enterprise node in other integrated nodes whose association level with each edge node is the first layer as the related node corresponding to the current integrated node, and to obtain the node pair consisting of each edge node and each corresponding related node.

[0140] The first relationship determination unit is used to determine the connection relationship between the current integrated node and the integrated node to which the current related node belongs as a connection relationship for any related node corresponding to the current integrated node.

[0141] The first degree acquisition unit is used to acquire, for any integrated node that is connected to the current integrated node, a second degree of association between the current integrated node and any integrated node that is connected to the current integrated node, based on all node pairs corresponding to the current integrated node and any integrated node that is connected to the current integrated node, and the first degree of association between edge nodes and related nodes in each node pair.

[0142] The second relationship determination unit is used to determine the connection relationship between the current integrated node and any related node in the current integrated node as a non-connected relationship.

[0143] The second degree acquisition unit is used to determine the preset degree value as the second degree of association between the current integrated node and the integrated node whose connection relationship with the current integrated node is not connected.

[0144] In one specific implementation, the knowledge graph construction submodule includes: The second side length acquisition unit is used to obtain the second side length corresponding to the second side between any two integrated nodes whose connection relationship is connected, based on the second association degree between the two integrated nodes. The second side length is negatively correlated with the corresponding second association degree.

[0145] The knowledge graph construction unit is used to construct an enterprise-level knowledge graph corresponding to all enterprise nodes based on all comprehensive nodes and the second side length corresponding to the second side between any two second nodes that are connected.

[0146] In one specific embodiment, the target path acquisition module 23 includes: The start and end node determination submodule is used to determine the start node of the comprehensive node to which the abnormal enterprise node belongs and the end node of the comprehensive node to which the target enterprise node belongs, based on the number of enterprise nodes included in each comprehensive node.

[0147] The first candidate path acquisition submodule is used to obtain several first candidate paths from the start node to the end node based on the connection relationship between the comprehensive nodes in the enterprise-level knowledge graph. Each first candidate path includes several comprehensive nodes in a sequential order.

[0148] The second association degree acquisition submodule is used to obtain all the second association degrees included in each first candidate path based on the second association degree between any two comprehensive nodes that are connected.

[0149] The first priority acquisition submodule is used to obtain the first priority corresponding to each first candidate path based on all the second relevance levels included in each first candidate path.

[0150] The target path determination submodule is used to determine the first candidate path corresponding to the highest first priority as the target path.

[0151] In one specific embodiment, the target anomaly degree acquisition module 24 includes: The reference node determination submodule is used to determine, for any given integrated node, the integrated node preceding the current integrated node as the first reference node and the integrated node following the current integrated node as the second reference node, based on the order of the integrated nodes in the target path.

[0152] The first critical node determination submodule is used to determine the edge node corresponding to each related node of the current integrated node in the first reference node as the first critical node of the current integrated node.

[0153] The second key node determination submodule is used to determine the edge node corresponding to each related node of the current integrated node in the second reference node as the second key node of the current integrated node.

[0154] The second candidate path acquisition submodule is used to obtain several second candidate paths between each first key node and each second key node in the current integrated node based on the hierarchical relationship between the various enterprise nodes included in the current integrated node.

[0155] The first association degree acquisition submodule is used to obtain all the first association degrees included in each second candidate path corresponding to the current comprehensive node based on the first association degree between each enterprise node in the current comprehensive node and other enterprise nodes with the corresponding association level of level 1.

[0156] The third correlation degree acquisition submodule is used to obtain the third correlation degree corresponding to each second candidate path corresponding to the current integrated node based on all the first correlation degrees included in each second candidate path corresponding to the current integrated node.

[0157] The importance determination submodule is used to determine the importance of the current integrated node by summing the values ​​of all third-level associations corresponding to the current integrated node.

[0158] The target anomaly degree acquisition submodule is used to obtain the target anomaly degree corresponding to the target enterprise node based on the reference anomaly degree of the anomaly enterprise node, the importance of each comprehensive node in the target path, and all the second association degrees corresponding to the target path.

[0159] In one specific implementation, the target anomaly degree acquisition submodule includes: The abnormal diffusion degree acquisition unit is used to obtain the abnormal diffusion degree of the target path based on the importance of each comprehensive node in the target path and all the second association degrees of the target path.

[0160] The target anomaly degree acquisition unit is used to obtain the target anomaly degree corresponding to the target enterprise node based on the reference anomaly degree and the anomaly propagation degree of the anomaly enterprise node.

[0161] It should be noted that the information interaction and execution process between the above modules are based on the same concept as the method embodiments of the present invention. For details on their specific functions and technical effects, please refer to the method embodiments section, which will not be repeated here.

[0162] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A method for judging abnormal nodes based on node association relationships, characterized in that, The method includes the following steps: Based on the connection relationships between comprehensive nodes in the enterprise-level knowledge graph, several first candidate paths from the starting node to the ending node are obtained. Specifically, the enterprise-level knowledge graph is obtained based on the association hierarchy between each enterprise node and other enterprise nodes in the enterprise node set, and the degree of first association between each enterprise node and other enterprise nodes at association level 1. The association hierarchy is a hierarchical concept used to describe the closeness of relationships or the depth of business interactions between enterprise nodes. Each comprehensive node includes a central node and all enterprise nodes at association levels 1 to M with that central node. The destination corresponding to the central node... The target level value M satisfies the preset judgment condition, and 1≤M≤N, where N is the maximum value of the association level between all enterprise nodes. The preset judgment condition is: the sum of the number of the first node to the (M-1)th node corresponding to the central node is less than the preset number threshold, and the sum of the number of the first node to the Mth node corresponding to the central node is greater than or equal to the preset number threshold. The first association degree is used to quantify the tightness of the business association between enterprise nodes. The starting node is the comprehensive node to which the abnormal enterprise node belongs, and the ending node is the comprehensive node to which the target enterprise node belongs. Each first candidate path includes several comprehensive nodes with a sequential order. Based on the second degree of association between any two integrated nodes that are connected, the target path between the abnormal enterprise node and the target enterprise node in the enterprise node set is selected from all the first candidate paths. The second degree of association is used to quantify the tightness of the business association between the two integrated nodes. Based on the order of the various integrated nodes in the target path, the association level between enterprise nodes, and the degree of first association, the importance of each integrated node is obtained. Based on the reference abnormality level of the abnormal enterprise node, the importance level of each comprehensive node in the target path, and all the second association levels corresponding to the target path, the node type corresponding to the target enterprise node is obtained, wherein the node type is an abnormal node or a non-abnormal node.

2. The method for judging abnormal nodes based on node association relationships according to claim 1, characterized in that, The integrated node belongs to the enterprise nodes in the enterprise node set; Based on the connection relationships between nodes in the enterprise-level knowledge graph, several first candidate paths are obtained from the starting node to the ending node, including: Based on the association hierarchy between enterprise nodes in the enterprise node set, a central node is selected from the enterprise node set, and the target level value M corresponding to the central node is obtained. The association hierarchy includes the first to the Nth level, and the target level value M is the largest association hierarchy covered when constructing a comprehensive node with the central node as the core. Based on the central node and all enterprise nodes with a relationship hierarchy from the first to the Mth level, a comprehensive node corresponding to the central node is formed. Remove all enterprise nodes from the enterprise node set in the integrated node set. Then, repeat the steps of filtering out the central node from the enterprise node set based on the association hierarchy between enterprise nodes in the enterprise node set and obtaining the target level value M corresponding to the central node, until the enterprise node set is empty and all integrated nodes are obtained. By analyzing the connections and relationships between the nodes, an enterprise-level knowledge graph corresponding to all enterprise nodes can be obtained.

3. The method for judging abnormal nodes based on node association relationships according to claim 2, characterized in that, Connection relationships include connected relationships and non-connected relationships; The step of obtaining several first candidate paths from the starting node to the ending node based on the connection relationships between comprehensive nodes in the enterprise-level knowledge graph also includes: For any given integrated node, each enterprise node with an association level of the Mth layer with the central node in the current integrated node is treated as an edge node in the current integrated node; Each enterprise node in other integrated nodes that has a connection level of Level 1 with each edge node is identified as a related node corresponding to the current integrated node; For any related node corresponding to the current integrated node, the connection relationship between the current integrated node and the integrated node to which the current related node belongs is determined as a connection relationship; The connection relationship between the current integrated node and any integrated node that does not include any related node in the current integrated node is defined as a non-connected relationship. Based on the interconnections between the nodes, several first candidate paths between the starting node and the ending node are obtained.

4. The method for judging abnormal nodes based on node association relationships according to claim 3, characterized in that, The step of filtering target paths from all first candidate paths based on the second degree of association between any two connected nodes, from abnormal enterprise nodes in the enterprise node set to the target enterprise node, includes: Based on the second degree of association between any two integrated nodes that are connected, calculate the average of all the second degree of association included in each first candidate path, and use it as the first priority of each first candidate path; The first candidate path corresponding to the highest first priority is determined as the target path.

5. The method for judging abnormal nodes based on node association relationships according to claim 3, characterized in that, The step of obtaining the importance of each integrated node based on the sequential order of the integrated nodes in the target path, the association hierarchy between enterprise nodes, and the degree of first association includes: For any given integrated node, obtain the node pair consisting of each edge node and each corresponding related node in the current integrated node; Based on the order of the integrated nodes in the target path and all node pairs corresponding to the current integrated node, several first key nodes and several second key nodes in the current integrated node are obtained. The first key node is the edge node in the node pair between the current integrated node and the integrated node before it, and the second key node is the edge node in the node pair between the current integrated node and the integrated node after it. Based on the hierarchical relationships between all first-key nodes and all second-key nodes in the current integrated node, the various enterprise nodes included in the current integrated node, and the degree of first association between each enterprise node in the current integrated node and other enterprise nodes at the first level of association, the importance of the current integrated node is obtained.

6. The method for judging abnormal nodes based on node association relationships according to claim 5, characterized in that, The method of obtaining the importance of the current integrated node based on the hierarchical relationships between all first key nodes and all second key nodes in the current integrated node, the various enterprise nodes included in the current integrated node, and the degree of first association between each enterprise node in the current integrated node and other enterprise nodes at the first level of association, includes: Based on the hierarchical relationship between the various enterprise nodes included in the current integrated node, several second candidate paths are obtained between each first key node and each second key node in the current integrated node; For any second candidate path corresponding to the current integrated node, based on the first association degree between each enterprise node in the current integrated node and other enterprise nodes with the corresponding association level of 1, obtain all the first association degrees included in the current second candidate path; The average value of all first-degree associations included in the current second candidate path is taken as the third degree of association corresponding to the current second candidate path. The sum of all third-level association degrees corresponding to the current comprehensive node is determined as the importance degree corresponding to the current comprehensive node.

7. The method for judging abnormal nodes based on node association relationships according to claim 1, characterized in that, The step of obtaining the node type corresponding to the target enterprise node based on the reference anomaly degree of the abnormal enterprise node, the importance of each comprehensive node in the target path, and all second association degrees corresponding to the target path includes: Based on the importance of each integrated node in the target path and all the second correlation degrees corresponding to the target path, the degree of abnormal diffusion corresponding to the target path is obtained; Based on the reference anomaly degree of the abnormal enterprise node and the anomaly propagation degree, the target anomaly degree corresponding to the target enterprise node is obtained; If the target abnormality level corresponding to the target enterprise node is greater than or equal to a preset abnormality level threshold, then the node type corresponding to the target enterprise node is determined to be an abnormal node. If the target enterprise node's abnormality level is less than the preset abnormality level threshold, then the node type corresponding to the target enterprise node is determined to be a non-abnormal node.

8. The method for judging abnormal nodes based on node association relationships according to claim 7, characterized in that, The degree of abnormal diffusion meets the following conditions: KS=(∑ Ф-1 t=1 ((ZY t +ZY t+1 ) / (2×ZY 0 )×GL t(t+1) )) / (Ф-1), where KS is the degree of abnormal diffusion, Ф is the total number of integrated nodes in the target path, t=1,2,...,Ф-1,ZY t ZY represents the importance of the t-th integrated node in the target path. t+1 ZY represents the importance of the (t+1)th integrated node in the target path. 0 GL is the maximum importance value of the Ф integrated nodes in the target path. t(t+1) It is the second degree of association between the t-th integrated node and the (t+1)-th integrated node in the target path.

Images