Data processing method, apparatus, device, and readable storage medium

Abstract

The application discloses a data processing method, device and equipment and a readable storage medium. The method comprises the following steps: constructing an object relationship graph based on the business attribute features of each detection object in a detection object set in a business; determining the aggregation representation features corresponding to each business attribute feature and the reconstruction relationship graph corresponding to the object relationship graph in a graph self-encoder; performing feature clustering processing on each aggregation representation feature to obtain a class cluster distribution result; optimizing the graph self-encoder based on the class cluster distribution result, the reconstruction relationship graph and the object relationship graph; outputting the optimized aggregation representation features corresponding to each business attribute feature in the optimized graph self-encoder; performing feature clustering processing on each optimized aggregation representation feature; and identifying an abnormal object group based on the optimized class cluster distribution result obtained through the feature clustering processing. By using the application, the detection cost can be reduced and the detection efficiency can be improved in the detection business of the abnormal object group.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a data processing method, apparatus, device, and readable storage medium. Background Technology

[0002] Currently, in various sectors (such as finance and medical insurance), irregularities frequently occur due to inadequate regulatory systems and insufficient constraint mechanisms. For example, in the medical insurance sector, some insured individuals or organizations engage in fraudulent activities, abnormal consumption, and false reimbursements during the process of participating in and receiving medical insurance benefits.

[0003] To reduce the frequency of anomalous behavior across various domains, relevant inspection organizations expend significant manpower and time filtering and screening massive amounts of data to identify anomalous objects exhibiting unusual behavior. Typically, anomalous behavior in different domains involves different groups of individuals; that is, different members form a group to execute anomalous actions. This presents a significant challenge for inspection organizations, requiring them to detect every member involved in the same anomalous behavior to ultimately identify the group of individuals exhibiting the behavior. Currently, the detection of groups of individuals exhibiting anomalous behavior primarily involves checking each detected anomalous object one by one to see if other objects are associated with it, thus identifying the final group of anomalous objects. This method is extremely time- and manpower-intensive and highly inefficient. Summary of the Invention

[0004] This application provides a data processing method, apparatus, device, and readable storage medium, which can reduce detection costs and improve detection efficiency in the detection of abnormal object groups.

[0005] One embodiment of this application provides a data processing method, including:

[0006] Based on the business attribute characteristics of each detection object in the business within the detection object set, an object relationship graph is constructed with each detection object as an object node;

[0007] The graph self-encoder is invoked. In the graph self-encoder, based on the connection relationship between object nodes in the object relationship graph, the aggregate representation feature corresponding to each business attribute feature and the reconstruction relationship graph corresponding to the object relationship graph are determined.

[0008] Each aggregated representation feature is subjected to feature clustering processing to obtain the cluster distribution results corresponding to the set of detected objects;

[0009] Based on the cluster distribution results, the reconstructed relation graph, and the object relation graph, the graph self-encoder is optimized to obtain an optimized graph self-encoder.

[0010] In the optimized graph self-encoder, based on the connection relationship between object nodes in the object relationship graph, the optimized aggregate representation feature corresponding to each business attribute feature is output;

[0011] Each optimized aggregate representation feature is subjected to feature clustering processing to obtain the optimized cluster distribution results corresponding to the set of detected objects;

[0012] Identify abnormal object groups in the detection object set based on the optimized cluster distribution results.

[0013] One embodiment of this application provides a data processing apparatus, including:

[0014] The graph construction module is used to construct an object relationship graph with each detected object as an object node, based on the business attribute characteristics of each detected object in the business in the detection object set.

[0015] The calling module is used to call the graph auto-coder;

[0016] The feature determination module is used in the graph auto-encoder to determine the aggregate representation features corresponding to each business attribute feature and the reconstruction relationship graph corresponding to the object relationship graph, based on the connection relationship between object nodes in the object relationship graph.

[0017] The first clustering module is used to perform feature clustering processing on each aggregate representation feature to obtain the cluster distribution result corresponding to the set of detected objects.

[0018] The optimization module is used to optimize the graph auto-coder based on the cluster distribution results, the reconstructed relationship graph, and the object relationship graph, to obtain an optimized graph auto-coder.

[0019] The optimized feature output module is used in the optimized graph self-encoder to output the optimized aggregated representation features corresponding to each business attribute feature based on the connection relationship between object nodes in the object relationship graph;

[0020] The second clustering module performs feature clustering processing on each optimized aggregate representation feature to obtain the optimized cluster distribution results corresponding to the set of detected objects.

[0021] The group identification module is used to identify abnormal object groups in the detection object set based on the optimized cluster distribution results.

[0022] In one embodiment, the detection object set includes detection object S i Each detected object possesses specific business attribute characteristics within the business context, including the detected object S. iBusiness attribute characteristics T in business i i is a positive integer;

[0023] The specific methods by which the graph construction module constructs an object relationship graph with each detected object as an object node based on the business attribute features of each detected object in the set of detected objects can include:

[0024] In constructing the set of detected objects, the object nodes corresponding to each detected object are obtained, resulting in a set of object nodes;

[0025] Based on business attribute features T i And the business attribute characteristics of the remaining detection objects in the business, to determine the detection object S in the detection object set. i The corresponding associated object; the remaining detection objects refer to the set of detection objects excluding detection object S. i Other than the objects being tested;

[0026] Detect object S i The corresponding object node is identified as the target object node, and the detection object S is... i The object node corresponding to the associated object is determined as the associated object node;

[0027] Construct connecting edges between the target object node and the associated object node to obtain the associated edges corresponding to the target object node;

[0028] Once the associated edges corresponding to each object node in the object node set are determined, the structural graph containing the object node set and the associated edges corresponding to each object node is defined as the object relationship graph.

[0029] In one embodiment, the number of remaining detection objects is M; M is a positive integer;

[0030] For the graph construction module based on business attribute feature T i And the business attribute characteristics of the remaining detection objects in the business, to determine the detection object S in the detection object set. i The specific methods for associating the corresponding objects can include:

[0031] The business attribute features of each of the M remaining detection objects in the business are determined as the remaining business attribute features.

[0032] Determine business attribute features T i The feature similarity between each remaining business attribute feature and the feature similarity between the two features is used to obtain M feature similarities;

[0033] Among the M feature similarities, the feature similarities that are greater than the similarity threshold are determined as the target feature similarities, and the remaining business attribute features corresponding to the target feature similarities are determined as similar business attribute features.

[0034] The remaining detection objects corresponding to similar business attribute features in the detection object set are determined as detection objects S. i The corresponding associated object.

[0035] In one embodiment, the M remaining service attribute features include the remaining service attribute feature T. j The M feature similarities include the remaining business attribute features T. j With business attribute feature T i The feature similarity between them, where j is a positive integer; each business attribute feature includes the business participation time;

[0036] For the graph construction module to determine the business attribute feature T i The specific methods for obtaining M feature similarities by calculating the feature similarity between each remaining business attribute feature and the feature similarity between the remaining business attribute features can include:

[0037] Business attribute feature T i The included business participation time is determined as the first participation time, and the remaining business attribute features T are... j The business participation time included is determined as the second participation time;

[0038] Determine the time interval between the first participation time and the second participation time;

[0039] Obtain the duration mapping table; the duration mapping table contains the mapping relationship between the set of configuration time intervals and the set of configuration similarity; there is a mapping relationship between a configuration duration interval in the set of configuration time intervals and a configuration similarity in the set of configuration similarity;

[0040] The configuration duration intervals within the set of configuration duration intervals are determined as the target duration intervals. The configuration similarity intervals within the configuration similarity set that have a mapping relationship with the target duration intervals are determined as the remaining business attribute features T. j With business attribute feature T i Feature similarity between them.

[0041] In one embodiment, the graph auto-codec includes a graph encoder and a graph decoder;

[0042] For the feature determination module in the graph auto-encoder, based on the connection relationships between object nodes in the object relationship graph, it determines the aggregate representation features corresponding to each business attribute feature, as well as the specific method for reconstructing the relationship graph corresponding to the object relationship graph. This can include:

[0043] The graph encoder in the graph encoder is called. In the graph encoder, each business attribute feature is encoded by the connection relationship between object nodes in the object relationship graph to obtain the aggregate representation feature corresponding to each business attribute feature.

[0044] The graph decoder in the graph auto-decoder is called. In the graph decoder, the connection relationship between object nodes in the object relationship graph is reconstructed based on the aggregate representation feature corresponding to each business attribute feature, so as to obtain the reconstructed relationship graph.

[0045] In one embodiment, the detection object set includes detection object S i Each detected object possesses specific business attribute characteristics within the business context, including the detected object S. i Business attribute characteristics T in business i i is a positive integer;

[0046] In the graph encoder, the feature determination module encodes each business attribute feature separately based on the connection relationships between object nodes in the object relationship graph, obtaining the specific method of the aggregated representation feature corresponding to each business attribute feature, including:

[0047] In the graph encoder, the detected object S i The corresponding object node is determined as the target object node, and the object nodes in the object relationship graph that have a connection relationship with the target object node are determined as the adjacent nodes of the target object node;

[0048] Connect the adjacent service attribute features corresponding to the adjacent nodes with the service attribute feature T. i The code fusion process is performed to obtain the business attribute feature T. i The corresponding aggregate representation features; the adjacent business attribute features corresponding to adjacent nodes refer to the business attribute features of the detection objects corresponding to adjacent nodes in the business.

[0049] In one embodiment, the feature determination module compares the adjacency service attribute features corresponding to adjacent nodes with the service attribute feature T. i The code fusion process is performed to obtain the business attribute feature T. i The specific methods for representing the corresponding aggregated features may include:

[0050] Obtain the relational adjacency matrix corresponding to the object relation graph; the relational adjacency matrix is ​​used to represent the connection relationships between object nodes in the object relation graph;

[0051] The relational adjacency matrix is ​​normalized to obtain the normalized adjacency matrix corresponding to the relational adjacency matrix.

[0052] Obtain the encoding parameter matrix from the graph encoder, and then use the logical operation functions of the graph encoder to combine the relation adjacency matrix and business attribute features T. i The adjacent service attribute features and the encoding parameter matrix are processed to obtain the service attribute feature T. i The corresponding aggregate representation features.

[0053] In one embodiment, the object relationship graph consists of a set of object nodes and the associated edges corresponding to each object node in the set of object nodes; one object node in the set of object nodes corresponds to one detection object in the set of detection objects;

[0054] In the graph decoder, the feature determination module reconstructs the connection relationships between object nodes in the object relationship graph based on the aggregated representation features corresponding to each business attribute feature. This reconstruction of the relationship graph can include:

[0055] Obtain the representation feature vector composed of the aggregated representation features corresponding to each business attribute feature, and perform transpose transformation on the representation feature vector to obtain the transpose transformation vector corresponding to the representation feature vector.

[0056] The reconstructed adjacency matrix is ​​obtained by performing a dot product operation between the eigenvector and the transpose transformation vector. The reconstructed adjacency matrix contains Q reconstructed connection probabilities. One of the Q reconstructed connection probabilities is the predicted probability that there is a connection between two object nodes in the object node set; Q is a positive integer.

[0057] By deleting the associated edges corresponding to each object node in the object relationship graph, an intermediate object relationship graph is obtained.

[0058] Among the Q reconstruction connection probabilities, the reconstruction connection probability greater than the connection probability threshold is determined as the target reconstruction connection probability. In the intermediate object relationship graph, a connection edge is constructed between the two object nodes corresponding to the target reconstruction connection probability to obtain the reconstruction relationship graph.

[0059] In one embodiment, the optimization module optimizes the graph self-encoder based on the cluster distribution results, the reconstructed relationship graph, and the object relationship graph, to obtain a specific method for optimizing the graph self-encoder, which may include:

[0060] The cluster distribution results are processed by calculating the distribution error to obtain the cluster distribution loss value corresponding to the cluster distribution results.

[0061] Obtain the reconstruction adjacency matrix corresponding to the reconstruction relationship graph, and the relationship adjacency matrix corresponding to the object relationship graph; the relationship adjacency matrix is ​​used to represent the connection relationship between object nodes in the object relationship graph, and the reconstruction adjacency matrix is ​​used to represent the connection relationship between object nodes in the reconstruction relationship graph;

[0062] The prediction error is calculated and processed on the reconstructed adjacency matrix and the relational adjacency matrix to obtain the connection prediction loss value corresponding to the reconstructed relational graph;

[0063] Based on the cluster distribution loss value and the connection prediction loss value, the total loss value corresponding to the graph self-coder is determined. The graph self-coder is then optimized based on the total loss value to obtain the optimized graph self-coder.

[0064] In one embodiment, the cluster distribution result contains W feature clusters, and each of the W feature clusters contains one or more aggregated representation features; W is a positive integer; the aggregated representation feature corresponding to each business attribute feature contains aggregated representation feature U. v v is a positive integer;

[0065] The optimization module performs distribution error calculation on the cluster distribution results to obtain the cluster distribution loss value corresponding to the cluster distribution results. The specific methods for this can include:

[0066] Obtain the cluster center corresponding to each feature cluster;

[0067] Calculate the aggregate representation feature U separately v The cluster distance between each cluster center and the aggregate representation feature U v The cluster distance between each cluster center determines the aggregate representation feature U. v The corresponding distance loss value;

[0068] Once the distance loss value corresponding to each aggregated representation feature is determined, the distance loss value corresponding to each aggregated representation feature is processed to obtain the cluster distribution loss value.

[0069] In one embodiment, the optimized cluster distribution result includes at least two optimized feature clusters, and each of the at least two optimized feature clusters includes one or more optimized aggregate representation features; the at least two optimized feature clusters include optimized feature cluster K. c c is a positive integer;

[0070] The specific methods by which the group identification module identifies abnormal object groups in the detection object set based on the optimized cluster distribution results include:

[0071] Identify and optimize feature clusters K c The abnormal objects contained therein will optimize feature cluster K. c The set of abnormal objects contained therein is determined as the optimized feature cluster K. c The corresponding anomalous subgroups of the cluster;

[0072] Once the abnormal subgroups corresponding to each optimized feature cluster are identified, each abnormal subgroup corresponding to each optimized feature cluster is identified as an abnormal object group in the detection object set.

[0073] In one embodiment, the feature cluster K is optimized. c It contains exception label objects; exception label objects refer to objects that exhibit exception label behavior in the business logic.

[0074] The group identification module identifies and optimizes feature clusters K c The specific methods of the exception objects included in the document can include:

[0075] Optimize feature cluster K c Among the one or more optimized aggregated representation features included, the optimized aggregated representation feature corresponding to the anomaly label object is determined as the target representation feature, and the optimized feature cluster K is... c Among the one or more optimized aggregated representation features included, the optimized aggregated representation features other than the target representation feature are determined as candidate anomaly representation features corresponding to the target representation feature;

[0076] The detection objects corresponding to the candidate anomaly representation features are identified as candidate anomaly objects;

[0077] Obtain business behavior data of candidate anomalies in the business, and determine the degree of behavioral correlation between the business behavior data and the anomaly label behavior;

[0078] When the behavioral correlation is greater than the correlation threshold, the candidate abnormal object is identified as the abnormal associated object corresponding to the abnormal label object. Both the abnormal label object and the abnormal associated object are identified as the optimized feature cluster K. c The exception objects contained therein.

[0079] One embodiment of this application provides a computer device, including: a processor and a memory;

[0080] The memory stores a computer program, which, when executed by a processor, causes the processor to perform the methods described in the embodiments of this application.

[0081] One aspect of this application provides a computer-readable storage medium storing a computer program, which includes program instructions. When executed by a processor, the program instructions perform the methods described in this application.

[0082] One aspect of this application provides a computer program product comprising a computer program stored in a computer-readable storage medium. A processor of a computer device reads the computer program from the computer-readable storage medium and executes the computer program, causing the computer device to perform the method provided in one aspect of the embodiments of this application.

[0083] In this embodiment of the application, a graph structure is introduced in the task of mining abnormal object groups in a certain business, and a self-supervised learning method based on graph structure is adopted to detect abnormal object groups in the business. Specifically, for a given set of detection objects, if the goal is to detect a group of abnormal objects within that set, an object relationship graph can be constructed first, with each detection object as an object node, based on its business attribute features. Then, a graph autoencoder can be invoked. This autoencoder learns the aggregate representation features corresponding to each object node (i.e., the aggregate representation features corresponding to each business attribute feature) based on the connections between object nodes in the object relationship graph. Simultaneously, the reconstructed relationship graph corresponding to the object relationship graph can be calculated. These aggregate representation features for each object node can be used for clustering. Finally, based on the cluster distribution results, the reconstructed relationship graph, and the object relationship graph obtained after clustering, the graph autoencoder can be trained and optimized. This optimized graph autoencoder can output effective and accurate optimized aggregate representation features. Based on these optimized aggregate representation features, the detection object set can be accurately divided, yielding accurate optimized cluster distribution results. These optimized cluster distribution results can then serve as a reference for identifying a group of abnormal objects within the detection object set. It should be understood that this application can construct an object relationship graph based on the business attribute features of different detected objects in the object detection set. Based on this object relationship graph, a graph self-encoder / decoder can perform self-supervised learning, enabling it to effectively and accurately determine the optimized aggregate representation features corresponding to each object node based on the connection relationships between object nodes in the object relationship graph. Subsequently, the detected object set can be clustered based on these effective and accurate optimized aggregate representation features. The resulting optimized cluster distribution can serve as a reference aid in the task of identifying abnormal object groups in the detected object set. For example, based on a detected abnormal object, related objects can be searched within its cluster. This allows for efficient and accurate identification of related objects of an abnormal object in clusters with a smaller number of objects, eliminating the need to search through a massive number of objects one by one. This significantly reduces labor and time costs and improves identification efficiency. In summary, this application can reduce detection costs and improve detection efficiency in the detection of abnormal object groups. Attached Figure Description

[0084] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0085] Figure 1 This is a network architecture diagram provided in an embodiment of this application;

[0086] Figure 2 This is a schematic flowchart of a data processing method provided in an embodiment of this application;

[0087] Figure 3 This is a schematic diagram of constructing an object relationship diagram provided in an embodiment of this application;

[0088] Figure 4 This is a schematic diagram of a process provided in this application embodiment of outputting aggregated representation features and reconstructing a relationship graph through a graph self-encoder;

[0089] Figure 5 This is a schematic diagram of a process for optimizing a graph autocoder to obtain an optimized graph autocoder, provided in an embodiment of this application.

[0090] Figure 6 This is a system architecture diagram provided in an embodiment of this application;

[0091] Figure 7 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application;

[0092] Figure 8 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0093] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0094] This application involves artificial intelligence and related concepts. For ease of understanding, the following will briefly describe artificial intelligence and related concepts:

[0095] Artificial intelligence (AI) is the theory, methods, technology, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. AI studies the design principles and implementation methods of various intelligent machines, enabling them to possess the functions of perception, reasoning, and decision-making.

[0096] Artificial intelligence (AI) is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0097] With the research and advancement of artificial intelligence (AI) technology, AI is being studied and applied in various fields, such as smart homes, smart wearable devices, virtual assistants, smart speakers, smart marketing, autonomous driving, drones, robots, smart healthcare, and smart customer service. It is believed that with the development of technology, AI will be applied in more fields and play an increasingly important role.

[0098] The solutions provided in this application belong to the field of machine learning (ML) within the field of artificial intelligence.

[0099] Machine Learning (ML) is a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, and algorithm complexity theory. It specifically studies how computers can simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to endow computers with intelligence; its applications span all areas of artificial intelligence. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and instructional learning.

[0100] For easier understanding, please refer to Figure 1 , Figure 1 This is a network architecture diagram provided in an embodiment of this application. For example... Figure 1As shown, this network architecture may include a data processing server 10000, a business server 1000, and a terminal device cluster. The terminal device cluster may include one or more terminal devices; the number of terminal devices is not limited here. Figure 1 As shown, multiple terminal devices may include terminal device 100a, terminal device 100b, terminal device 100c, ..., terminal device 100n; as Figure 1 As shown, terminal devices 100a, 100b, 100c, ..., 100n can each connect to the business server 1000 via a network, enabling data interaction between each terminal device and the business server 1000. Any terminal device in the terminal device cluster can have a communication connection with the data processing server 10000; for example, terminal device 100b can have a communication connection with the data processing server 10000. Similarly, the business server 1000 can have a communication connection with the data processing server 10000, enabling data interaction between them.

[0101] like Figure 1 The business server 1000 shown can be the backend server for any enterprise or institution (such as a medical institution or insurance institution). A terminal device in the terminal device cluster can refer to the terminal corresponding to the relevant personnel of the enterprise or institution (for example, when the business server 1000 is the backend server corresponding to a medical institution, terminal device 100a can refer to the terminal corresponding to a member of the medical institution, and terminal device 100b can refer to the terminal corresponding to a patient of the medical institution). A terminal device in the terminal device cluster is used to provide relevant services to the enterprise or institution (such as providing intelligent medical services to medical institutions), and each terminal device can store the service data generated by itself. The business server 1000 can be used to store all business data generated in the enterprise or institution (including the service data of each of the above terminal devices). For example, taking a medical institution as an example, assuming that terminal device 100a is the terminal corresponding to a member of the medical institution, terminal device 100a can be used to provide intelligent medical services. The intelligent service data generated by terminal device 100a can be stored locally on the terminal device. Terminal device 100a can also send the intelligent service data to business server 1000, and business server 1000 will also synchronously store the intelligent service data.

[0102] It should be understood that in the field of medical insurance, due to an imperfect regulatory system and inadequate constraint mechanisms, abnormal behavior frequently occurs. For example, some insured individuals or organizations engage in fraudulent activities, abnormal consumption, and false reimbursements during the process of participating in and receiving medical insurance benefits. To reduce the frequency of abnormal behavior in the medical insurance field, relevant inspection organizations (such as law enforcement agencies) spend a significant amount of manpower and time filtering and screening a massive number of individuals to identify those who have engaged in abnormal behavior (such as users, which can be referred to as abnormal subjects). Some abnormal behaviors in the medical insurance field are caused by individuals acting independently, while others are caused by groups (or communities) acting collectively. For abnormal behaviors involving groups, relevant rules are needed to identify and detect the groups involved. The data processing server 10000 in this application can refer to a server used to group different objects. The data processing server 10000 can group objects that may have a large correlation together. Thus, the relevant inspection organization can efficiently judge and identify abnormal object groups (groups) that are jointly involved in the same abnormal behavior based on the results obtained by the data processing server 10000.

[0103] Specifically, assuming a group of individuals all received medical treatment at medical institutions, and it is necessary to identify the abnormal group of individuals exhibiting unusual behavior, then this group of individuals can be designated as detection objects, forming a detection object set. The data processing server 10000 can obtain the medical treatment data of each detection object in the medical institution from the business server 1000 (this medical treatment data may include the detection object's treatment information, such as the treatment time, the type of disease treated each time, and the treatment plan for each treatment, etc. This application may refer to the medical treatment data of the detection objects in medical business as the business attribute characteristics of the detection objects in medical business). Based on the medical treatment data of these detection objects in the detection object set, the data processing server 10000 can construct the association relationships between the detection objects (the association relationships between the detection objects can be constructed according to certain relationship construction rules, for example, according to medical...). The medical visit times in the medical visit data are used to construct the association between the test objects. Specifically, if the difference between the medical visit times of two test objects is within a preset time (such as 5 minutes, 4 minutes, 30 minutes, etc.), it can be determined that there is an association between the two test objects. Thus, based on the association between different test objects in the test object set, an object relationship graph can be constructed. In this object relationship graph, each test object is used as a node (which can be called an object node). A test object can be used as a node, and there are connecting edges between different object nodes in the object relationship graph. Specifically, if there is an association between two test objects, then there will be a connecting edge between the two object nodes corresponding to these two test objects.

[0104] Furthermore, the data processing server 10000 can input the object relationship graph and the medical visit data of each detected object in the medical service (i.e., the business attribute features of the detected object) into a graph self-encoder / decoder (the graph self-encoder / decoder can be composed of a graph encoder and a graph decoder, wherein the graph encoder can encode the input data (such as the business attribute features of the detected object) into latent variables to learn the representation information of the business attribute features, while the graph decoder can decode the latent variables obtained by the graph encoder into the original input). In this graph self-encoder / decoder, the graph encoder can encode each business attribute feature based on the connection relationship between object nodes in the object relationship graph, thereby obtaining the latent variables corresponding to each business attribute feature (since the graph encoder will pass the feature information of its adjacent nodes when encoding a certain business attribute feature to obtain the aggregated information corresponding to the business attribute feature, this application can refer to the latent variables as aggregated representation features); subsequently, the graph decoder can reconstruct these latent variables, thereby reconstructing the connection relationship between object nodes to obtain a new relationship graph (which can be called a reconstructed relationship graph). In other words, by using a graph auto-encoder, the aggregated representation features corresponding to each business attribute feature and the reconstructed relation graph corresponding to the object relation graph can be determined.

[0105] Furthermore, for each aggregated representation feature output by the graph auto-encoder, the data processing server 10000 can perform feature clustering processing. Feature clustering processing involves dividing these aggregated representation features into clusters. Any clustering algorithm can be used for clustering, such as the K-means algorithm. No specific clustering method is restricted here. It should be understood that after feature clustering, a cluster distribution result is obtained, which may contain different feature clusters (each feature cluster contains different aggregated representation features). To improve the clustering effect and make the group division result of the detected object set more accurate, this embodiment can train the graph auto-encoder based on the cluster distribution result, so that the aggregated representation features output by the graph auto-encoder are strongly correlated with the clustering task (i.e., the aggregated representation features output by the graph auto-encoder have a high correlation with the subsequent clustering task).

[0106] Meanwhile, it is understood that the reconstructed relational graph output by the graph decoder is determined by the graph decoder based on the aggregated representation features encoded by the graph encoder. Therefore, this reconstructed relational graph reflects the accuracy of the aggregated representation features encoded by the graph encoder. For example, if the error between the connection relationships between object nodes represented by the reconstructed relational graph and the connection relationships represented by the object relational graph is small, it indicates that a relational graph close to the real connection relationships can be determined based on the aggregated representation features output by the graph encoder, thus indicating that the aggregated representation features output by the graph encoder are relatively accurate. Conversely, if the error between the connection relationships between object nodes represented by the reconstructed relational graph and the connection relationships represented by the object relational graph is large, it indicates that the aggregated representation features output by the graph encoder do not yet possess high accuracy. In this case, the graph auto-coder needs to be trained based on the error values ​​until the graph auto-coder can output accurate and effective aggregated representation features. In other words, in this embodiment, the graph auto-coder can be trained based on the reconstructed relational graph output by the graph decoder and the real object relational graph. The trained graph self-encoder (which can be called the optimized graph self-encoder) can output various aggregated representation features with high accuracy and effectiveness (which can be called optimized aggregated representation features). Based on these optimized aggregated representation features, clustering can be performed to obtain clustering results with high accuracy (which can be called optimized cluster distribution results). Based on these optimized cluster distribution results, abnormal object groups in the detected object set can be identified.

[0107] In summary, this application can obtain supervisory information (the actual connections in the object relationship graph) from the input data (including object relationship graphs and business attribute features). Based on this supervisory information and clustering results, a graph self-encoder is jointly trained, allowing the graph self-encoder to learn representational information useful for subsequent tasks (i.e., the aggregated representation features corresponding to each business attribute feature). In other words, this application can train the graph self-encoder using graph self-supervised learning without using any pre-set labels or manually labeling them (such as pre-labeling standard abnormal object groups). This allows for accurate training of the graph self-encoder and the acquisition of accurate aggregated representation features. Consequently, it can accurately identify abnormal object groups even without labels, effectively reducing the time spent on manual data labeling, improving training efficiency, and enhancing the detection accuracy of abnormal object groups.

[0108] It is understood that the methods provided in the embodiments of this application can be executed by a computer device, which includes, but is not limited to, computer devices. Figure 1The terminal devices, data processing servers, or business servers mentioned herein may be independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal devices mentioned herein may be smartphones, tablets, laptops, PDAs, desktop computers, mobile internet devices (MIDs), POS (Point of Sales) machines, smart speakers, smartwatches, smart vehicle terminals, etc., but are not limited to these. The terminal devices and business servers or data processing servers may be directly or indirectly connected via wired or wireless communication, and this application does not impose any restrictions.

[0109] Optionally, and understandably, the aforementioned computer devices (such as the aforementioned business server 1000, terminal device 100a, terminal device 100b, etc.) can be nodes in a distributed system. This distributed system can be a blockchain system, formed by connecting multiple nodes through network communication. The nodes can form a peer-to-peer (P2P) network, where the P2P protocol is an application layer protocol running on top of the Transmission Control Protocol (TCP). In this distributed system, any type of computer device, such as a business server or terminal device, can become a node in the blockchain system by joining this peer-to-peer network. For ease of understanding, the concept of blockchain is explained below: Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. It is mainly used to organize data in chronological order and encrypt it into a ledger, making it tamper-proof and forgery-proof, while also enabling data verification, storage, and updating. When a computer device is a blockchain node, the immutability and anti-counterfeiting characteristics of the blockchain can ensure the authenticity and security of the data in this application (such as the medical treatment data of the test subject). This makes the results obtained after processing the data more reliable.

[0110] It is understood that the data processing method proposed in this application can be applied to anomaly detection scenarios in various fields. However, the business attribute characteristics of the detected objects will differ depending on the field. For example, the data processing method proposed in this application can be applied to the aforementioned medical field (specifically, the medical insurance field). This method can efficiently and accurately cluster the set of detected objects, thereby efficiently and accurately identifying anomaly groups exhibiting abnormal behavior in the medical field. When applied to the medical field, the business attribute characteristics of the detected objects can refer to their medical consultation data. Similarly, the data processing method proposed in this application can be applied to the financial field. This method can efficiently and accurately cluster the set of detected objects, thereby efficiently and accurately identifying anomaly groups exhibiting abnormal behavior in the financial field. When applied to the financial field, the business attribute characteristics of the detected objects can refer to their business data in financial-related businesses (such as the purchase of financial products). Furthermore, the data processing method proposed in this application can also be applied to the gaming field, where the business attribute characteristics of the detected objects can refer to their game data. Of course, the medical, financial, and gaming fields mentioned above are merely examples. The application fields of the method provided in this application are not limited to these; for example, it can also be applied to the short video field, the education field, and so on. For ease of understanding, the following description uses the application of the method provided in this application to the medical field, taking the detection of abnormal object groups in the medical field as an example. Scenarios for detecting abnormal object groups in other application fields can be referred to the following description.

[0111] To address the problem in the medical field that currently requires significant human and material resources to identify and detect abnormal groups exhibiting unusual behavior, this application provides a method for clustering a set of detected objects based on graph self-supervised learning. This method can help relevant inspectors (such as medical institutions or law enforcement organizations) efficiently identify abnormal groups in the medical field through the clustering results. The specific implementation process is detailed below.

[0112] It should be noted that, in the specific embodiments of this application, user information and user data (such as the aforementioned medical treatment data, game data, etc.) are all obtained only after the user has manually authorized permission (i.e., with the user's consent). In other words, when the above embodiments of this application are applied to specific products or technologies, the methods and related functions provided by the embodiments of this application operate with the user's permission or consent (the user may actively activate the functions provided by the embodiments of this application), and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0113] Further, please see Figure 2 , Figure 2 This is a schematic flowchart illustrating a data processing method provided in an embodiment of this application. The method provided in this application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, and assisted driving. This method can be implemented by a terminal device (e.g., the one described above). Figure 1 The execution can be performed by any terminal device in the terminal device cluster shown, such as terminal device 100a, or by a server (as described above). Figure 1 The business server 1000 in the corresponding embodiment, or the one described above Figure 1 The data processing server 10000 in the corresponding embodiment can execute the method, but it can also be jointly executed by the terminal device and the server. For ease of understanding, this embodiment uses the method executed by the server as an example for explanation. Figure 2 As shown, the data processing method may include at least the following steps S101-S107:

[0114] Step S101: Based on the business attribute features of each detection object in the business within the detection object set, construct an object relationship graph with each detection object as an object node.

[0115] In this application, "business" can refer to a functional business that serves users within a specific application domain. For example, a business can refer to related financial businesses in the financial field (such as financial product purchase services, related product display services, etc.); it can also refer to medical businesses in the medical field (such as medical consultation services, medical insurance reimbursement services, etc.); or it can refer to video recommendation services in the short video field, etc. The above application domains and businesses within them are merely illustrative examples. The application domains and businesses within them in this application are not limited to these examples. For instance, the application domain could also be the insurance field or the multimedia field, and the business could refer to insurance services in the insurance field, advertising services in the multimedia field, etc. These will not be listed in detail here. The following description will use the medical field (specifically, the medical insurance field) as an example, with the business being medical services (specifically, medical insurance reimbursement services).

[0116] It should be understood that in the field of medical insurance, there are various groups that organize themselves to engage in fraudulent activities, abnormal consumption, and false reimbursements. To reduce the frequency of these abnormal behaviors, it is necessary to investigate and identify these groups of individuals exhibiting such behavior. The set of objects to be investigated here refers to a collection of objects to be examined. Each object can be the subject of the investigation; in other words, each object needs to be examined to determine whether it is involved in abnormal behavior. For each object, its business attribute characteristics can be obtained. These characteristics can include the object's attribute features and its business behavior characteristics. Object attribute features can be those describing the object's attributes (such as age, place of residence, etc.), while business behavior characteristics can be those describing the object's relevant behaviors within the business context. For example, in the context of medical services, business behavior characteristics can refer to the characteristics of a subject's medical treatment behavior. A subject receives treatment at a medical institution at different times, and these business behavior characteristics can include the subject's consultation time, reason for consultation, type of disease diagnosed, treatment plan, etc. In general, for medical services, the business attribute characteristics of a subject in medical services can refer to the subject's medical treatment data (including information such as the subject's age, place of residence, consultation time, reason for consultation, type of disease diagnosed, treatment plan, etc.).

[0117] In this application, the server can obtain the business attribute characteristics of each detection object in the business. Based on these business attribute characteristics, the server can determine whether there is a relationship between different detection objects according to the preset relationship verification rules. Thus, based on the relationship between the detection objects, an object relationship graph of the detection object set can be constructed.

[0118] The set of objects to be detected contains the object S. i Each detected object possesses specific business attribute characteristics within the business context, including the detected object S. i Business attribute characteristics T in business i Taking (i is a positive integer) as an example, the specific implementation of constructing an object relationship graph with each detection object as an object node based on the business attribute features of each detection object in the detection object set can be as follows: We can construct the object node corresponding to each detection object in the detection object set, thereby obtaining the object node set; subsequently, based on the business attribute features T... i Based on the business attribute characteristics of the remaining detection objects in the business, the detection object S can be determined from the detection object set. iThe corresponding associated objects; where, the remaining detection objects refer to the set of detection objects excluding detection object S. i Other than the detection objects; further, the detection object S can be... i The corresponding object node is identified as the target object node, and the detection object S is... i The object node corresponding to the associated object is identified as the associated object node; a connection edge can be constructed between the target object node and the associated object node, thereby obtaining the associated edge corresponding to the target object node; when the associated edge corresponding to each object node in the object node set is determined, the structure graph containing the object node set and the associated edge corresponding to each object node can be identified as the object relationship graph corresponding to the detected object set.

[0119] It should be noted that the set of detection objects usually contains a large number of detection objects. For the set of detection objects, excluding detection object S... i The remaining detection objects besides the one mentioned above may not be just one; that is, the number of remaining detection objects may be one or at least two. Here, the detection object S is determined based on the business attribute characteristics of the remaining detection objects within the business context. i The corresponding associated object is actually determined from all remaining detection objects based on their business attribute characteristics in the business context. i The corresponding associated objects. Specifically, taking the number of remaining detected objects as M (M is a positive integer) as an example, for a business attribute feature T... i And the business attribute characteristics of the remaining detection objects in the business, to determine the detection object S in the detection object set. i The specific implementation of the corresponding associated object can be as follows: The business attribute features of each of the M remaining detection objects in the business can be determined as remaining business attribute features; subsequently, the business attribute feature T can be determined. i The feature similarity between each remaining business attribute feature and the target feature similarity can be obtained by calculating M feature similarities. Further, the feature similarities among these M feature similarities that are greater than a similarity threshold are identified as target feature similarities, and the remaining business attribute features corresponding to these target feature similarities are identified as similar business attribute features. Subsequently, the remaining detection objects corresponding to the similar business attribute features in the detection object set can be identified as detection objects S. i The corresponding associated object.

[0120] Among them, the remaining business attribute features are included in the M remaining business attribute features T. j (j is a positive integer), M feature similarities include the remaining business attribute features T j With business attribute feature T iThe similarity of features between them, taking the time of business participation as an example, for determining business attribute feature T i The specific implementation of obtaining M feature similarities with each remaining business attribute feature can be as follows: Business attribute feature T can be... i The included business participation time is determined as the first participation time, and the remaining business attribute features T are... j The included business participation time is determined as the second participation time; the interval between the first and second participation times can be determined; subsequently, a duration mapping table can be obtained; this duration mapping table contains the mapping relationship between the configuration time interval set and the configuration similarity set; and there is a mapping relationship between a configuration duration interval in the configuration time interval set and a configuration similarity in the configuration similarity set; furthermore, the configuration duration interval to which the interval duration belongs in the configuration duration interval set can be determined as the target duration interval, and the configuration similarity in the configuration similarity set that has a mapping relationship with the target duration interval can be determined as the remaining business attribute feature T. j With business attribute feature T i Feature similarity between them.

[0121] It is understood that, in the embodiments of this application, when constructing the object relationship graph corresponding to the set of detection objects, object nodes corresponding to each detection object can be constructed first. Then, the business attribute features corresponding to any two detection objects can be compared to calculate the feature similarity between the two business attribute features. If the feature similarity between the two business attribute features is lower than the similarity threshold, then it can be determined that there is an association between the two detection objects in this business. Thus, a connecting edge can be constructed between the two object nodes corresponding to the two detection objects, thereby obtaining an object relationship graph containing different object nodes and connecting edges. That is to say, this object relationship graph can be used to represent the association between any two detection objects in the set of detection objects (if there is a connecting edge between two object nodes, then it can be determined that there is an association between the detection objects corresponding to the two object nodes). The association between detection objects in this application can vary depending on the business. For example, in the medical business, this application can determine the centralized medical treatment relationship between detection objects as the association relationship. That is, through the business attribute features of the detection objects, it can be determined whether there is a centralized medical treatment relationship between the detection objects. If there is a centralized medical treatment relationship, then there is an association relationship.

[0122] In medical services, determining whether a clustered medical visit relationship exists among the tested individuals can be achieved through their consultation time (which can be understood as the time spent participating in medical services, also known as the service participation time, which can be pinpointed to a specific moment, hence also called the service participation moment). For example, this application can pre-set a duration threshold (the duration threshold can be determined based on actual business needs). If the interval between the consultation times (visit moments) of two tested individuals is less than this duration threshold, it indicates that the two tested individuals have a shared medical visit behavior, thus indicating a clustered medical visit relationship between them. Optionally, this application can also pre-configure a mapping table between different duration intervals (which can be called configured duration intervals) and similarity (which can be called configured similarity). Subsequently, it can determine which duration interval the interval between the consultation times of the two tested individuals falls into, and then determine the feature similarity between the two tested individuals based on the duration interval in which the interval falls. When the feature similarity between the two tested individuals is less than the similarity threshold, it can be determined that a clustered medical visit relationship exists between the two tested individuals.

[0123] To facilitate understanding, the following will combine Figure 3 This section explains the specific methods for constructing the object relationship graph of the detection object set. Specifically, Figure 3 This is a schematic diagram illustrating the construction of an object relationship diagram provided in an embodiment of this application. For example... Figure 3 As shown, taking the detection object set 300 as an example, this detection object set 300 contains detection object 3001, detection object 3002, detection object 3003... detection object 300n. Assume the business attribute feature T... i For the medical visit data of object 3001 in the medical business, the business attribute feature T j To obtain the medical visit data of the test subject 3002 in the medical business, the visit time of the test subject 3001 (the business participation time of the test subject 3001 in the medical business) can be obtained from the medical visit data of the test subject 3001, and the visit time of the test subject 3002 (the business participation time of the test subject 3002 in the medical business) can also be obtained from the medical visit data of the test subject 3002.

[0124] Here, we assume that the consultation time of subject 3001 is time a1, and the consultation time of subject 3002 is time a2. We also assume that the consultation interval between time a2 and time a1 is 2 minutes. Based on this consultation interval (2 minutes), we can determine whether there is a concentrated consultation relationship between subject 3001 and subject 3002. Specifically, in this embodiment, a duration mapping table can be pre-configured to configure the mapping relationship between different duration intervals and similarity. For example, the duration mapping table configured in this application can be shown in Table 1:

[0125] Table 1

[0126] Configure duration range (min) Configuration similarity [0，1] 90％ (1，2] 80％ (2，3] 70％ (3，4] 60％ (4，5] 50％ >5 0

[0127] The configuration duration intervals shown in Table 1 can refer to pre-configured duration intervals (a duration interval can refer to a duration range), specifically including duration intervals [0, 1], (1, 2], (2, 3], (3, 4], (4, 5], and >5. For each duration interval, a corresponding similarity can be configured (the configuration similarity corresponding to the configured duration interval, that is, there is a mapping relationship between it and the configured duration interval). For example, the configuration similarity corresponding to duration interval [0, 1] is 90%, the configuration similarity corresponding to duration interval (1, 2] is 80%, ..., and the configuration similarity corresponding to duration interval >5 is 0.

[0128] Furthermore, within these configured duration intervals, the interval for the aforementioned 2-minute consultation interval is found to be (1, 2]. Therefore, it can be determined that the feature similarity between the detection object 3001 and the detection object 3002 is 80% (business attribute feature T). i With remaining business attribute features T jThe feature similarity between them is 80%. Assuming a similarity threshold of 50%, since the feature similarity of 80% is already greater than this threshold, we can immediately identify detection object 3002 as an associated object of detection object 3001 (similarly, for detection object 3002, detection object 3001 is also an associated object of detection object 3002). This establishes an association (centralized treatment relationship) between detection objects 3001 and 3002. Similarly, by determining the association between detection objects 3001 and 3002, we can determine the association between any two detection objects in the detection object set 300. This allows us to obtain the association between different detection objects in the detection object set 300. Subsequently, based on the association between different detection objects, we can construct an object relationship graph. For example, we can first create object nodes corresponding to each detected object (assuming object node 3001 corresponds to object node 3001, object node 3002 corresponds to object node 3002, ..., object node 300n corresponds to object node 300n). Then, we can connect the object nodes corresponding to two related detected objects, thereby obtaining... Figure 3 The object relationship diagram 300A shown has an association between the detection object 3001 and the detection object 3002. Therefore, there will also be a connecting edge between the object node 3001 and the object node 3002 (the object node 3001 and the object node 3002 are connected).

[0129] Optionally, when determining whether there is a correlation between two detected objects, the method of directly comparing the business participation time can also be used. That is, if the interval between the two business participation times is less than the duration threshold (such as 5 minutes, 10 minutes, etc., which can be pre-configured manually), then it can be directly determined that there is a correlation between the two detected objects without introducing feature similarity.

[0130] Step S102: Call the graph auto-coder. In the graph auto-coder, based on the connection relationship between object nodes in the object relationship graph, determine the aggregate representation feature corresponding to each business attribute feature, and the reconstruction relationship graph corresponding to the object relationship graph.

[0131] In this application, after determining the object relationship graph, a graph auto-encoder / decoder can be invoked (for example, the object relationship graph and the business attribute features of each detected object can be input into the graph auto-encoder / decoder). The graph auto-encoder / decoder can output the aggregated representation features corresponding to each business attribute feature, as well as the reconstructed relationship graph corresponding to the object relationship graph. Specifically, the graph auto-encoder / decoder here can refer to a model containing a graph encoder and a graph decoder. Both the graph encoder and graph decoder can refer to a graph neural network. The graph neural network here can refer to a neural network that uses deep neural networks (such as convolutional networks, recurrent neural networks, autoencoders, etc.) to process graph structure data, learn node representation features, graph representations, and other information. Common graph neural networks include graph convolutional networks, graph attention networks, etc.

[0132] It should be understood that in the graph encoder of a graph autoencoder, each business attribute feature can be encoded based on the connection relationships in the object relationship graph, thereby obtaining the aggregated representation feature (encoded latent variable) corresponding to each business attribute feature. Specifically, for the business attribute feature of a certain detection object (let's say detection object A), when encoding it, we can obtain the object node (let's say object node A) of the detection object in the object relationship graph, and obtain the object nodes that have a connection relationship with object node A. The object nodes that have a connection relationship with object node A can be used as the adjacent nodes of object node A. Subsequently, the graph encoder can pass and aggregate the business attribute features corresponding to all adjacent nodes to the business attribute feature corresponding to object node A (that is, the business attribute feature of detection object A), thereby aggregating a representation feature. This aggregated representation feature can be used as the aggregated representation feature corresponding to the business attribute feature of detection object A (that is, the node representation feature of object node A after encoding and aggregation). Similarly, we can obtain the node representation feature corresponding to each object node, that is, we can obtain the aggregated representation feature corresponding to each business attribute feature.

[0133] Furthermore, for each aggregated representation feature obtained by the graph encoder, the graph decoder can decode and reconstruct it, thereby obtaining new connection relationships between object nodes (which can be called the predicted connection relationships output by the graph auto-encoder). Through the reconstructed new connection relationships between different object nodes, a new relationship graph can be obtained, which can be called the reconstructed relationship graph. For the specific implementation method of determining the aggregated representation features corresponding to each business attribute feature based on the connection relationships between object nodes in the object relationship graph in the graph auto-encoder, and the reconstructed relationship graph corresponding to the object relationship graph, please refer to the description in subsequent embodiments.

[0134] Step S103: Perform feature clustering processing on each aggregated representation feature to obtain the cluster distribution results corresponding to the set of detected objects.

[0135] In this application, after determining the aggregated representation features corresponding to each business attribute feature through the graph auto-encoder, each aggregated representation feature contains relevant feature information of other detected objects with related relationships. Therefore, the set of detected objects can be clustered using these aggregated representation features. Specifically, feature clustering processing can be performed on each aggregated representation feature, resulting in a cluster distribution. In this application, a clustering algorithm can be used for clustering. Clustering algorithms are commonly used and important data analysis methods in data mining. Essentially, they aggregate similar samples or patterns together using distance metrics in the sample representation space, achieving a classification effect. The results of clustering algorithms can be used in a wide range of downstream data application businesses, greatly facilitating production and daily life. A typical clustering algorithm involves collecting samples to be clustered and grouping samples with the closest distance metrics into one class based on a defined metric (such as K-means clustering). Common and representative clustering algorithms include K-means clustering, manifold learning, hierarchical clustering, density clustering, and covariance clustering. This application can employ any clustering algorithm to cluster data (such as aggregated representation features). For ease of understanding, the following description will use K-means clustering as an example. It should be understood that K-means is a classic clustering algorithm. It first requires the user to set a value K, and the algorithm will then cluster the samples into K classes. The algorithm first initializes K centers, and then repeats two steps until the centers no longer change. The two steps can be: Step 1, calculating the distance from each sample to each center and assigning the sample to the class indicated by the nearest center; Step 2, changing the center to the mean value of each dimension of the samples in that class. These two steps are repeated until the convergence condition is met.

[0136] In the embodiments of this application, after the graph auto-encoder outputs each aggregated representation feature, the K-means clustering algorithm can be used to cluster the aggregated representation features. Specific steps may include: Step 1: Randomly selecting K aggregated representation features as the centroid vectors of each cluster (i.e., using the K aggregated representation features as the centers of the clusters); Step 2: Calculating the distance (vector distance, such as Euclidean distance) between each aggregated representation feature and the K centroid vectors. This allows each aggregated representation feature to be assigned to the cluster closest to it (for example, for a given aggregated representation feature, the distances between that feature and the K centroid vectors can be calculated, thus determining the closest centroid among the K distances). The minimum distance, and the centroid vector corresponding to the minimum distance can be determined as the centroid vector closest to the aggregate representation feature. Then the aggregate representation feature can be assigned to the cluster where the nearest centroid vector is located. 3: After assigning each aggregate representation feature to different clusters, for K clusters, the new centroid vector corresponding to each cluster can be recalculated based on the aggregate representation features contained therein (for example, the average value of the aggregate representation features contained in the cluster can be used as the new centroid vector of the cluster). 4: Repeat steps 2 and 3 above until the convergence condition is met (such as reaching the preset number of iterations). Finally, output the final cluster where each aggregate representation feature is located, and the final centroid vector of each cluster.

[0137] Based on this, it can be determined that after performing feature clustering on each aggregate representation feature using the K-means algorithm, a cluster distribution result can be obtained. This cluster distribution result contains multiple (multiple means two or more) clusters (here, clusters can be called feature clusters). Each feature cluster contains one or more aggregate representation features, and the aggregate representation features contained in a feature cluster are similar.

[0138] Step S104: Based on the cluster distribution results, the reconstructed relation graph, and the object relation graph, the graph self-coder is optimized to obtain the optimized graph self-coder.

[0139] In this application, in order to improve the above-mentioned clustering effect and make the clustering results of the detected object set more accurate, the embodiments of this application can train the graph auto-decoder according to the cluster distribution results, so that the aggregated representation features output by the graph auto-decoder can be strongly correlated with the clustering task (that is, the aggregated representation features output by the graph auto-decoder are highly correlated with the subsequent clustering task), thereby improving the effectiveness of the aggregated representation features output by the graph auto-decoder. Meanwhile, it is understood that the reconstructed relational graph output by the graph decoder is determined by the graph decoder based on the aggregated representation features encoded by the graph encoder. Therefore, this reconstructed relational graph reflects the accuracy of the aggregated representation features encoded by the graph encoder. For example, if the error between the connection relationships between object nodes represented by the reconstructed relational graph and the connection relationships represented by the object relational graph is small, it indicates that a relational graph close to the real connection relationships can be determined based on the aggregated representation features output by the graph encoder, thus indicating that the aggregated representation features output by the graph encoder are relatively accurate. Conversely, if the error between the connection relationships between object nodes represented by the reconstructed relational graph and the connection relationships represented by the object relational graph is large, it indicates that the aggregated representation features output by the graph encoder do not yet possess high accuracy. In this case, the graph auto-coder needs to be trained based on the error values ​​until the graph auto-coder can output accurate and effective aggregated representation features. In other words, in this embodiment, the graph auto-coder can be trained based on the reconstructed relational graph output by the graph decoder and the real object relational graph. Based on this, this application can train a graph self-encoder using the reconstructed relation graph, the object relation graph, and the cluster distribution results obtained from clustering. Training the reconstructed relation graph and the object relation graph can train the connections between object nodes, making the connections reflected in the reconstructed relation graph closer to those obtained in the object relation graph. Training the cluster distribution results can train the distance between the aggregated representation features and the centroids of each cluster. Therefore, by jointly optimizing the graph self-encoder using the reconstructed relation graph and the cluster distribution results, the aggregated representation features output by the optimized graph self-encoder can be more accurate and strongly correlated with the clustering task. In other words, the aggregated representation features output by the optimized graph self-encoder (referred to as optimized aggregated representation features) are effective and accurate, and the cluster distribution results obtained based on the optimized aggregated representation features (referred to as optimized cluster distribution results) have higher accuracy, i.e., better clustering performance. For a detailed implementation of optimizing the graph self-encoder based on the cluster distribution results, the reconstructed relation graph, and the object relation graph, please refer to the following sections. Figure 5 The description in the corresponding embodiments.

[0140] Step S105: In the optimized graph self-encoder, based on the connection relationship between object nodes in the object relationship graph, the optimized aggregate representation feature corresponding to each business attribute feature is output.

[0141] Furthermore, in this application, once the optimized graph self-encoder is trained, it can be invoked to output the optimized aggregated representation features corresponding to each business attribute feature. Specifically, the object relationship graph and each business attribute feature can be input into the optimized graph self-encoder. In the optimized graph self-encoder, the optimized aggregated representation features corresponding to each business attribute feature can be determined based on the connection relationships between object nodes in the object relationship graph.

[0142] Step S106: Perform feature clustering processing on each optimized aggregate representation feature to obtain the optimized cluster distribution result corresponding to the set of detected objects.

[0143] In this application, after obtaining the optimized aggregated representation features corresponding to each business attribute feature, feature clustering processing can be performed based on these optimized aggregated representation features. This yields a new cluster distribution result (referred to as the optimized cluster distribution result). Based on this optimized cluster distribution result, the abnormal object group in the detection object set can be identified. Here, a clustering algorithm can also be used to perform feature clustering processing on each optimized aggregated representation feature. Specifically, the same clustering algorithm as in step S103 above (such as the K-means clustering algorithm) can be preferred for feature clustering processing.

[0144] Step S107: Identify abnormal object groups in the detection object set based on the optimized cluster distribution results.

[0145] In this application, the optimized cluster distribution result includes at least two optimized feature clusters, and each of the at least two optimized feature clusters contains one or more optimized aggregate representation features, and the at least two optimized feature clusters contain optimized feature cluster K. c Taking (c as a positive integer) as an example, the specific method for identifying abnormal object groups in the detection object set based on the optimized cluster distribution results can be as follows: Optimized feature clusters K can be identified. c The abnormal objects contained therein can then be optimized into feature clusters K. c The set of abnormal objects contained therein is determined as the optimized feature cluster K. c The corresponding cluster abnormal subgroups; using the same principle, the cluster abnormal subgroups corresponding to each optimized feature cluster can be determined. When the cluster abnormal subgroups corresponding to each optimized feature cluster are determined, the cluster abnormal subgroups corresponding to each optimized feature cluster can be identified as abnormal object groups in the detection object set.

[0146] It should be understood that when the set of detected objects is clustered and divided into optimized cluster distribution results by optimizing aggregate representation features, since each optimized feature cluster contained in the optimized cluster distribution results contains detected objects with similar optimized aggregate representation features, in other words, the detected objects classified into the same optimized feature cluster are very likely to be related. Each abnormal object (object that has exhibited abnormal behavior) in the same optimized feature cluster can be understood as a group that has exhibited abnormal behavior (called the abnormal subgroup of the cluster). The abnormal subgroups of the cluster in each optimized feature cluster can all be considered as the abnormal object group in the set of detected objects. It should be noted that, in this application, after obtaining the optimized cluster distribution result, the server can directly output the optimized cluster distribution result as a reference for manually identifying abnormal object groups. For example, relevant personnel (such as abnormal object group investigators) can efficiently and accurately identify abnormal object groups in the detection object set based on the correlation between the detection objects reflected by each optimized feature cluster in the optimized cluster distribution result. Of course, after obtaining the optimized cluster distribution result, the server can also first identify the abnormal objects in each optimized feature cluster, obtain the abnormal subgroups of each optimized feature cluster, and then output the optimized cluster distribution result and the abnormal subgroups of each optimized feature cluster together. The abnormal subgroups of each optimized feature cluster identified by the server can also be used as a reference for manually identifying abnormal object groups.

[0147] Among them, optimizing feature cluster K c Taking the inclusion of anomaly-labeled objects (anomaly-labeled object refers to an object exhibiting abnormal label behavior in the business logic) as an example, for identifying and optimizing feature cluster K... c The specific way to include the abnormal objects can be as follows: the optimized feature cluster K can be... c Among the one or more optimized aggregated representation features included, the optimized aggregated representation feature corresponding to the anomaly label object is determined as the target representation feature, and the optimized feature cluster K is... c Among the one or more optimized aggregated representation features included, those other than the target representation feature are identified as candidate anomaly representation features corresponding to the target representation feature. Subsequently, the detection objects corresponding to the candidate anomaly representation features can be identified as candidate anomaly objects. Business behavior data of the candidate anomaly objects in the business can be obtained, and the behavioral correlation between the business behavior data and the anomaly label behavior can be determined. When the behavioral correlation is greater than the correlation threshold, the candidate anomaly object can be identified as the anomaly associated object corresponding to the anomaly label object, and both the anomaly label object and the anomaly associated object are identified as optimized feature cluster K. c The exception objects contained therein.

[0148] It should be understood that in the medical insurance field, if multiple anomalous entities form a group to perform an anomalous behavior (such as fabricating false invoices, creating false treatment plans, fraudulently buying and selling drugs, etc.), these anomalous entities typically execute different anomalous steps, which can ultimately be chained together to achieve the anomalous behavior. Therefore, the behavioral data of these anomalous entities within the group will exhibit a certain degree of correlation. Based on this, in identifying and optimizing feature clusters K... c When considering the abnormal objects contained within, if the optimized feature cluster K is determined first... c In this process, if a detected object exhibits an abnormal labeled behavior (an abnormal labeled behavior can refer to a behavior that is pre-defined as abnormal) in the business, then the detected object can be identified as an abnormal labeled object. Subsequently, the optimization of feature cluster K can be performed. c Among the other detection objects included, find detection objects that have a behavioral association with the abnormal label object (the behavioral association between the business behavior data and the behavior of the abnormal label is greater than the association threshold, where the association threshold can be a pre-configured value). These detection objects can be identified as abnormal associated objects of the abnormal label object, and they can be identified together with the abnormal label object as an abnormal group (clustered abnormal subgroup).

[0149] It should be noted that the method provided in this application embodiment can be used in the detection of abnormal object groups. The method provided in this application embodiment can accurately and efficiently cluster the detection object set, grouping detection objects with similar characteristics together, thereby assisting relevant personnel in efficiently and accurately identifying abnormal object groups within the detection object set. However, the method of identifying abnormal object groups in the detection object set based on clustering results (such as optimized cluster distribution results) in this application embodiment is an exemplary description. The specific method for identifying abnormal object groups in the detection object set based on clustering results can be dynamically determined based on actual business needs, and this application does not impose any limitations on it.

[0150] In this embodiment, an object relationship graph can be constructed based on the business attribute features of different detected objects in the object detection set. Based on this object relationship graph, a self-supervised learning process can be performed on the graph self-encoder, enabling the graph self-encoder to effectively and accurately determine the optimized aggregate representation features corresponding to each object node based on the connection relationships between object nodes in the object relationship graph. Subsequently, the detected object set can be clustered based on these effective and accurate optimized aggregate representation features. The resulting optimized cluster distribution can serve as a reference aid in the task of identifying abnormal object groups in the detected object set. For example, based on a detected abnormal object, related objects associated with it can be searched in its respective cluster. This allows for efficient and accurate identification of related objects of an abnormal object in a cluster with a small number of objects, without having to search through a massive number of objects one by one. This can effectively reduce labor and time costs and improve identification efficiency.

[0151] Further, please see Figure 4 , Figure 4 This is a schematic diagram illustrating a process for outputting aggregated representation features and reconstructing a relationship graph using a graph auto-encoder, as provided in an embodiment of this application. This process can correspond to the above-mentioned... Figure 2 In the corresponding embodiment, in the graph auto-encoder, based on the connection relationships between object nodes in the object relationship graph, the aggregated representation features corresponding to each business attribute feature are determined, as well as the flow of the object relationship graph. For example... Figure 4 As shown, the process may include at least the following steps S401-S402:

[0152] Step S401: Call the graph encoder in the graph auto-encoder. In the graph encoder, each business attribute feature is encoded by the connection relationship between object nodes in the object relationship graph to obtain the aggregated representation feature corresponding to each business attribute feature.

[0153] Specifically, based on the above, a graph self-encoder / decoder can include a graph encoder and a graph decoder. After obtaining the object relationship graph, the graph encoder in the graph self-encoder / decoder can be called first. Specifically, the object relationship graph and each business attribute feature can be input into the graph encoder. Through the graph encoder, the structural information of the graph and the business attribute features corresponding to the object nodes can be encoded into aggregated representation features. Specifically, the graph encoder can obtain the aggregated representation feature of a certain object node by passing and aggregating the relevant feature information corresponding to the adjacent nodes in the object relationship graph. Thus, the aggregated representation features corresponding to each object node simultaneously encode the structural information (i.e., connection relationship) of the object relationship graph and the relevant feature information of the adjacent nodes.

[0154] The set of objects to be detected contains the object S.i Each detected object possesses specific business attribute characteristics within the business context, including the detected object S. i Business attribute characteristics T in business i Taking (i is a positive integer) as an example, in a graph encoder, the specific implementation of encoding each business attribute feature through the connection relationships between object nodes in the object relationship graph to obtain the aggregate representation feature corresponding to each business attribute feature can be as follows: In a graph encoder, the detected object S can be... i The corresponding object node is identified as the target object node, and the object nodes in the object relationship graph that have connections with the target object node are identified as the adjacent nodes of the target object node. Subsequently, the adjacent business attribute features corresponding to the adjacent nodes can be compared with the business attribute feature T. i By performing encoding fusion processing, the business attribute feature T can be obtained. i The corresponding aggregated representation features; among them, the adjacent business attribute features corresponding to adjacent nodes refer to the business attribute features of the detection object corresponding to the adjacent node in the business (that is, for a certain detection object, after creating its corresponding object node, the business attribute features of the detection object can also be understood as the business attribute features corresponding to the object node). It should be understood that for the business attribute features corresponding to a certain object node, the aggregated representation features corresponding to the object node can be obtained by passing and aggregating the relevant feature information of its adjacent nodes.

[0155] Among them, the adjacency service attribute features corresponding to adjacent nodes are compared with the service attribute feature T. i The code fusion process is performed to obtain the business attribute feature T. i The specific implementation of the corresponding aggregated representation features can be as follows: The relational adjacency matrix corresponding to the object relation graph can be obtained; whereby the relational adjacency matrix is ​​used to represent the connection relationships between object nodes in the object relation graph; subsequently, the relational adjacency matrix can be normalized, thereby obtaining the normalized adjacency matrix corresponding to the relational adjacency matrix; furthermore, the encoding parameter matrix in the graph encoder can be obtained, and through the logical operation function of the graph encoder, the relational adjacency matrix and the business attribute feature T can be... i The adjacent service attribute features and the encoding parameter matrix are processed to obtain the service attribute feature T. i The corresponding aggregate representation features.

[0156] It should be understood that the relational adjacency matrix corresponding to the object relation graph is determined based on the connection relationships between object nodes in the object relation graph. Specifically, if there is a connection relationship between two object nodes in the object relation graph, the relation data commonly corresponding to the object nodes can be set to a valid value (such as the value 1). If there is no connection relationship between two object nodes in the object relation graph, the relation data commonly corresponding to the object nodes can be set to an invalid value (such as the value 0). Thus, a relational adjacency matrix containing valid and invalid values ​​can be obtained. (It should be noted that the relation data is generated based on the common correspondence between two object nodes. In this application, the relation data commonly corresponding to an object node and itself can be set to a valid value.) For ease of understanding, taking an object node set containing object node 1, object node 2, and object node 3 as an example, assuming that there is a connection relationship between object node 1 and object node 2, no connection relationship between object node 1 and object node 3, and a connection relationship between object node 2 and object node 3, then based on the connection relationships between object node 1, object node 2, and object node 3, a relational adjacency matrix A1 can be obtained to represent the connection relationships between object nodes. The relational adjacency matrix A1 is shown in the following matrix:

[0157] Relational adjacency matrix A1

[0158] Specifically, in the adjacency matrix A1, relation data 11 can be used to represent the connection relationship between object node 1 and object node 2 (default is that a connection relationship exists), relation data 22 can be used to represent the connection relationship between object node 2 and object node 3 (default is that a connection relationship exists), and relation data 33 can be used to represent the connection relationship between object node 3 and object node 4 (default is that a connection relationship exists). Relation data 11, relation data 22, and relation data 33 can all be valid values ​​of 1. Relation data 12 and relation data 21 can both be used to represent the connection relationship between object node 1 and object node 2, and both relation data 12 and relation data 21 can be valid values ​​of 1. Relation data 13 and relation data 31 can both be used to represent the connection relationship between object node 1 and object node 3, and both relation data 13 and relation data 31 can be invalid values ​​of 0. Relation data 23 and relation data 32 can both be used to represent the connection relationship between object node 2 and object node 3, and both relation data 23 and relation data 32 can be valid values ​​of 1. Based on this, we can obtain the relational adjacency matrix A2, which represents the connection relationships between object nodes. The relational adjacency matrix A2 is shown in the following matrix:

[0159] Relational adjacency matrix A1

[0160] For ease of understanding, please refer to Formula (1). Formula (1) is the specific implementation method of the graph encoder to encode business attribute features and obtain aggregated representation features, as shown in Formula (1):

[0161] H (l) =ReLu(A′H (l-1) W (l) ) Formula (1)

[0162] Among them, A, as shown in formula (1), can be used to characterize the relational adjacency matrix corresponding to the object relation graph; A′ can be used to characterize the matrix obtained after normalizing the relational adjacency matrix (i.e., the normalized adjacency matrix); H (l) It can be used to represent the aggregated representation features obtained from the l-th encoding layer in a graph encoder; H (l-1) In a graph encoder, the aggregated representation features obtained by the encoder layer above the l-th layer can be characterized; W (l) This can be used to characterize the parameters of the l-th layer in a graph encoder. ReLU() represents the activation function (i.e., the logical operation function). It should be understood that a graph encoder can consist of multiple encoder layers (for example, when the graph encoder is a graph neural network, it can consist of multiple neural network layers, each of which can be understood as an encoding layer). Therefore, business attribute features can be encoded layer by layer (the input of each encoding layer is the output of the previous layer; for the first encoding layer, the input is the initial business attribute feature). The aggregated representation feature obtained in the last layer can be understood as the aggregated representation feature output by the graph encoder.

[0163] In summary, the way the graph encoder outputs aggregated representation features can be shown in Equation (2):

[0164] H = f e (A, X) Formula (2)

[0165] Wherein, A, as shown in formula (2), can be used to characterize the relational adjacency matrix corresponding to the object relation graph; X can be used to characterize the feature vector composed of each business attribute feature (containing each business attribute feature); H can be used to characterize the feature vector output by the graph encoder composed of each aggregate representation feature (containing the aggregate representation feature corresponding to each business attribute feature); f e It can be used in characterization graph encoders.

[0166] Step S402: Call the graph decoder in the graph auto-decoder. In the graph decoder, based on the aggregate representation features corresponding to each business attribute feature, reconstruct the connection relationship between object nodes in the object relationship graph to obtain the reconstructed relationship graph.

[0167] Specifically, in the graph decoder, the aggregated representation features encoded by the graph encoder can be decoded into the structural information of the graph (i.e., a new relational graph is obtained, which can be called the reconstructed relational graph). Based on the above, the object relational graph consists of a set of object nodes (one object node in the set corresponds to one detected object in the set of detected objects) and the associated edges corresponding to each object node in the set (an associated edge is the connection edge between two object nodes). Therefore, in the graph decoder, the specific implementation of reconstructing the connection relationships between object nodes in the object relational graph based on the aggregated representation features corresponding to each business attribute feature can be as follows: The representation feature vector composed of the aggregated representation features corresponding to each business attribute feature can be obtained. The representation feature vector can be transposed to obtain the transposed transformation vector. Subsequently, the representation feature vector and the transposed transformation vector can be multiplied by a dot product to obtain the reconstructed neighboring features. The reconstructed adjacency matrix contains Q reconstructed connection probabilities (Q being a positive integer). One of these Q reconstructed connection probabilities is the predicted probability that two object nodes in the object node set have a connection relationship. Further, the associated edges corresponding to each object node in the object relationship graph can be deleted, and the resulting object relationship graph can be determined as an intermediate object relationship graph. The reconstructed connection probabilities among the Q reconstructed connection probabilities that are greater than a connection probability threshold (usually a preset value) can be determined as the target reconstructed connection probabilities. Subsequently, in the intermediate object relationship graph, connecting edges can be constructed between the two object nodes corresponding to the target reconstructed connection probabilities, thus obtaining the reconstructed relationship graph (that is, the connection relationships between object nodes in the reconstructed relationship graph may be different from those in the original object relationship graph).

[0168] For ease of understanding, please refer to formula (3). Formula (3) is the specific implementation of the graph decoder in decoding the aggregated representation features to obtain the reconstructed adjacency matrix, as shown in formula (3):

[0169]

[0170] Wherein, H as shown in formula (3) can refer to the feature vector (composed of aggregated feature vectors) shown in formula (2) above; H T It can be used to characterize the transpose of H, that is, the transpose vector obtained after transposing H; This can be used to characterize the reconstructed adjacency matrix obtained from the computation. It should be understood that when performing a dot product operation on two vectors, for each value in one vector (e.g., for each aggregated representation feature in the feature vector H), an inner product operation is performed with all values ​​in the other vector (the aggregated representation features after transpose transformation). Based on the result of this inner product operation, it can be determined whether a connection exists between the two object nodes. This inner product result can be understood as the predicted probability value (connection prediction probability, or reconstructed connection probability) of the connection between the two object nodes. For example, the larger the inner product result between two values, the greater the probability that there is a connection between the two object nodes. Based on this, a connection edge can be constructed between the two object nodes corresponding to the reconstructed connection probabilities in the reconstructed adjacency matrix that are greater than the connection probability threshold.

[0171] In summary, the method for the graph decoder to obtain the reconstructed adjacency matrix can be shown in Equation (4):

[0172]

[0173] Wherein, H as shown in formula (4) refers to the feature vector (composed of aggregated feature vectors) shown in formula (2) above; f d It can be used in a representation graph decoder; It can be used to characterize the reconstructed adjacency matrix.

[0174] In this embodiment of the application, a graph self-encoder is introduced in the task of identifying abnormal object groups. In the graph self-encoder, some information can be obtained from the input data as labels, so that self-supervised learning can be performed to obtain aggregated features containing the features of related objects. Thus, in the training phase, training can be completed without manual pre-labeling of data, which can effectively reduce the time for manual labeling of data to obtain labels and speed up the training process.

[0175] To better understand the process of training and optimizing the graph auto-decoder described above, please refer to [link / reference needed]. Figure 5 , Figure 5 This is a schematic diagram illustrating a process for optimizing a graph auto-codec according to an embodiment of this application, resulting in an optimized graph auto-codec. This process can correspond to the above-mentioned... Figure 2 In the corresponding embodiment, the graph self-encoder is optimized based on the cluster distribution results, the reconstructed relationship graph, and the object relationship graph, resulting in the optimized graph self-encoder process. For example... Figure 5 As shown, the process may include at least the following steps S501-S504:

[0176] Step S501: Perform distribution error calculation on the cluster distribution results to obtain the cluster distribution loss value corresponding to the cluster distribution results.

[0177] Specifically, a loss function can be pre-configured for training the clustering results. This loss function can be used as a cluster loss function to calculate the clustering error. The cluster loss function can be used to calculate the distribution error of the cluster distribution results, thereby determining the cluster distribution loss value. Here, the cluster distribution results contain W (W is a positive integer) feature clusters, and each of the W feature clusters contains one or more aggregated representation features. Each business attribute feature corresponds to an aggregated representation feature U. v Taking (v as a positive integer) as an example, the specific implementation of the cluster distribution loss value for determining the cluster distribution result can be as follows: the cluster center corresponding to each feature cluster can be obtained; subsequently, the aggregate representation feature U can be calculated separately. v The cluster distance between each cluster center and the cluster center, and according to the aggregation representation feature U v The cluster distance between each cluster center and the cluster center can determine the aggregate representation feature U. v The corresponding distance loss value; once the distance loss value corresponding to each aggregate representation feature is determined, the distance loss value corresponding to each aggregate representation feature can be processed to obtain the cluster distribution loss value.

[0178] The specific method for determining the cluster distribution loss value is shown in formula (5):

[0179]

[0180] Among them, H, as shown in formula (5) i It can be used to characterize the aggregate representation features corresponding to a certain object node i; This can be used to characterize the cluster distribution results after feature clustering, where the aggregation represents feature H. i The centroid vector of the cluster (the feature cluster to which it belongs) (i.e., the center of the feature cluster, i.e., the cluster center); This can be used to characterize a cluster distribution result where a certain aggregation representation feature H is not included. i The cluster center of the feature cluster; τ can be used to characterize a hyperparameter. The function shown in formula (5) can be used to characterize the cluster loss function (which is specifically a contrastive loss function), while for a certain aggregate representation feature (such as aggregate representation feature U) vThe cluster distance between the aggregate representation feature and each cluster center can be calculated. This distance can then be substituted into formula (5) to obtain the distance loss value corresponding to the aggregate representation feature. After performing the operation shown in formula (5) on the distance values ​​of all aggregate representation features (such as adding them and then taking the negative value), the final cluster distribution loss value L2 can be obtained.

[0181] It should be noted that the cluster loss function shown in formula (5) is based on the number of feature clusters k. However, in actual scenarios, the number of feature clusters in the cluster distribution result may not be a constant. So, assuming that the range of the number of feature clusters is [1,…,K] (the maximum value of the number of feature clusters), the loss function shown in formula (5) can be changed to the loss function shown in formula (6), as shown in formula (6):

[0182]

[0183] Among them, K, as shown in formula (6), is used to characterize the maximum value of the number of feature clusters.

[0184] Step S502: Obtain the reconstruction adjacency matrix corresponding to the reconstruction relationship graph and the relationship adjacency matrix corresponding to the object relationship graph; the relationship adjacency matrix is ​​used to represent the connection relationship between object nodes in the object relationship graph, and the reconstruction adjacency matrix is ​​used to represent the connection relationship between object nodes in the reconstruction relationship graph.

[0185] Specifically, the adjacency matrix corresponding to the object relationship graph is determined based on the connection relationships between object nodes in the graph. Specifically, if there is a connection between two object nodes, the common relationship data of the object nodes can be set to a valid value (e.g., the value 1). Conversely, if there is no connection between two object nodes, the common relationship data can be set to an invalid value (e.g., the value 0). This yields a adjacency matrix containing both valid and invalid values. The aforementioned adjacency matrix A2 can be used as an example of an adjacency matrix.

[0186] Step S503: Perform prediction error calculation on the reconstructed adjacency matrix and relational adjacency matrix to obtain the connection prediction loss value corresponding to the reconstructed relational graph.

[0187] Specifically, based on the reconstructed adjacency matrix and the relational adjacency matrix, prediction error calculation can be performed (i.e., calculating the error between the predicted node connection relationship represented by the reconstructed adjacency matrix and the actual node connection relationship represented by the relational adjacency matrix). Thus, the connection prediction loss value corresponding to the reconstructed relational graph can be determined. The specific method for performing prediction error calculation on the reconstructed adjacency matrix and the relational adjacency matrix to obtain the connection prediction loss value corresponding to the reconstructed relational graph is shown in formula (7):

[0188]

[0189] Among them, L1, as shown in formula (7), can be used to characterize the connection prediction loss value, A ij It can be used to characterize the relationship data between object node i and object node j in the relational adjacency matrix (i.e., whether there is a connection between object node i and object node j, and if there is a connection, A). ij It can be 1; otherwise it can be 0. It can be used to characterize the connection prediction probability between object node i and object node j in the reconstructed adjacency matrix (i.e. the reconstructed connection probability mentioned above); the function shown in formula (7) can be used to characterize the connection prediction loss function. By substituting the values ​​in the relational adjacency matrix and the reconstructed adjacency matrix into it, the connection prediction loss value can be obtained.

[0190] Step S504: Determine the total loss value corresponding to the graph self-coder based on the cluster distribution loss value and the connection prediction loss value, and optimize the graph self-coder based on the total loss value to obtain the optimized graph self-coder.

[0191] It should be understood that after determining the cluster distribution loss value and the connection prediction loss value, the total loss value corresponding to the graph auto-decoder can be determined based on the cluster distribution loss value and the connection prediction loss value. The specific implementation method is shown in formula (8):

[0192] L=L1+λL2 Formula (8)

[0193] Wherein, L1, as shown in formula (8), can be used to characterize the above connection prediction loss value; L2 can be used to characterize the above cluster distribution loss value; λ can be used to characterize the weight coefficient of the cluster distribution loss value L2, and the importance of the cluster distribution loss value L2 can be changed by adjusting the size of λ; L can be used to characterize the total loss value. Based on this total loss value, the graph self-coder can be jointly optimized (optimizing and updating the computational parameters in the graph self-coder). Specifically, in the embodiments of this application, any optimization algorithm (such as the Adam optimization algorithm) can be used to optimize the graph self-coder. In other words, after determining the cluster distribution loss value and the connection prediction loss value, the cluster distribution loss value can be multiplied by the weight coefficient λ to obtain the operational distribution loss value of the cluster distribution loss value. (If the cluster distribution loss value is of high importance, the weight coefficient λ can be set to a larger value, and the operational distribution loss value will be correspondingly larger; conversely, if the cluster distribution loss value is of low importance, the weight coefficient λ can be set to a smaller value, and the operational distribution loss value will be correspondingly smaller. The importance of the cluster distribution loss value can be preset manually.) Subsequently, the operational distribution loss value can be summed with the connection prediction loss value to obtain the total loss value used for training and adjusting the graph auto-encoder.

[0194] In this embodiment, a graph self-encoder is introduced into the task of identifying abnormal object groups. This graph self-encoder can extract partial information from the input data as labels, enabling self-supervised learning to obtain aggregated features containing characteristics of related objects. Therefore, during the training phase, no manual pre-labeling of data is required, effectively reducing the time spent on manual data labeling and accelerating the training process. Furthermore, this application can reconstruct relationships based on each clustering result (such as cluster distribution results). Figure 1 By jointly training and optimizing the graph auto-coder, we can not only improve the accuracy of the graph auto-coder in predicting the connection relationships between object nodes, but also enable the graph auto-coder to output aggregated representation features that are strongly correlated with the clustering task, thereby optimizing the clustering effect.

[0195] Further, please see Figure 6 , Figure 6 This is a system architecture diagram provided in an embodiment of this application. For example... Figure 6 As shown, this system architecture may include at least a graph construction component, a graph self-encoder / decoder, a clustering module, a connection prediction loss determination component, a clustering loss determination component, and a total loss determination component. For ease of understanding, the functions implemented by each component in this system architecture will be described below:

[0196] The relational graph building component can be used to construct an object relational graph with the detection objects as object nodes, based on the business attribute features corresponding to each detection object in the detection object set.

[0197] The graph self-encoder is used to encode various business attribute features based on the connection relationships between object nodes in the object relationship graph, so as to obtain the aggregate representation features corresponding to each business attribute feature. At the same time, the graph self-encoder is also used to decode the aggregate representation features, thereby reconstructing the connection relationships between object nodes to obtain a reconstructed relationship graph.

[0198] The clustering component is used to perform feature clustering on the aggregated representation features encoded by the graph auto-encoder.

[0199] The reconstruction loss determination component is used to calculate the error between the reconstructed relationship graph and the object relationship graph to obtain a connection prediction loss value.

[0200] The clustering loss determination component is used to calculate the loss of clustering results (such as cluster distribution results) to obtain a cluster distribution loss value.

[0201] The total loss determination component is used to determine a total loss value based on the connection prediction loss value and the cluster distribution loss value mentioned above. This total loss value can be used to train and optimize the graph auto-decoder to obtain an optimized graph auto-decoder, thereby outputting more accurate aggregated representation features through the optimized graph auto-decoder.

[0202] For details on the specific implementation methods of each component, please refer to the above. Figures 2-5 The descriptions in the corresponding embodiments will not be repeated here. The beneficial effects they bring will also not be elaborated upon.

[0203] Further, please see Figure 7 , Figure 7 This is a schematic diagram of the structure of a data processing apparatus provided in an embodiment of this application. The data processing apparatus can be a computer program (including program code) running on a computer device; for example, the data processing apparatus is an application software. The data processing apparatus can be used to execute... Figure 3 The method shown. (As illustrated) Figure 7 As shown, the data processing device 1 may include: a graph construction module 11, a calling module 12, a feature determination module 13, a first clustering module 14, an optimization module 15, an optimized feature output module 16, a second clustering module 17, and a group identification module 18.

[0204] Graph construction module 11 is used to construct an object relationship graph with each detection object as an object node based on the business attribute features of each detection object in the business in the detection object set.

[0205] Module 12 is invoked to call the graph auto-coder;

[0206] The feature determination module 13 is used to determine the aggregate representation feature corresponding to each business attribute feature and the reconstruction relationship graph corresponding to the object relationship graph in the graph auto-encoder based on the connection relationship between object nodes in the object relationship graph.

[0207] Clustering module 14 is used to perform feature clustering processing on each aggregated representation feature to obtain the cluster distribution result corresponding to the set of detected objects;

[0208] Optimization module 15 is used to optimize the graph auto-coder based on the cluster distribution results, the reconstructed relationship graph, and the object relationship graph, to obtain an optimized graph auto-coder;

[0209] The optimized feature output module 16 is used to output the optimized aggregated representation features corresponding to each business attribute feature in the optimized graph self-encoder based on the connection relationship between object nodes in the object relationship graph;

[0210] The second clustering module 17 is used to perform feature clustering processing on each optimized aggregate representation feature to obtain the optimized cluster distribution result corresponding to the set of detected objects.

[0211] The group identification module 18 is used to identify abnormal object groups in the detection object set based on the optimized cluster distribution results.

[0212] The specific implementation methods of the graph construction module 11, the calling module 12, the feature determination module 13, the first clustering module 14, the optimization module 15, the optimized feature output module 16, the second clustering module 17, and the group identification module 18 can be found in the above description. Figure 2 The descriptions of steps S101-S107 in the corresponding embodiments will not be repeated here.

[0213] In one embodiment, the detection object set includes detection object S i Each detected object possesses specific business attribute characteristics within the business context, including the detected object S. i Business attribute characteristics T in business i i is a positive integer;

[0214] The graph construction module 11 is also specifically used to construct the object node corresponding to each detection object in the detection object set, thereby obtaining the object node set.

[0215] Graph construction module 11 is also specifically used for graph construction based on business attribute features T i And the business attribute characteristics of the remaining detection objects in the business, to determine the detection object S in the detection object set. i The corresponding associated object; the remaining detection objects refer to the set of detection objects excluding detection object S. i Other than the objects being tested;

[0216] Graph construction module 11 is also specifically used to construct the detection object S i The corresponding object node is identified as the target object node, and the detection object S is... i The object node corresponding to the associated object is determined as the associated object node;

[0217] The graph construction module 11 is also specifically used to construct connecting edges between the target object node and the associated object node, so as to obtain the associated edges corresponding to the target object node;

[0218] The graph construction module 11 is also specifically used to determine the structure graph containing the set of object nodes and the associated edges corresponding to each object node as an object relationship graph when the associated edges corresponding to each object node in the set of object nodes are determined.

[0219] In one embodiment, the number of remaining detection objects is M; M is a positive integer;

[0220] The graph construction module 11 is also specifically used to determine the business attribute features of each of the M remaining detection objects in the business as the remaining business attribute features.

[0221] Graph construction module 11 is also specifically used to determine business attribute features T. i The feature similarity between each of the remaining business attribute features is used to obtain M feature similarities;

[0222] The graph construction module 11 is also specifically used to determine the feature similarity greater than the similarity threshold among the M feature similarities as the target feature similarity, and to determine the remaining business attribute features corresponding to the target feature similarity as similar business attribute features;

[0223] The graph construction module 11 is also specifically used to determine the remaining detection objects corresponding to similar business attribute features in the detection object set as detection objects S. i The corresponding associated object.

[0224] In one embodiment, the M remaining service attribute features include the remaining service attribute feature T. j The M feature similarities include the remaining business attribute features T. j With business attribute feature T iThe feature similarity between them, where j is a positive integer; each business attribute feature includes the business participation time;

[0225] Graph construction module 11 is also specifically used to construct business attribute features T i The included business participation time is determined as the first participation time, and the remaining business attribute features T are... j The business participation time included is determined as the second participation time;

[0226] The graph construction module 11 is also specifically used to determine the interval between the first participation time and the second participation time.

[0227] The graph construction module 11 is also specifically used to obtain a duration mapping table; the duration mapping table contains the mapping relationship between the set of configuration time intervals and the set of configuration similarities; there is a mapping relationship between a configuration duration interval in the set of configuration time intervals and a configuration similarity in the set of configuration similarities;

[0228] The graph construction module 11 is further specifically used to determine the configuration duration interval to which the interval duration belongs in the configuration duration interval set as the target duration interval, and to determine the configuration similarity in the configuration similarity set that has a mapping relationship with the target duration interval as the remaining business attribute feature T. j With business attribute feature T i Feature similarity between them.

[0229] In one embodiment, the graph auto-codec includes a graph encoder and a graph decoder;

[0230] The feature determination module 13 is also specifically used to call the graph encoder in the graph self-encoder. In the graph encoder, each business attribute feature is encoded by the connection relationship between object nodes in the object relationship graph to obtain the aggregate representation feature corresponding to each business attribute feature.

[0231] The feature determination module 13 is also specifically used to call the graph decoder in the graph self-encoder. In the graph decoder, based on the aggregate representation features corresponding to each business attribute feature, the connection relationship between object nodes in the object relationship graph is reconstructed to obtain the reconstructed relationship graph.

[0232] In one embodiment, the detection object set includes detection object S i Each detected object possesses specific business attribute characteristics within the business context, including the detected object S. i Business attribute characteristics T in business i i is a positive integer;

[0233] The feature determination module 13 is also specifically used in the graph encoder to determine the detected object S iThe corresponding object node is determined as the target object node, and the object nodes in the object relationship graph that have a connection relationship with the target object node are determined as the adjacent nodes of the target object node;

[0234] The feature determination module 13 is also specifically used to compare the adjacent service attribute features corresponding to adjacent nodes with the service attribute feature T. i The code fusion process is performed to obtain the business attribute feature T. i The corresponding aggregate representation features; the adjacent business attribute features corresponding to adjacent nodes refer to the business attribute features of the detection objects corresponding to adjacent nodes in the business.

[0235] In one embodiment, the feature determination module 13 is further specifically used to obtain the relational adjacency matrix corresponding to the object relation graph; the relational adjacency matrix is ​​used to characterize the connection relationship between object nodes in the object relation graph;

[0236] The feature determination module 13 is also specifically used to normalize the relational adjacency matrix to obtain the normalized adjacency matrix corresponding to the relational adjacency matrix.

[0237] Feature determination module 13 is also specifically used to obtain the encoding parameter matrix in the graph encoder, and through the logical operation function of the graph encoder, to combine the relation adjacency matrix and business attribute feature T. i The adjacent service attribute features and the encoding parameter matrix are processed to obtain the service attribute feature T. i The corresponding aggregate representation features.

[0238] In one embodiment, the object relationship graph consists of a set of object nodes and the associated edges corresponding to each object node in the set of object nodes; one object node in the set of object nodes corresponds to one detection object in the set of detection objects;

[0239] The feature determination module 13 is also specifically used to obtain the representation feature vector composed of the aggregate representation features corresponding to each business attribute feature, and to perform transpose transformation on the representation feature vector to obtain the transpose transformation vector corresponding to the representation feature vector.

[0240] The feature determination module 13 is also specifically used to perform a dot product operation on the feature vector and the transpose transformation vector to obtain the reconstructed adjacency matrix; the reconstructed adjacency matrix contains Q reconstructed connection probabilities, and one of the Q reconstructed connection probabilities is the predicted probability that there is a connection relationship between two object nodes in the object node set; Q is a positive integer;

[0241] The feature determination module 13 is also specifically used to delete the associated edges corresponding to each object node in the object relationship graph to obtain an intermediate object relationship graph;

[0242] The feature determination module 13 is also specifically used to determine the reconstruction connection probability that is greater than the connection probability threshold among the Q reconstruction connection probabilities as the target reconstruction connection probability, and to construct a connection edge between the two object nodes corresponding to the target reconstruction connection probability in the intermediate object relationship graph to obtain the reconstruction relationship graph.

[0243] In one embodiment, the optimization module 15 is further specifically used to perform distribution error calculation processing on the cluster distribution results to obtain the cluster distribution loss value corresponding to the cluster distribution results;

[0244] The optimization module 15 is also specifically used to obtain the reconstruction adjacency matrix corresponding to the reconstruction relationship graph and the relationship adjacency matrix corresponding to the object relationship graph; the relationship adjacency matrix is ​​used to represent the connection relationship between object nodes in the object relationship graph, and the reconstruction adjacency matrix is ​​used to represent the connection relationship between object nodes in the reconstruction relationship graph.

[0245] The optimization module 15 is also specifically used to perform prediction error calculation on the reconstructed adjacency matrix and the relational adjacency matrix to obtain the connection prediction loss value corresponding to the reconstructed relational graph.

[0246] The optimization module 15 is also specifically used to determine the total loss value corresponding to the graph self-coder based on the cluster distribution loss value and the connection prediction loss value, and to optimize the graph self-coder based on the total loss value to obtain the optimized graph self-coder.

[0247] In one embodiment, the cluster distribution result contains W feature clusters, and each of the W feature clusters contains one or more aggregated representation features; W is a positive integer; the aggregated representation feature corresponding to each business attribute feature contains aggregated representation feature U. v v is a positive integer;

[0248] Optimization module 15 is also specifically used to obtain the cluster center corresponding to each feature cluster;

[0249] Optimization module 15 is also specifically used to calculate the aggregate representation feature U. v The cluster distance between each cluster center and the aggregate representation feature U v The cluster distance between each cluster center determines the aggregate representation feature U. v The corresponding distance loss value;

[0250] The optimization module 15 is also specifically used to calculate and process the distance loss value corresponding to each aggregate representation feature when the distance loss value corresponding to each aggregate representation feature is determined, so as to obtain the cluster distribution loss value.

[0251] In one embodiment, the optimized cluster distribution result includes at least two optimized feature clusters, and each of the at least two optimized feature clusters includes one or more optimized aggregate representation features; the at least two optimized feature clusters include optimized feature cluster K. c c is a positive integer;

[0252] The group identification module 18 is also specifically used to identify optimized feature clusters K. c The abnormal objects contained therein will optimize feature cluster K. c The set of abnormal objects contained therein is determined as the optimized feature cluster K. c The corresponding anomalous subgroups of the cluster;

[0253] The group identification module 18 is also specifically used to identify each cluster of abnormal subgroups corresponding to each optimized feature cluster as an abnormal object group in the detection object set when the cluster abnormal subgroups corresponding to each optimized feature cluster are determined.

[0254] In one embodiment, the feature cluster K is optimized. c It contains exception label objects; exception label objects refer to objects that exhibit exception label behavior in the business logic.

[0255] The group identification module 18 is also specifically used to optimize the feature cluster K c Among the one or more optimized aggregated representation features included, the optimized aggregated representation feature corresponding to the anomaly label object is determined as the target representation feature, and the optimized feature cluster K is... c Among the one or more optimized aggregated representation features included, the optimized aggregated representation features other than the target representation feature are determined as candidate anomaly representation features corresponding to the target representation feature;

[0256] The group identification module 18 is also specifically used to identify the detection objects corresponding to the candidate anomaly representation features as candidate anomaly objects;

[0257] The group identification module 18 is also specifically used to obtain the business behavior data of the candidate abnormal objects in the business, and to determine the behavioral correlation between the business behavior data and the abnormal label behavior;

[0258] The group identification module 18 is further specifically used to determine the candidate abnormal object as the abnormal associated object corresponding to the abnormal label object when the behavioral correlation is greater than the correlation threshold, and to determine both the abnormal label object and the abnormal associated object as the optimized feature cluster K. c The exception objects contained therein.

[0259] According to one embodiment of this application, Figure 2 The steps involved in the data processing method shown can be derived from... Figure 7The data processing apparatus 1 shown is executed by each module. For example, Figure 2 Step S101 shown can be performed by Figure 7 The graph construction module 11 in the middle is used to execute, Figure 2 Step S102 shown can be performed by Figure 7 The calling module 12 and the feature determination module 13 are executed together; Figure 2 Step S103 shown can be performed by Figure 7 The clustering module 14 in the middle is executed; Figure 2 Step S104 shown can be derived from Figure 7 The optimization module 15 in the middle is used to execute; Figure 2 The step S105 shown can be performed by Figure 7 The optimized feature output module 16 in the middle is used to execute; Figure 2 The step S106 shown can be performed by Figure 7 The second clustering module 17 in the middle is used to execute; Figure 2 The step S107 shown can be performed by Figure 7 The group identification module 18 in the middle is used to perform this.

[0260] In this embodiment, an object relationship graph can be constructed based on the business attribute features of different detected objects in the object detection set. Based on this object relationship graph, a self-supervised learning process can be performed on the graph self-encoder, enabling the graph self-encoder to effectively and accurately determine the optimized aggregate representation features corresponding to each object node based on the connection relationships between object nodes in the object relationship graph. Subsequently, the detected object set can be clustered based on these effective and accurate optimized aggregate representation features. The resulting optimized cluster distribution can serve as a reference aid in the task of identifying abnormal object groups in the detected object set. For example, based on a detected abnormal object, related objects associated with it can be searched in its respective cluster. This allows for efficient and accurate identification of related objects of an abnormal object in a cluster with a small number of objects, without having to search through a massive number of objects one by one. This can effectively reduce labor and time costs and improve identification efficiency.

[0261] Further, please see Figure 8 , Figure 8 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Figure 8 As shown above, Figure 7The data processing device 1 in the corresponding embodiment can be applied to the aforementioned computer device 8000. The computer device 8000 may include a processor 8001, a network interface 8004, and a memory 8005. Furthermore, the computer device 8000 also includes a user interface 8003 and at least one communication bus 8002. The communication bus 8002 is used to enable communication between these components. The user interface 8003 may include a display screen and a keyboard; optionally, the user interface 8003 may also include a standard wired interface or a wireless interface. The network interface 8004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 8005 may be high-speed RAM or non-volatile memory, such as at least one disk storage device. Optionally, the memory 8005 may also be at least one storage device located remotely from the aforementioned processor 8001. Figure 8 As shown, the memory 8005, which is a computer-readable storage medium, may include an operating system, a network communication module, a user interface module, and a device control application program.

[0262] exist Figure 8 In the computer device 8000 shown, the network interface 8004 provides network communication functionality; the user interface 8003 is mainly used to provide an input interface for the user; and the processor 8001 can be used to call the device control application program stored in the memory 8005 to achieve:

[0263] Based on the business attribute characteristics of each detection object in the business within the detection object set, an object relationship graph is constructed with each detection object as an object node;

[0264] The graph self-encoder is invoked. In the graph self-encoder, based on the connection relationship between object nodes in the object relationship graph, the aggregate representation feature corresponding to each business attribute feature and the reconstruction relationship graph corresponding to the object relationship graph are determined.

[0265] Each aggregated representation feature is subjected to feature clustering to obtain the cluster distribution results corresponding to the set of detected objects. Based on the cluster distribution results, the reconstructed relationship graph, and the object relationship graph, the graph self-encoder is optimized to obtain the optimized graph self-encoder.

[0266] In the optimized graph self-encoder, based on the connection relationship between object nodes in the object relationship graph, the optimized aggregate representation feature corresponding to each business attribute feature is output;

[0267] Each optimized aggregate representation feature is subjected to feature clustering processing to obtain the optimized cluster distribution results corresponding to the set of detected objects.

[0268] Identify abnormal object groups in the detection object set based on the optimized cluster distribution results.

[0269] It should be understood that the computer device 8000 described in the embodiments of this application can execute the foregoing text. Figures 2 to 5 The description of the data processing method in the corresponding embodiment can also be performed as described above. Figure 7 The description of the data processing apparatus 1 in the corresponding embodiments will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated here.

[0270] Furthermore, it should be noted that this application embodiment also provides a computer-readable storage medium, which stores a computer program executed by the aforementioned data processing computer device 8000. The computer program includes program instructions, and when the processor executes the program instructions, it can execute the aforementioned... Figures 2 to 5 The description of the data processing method in the corresponding embodiments is already provided and will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated. For technical details not disclosed in the computer-readable storage medium embodiments related to this application, please refer to the description of the method embodiments of this application.

[0271] The aforementioned computer-readable storage medium can be an internal storage unit of the data processing apparatus or computer device provided in any of the foregoing embodiments, such as a hard disk or memory of the computer device. The computer-readable storage medium can also be an external storage device of the computer device, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., provided on the computer device. Furthermore, the computer-readable storage medium can include both internal and external storage units of the computer device. The computer-readable storage medium is used to store the computer program and other programs and data required by the computer device. The computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0272] One aspect of this application provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the method provided in one aspect of the embodiments of this application.

[0273] The terms "first," "second," etc., in the specification, claims, and drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the term "comprising," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, apparatus, product, or device that includes a series of steps or units is not limited to the listed steps or modules, but may optionally include steps or modules not listed, or may optionally include other step units inherent to these processes, methods, apparatuses, products, or devices.

[0274] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0275] The methods and related apparatuses provided in this application are described with reference to the method flowcharts and / or structural diagrams provided in this application. Specifically, each block of the method flowchart and / or structural diagram, as well as combinations of blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to create a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing device, generate instructions for implementing the process. Figure 1 A schematic diagram of one or more processes and / or structures. Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 A schematic diagram of one or more processes and / or structures. Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 A process or multiple processes and / or structures illustrate the steps of the functions specified in one or more boxes.

[0276] The above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of this application. Therefore, any equivalent variations made in accordance with the claims of this application shall still fall within the scope of this application.

Claims

1. A data processing method, characterized in that, include: Based on the business attribute characteristics of each detection object in the business within the detection object set, an object relationship graph is constructed with each detection object as an object node; The graph self-encoder is invoked. In the graph self-encoder, based on the connection relationship between object nodes in the object relationship graph, the aggregate representation feature corresponding to each business attribute feature and the reconstruction relationship graph corresponding to the object relationship graph are determined. Each aggregated representation feature is subjected to feature clustering processing to obtain the cluster distribution result corresponding to the set of detected objects; The cluster distribution results are processed by distribution error calculation to obtain the cluster distribution loss value corresponding to the cluster distribution results; the reconstruction adjacency matrix corresponding to the reconstruction relationship graph and the relationship adjacency matrix corresponding to the object relationship graph are obtained; The relational adjacency matrix is ​​used to characterize the connection relationships between object nodes in the object relation graph, and the reconstructed adjacency matrix is ​​used to characterize the connection relationships between object nodes in the reconstructed relation graph. Prediction error calculation is performed on the reconstructed adjacency matrix and the relational adjacency matrix to obtain the connection prediction loss value corresponding to the reconstructed relation graph. Based on the cluster distribution loss value and the connection prediction loss value, the total loss value corresponding to the graph auto-coder is determined. The graph auto-coder is then optimized based on the total loss value to obtain an optimized graph auto-coder. In the optimized graph self-encoder, based on the connection relationship between object nodes in the object relationship graph, the optimized aggregate representation feature corresponding to each business attribute feature is output; Each optimized aggregate representation feature is subjected to feature clustering processing to obtain the optimized cluster distribution result corresponding to the set of detected objects; Based on the optimized cluster distribution results, abnormal object groups in the detection object set are identified.

2. The method according to claim 1, characterized in that, The set of detection objects includes detection object S. i The business attribute features of each detection object in the business include the detection object S. i Business attribute feature T in the business i i is a positive integer; The process of constructing an object relationship graph with each detected object as an object node, based on the business attribute characteristics of each detected object in the detection object set, includes: Construct the object node corresponding to each detection object in the detection object set to obtain the object node set; Based on the aforementioned business attribute feature T i And the business attribute characteristics of the remaining detection objects in the business, to determine the detection object S in the set of detection objects. i The corresponding associated object; the remaining detection objects refer to the set of detection objects, excluding the detection object S. i Other than the objects being tested; The detection object S i The corresponding object node is identified as the target object node, and the detection object S is... i The object node corresponding to the associated object is determined as the associated object node; Construct a connection edge between the target object node and the associated object node to obtain the associated edge corresponding to the target object node; When the associated edges corresponding to each object node in the set of object nodes are determined, the structural graph containing the set of object nodes and the associated edges corresponding to each object node is determined as the object relationship graph.

3. The method according to claim 2, characterized in that, The number of remaining detection objects is M; M is a positive integer; The business attribute feature T i And the business attribute characteristics of the remaining detection objects in the business, to determine the detection object S in the set of detection objects. i The corresponding associated objects include: The business attribute features of each of the M remaining detection objects in the business are determined as the remaining business attribute features. Determine the business attribute feature T i The feature similarity between each remaining business attribute feature and the feature similarity between the two features is used to obtain M feature similarities; Among the M feature similarities, the feature similarities that are greater than the similarity threshold are determined as the target feature similarity, and the remaining business attribute features corresponding to the target feature similarity are determined as similar business attribute features. The remaining detection objects corresponding to the similar business attribute features in the detection object set are determined as the detection object S. i The corresponding associated object.

4. The method according to claim 3, characterized in that, M remaining business attribute features include remaining business attribute feature T. j The M feature similarities include the remaining business attribute features T j With the business attribute feature T i The feature similarity between them, where j is a positive integer; each business attribute feature includes the business participation time; The determination of the business attribute feature T i The feature similarity between each remaining business attribute feature yields M feature similarities, including: The business attribute feature T i The included business participation time is determined as the first participation time, and the remaining business attribute features T are... j The business participation time included is determined as the second participation time; Determine the time interval between the first participation time and the second participation time; Obtain a duration mapping table; the duration mapping table contains a mapping relationship between a set of configuration time intervals and a set of configuration similarities; a configuration duration interval in the set of configuration time intervals has a mapping relationship with a configuration similarity in the set of configuration similarities; The configuration duration interval to which the interval duration belongs in the set of configuration duration intervals is determined as the target duration interval. The configuration similarity values ​​in the set of configuration similarity values ​​that have a mapping relationship with the target duration interval are determined as the remaining business attribute feature T. j With the business attribute feature T i Feature similarity between them.

5. The method according to claim 1, characterized in that, The graph auto-coder includes a graph encoder and a graph decoder; In the graph-based auto-encoder, based on the connection relationships between object nodes in the object relationship graph, the method for determining the aggregated representation features corresponding to each business attribute feature, and the reconstructed relationship graph corresponding to the object relationship graph, includes: The graph encoder in the graph encoder is invoked. In the graph encoder, each business attribute feature is encoded by the connection relationship between object nodes in the object relationship graph to obtain the aggregate representation feature corresponding to each business attribute feature. The graph decoder in the graph auto-decoder is invoked. In the graph decoder, the connection relationship between object nodes in the object relationship graph is reconstructed based on the aggregate representation feature corresponding to each business attribute feature, so as to obtain the reconstructed relationship graph.

6. The method according to claim 5, characterized in that, The set of detection objects includes detection object S. i The business attribute features of each detection object in the business include the detection object S. i Business attribute feature T in the business i i is a positive integer; In the graph encoder, each business attribute feature is encoded using the connection relationships between object nodes in the object relationship graph to obtain the aggregated representation feature corresponding to each business attribute feature, including: In the graph encoder, the detected object S i The corresponding object node is determined as the target object node, and the object nodes in the object relationship graph that have a connection relationship with the target object node are determined as the adjacent nodes of the target object node; The adjacency service attribute features corresponding to the adjacent nodes are compared with the service attribute feature T. i The business attribute feature T is obtained by performing encoding fusion processing. i The corresponding aggregate representation features; the adjacent business attribute features corresponding to the adjacent nodes refer to the business attribute features of the detection objects corresponding to the adjacent nodes in the business.

7. The method according to claim 6, characterized in that, The adjacency service attribute feature corresponding to the adjacent node is compared with the service attribute feature T. i The business attribute feature T is obtained by performing encoding fusion processing. i The corresponding aggregated representation features include: Obtain the relational adjacency matrix corresponding to the object relation graph; the relational adjacency matrix is ​​used to represent the connection relationships between object nodes in the object relation graph; The relational adjacency matrix is ​​normalized to obtain the normalized adjacency matrix corresponding to the relational adjacency matrix; Obtain the encoding parameter matrix from the graph encoder, and then, through the logical operation function of the graph encoder, combine the relational adjacency matrix and the business attribute feature T. i The adjacent service attribute features and the encoding parameter matrix are processed to obtain the service attribute feature T. i The corresponding aggregate representation features.

8. The method according to any one of claims 5 to 7, characterized in that, The object relationship graph consists of a set of object nodes and the associated edges corresponding to each object node in the set of object nodes; one object node in the set of object nodes corresponds to one detection object in the set of detection objects. In the graph decoder, based on the aggregated representation features corresponding to each business attribute feature, the connection relationships between object nodes in the object relationship graph are reconstructed to obtain the reconstructed relationship graph, including: Obtain the representation feature vector composed of the aggregate representation features corresponding to each business attribute feature, and perform a transpose transformation on the representation feature vector to obtain the transpose transformation vector corresponding to the representation feature vector; The reconstructed adjacency matrix is ​​obtained by performing a dot product operation between the feature vector and the transpose transformation vector. The reconstructed adjacency matrix contains Q reconstructed connection probabilities. One of the Q reconstructed connection probabilities is the predicted probability that there is a connection between two object nodes in the object node set. Q is a positive integer. The associated edges corresponding to each object node in the object relationship graph are deleted to obtain the intermediate object relationship graph. Among the Q reconstructed connection probabilities, the reconstructed connection probability greater than the connection probability threshold is determined as the target reconstructed connection probability. In the intermediate object relationship graph, a connection edge is constructed between the two object nodes corresponding to the target reconstructed connection probability to obtain the reconstructed relationship graph.

9. The method according to claim 1, characterized in that, The cluster distribution result contains W feature clusters, and each of the W feature clusters contains one or more aggregate representation features; W is a positive integer; the aggregate representation feature corresponding to each business attribute feature contains aggregate representation feature U. v v is a positive integer; The step of performing distribution error calculation on the cluster distribution results to obtain the cluster distribution loss value corresponding to the cluster distribution results includes: Obtain the cluster center corresponding to each feature cluster; Calculate the aggregate representation feature U respectively v The cluster distance between each cluster center and the aggregation representation feature U is determined according to the aggregation representation feature U. v The cluster distance between each cluster center determines the aggregate representation feature U. v The corresponding distance loss value; Once the distance loss value corresponding to each aggregate representation feature is determined, the distance loss value corresponding to each aggregate representation feature is processed to obtain the cluster distribution loss value.

10. The method according to claim 1, characterized in that, The optimized cluster distribution result includes at least two optimized feature clusters, and each of the at least two optimized feature clusters contains one or more optimized aggregate representation features; the at least two optimized feature clusters include optimized feature cluster K. c c is a positive integer; The step of identifying abnormal object groups in the detection object set based on the optimized cluster distribution results includes: Identify the optimized feature cluster K c The abnormal objects contained therein will be the optimized feature cluster K. c The set of abnormal objects contained therein is determined as the optimized feature cluster K. c The corresponding anomalous subgroups of the cluster; When the abnormal subgroups corresponding to each optimized feature cluster are determined, the abnormal subgroups corresponding to each optimized feature cluster are all determined as abnormal object groups in the detection object set.

11. The method according to claim 10, characterized in that, The optimized feature cluster K c It contains an anomaly tag object; the anomaly tag object refers to an object that exhibits anomaly tag behavior in the business; The identification of the optimized feature cluster K c The exception objects included in the document include: The optimized feature cluster K c Among the one or more optimized aggregated representation features included, the optimized aggregated representation feature corresponding to the anomaly label object is determined as the target representation feature, and the optimized feature cluster K is... c Among the one or more optimized aggregated representation features included, the optimized aggregated representation features other than the target representation feature are determined as candidate anomaly representation features corresponding to the target representation feature; The detection objects corresponding to the candidate anomaly representation features are identified as candidate anomaly objects; Obtain the business behavior data of the candidate anomaly object in the business, and determine the behavioral correlation between the business behavior data and the anomaly tag behavior; When the behavioral correlation is greater than the correlation threshold, the candidate anomaly object is determined as the anomaly associated object corresponding to the anomaly label object, and both the anomaly label object and the anomaly associated object are determined as the optimized feature cluster K. c The exception objects contained therein.

12. A data processing apparatus, characterized in that, include: The graph construction module is used to construct an object relationship graph with each detected object as an object node, based on the business attribute features of each detected object in the business in the detection object set. The calling module is used to call the graph auto-coder; The feature determination module is used in the graph auto-encoder to determine, based on the connection relationship between object nodes in the object relationship graph, the aggregate representation feature corresponding to each business attribute feature and the reconstructed relationship graph corresponding to the object relationship graph. The first clustering module is used to perform feature clustering processing on each aggregate representation feature to obtain the cluster distribution result corresponding to the set of detected objects; An optimization module is used to optimize the graph self-encoder based on the cluster distribution results, the reconstructed relationship graph, and the object relationship graph to obtain an optimized graph self-encoder. The optimized feature output module is used to perform distribution error calculation on the cluster distribution results to obtain the cluster distribution loss value corresponding to the cluster distribution results; and to obtain the reconstruction adjacency matrix corresponding to the reconstruction relationship graph and the relationship adjacency matrix corresponding to the object relationship graph. The relational adjacency matrix is ​​used to characterize the connection relationships between object nodes in the object relation graph, and the reconstructed adjacency matrix is ​​used to characterize the connection relationships between object nodes in the reconstructed relation graph. Prediction error calculation is performed on the reconstructed adjacency matrix and the relational adjacency matrix to obtain the connection prediction loss value corresponding to the reconstructed relation graph. Based on the cluster distribution loss value and the connection prediction loss value, the total loss value corresponding to the graph auto-coder is determined. The graph auto-coder is then optimized based on the total loss value to obtain an optimized graph auto-coder. The second clustering module is used to perform feature clustering processing on each optimized aggregation representation feature to obtain the optimized cluster distribution result corresponding to the set of detected objects. The group identification module is used to identify abnormal object groups in the detection object set based on the optimized cluster distribution results.

13. A computer device, characterized in that, include: Processor, memory, and network interface; The processor is connected to the memory and the network interface, wherein the network interface is used to provide network communication functions, the memory is used to store computer programs, and the processor is used to call the computer programs to cause the computer device to execute the method according to any one of claims 1-11.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted to be loaded by a processor and to execute the method according to any one of claims 1-11.

15. A computer program product, characterized in that, The computer program product includes a computer program stored in a computer-readable storage medium, the computer program being adapted to be read and executed by a processor to cause a computer device having the processor to perform the method of any one of claims 1-11.

Images