Risk address identification method and apparatus, electronic device, and storage medium

Abstract

Embodiments of the present application provide a risk address identification method and apparatus, an electronic device, and a storage medium. The risk address identification method comprises: on the basis of the text similarity among addresses to be identified in a set of said addresses, performing primary clustering on said addresses to obtain primary clustering clusters (S110); on the basis of the degree of association among pieces of order information of said addresses in each primary clustering cluster, performing secondary clustering on said addresses in the primary clustering cluster to obtain secondary clustering clusters (S120); and on the basis of the secondary clustering clusters, obtaining a risk address identification result (S130). According to the solution, primary clustering is performed on said addresses on the basis of the text similarity among said addresses, and then secondary clustering is performed on said addresses in the primary clustering clusters on the basis of the degree of association among said addresses, so as to realize secondary clustering of said addresses in the same region from a service perspective, thereby improving the accuracy of risk address identification.

Description

A method, device, electronic device and storage medium for identifying risky addresses

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to Chinese patent application CN202410225893.3, filed on February 29, 2024, entitled “A method, device, electronic device and storage medium for identifying risky addresses”, the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present application belongs to the field of data processing technology, and in particular relates to a risk address identification method, device, electronic device and storage medium. Background Art

[0004] With the rapid development of e-commerce, more and more users are choosing to shop online. To ensure transaction security, corresponding risk control measures are needed to identify and handle abnormal transactions. For example, the problem of certain addresses being widely used in e-commerce transactions may involve illegal transactions or other related business risks, resulting in security risks and economic losses for e-commerce platforms and users.

[0005] The risk address identification method in the related art determines whether an address is similar to a blacklisted risk address by the text similarity between addresses, thereby determining whether the address is a risk address. This solution only relies on the text similarity between addresses to identify risk addresses, and its identification accuracy is low.

[0006] Summary of the Invention

[0007] The present application provides a risk address identification method, device, electronic device and storage medium to improve the accuracy of risk address identification.

[0008] In a first aspect, an embodiment of the present application provides a method for identifying risky addresses, the method comprising: performing a primary clustering of the addresses to be identified based on the text similarity between the addresses to be identified in the address set to be identified, and obtaining a primary clustering cluster; performing a secondary clustering of the addresses to be identified in the primary clustering cluster based on the correlation between the order information of the addresses to be identified in the primary clustering cluster, and obtaining a secondary clustering cluster; and obtaining a risky address identification result based on the secondary clustering cluster.

[0009] In the implementation process of the above scheme, the addresses to be identified are first clustered based on the text similarity between the addresses to be identified, so as to achieve clustering of the addresses to be identified from a geographical perspective, so that the addresses to be identified that are clustered geographically are clustered in the same clustering cluster; then the addresses to be identified in the initial clustering cluster are secondary clustered according to the correlation between the addresses, so as to achieve secondary clustering of the addresses to be identified in the same region from a business perspective, so that the addresses to be identified that are geographically clustered and have high business similarity are clustered in the same clustering cluster, thereby identifying the addresses to be identified with clustering risks. Compared with the method of obtaining risk addresses by only using the text similarity between addresses in the related art, the above scheme has a higher accuracy rate in identifying risky addresses.

[0010] In an implementation method of the first aspect, the addresses to be identified in the primary cluster are secondary clustered according to the correlation between the order information of the addresses to be identified in the primary cluster to obtain a secondary cluster, including: calculating the order side correlation and / or the delivery side correlation between the order information of the addresses to be identified in the primary cluster; according to the order side correlation and / or the delivery side correlation, the addresses to be identified in the primary cluster are secondary clustered to obtain a secondary cluster.

[0011] In the process of implementing the above scheme, the addresses to be identified in the initial clustering cluster can be clustered again based only on the order-side correlation or the receiving-side correlation, or the addresses to be identified in the initial clustering cluster can be clustered again based on the order-side correlation and the receiving-side correlation, so as to obtain risk address identification results focused on different angles, so that the above risk address identification method can be applied to more application scenarios, which is conducive to improving the applicability of the above risk address identification method.

[0012] In an implementation method of the first aspect, the order side correlation between the order information of the addresses to be identified in the initial clustering cluster is calculated, including: calculating the order side correlation between the order information of the addresses to be identified in the initial clustering cluster based on at least one order side information among the user information, product information, order device information and payment information in the order information.

[0013] In the process of implementing the above scheme, at least one of the order-side information such as user information, product information, order device information and payment information in the order information is comprehensively considered, and the order-side correlation between the order information of the addresses to be identified in the initial clustering cluster is calculated, so as to obtain the correlation information that can characterize the addresses to be identified in the initial clustering cluster from the order-side perspective, and perform secondary clustering of the addresses to be identified in the initial clustering cluster through the order-side correlation, which is conducive to improving the risk address identification accuracy of the above-mentioned risk address identification method.

[0014] In an implementation method of the first aspect, the recipient side correlation between the order information of the addresses to be identified in the initial clustering cluster is calculated, including: calculating the recipient side correlation between the order information of the addresses to be identified in the initial clustering cluster based on at least one recipient side information among the recipient address information, recipient phone information, delivery method information and recipient information in the order information.

[0015] In the process of implementing the above scheme, at least one of the delivery side information such as delivery address information, delivery phone information, delivery method information and consignee information in the order information is comprehensively considered, and the delivery side correlation between the order information of the address to be identified in the initial clustering cluster is calculated, so as to obtain the correlation information that can characterize the address to be identified in the initial clustering cluster from the delivery side perspective, and perform secondary clustering of the address to be identified in the initial clustering cluster through the delivery side correlation, which is conducive to improving the risk address identification accuracy of the above risk address identification method.

[0016] In an implementation of the first aspect, the addresses to be identified in the primary cluster are secondary clustered according to the correlation between the order information of the addresses to be identified in the primary cluster to obtain a secondary cluster, including: obtaining an address association graph corresponding to the primary cluster; wherein the address association graph has the addresses to be identified as nodes and the correlation between the order information of the addresses to be identified as edges; and according to the correlation, the address association graph is secondary clustered to obtain a secondary cluster.

[0017] In the implementation process of the above scheme, an address association graph is used to perform secondary clustering on the addresses to be identified in the initial clustering cluster. On the one hand, the obtained secondary clustering results can capture the global relationship between the nodes, which is conducive to improving the risk address identification accuracy of the above risk address identification method; on the other hand, the use of an address association graph that can more intuitively display the association relationship between the addresses to be identified and the clustering relationship of the secondary clustering clusters for secondary clustering is conducive to improving the interpretability of the secondary clustering clusters.

[0018] In an implementation of the first aspect, the addresses to be identified are initially clustered according to the text similarity between the addresses to be identified in the address set to be identified to obtain the initial clustering cluster, including: performing structured processing on the addresses to be identified in the address set to be identified; and performing initial clustering on the addresses to be identified according to the text similarity between the addresses to be identified after the structured processing to obtain the initial clustering cluster.

[0019] In the implementation process of the above scheme, by performing structured processing on the addresses to be identified and then performing initial clustering on the addresses to be identified based on the text similarity between the addresses to be identified after the structured processing, the situation where the text similarity between the addresses of the same address is low due to different text descriptions can be greatly reduced, which is conducive to improving the risk address identification accuracy of the above risk address identification method.

[0020] In an implementation of the first aspect, the addresses to be identified are initially clustered according to the text similarity between the addresses to be identified after structured processing to obtain initial clustering clusters, including: taking the cell where the addresses to be identified are located as the smallest unit, extracting the cell-level address from the addresses to be identified; and performing initial clustering on the addresses to be identified according to the text similarity between the cell-level addresses to obtain initial clustering clusters.

[0021] In the implementation of the above scheme, cell-level addresses are used for initial clustering. On the one hand, the clustering results can show the aggregation of addresses to be identified from the regional perspective of the cell, which is conducive to enhancing the interpretability of the risk address identification results; on the other hand, it can effectively reduce the amount of calculation during the initial clustering, especially for the risk address identification scenario of large-scale transaction data. The above scheme can greatly reduce the amount of calculation, which is conducive to improving the risk address identification efficiency of the above-mentioned risk address identification method.

[0022] In a second aspect, an embodiment of the present application provides a risky address identification device, the device comprising:

[0023] A primary clustering cluster acquisition module, configured to perform primary clustering on the addresses to be identified according to text similarities between the addresses to be identified in the address set to be identified, and obtain primary clusters;

[0024] a secondary cluster acquisition module, configured to perform secondary clustering on the addresses to be identified in the primary cluster according to the correlation between the order information of the addresses to be identified in the primary cluster, to acquire a secondary cluster;

[0025] The risk address identification result acquisition module is used to obtain the risk address identification result based on the secondary clustering cluster.

[0026] In a third aspect, an embodiment of the present application provides an electronic device comprising: a processor, a memory, and a communication bus, wherein the processor and the memory communicate with each other through the communication bus; the memory stores computer program instructions that can be executed by the processor, and when the computer program instructions are read and run by the processor, the method provided in the first aspect or any possible implementation of the first aspect is executed.

[0027] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which computer program instructions are stored. When the computer program instructions are read and run by a processor, the method provided by the first aspect or any possible implementation of the first aspect is executed.

[0028] Other features and advantages of the present application will be described in the following description and, in part, will become apparent from the description or be understood by practicing the embodiments of the present application. The objectives and other advantages of the present application can be achieved and obtained through the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0030] FIG1 is a flow chart of a method for identifying risky addresses according to an embodiment of the present application;

[0031] FIG2 is a schematic diagram of order information associated with an address A to be identified provided in an embodiment of the present application;

[0032] FIG3 is a schematic diagram of order information associated with the address B to be identified provided in an embodiment of the present application;

[0033] FIG4 is a schematic diagram of the structure of a risky address identification device provided in an embodiment of the present application;

[0034] FIG5 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0035] The following will be combined with the accompanying drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. The following embodiments are only used to more clearly illustrate the technical solutions of the present application and are therefore only used as examples and cannot be used to limit the scope of protection of the present application.

[0036] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned figure descriptions are intended to cover non-exclusive inclusions.

[0037] In the description of the embodiments of this application, the technical terms "first" and "second" are used only to distinguish different objects and should not be understood to indicate or imply relative importance or implicitly specify the quantity, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, the meaning of "plurality" is more than two, unless otherwise clearly and specifically defined.

[0038] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0039] In the description of the embodiments of this application, the term "and / or" is simply a description of the association relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent the following three situations: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / " in this document generally indicates that the associated objects are in an "or" relationship.

[0040] In the e-commerce sector, if a specific address is used repeatedly, it may indicate that scalpers or proxy ordering are behind the transactions corresponding to this address, which can pose varying degrees of security risks to e-commerce platforms, sellers, and buyers. Therefore, it is necessary to identify the risk of aggregation of delivery addresses in e-commerce transactions.

[0041] Currently, the aggregation risk of delivery addresses in related technologies can be identified using the following solutions:

[0042] Calculate the similarity between the address to be identified and the risky addresses in the address blacklist. If the similarity is greater than a preset threshold, the identified address is determined to be a risky address with aggregation risk.

[0043] The above solution only considers text similarity between addresses. When determining whether an address to be identified is risky, it only considers whether the address to be identified is geographically close to the risky addresses on the blacklist. The following example illustrates why the above solution has a low accuracy rate in identifying risky addresses:

[0044] If there is a risky address in the address blacklist, and when setting the similarity threshold, all delivery addresses in the same community as the risky address are identified as risky addresses, then the risky addresses identified using this solution will have the following defects:

[0045] (1) All addresses to be identified in the same area (e.g., in the same community as mentioned above), or most of the addresses to be identified, are determined to be risky addresses. This results in a high misjudgment rate, and most of the identified risky addresses do not have aggregation risks.

[0046] (2) The relationship between the orders associated with the address to be identified is not taken into account. It only determines whether the address to be identified has a clustering risk from a geographical perspective, resulting in a low recognition accuracy.

[0047] In summary, the risk address identification method in the related art has a low recognition accuracy rate for risk addresses.

[0048] Based on this, an embodiment of the present application provides a method for identifying risky addresses. The method first performs an initial clustering of the addresses to be identified based on the text similarity between the addresses to be identified, so as to achieve clustering of the addresses to be identified from a geographical perspective, so that the addresses to be identified that are geographically clustered are clustered in the same clustering cluster; and then the addresses to be identified in the initial clustering cluster are secondary clustered according to the correlation between the addresses, so as to achieve secondary clustering of the addresses to be identified in the same region from a business perspective, so that the addresses to be identified that are geographically clustered and have high business similarity are clustered in the same clustering cluster, thereby identifying addresses to be identified with clustering risks. Compared with the method of obtaining risk addresses by only using text similarity between addresses in the related art, the above scheme has a higher accuracy rate in identifying risky addresses.

[0049] It can be understood that the above-mentioned risk address identification method can be applied to the application scenario of identifying delivery addresses with clustering risks in the e-commerce field. Of course, after the above-mentioned risk address identification method identifies risk addresses with clustering risks, more specific business risk identification can be performed based on the clustering results. For example, business risks such as order brushing risks or agency risks can be identified based on the clustering results.

[0050] The following is a detailed introduction to the above-mentioned risky address identification method. Referring to Figure 1, an embodiment of the present application provides a risky address identification method, which includes:

[0051] Step S110: performing initial clustering of the addresses to be identified based on the text similarity between the addresses to be identified in the address set to be identified, and obtaining initial clusters;

[0052] Step S120: performing secondary clustering on the addresses to be identified in the primary clustering according to the correlation between the order information of the addresses to be identified in the primary clustering to obtain secondary clustering;

[0053] Step S130: Obtain risk address identification results based on the secondary clustering.

[0054] First, the specific implementation of the above step S110 is introduced:

[0055] In order to cope with different application scenarios, the composition of the addresses to be identified in the above-mentioned address set and the amount of calculation for text similarity are also different, which are specifically reflected in:

[0056] (1) For scenarios where it is necessary to identify the aggregated risk of one or more new addresses to be identified;

[0057] It is understandable that if the delivery address that existed before the new address to be identified is called a historical address, it is possible that the historical address has already been identified as a risky address, that is, the initial cluster has been obtained based on the historical address. In this case, the address set to be identified can include the historical address (the historical address is only used to distinguish the time when the delivery address was obtained, and it is essentially also the address to be identified) and the new address to be identified. When the address to be identified is initially clustered, since the initial cluster has been obtained based on the historical address, the initial cluster can be directly updated based on the new address to be identified.

[0058] Of course, if risk addresses have not been identified based on historical addresses, that is, if the initial clustering clusters have not been obtained based on historical addresses, then the initial clustering clusters can be directly obtained by performing initial clustering based on the addresses to be identified in the set of addresses to be identified.

[0059] (2) For scenarios where it is necessary to identify the aggregated risks of delivery addresses in large-scale transaction data;

[0060] In this scenario, the address set to be identified is the delivery address extracted from large-scale transaction data. In this case, the addresses to be identified in the address set can be directly clustered to obtain the initial clustering clusters.

[0061] The following describes a method for initially clustering addresses to be identified based on text similarity between the addresses to be identified in step S110:

[0062] It is understandable that before performing initial clustering on the addresses to be identified, the addresses to be identified may be pre-processed, for example, the addresses to be identified may be cleaned to remove interference factors such as special characters in the addresses to be identified.

[0063] Of course, in addition to cleaning, other processing methods can be used to process the addresses to be identified before initial clustering. The specific solutions are as follows:

[0064] As an optional implementation of the above-mentioned risk address identification method, the above-mentioned step S110 includes: performing structural processing on the addresses to be identified in the address set to be identified; and performing initial clustering on the addresses to be identified based on the text similarity between the addresses to be identified after the structural processing to obtain initial cluster clusters. This implementation example:

[0065] Using the Chinese address segmentation and tagging method based on CRF (Conditional Random Fields), the addresses to be identified are structured according to the structures of province, city, district, street, community, road, street number, community, building, and room.

[0066] The CRF conditional random field is a statistical modeling method commonly used in sequence labeling tasks, such as word segmentation and labeling. CRF word segmentation and labeling refers to the use of the CRF model to segment and label text, dividing the text sequence into words and assigning corresponding labels to each word.

[0067] The structural processing process of identifying addresses using CRF word segmentation tagging can include the following steps:

[0068] (1) Extract features from the text of the address to be identified;

[0069] Common features include the character / word itself, contextual information, part of speech, word frequency, etc. These features can help the model capture the relationship between words and the context;

[0070] (2) Define the annotation set;

[0071] For word segmentation tasks, commonly used annotation sets include B (beginning of word), M (middle of word), E (end of word), and S (single-word word).

[0072] (3) Training the CRF model;

[0073] Use labeled training data to train the CRF model through maximum likelihood estimation or other optimization algorithms. During the training process, the CRF model will learn the relationship between features and labels, and how to predict the next label based on the context.

[0074] (4) prediction and word segmentation;

[0075] Use the trained CRF model to predict and segment the address to be identified. The CRF model predicts the most likely label for each character or word based on features and context information.

[0076] Of course, after obtaining each word segment, the area corresponding to each word can be identified, and each word segment can also be identified as province, city, district, street, community, road, road number, community, building, room and other information.

[0077] The above scheme performs structured processing on the addresses to be identified, and then performs initial clustering on the addresses to be identified based on the text similarity between the addresses to be identified after the structured processing. This can greatly reduce the situation where the text similarity between addresses of the same address is low due to different text descriptions, which is beneficial to improving the risk address identification accuracy of the above risk address identification method.

[0078] In addition, it is understandable that after the addresses to be identified are structured, initial clustering can be performed directly based on the text similarity between the structured addresses, or initial clustering can be performed by setting different clustering units to reduce the amount of calculation during initial clustering. The solution can be:

[0079] As an optional implementation of the above-mentioned risk address identification method, the above-mentioned step S110 includes: taking the cell where the address to be identified is located as the smallest unit, extracting the cell-level address from the address to be identified; performing initial clustering of the address to be identified based on the text similarity between the cell-level addresses to obtain the initial clustering cluster. This implementation example:

[0080] For example, if an address to be identified after structured processing is: Room J, Building I, H Community, No. G, F Road, District D, City B, Province A, then the method for extracting the cell-level address (i.e., cell-granular address) of the address to be identified can be:

[0081] Eliminate the building and room information from the address to be identified after structured processing, that is, eliminate "Building I, Room J", and the obtained community-level address is: H Community, No. G, F Road, E Community, D Street, District C, City B, Province A;

[0082] Of course, it is understandable that the cell-level address after removing relevant information is only used for the first clustering, and is not necessarily used in the second clustering. The specific form of the address to be identified will be introduced in the subsequent description of the second clustering solution.

[0083] The above scheme uses cell-level addresses for initial clustering. On the one hand, the clustering results show the clustering of addresses to be identified from the regional perspective of the cell, which is conducive to enhancing the interpretability of the risk address identification results; on the other hand, it can effectively reduce the amount of calculation during the initial clustering, especially for the risk address identification scenario of large-scale transaction data. The above scheme can greatly reduce the amount of calculation, which is conducive to improving the risk address identification efficiency of the above-mentioned risk address identification method.

[0084] Of course, it can be understood that although the above scheme only introduces the extraction of cell-level addresses from the perspective of the cell, it does not mean that the risk address identification method in the embodiment of the present application can only perform initial clustering through cell-level addresses. Different levels of addresses can be selected for extraction according to different application scenarios, such as extracting district-level addresses, street-level addresses, etc. The specific extraction method will not be repeated in the embodiment of this application.

[0085] The following is a detailed introduction to the specific clustering method used in the initial clustering:

[0086] In step S110, a clustering algorithm such as K-means clustering algorithm, hierarchical clustering algorithm, spectral clustering algorithm, DBSCAN clustering algorithm, etc. may be used to perform initial clustering of the texts to be identified based on the text similarity between the addresses to be identified. The initial clustering process is described below using the DBSCAN clustering algorithm as an example:

[0087] DBSCAN (Density-Based Spatial Clustering of Applications with Noise) is a density-based clustering method used to discover clusters of data points with similar density. DBSCAN can effectively handle noise and outliers in the data and does not require a predefined number of clusters.

[0088] The core idea of ​​the DBSCAN clustering algorithm is to cluster based on the density reachability between data points. It defines the following important concepts:

[0089] (1) Core Point: For a given radius ε and minimum number of neighbors minPts, if a data point’s ε-neighborhood contains at least minPts data points (including itself), then the point is considered a core point;

[0090] (2) Border Point: For a given radius ε and minimum number of neighbors minPts, if a data point’s ε-neighborhood contains fewer than minPts data points, but its ε-neighborhood contains a core point, then the point is considered a border point;

[0091] (3) Noise Point: For a given radius ε and minimum number of neighbors minPts, if the ε-neighborhood of a data point contains neither core points nor boundary points, the point is considered a noise point.

[0092] Solutions for initially clustering the addresses to be identified using the DBSCAN clustering algorithm may include:

[0093] (1) Feature extraction;

[0094] Through feature extraction, the address text to be identified is converted into a numerical feature vector. Common feature extraction models include the bag-of-words model and the TF-IDF model.

[0095] (2) Text similarity calculation;

[0096] Calculate the distance between any two addresses to be identified, that is, the text similarity between the two addresses to be identified, such as cosine similarity, Jaccard similarity and other distance metrics;

[0097] (3) Determination of noise points, core points and boundary points;

[0098] Specifically: select an unvisited data point P;

[0099] Check the number of data points in the ε-neighborhood of P. If the number is greater than or equal to minPts, mark P as a core point and create a new cluster.

[0100] Select an unvisited data point Q from the ε-neighborhood of P and add Q to the current cluster;

[0101] For each unvisited data point in the ε-neighborhood of Q, if the point is a core point, add the point and the unvisited points in its ε-neighborhood to the current cluster; repeat this step until there are no more core points in the current cluster;

[0102] Mark all unvisited noise points;

[0103] (4) Obtaining the initial clustering clusters;

[0104] It is understandable that after obtaining the initial clustering clusters, the clustering results can also be evaluated based on the initial clustering clusters to obtain the best clustering effect, such as clustering evaluation indicators such as silhouette coefficient, F1 score, etc.

[0105] The following is a detailed introduction to the solution of performing secondary clustering of the addresses to be identified based on the correlation between the order information in step S120:

[0106] It is understandable that each address to be identified can be associated with one or more order information, and the content contained in each order information can be divided into order-side information (such as the ordering user ID, etc.) and delivery-side information (such as the consignee information, etc.). Secondary clustering is performed based on the order information associated with the address to be identified. The specific scheme is as follows:

[0107] As an optional implementation of the above-mentioned risk address identification method, the above-mentioned step S120 includes: calculating the order side correlation and / or the delivery side correlation between the order information of the addresses to be identified in the initial clustering cluster; performing secondary clustering on the addresses to be identified in the initial clustering cluster according to the order side correlation and / or the delivery side correlation to obtain a secondary clustering cluster.

[0108] It is understandable that there are three implementations of the above step S120, which are described in detail below:

[0109] The first implementation method: based on the unilateral correlation degree, the addresses to be identified in the initial cluster are clustered twice;

[0110] It can be understood that the order side correlation refers to the correlation calculated based on the order side information in the order information;

[0111] Under this implementation, the addresses to be identified in the primary clustering cluster are secondary clustered only based on the order side correlation calculated based on the order side information in the order information, so that the secondary clustering cluster obtained can focus on the order side information, and the risk address identification results obtained based on the secondary clustering cluster can also focus on the order side.

[0112] The second implementation method: based on the relevance of the receiving side, the addresses to be identified in the initial cluster are clustered twice;

[0113] It can be understood that the receiving side correlation refers to the correlation calculated based on the receiving side information in the order information;

[0114] Under this implementation, the addresses to be identified in the primary cluster are secondary clustered only based on the consignee side association calculated based on the consignee side information in the order information, so that the secondary cluster obtained can focus on the consignee side information, and the risk address identification results obtained based on the secondary cluster can also focus on the consignee side.

[0115] The third implementation method: based on the order-side correlation and the delivery-side correlation, the addresses to be identified in the initial cluster are clustered again;

[0116] It can be understood that under this embodiment, for the initial clustering cluster, the addresses to be identified in the initial clustering cluster can be clustered secondary according to the order side correlation and the receiving side correlation, thereby obtaining two groups of clusters, that is, in the secondary clustering cluster under this embodiment, the same initial clustering cluster corresponds to two groups of secondary clustering clusters, and then these two groups of clustering clusters are combined to obtain the risk address identification results.

[0117] Under this implementation method, the addresses to be identified in the initial cluster are secondary clustered according to the correlation degree of the order side and the correlation degree of the receiving side, so as to obtain the risk address identification results by combining the order side perspective and the receiving side perspective, and realize comprehensive analysis of the risk addresses.

[0118] The above scheme can perform secondary clustering on the addresses to be identified in the initial clustering cluster based only on the order-side correlation or the receiving-side correlation, or it can perform secondary clustering on the addresses to be identified in the initial clustering cluster based on the combined order-side correlation and the receiving-side correlation, thereby obtaining risk address identification results focused on different angles, so that the above risk address identification method can be applied to more application scenarios, which is conducive to improving the applicability of the above risk address identification method.

[0119] It should be pointed out that when performing secondary clustering, all primary clusters can be subjected to secondary clustering, or the primary clusters can be screened and then the screened primary clusters are subjected to secondary clustering. The screening method is, for example: if the number of addresses to be identified contained in the primary cluster is greater than a preset number threshold, the addresses to be identified in the primary cluster are subjected to secondary clustering. Conversely, if the number of addresses to be identified contained in the primary cluster is not greater than the preset number threshold, the primary cluster is not subjected to secondary clustering. This method can also reduce the amount of invalid calculations to a certain extent, because if a primary cluster contains only a small number of addresses to be identified, then even if the addresses to be identified in the primary cluster are subjected to secondary clustering, it is not possible to identify risky addresses among the addresses to be identified in the primary cluster.

[0120] The following is a detailed introduction to the calculation method of the order-side correlation degree and the receiving-side correlation degree:

[0121] As an optional implementation of the above-mentioned risky address identification method, calculating the order-side correlation between the order information of the addresses to be identified within the initial clustering includes: calculating the order-side correlation between the order information of the addresses to be identified within the initial clustering based on at least one item of order-side information among user information, product information, order device information, and payment information in the order information. For example, this implementation is:

[0122] Taking the order information associated with the address to be identified A and the address to be identified B shown in FIG2 and FIG3 as an example, the calculation method of the order-side association degree between the address to be identified A and the address to be identified B can be:

[0123] (1) Calculating the first degree of association between the address to be identified A and the address to be identified B when the address to be identified A is the subject. The calculation steps are shown in Table 1.

[0124] Table 1 Calculation steps of the first degree of association when the address to be identified is A

[0125] It is understood that the above indicative function can be a 01 indicative function, which can be extended to similarity, such as the calculation of user ID similarity, mobile phone dimension ID similarity, and device ID similarity. For example, in the user ID dimension, if the user ID: a of order A001 is the same as the user dimension ID in any order associated with the address B to be identified, then the indicative function = 1; otherwise, the indicative function = 0. Of course, the above indicative function can also be a real number between 0 and 1 to limit the maximum similarity that can be achieved for different order dimensions.

[0126] The above dimension weights can be determined by hyperparameters according to different business scenarios, and the dimension weight values ​​can be between 0 and 1.

[0127] (2) When the address B to be identified is used as the subject, the second degree of association between the address B to be identified and the address A to be identified is calculated in a manner similar to the steps shown in Table 1 above, and will not be described in detail in this embodiment of the present application.

[0128] (3) Calculate the lower unilateral correlation degree between the address to be identified A and the address to be identified B = Max (first correlation degree, second correlation degree).

[0129] Of course, the above implementation is only one way of calculating the unilateral correlation degree, and other ways of calculating the correlation degree may also be used. For example, in the above calculation formula for selecting the maximum value, a calculation method of taking the median or the average value may also be used.

[0130] The above scheme comprehensively considers at least one of the order-side information such as user information, product information, order device information and payment information in the order information, calculates the order-side correlation between the order information of the addresses to be identified in the initial clustering cluster, thereby obtaining the correlation information that can characterize the addresses to be identified in the initial clustering cluster from the order-side perspective, and performs secondary clustering of the addresses to be identified in the initial clustering cluster through the order-side correlation, which is conducive to improving the risk address identification accuracy of the above-mentioned risk address identification method.

[0131] As an optional implementation method of the above-mentioned risk address identification method, the delivery side correlation between the order information of the addresses to be identified in the initial clustering cluster is calculated, including: calculating the delivery side correlation between the order information of the addresses to be identified in the initial clustering cluster based on at least one delivery side information among the delivery address information, delivery phone information, delivery method information and consignee information in the order information.

[0132] It can be understood that the calculation method of the above-mentioned receiving side correlation is the same as the calculation method of the order side correlation in the above content. The difference is that the order dimensions involved in calculating the receiving side correlation include at least one dimension among the receiving address dimension, the receiving phone dimension, the delivery method dimension and the consignee dimension.

[0133] In addition, it is understandable that the above-mentioned delivery address information can adopt the original address information of the address to be identified, that is, the address to be identified that has not been structured.

[0134] In addition, it should be pointed out that the order information and delivery information in the above order information are relevant information obtained after obtaining the user's consent.

[0135] The above scheme comprehensively considers at least one of the delivery side information such as delivery address information, delivery phone information, delivery method information and consignee information in the order information, calculates the delivery side correlation between the order information of the address to be identified in the initial clustering cluster, thereby obtaining the correlation information that can characterize the address to be identified in the initial clustering cluster from the delivery side perspective, and performs secondary clustering of the address to be identified in the initial clustering cluster through the delivery side correlation, which is conducive to improving the risk address identification accuracy of the above risk address identification method.

[0136] It is understandable that the above step S120 may also use a clustering algorithm such as K-means clustering algorithm, hierarchical clustering algorithm, spectral clustering algorithm, DBSCAN clustering algorithm, etc. to perform secondary clustering on the addresses to be identified in the primary clustering cluster according to the correlation between the addresses to be identified.

[0137] Of course, when performing secondary clustering on the addresses to be identified in the initial cluster, the association relationship between the addresses to be identified can also be expressed in a connectivity graph to perform further clustering. The solution is as follows:

[0138] As an optional implementation of the above-mentioned risk address identification method, the above-mentioned step S120 includes: obtaining an address association graph corresponding to the initial clustering cluster; wherein the address association graph has the addresses to be identified as nodes and the correlation between the order information of the addresses to be identified as edges; based on the correlation, the address association graph is secondary clustered to obtain a secondary clustering cluster.

[0139] It is understood that the address association graph described above can be a connectivity graph. A connectivity graph is a concept in graph theory that describes whether there are paths connecting nodes in an undirected or directed graph. In an undirected graph, if there is a path between any two nodes, the graph is considered connected. In a directed graph, if starting from any node, all other nodes can be reached, the graph is considered strongly connected; if starting from any node, only some nodes can be reached, the graph is considered weakly connected. Connectivity graphs are widely used in practical applications, such as friend relationships in social networks and web link relationships on the internet. By analyzing connectivity graphs, we can study the relationships between nodes and information transmission paths. In computer science, connectivity graph algorithms are algorithms used to find connected components in a graph. Common algorithms include depth-first search (DFS) and breadth-first search (BFS). These algorithms traverse the entire graph, identify all connected components, and mark them with different colors or numbers. In short, connectivity graphs are a key concept in graph theory that describe the connection relationships between nodes in a graph and help understand and analyze the associations between addresses to be identified.

[0140] It can be understood that when constructing an address association graph based on the correlation between addresses, a correlation threshold can be set. The two addresses to be identified will be connected only when the correlation between them is higher than the correlation threshold. In this way, the correlation relationship between the addresses to be identified can be further represented by the address association graph.

[0141] Of course, if the correlation between order information includes two types of correlation: the order side correlation and the delivery side correlation, two address correlation diagrams can be obtained for these two types of correlation respectively to represent the correlation relationship of the address to be identified from the two perspectives of the order side and the delivery side.

[0142] In addition, it is understandable that a clustering algorithm capable of clustering the address association graph, such as the DBSCAN clustering algorithm, can still be used to perform secondary clustering on the address association graph to obtain secondary clusters.

[0143] The above scheme uses an address association graph to perform secondary clustering on the addresses to be identified in the initial clustering cluster. On the one hand, the obtained secondary clustering results can capture the global relationship between the nodes, which is conducive to improving the risk address identification accuracy of the above risk address identification method; on the other hand, the use of an address association graph that can more intuitively display the association relationship between the addresses to be identified and the clustering relationship of the secondary clustering clusters for secondary clustering is conducive to improving the interpretability of the secondary clustering clusters.

[0144] The following describes the method for obtaining the risk address identification result in step S130:

[0145] It is understandable that the secondary clustering in step S130 can be a data clustering or an association graph clustering. For clustering in different ways, the following method can be used to determine the risk address identification result:

[0146] Case 1: The secondary cluster contains only one type of cluster. That is, during secondary clustering, secondary clustering is performed only based on the order-side correlation or the delivery-side correlation.

[0147] In this case, the number of addresses to be identified in the cluster is used to determine whether the cluster has a clustering risk. If the number of addresses to be identified in the cluster is greater than the preset number of addresses, the cluster is determined to have a clustering risk, and all the addresses to be identified contained in the cluster are risky addresses.

[0148] Case 2: The secondary cluster contains two clusters, that is, during the secondary clustering, clustering is performed based on the order-side correlation and the delivery-side correlation.

[0149] In this case, the final risk address determination result can be determined by determining whether the address to be identified is determined as a risk address in the two clusters. The determination rule can be:

[0150] (1) If a certain address to be identified is determined to be a risky address in both clusters, then the address to be identified is finally determined to be a risky address;

[0151] (2) If a certain address to be identified is not determined as a risk address in both clusters, then the address to be identified is finally determined to be a non-risk address;

[0152] (3) If a certain address to be identified is determined to be a risk address and a non-risk address in two clusters respectively, then the address to be identified can be finally determined to be a risk address or a non-risk address according to the determination rules set to cope with different application scenarios.

[0153] Of course, the degree of risk can also be determined based on whether the address to be identified is judged as a risk address in the two clusters. For example, if a certain address to be identified is judged as a risk address in both clusters, then the address to be identified is ultimately judged to be a high-risk address. If a certain address to be identified is judged as a risk address and a non-risk address in both clusters, then the address to be identified is ultimately judged to be a medium-risk address.

[0154] Of course, in the case where an address to be identified is judged as a risk address and a non-risk address in two clusters respectively, different confidence levels can be set for the ordering side and the receiving side according to the application scenario. When the address is judged as a risk address and a non-risk address respectively, the high-confidence judgment result is taken as the final judgment result of the address to be identified.

[0155] It should be pointed out that the above-mentioned scheme for obtaining the risk address identification result in step S130 is only an implementation method, and is not a specific limitation of the above-mentioned step S130. The risk address identification method in the embodiment of the present application can adopt other acquisition methods or judgment rules to obtain the risk address identification result based on the secondary clustering cluster.

[0156] Referring to FIG. 4 , based on the same inventive concept, an embodiment of the present application further provides a risky address identification device 200 , which includes:

[0157] The initial cluster acquisition module 210 is configured to perform initial clustering on the addresses to be identified according to text similarities between the addresses to be identified in the address set to be identified, and acquire initial clusters;

[0158] A secondary cluster acquisition module 220 is configured to perform secondary clustering on the addresses to be identified in the primary cluster according to the correlation between the order information of the addresses to be identified in the primary cluster, to obtain a secondary cluster;

[0159] The risk address identification result acquisition module 230 is used to acquire the risk address identification result based on the secondary clustering clusters.

[0160] As an optional implementation of the risky address identification device, the secondary cluster acquisition module 220 includes:

[0161] a correlation calculation unit, configured to calculate an order-side correlation and / or a delivery-side correlation between the order information of the addresses to be identified within the initial cluster;

[0162] The secondary clustering unit is configured to perform secondary clustering on the addresses to be identified in the primary cluster according to the order-side association degree and / or the delivery-side association degree, to obtain a secondary cluster.

[0163] As an optional implementation of the risky address identification device, the correlation calculation unit is specifically configured to:

[0164] According to at least one order-side information among user information, product information, order-placing device information and payment information in the order information, the order-side correlation degree between the order information of the to-be-identified addresses in the initial cluster is calculated.

[0165] As an optional implementation of the risky address identification device, the correlation calculation unit is specifically configured to:

[0166] According to at least one item of the delivery side information among the delivery address information, delivery phone information, delivery method information and consignee information in the order information, the delivery side correlation degree between the order information of the address to be identified in the initial cluster is calculated.

[0167] As an optional implementation of the above-mentioned risk address identification device, the above-mentioned secondary clustering cluster acquisition module 220 is specifically used to: obtain the address association graph corresponding to the initial clustering cluster; wherein, the address association graph has the addresses to be identified as nodes and the correlation between the order information of the addresses to be identified as edges; according to the correlation, the address association graph is secondary clustered to obtain a secondary clustering cluster.

[0168] As an optional implementation of the risky address identification device, the initial cluster acquisition module 210 includes:

[0169] a structured processing unit, configured to perform structured processing on the addresses to be identified in the set of addresses to be identified;

[0170] The primary clustering unit is configured to perform primary clustering on the addresses to be identified according to the text similarities between the addresses to be identified after the structural processing, so as to obtain primary clustering clusters.

[0171] As an optional implementation of the risky address identification device, the initial cluster acquisition module 210 further includes:

[0172] A cell-level address extraction unit, configured to extract a cell-level address from the address to be identified, taking the cell where the address to be identified is located as the smallest unit;

[0173] At this time, the above-mentioned primary clustering unit is specifically used to: perform primary clustering on the addresses to be identified according to the text similarity between the cell-level addresses to obtain primary clustering clusters.

[0174] FIG5 is a schematic diagram of an electronic device provided in an embodiment of the present application. Referring to FIG5 , the electronic device 300 includes: a processor 310, a memory 320, and a communication interface 330. These components are interconnected and communicate with each other via a communication bus 340 and / or other forms of connection mechanisms (not shown).

[0175] The memory 320 includes one or more (only one is shown in the figure), which may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc. The processor 310 and other possible components can access the memory 320 and read and / or write data therein.

[0176] The processor 310 includes one or more (only one is shown in the figure), which can be an integrated circuit chip with signal processing capabilities. The above-mentioned processor 310 can be a general-purpose processor, including a central processing unit (CPU), a microcontroller unit (MCU), a network processor (NP), or other conventional processors; it can also be a special-purpose processor, including a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0177] Communication interface 330 includes one or more (only one is shown in the figure) interfaces that can be used to communicate directly or indirectly with other devices to exchange data. For example, communication interface 330 can be an Ethernet interface; a mobile communication network interface, such as a 3G, 4G, or 5G network interface; or other types of interfaces that have data transmission and reception capabilities.

[0178] One or more computer program instructions may be stored in the memory 320 , and the processor 310 may read and execute these computer program instructions to implement the risk address identification method and other desired functions provided in the embodiments of the present application.

[0179] It will be understood that the structure shown in FIG5 is for illustration only, and the electronic device 300 may also include more or fewer components than shown in FIG5 , or have a configuration different from that shown in FIG5 . The components shown in FIG5 may be implemented using hardware, software, or a combination thereof. For example, the electronic device 300 may be a single server (or other device with computing processing capabilities), a combination of multiple servers, a cluster of a large number of servers, etc., and may be either a physical device or a virtual device.

[0180] The present application also provides a computer-readable storage medium having computer program instructions stored thereon. When the computer program instructions are read and executed by a computer processor, the computer program instructions execute the risky address identification method provided in the present application. For example, the computer-readable storage medium can be implemented as memory 320 in electronic device 300 in FIG. 5 .

[0181] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interface, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0182] In addition, the units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0183] Furthermore, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0184] The above description is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, various modifications and variations of the present application are possible. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for identifying risky addresses, characterized in that: The method comprises: performing initial clustering of the addresses to be identified based on text similarities between the addresses to be identified in the address set to be identified, and obtaining initial clustering clusters; performing secondary clustering on the addresses to be identified in the primary cluster according to the correlation between the order information of the addresses to be identified in the primary cluster to obtain a secondary cluster; According to the secondary clustering, a risk address identification result is obtained.

2. The risk address identification method according to claim 1, characterized in that: The performing secondary clustering on the addresses to be identified in the primary clustering according to the correlation between the order information of the addresses to be identified in the primary clustering to obtain the secondary clustering includes: Calculating the order-side correlation degree and / or the delivery-side correlation degree between the order information of the to-be-identified addresses in the initial cluster; According to the order-side association degree and / or the delivery-side association degree, the addresses to be identified in the primary cluster are secondary clustered to obtain a secondary cluster.

3. The risk address identification method according to claim 2, characterized in that: Calculating the order-side correlation between the order information of the to-be-identified addresses within the initial clustering cluster, including: According to at least one order-side information among user information, product information, order-placing device information and payment information in the order information, the order-side correlation degree between the order information of the to-be-identified addresses in the initial cluster is calculated.

4. The risk address identification method according to claim 2, characterized in that: Calculating the receiving-side correlation between the order information of the to-be-identified addresses in the initial clustering clusters, including: According to at least one item of the delivery side information among the delivery address information, delivery phone information, delivery method information and consignee information in the order information, the delivery side correlation degree between the order information of the address to be identified in the initial cluster is calculated.

5. The risk address identification method according to claim 1, characterized in that: The performing secondary clustering on the addresses to be identified in the primary clustering according to the correlation between the order information of the addresses to be identified in the primary clustering to obtain the secondary clustering includes: Obtaining an address association graph corresponding to the initial clustering cluster; wherein the address association graph has the addresses to be identified as nodes and the association degrees between the order information of the addresses to be identified as edges; According to the association degree, the address association graph is secondary clustered to obtain secondary cluster clusters.

6. The risk address identification method according to any one of claims 1 to 5, characterized in that: The performing of initial clustering of the addresses to be identified based on text similarities between the addresses to be identified in the address set to be identified to obtain initial clustering clusters includes: Performing structural processing on the addresses to be identified in the set of addresses to be identified; According to the text similarity between the addresses to be identified after the structured processing, the addresses to be identified are initially clustered to obtain initial clustering clusters.

7. The risk address identification method according to claim 6, characterized in that: The performing of initial clustering on the addresses to be identified based on the text similarities between the addresses to be identified after the structural processing to obtain initial clustering clusters includes: Taking the cell where the address to be identified is located as the smallest unit, extracting the cell-level address from the address to be identified; The addresses to be identified are initially clustered according to the text similarity between the cell-level addresses to obtain initial clustering clusters.

8. A risk address identification device, characterized in that: The device comprises: A primary clustering cluster acquisition module, configured to perform primary clustering on the addresses to be identified according to text similarities between the addresses to be identified in the address set to be identified, and obtain primary clusters; a secondary cluster acquisition module, configured to perform secondary clustering on the addresses to be identified in the primary cluster according to the correlation between the order information of the addresses to be identified in the primary cluster, to acquire a secondary cluster; The risk address identification result acquisition module is used to obtain the risk address identification result based on the secondary clustering cluster.

9. An electronic device, characterized in that: include: A processor, a memory and a communication bus, wherein the processor and the memory communicate with each other via the communication bus; The memory stores program instructions that can be executed by the processor, and the processor can execute the method according to any one of claims 1 to 7 by calling the program instructions.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, which, when executed by a computer, enable the computer to perform the method according to any one of claims 1 to 7.

Images