Detailed Description
As described in the background, a user may implement various events, such as a query event, a payment event, etc., through a social platform, a transaction platform, etc., network platform. Based on events that have occurred, event bodies of the events are correlated to form a relational network. Because the association relationship between the event main body and the event main body is established, if a certain medium is commonly used by N event main bodies, the generated association relationship is in the order of N square. When N is large, the resource consumption of the calculation of the relational network constructed in the mode is large, and real-time implementation is difficult. Based on this, the embodiment of the present disclosure provides a method and an apparatus for constructing a relational network, by constructing an association relationship between an event main body and a medium, the order of magnitude of the association relationship in which a certain medium is commonly used by N event main bodies is reduced to N. In addition, in order to avoid losing the association relationship between the event main body and the event main body, the embodiment of the specification pulls the event main bodies which are originally independent to each other to the same space to calculate the similarity in an embedded mode, so that the accuracy of calculation by adopting a relationship network is ensured.
In order to better understand the technical solutions described above, the technical solutions of the embodiments of the present specification are described in detail below through the accompanying drawings and the specific embodiments, and it should be understood that the specific features of the embodiments of the present specification and the specific features of the embodiments of the present specification are detailed descriptions of the technical solutions of the embodiments of the present specification, and not limit the technical solutions of the present specification, and the technical features of the embodiments of the present specification may be combined with each other without conflict.
In a first aspect, embodiments of the present disclosure provide a method for constructing a relational network. Fig. 1 is a flowchart of the relationship network construction method including step S102 and step S106.
S102, extracting an event main body and a medium of a target event which occurs in a preset time period.
The target event may be an event occurring in the real world, or may be an event implemented through a network platform, including but not limited to an internet transaction event, a website access event, a mail receiving event, an instant messaging event, a forum access event, an online payment event, a login event, etc., which are not limited in this embodiment of the present disclosure. For different types of target events, the determined event main bodies and media are different, and the event main bodies and media of the target events are determined according to actual application scenes. Taking the target event as an internet transaction event as an example, in an application scenario of performing partner fraud identification according to a transaction relationship network, a user account number which is maliciously registered in batches needs to be identified according to the transaction relationship network constructed by the internet transaction event, and the partner fraud behavior has the following characteristics: the plurality of user accounts repeatedly use one or a plurality of bank card accounts for transaction, the plurality of user accounts repeatedly use one or a plurality of IP addresses for transaction, the plurality of user accounts repeatedly use one or a plurality of receiving addresses, and the like, so that the user accounts can be determined as event main bodies, and one or a plurality of IP addresses, bank card accounts and receiving addresses are used as media. In other application scenarios, a trade shop, a trade terminal, a telephone number, or the like may be used as a medium.
Typically, after the target event is completed, the parameters generated by the target event are stored in a specified database, so that the event body and medium of the target event can be extracted from the specified database. In the embodiment of the present specification, the event body and medium of some or all of the target events occurring within a certain fixed period of time may be extracted, or the event body and medium of some or all of the target events occurring within a set period of time may be extracted, so as to periodically construct a relational network. For example, event bodies and media of target events occurring within the past 24 hours may be extracted every 24 hours. By extracting event main bodies and media of target events occurring within a set time interval, the constructed relationship network can reflect the association relationship among event main bodies in the latest target event in real time.
And S104, associating the event main body with the medium.
Specifically, the event main body and the medium are taken as nodes, and an association relationship between the event main body and the medium is established. Taking the target event as an internet transaction event, taking the event main body as a user account and the medium as a transaction store as an example, if 7 internet transaction events occur in the preset time period, wherein the internet transaction event 1 is that the user account A1 is consumed in the transaction store B1, the internet transaction event 2 is that the user account A2 is consumed in the transaction store B1, the internet transaction event 3 is that the user account A3 is consumed in the transaction store B1, the internet transaction event 4 is that the user account A4 is consumed in the transaction store B1, the internet transaction event 5 is that the user account A5 is consumed in the transaction store B1, the internet transaction event 6 is that the user account A1 is consumed in the transaction store B2, the internet transaction event 7 is that the user account A5 is consumed in the transaction store B2, the node A1 is associated with the node B1, the node A2 is associated with the node B1, the node A3 is associated with the node B1, the node A5 is associated with the node B1, and the node A2 is associated with the node B2. The relationship network obtained after the association relationship is established is shown in fig. 2, wherein one end with the association relationship is a user account, and the other end with the association relationship is a trade shop.
S106, obtaining the weight between the event main body and the medium according to the similarity between the local behavior characteristics and the overall behavior characteristics, wherein the local behavior characteristics are the behavior characteristics of the event main body on the medium, and the overall behavior characteristics are the behavior characteristics of all event main bodies associated with the medium on the medium.
Specifically, by determining the similarity between the local behavior feature and the global behavior feature, the similarity between the local behavior feature and the global behavior feature may be directly determined as the weight between the event main body and the medium, or some mapping may be performed on the similarity between the local behavior feature and the global behavior feature, and the data obtained after mapping may be determined as the weight between the event main body and the medium. In the embodiment of the present specification, the event bodies which are originally independent of each other are pulled to the same space in an embedded manner to calculate the similarity.
The local behavior feature is converted into a first vector, i.e. the behavior feature of the event body on the medium is converted into the first vector. Taking the relationship network shown in fig. 2 as an example, if the behavior feature is a distribution of the consumption amount, when determining the weight between the user account A1 and the transaction portal B1, the event body is the user account A1 and the medium is the transaction portal B1, and the local behavior feature is the distribution of the consumption amount of the user account A1 in the transaction portal B1. If the consumption amount of all the user accounts at the trade shop B1 has 2, 4 and 10 elements, and the user account A1 consumes 2, 5, 4, 1 and 10 elements 0 times at the trade shop B1, the consumption amount distribution of the user account A1 at the trade shop B1 is converted into a vector (5, 1, 0), and the first vector (5, 1, 0) is obtained.
Similarly, the overall behavioral characteristics are converted to a second vector, i.e., the behavioral characteristics of all event agents associated with the medium on the medium are converted to a second vector. Still taking the relationship network shown in fig. 2 as an example, if the behavior feature is a consumption amount distribution, when determining the weight between the user account A1 and the transaction portal B1, the event body is the user account A1 and the medium is the transaction portal B1, and the overall behavior feature is that all the user accounts (the user account A1, the user account A2, the user account A3, the user account A4 and the user account A5) associated with the transaction portal B1 are distributed in the consumption amount of the transaction portal B1. If the consumption amount of all the user accounts at the trade shop B1 has 2, 4 and 10 elements, and the user accounts A1, A2, A3, A4 and A5 are consumed 2, 20 and 10 elements for 100 times, 4 and 5 times at the trade shop B1, the distribution of the consumption amounts of the user accounts A1, A2, A3, A4 and A5 at the trade shop B1 is converted into vectors (100, 20, 5), and the second vector is obtained as (100, 20, 5).
And obtaining the similarity between the local behavior feature and the overall behavior feature according to the first vector and the second vector. In this embodiment of the present disclosure, a cosine value between the first vector and the second vector is calculated, and the cosine value between the first vector and the second vector is a similarity between the local behavior feature and the global behavior feature. Taking the first vector as (5, 1, 0) and the second vector as (100, 20, 5) as an example, the cosine value cos [ (5, 1, 0), (100, 20, 5) ]= 0.9988 between the first vector and the second vector indicates that the consumption distribution of the user account A1 at the trade shop B1 is very similar to the consumption distribution of other user accounts at the trade shop B1. It should be noted that, the similarity between the local behavior feature and the global behavior feature may be obtained in other manners, for example, using other vector distance algorithms, which are not limited in the embodiments of the present disclosure.
It should be noted that, when executing step S102, the event body and the medium of the target event may be extracted in real time, that is, each time a target event occurs, the event body and the medium of the target event are extracted; and extracting the event main body and the medium of each target event after each target event occurs within the preset time period. If the event body and the medium of the target event are extracted in real time, the event body and the medium extracted from the newly generated target event are added into the existing relational network when the step S104 is executed, and the weight between the event body and the medium associated with each other is updated when the step S106 is executed.
Because the embodiment of the specification establishes the association relationship between the event main body and the medium, the complexity of the obtained relationship network is greatly reduced. Taking the relationship network shown in fig. 2 as an example, the transaction portal B1 is commonly used by the user account A1, the user account A2, the user account A3, the user account A4 and the user account A5, and the number of generated association relationships is 5 by establishing the association relationship between the event main body and the medium according to the embodiment of the present specification; the related relationship between event main bodies is established by adopting the prior art, the established relationship network is shown in figure 3, and the number of generated related relationships is C 5 2 =10, i.e. a certain medium is commonly used by N event bodies, the correlation produced using the prior art is of the order of N squared.
Therefore, compared with the prior art of establishing the association relationship between the event main body and the event main body, the complexity of the relationship network obtained by the embodiment of the specification is greatly reduced, so that the resource consumption of calculation by adopting the relationship network can be reduced, and real-time calculation is realized. In addition, in the embodiment of the specification, the weight between the event main body and the medium which are mutually related is obtained according to the similarity between the local behavior characteristics and the overall behavior characteristics, namely, the event main body which is originally mutually independent is pulled to the same space in an embedded mode to calculate the similarity, and the overall view of all event main bodies at the other end of the medium which is related to the event main body can be seen through one event main body, so that the relevance between the event main body and the event main body is not lost, and the accuracy of calculation by adopting a relational network is ensured.
In a second aspect, based on the same inventive concept, embodiments of the present specification provide a relational network construction apparatus. Fig. 4 is a schematic structural view of the relationship network constructing apparatus, which includes:
an extraction module 41, configured to extract an event main body and a medium of a target event occurring within a preset period of time;
an association module 42 for associating the event body with the medium;
the weight obtaining module 43 is configured to obtain weights between the event body and the medium according to a similarity between a local behavior feature and an overall behavior feature, where the local behavior feature is a behavior feature of the event body on the medium, and the overall behavior feature is a behavior feature of all event bodies associated with the medium on the medium.
In an alternative implementation, the weight obtaining module 43 includes:
a similarity determining module 431, configured to determine a similarity between the local behavior feature and the global behavior feature;
a weight determining module 432, configured to determine a similarity between the local behavior feature and the global behavior feature as a weight between the event body and the medium.
In an alternative implementation, the similarity determining module 431 includes:
a first conversion module for converting the local behavior feature into a first vector;
a second conversion module for converting the global behavioral characteristics into a second vector;
and the similarity obtaining module is used for obtaining the similarity between the local behavior characteristic and the whole behavior characteristic according to the first vector and the second vector.
In an alternative implementation, the similarity obtaining module is configured to calculate a cosine value between the first vector and the second vector, where the cosine value between the first vector and the second vector is a similarity between the local behavior feature and the global behavior feature.
In an alternative implementation, the extraction module 41 is configured to extract event bodies and media of target events that occur within a set time interval.
In an alternative implementation, the target event is an internet transaction event, the event body is a user account, and the medium is one or more of a transaction store, an IP address, a transaction terminal, a receiving address, a telephone number, and a bank card account.
In an alternative implementation, when the event body is a user account and the medium is a transaction store, the local behavior feature is a distribution of the amount of consumption of the user account at the transaction store, and the global behavior feature is a distribution of the amount of consumption of all user accounts associated with the transaction store at the transaction store.
In a third aspect, the present invention also provides a computer apparatus, as shown in fig. 5, based on the same inventive concept as the relationship network construction method in the foregoing embodiment. The computer device comprises a memory 504, a processor 502 and a computer program stored on the memory 504 and executable on the processor 502, which processor 502 implements the steps of the relationship network construction method of the previous embodiments when executing the computer program.
In FIG. 5, the bus architecture is represented by a bus 500, where the bus 500 may include any number of interconnected buses and bridges, with the bus 500 linking together various circuits, including one or more processors, represented by a processor 502, and memory, represented by a memory 504. Bus 500 may also link together various other circuits such as peripheral devices, voltage regulators, power management circuits, etc., as are well known in the art and, therefore, will not be described further herein. Bus interface 505 provides an interface between bus 500 and receiver 501 and transmitter 503. The receiver 501 and the transmitter 503 may be the same element, i.e. a transceiver, providing a means for communicating with various other apparatus over a transmission medium. The processor 502 is responsible for managing the bus 500 and general processing, while the memory 504 may be used to store data used by the processor 502 in performing operations.
In a fourth aspect, based on the same inventive concept as the relationship network construction method in the foregoing embodiment, the present invention also provides a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements the steps of the relationship network construction method in the foregoing embodiment.
The present description is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the specification. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
While preferred embodiments of the present description have been described, additional variations and modifications in those embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. It is therefore intended that the following claims be interpreted as including the preferred embodiments and all such alterations and modifications as fall within the scope of the disclosure.
It will be apparent to those skilled in the art that various modifications and variations can be made in the present specification without departing from the spirit or scope of the specification. Thus, if such modifications and variations of the present specification fall within the scope of the claims and the equivalents thereof, the present specification is also intended to include such modifications and variations.