JP7157328B2 - Graph simplification method, graph simplification program, and information processing device - Google Patents

Description

The present invention relates to a graph simplification method, a graph simplification program, and an information processing apparatus.

A large-scale graph including many nodes and edges connecting the nodes is generated, and various analyzes are performed using the generated large-scale graph. For example, entities such as people, companies, and devices are represented by nodes, relationships between the entities are represented by edges, and entities or relationships satisfying specific conditions are searched from the graph.

For example, there has been proposed a personal-connection analysis/search system that extracts communications that are strongly related to work among communications between users in the same company, and quantitatively evaluates personal connections between users. The proposed personal network analysis and search system extracts a group of users who have a large amount of communication with each other as a communication core.

Also, for example, a graph processing method has been proposed that parallelizes the shortest path search in a large-scale graph with scale-free characteristics. Further, for example, an information processing system has been proposed in which hardware processing using a dedicated logic circuit and software processing using a general-purpose processor are used together to search for the shortest path in a graph. The proposed information processing system extracts a node with the largest number of connected edges from the graph as a hub node, and preferentially assigns a node group formed around the hub node to hardware processing.

Japanese Patent Application Laid-Open No. 2007-280000 WO2013/145001 WO2015/004788

A graph used for search processing such as route search may be formed from hub nodes with many edges and peripheral nodes with a small number of edges. In particular, certain types of graphs, such as graphs representing social relationships between people and businesses, may have a core with densely connected hub nodes and a periphery with distributed peripheral nodes.

If a search process is performed on a graph having a core as it is, the core includes a large number of edges, resulting in a large amount of calculation. On the other hand, since many hub nodes are expected to be interconnected inside the core, their importance in search processing is relatively low, and strict search processing may not be necessary. Therefore, it is conceivable to simplify the graph in order to improve the efficiency of search processing. For example, it is conceivable to search for a path between two peripheral nodes belonging to the periphery using a graph that simplifies the core.

However, extreme simplification, such as ignoring the core or replacing the core with a single node, greatly reduces the information about the connection relationship between the hub node inside the core and the peripheral nodes, resulting in poor search accuracy. has the effect of lowering

An object of the present invention in one aspect is to provide a graph simplification method, a graph simplification program, and an information processing apparatus that reduce the influence on the accuracy of search processing using graphs.

In one aspect, a computer-implemented graph simplification method is provided. Obtain graph data including multiple nodes and multiple edges connecting the nodes. A plurality of hub nodes whose number of connected edges is greater than a threshold is detected from among the plurality of nodes indicated by the graph data, and a core node set including two or more hub nodes connected by edges is determined among the plurality of detected hub nodes. do. Based on the distance between the hub nodes belonging to the core node set, a central node is set for the core node set, and instead of the edge connecting the hub nodes belonging to the core node set other than the central node, the hub nodes belong to the core node set other than the central node. Generate other graph data containing edges connecting hub nodes and center nodes.

Also, in one aspect, a graph simplification program to be executed by a computer is provided. Also, in one aspect, an information processing apparatus having a storage unit and a processing unit is provided.

One aspect reduces the impact on the accuracy of search processing using graphs.

It is a figure explaining the example of the information processing apparatus of 1st Embodiment. It is a block diagram showing an example of hardware of an analysis device of a 2nd embodiment. FIG. 10 is a diagram showing an example of relationship analysis of a corporate network; 1 is a diagram showing an example of the shape of a corporate network; FIG. FIG. 2 is a distribution diagram showing an example of features of a corporate network; It is a figure which shows the example of route search. 1 illustrates a simplified example of a corporate network; FIG. 4 is a block diagram showing an example of functions of the analyzer; FIG. It is a figure which shows the example of graph data. FIG. 4 is a diagram showing an example of connection information; 7 is a flow chart showing an example of a procedure for graph simplification; FIG. 11 is a flowchart showing another procedure example of graph simplification; FIG.

Hereinafter, this embodiment will be described with reference to the drawings.
[First embodiment]
A first embodiment will be described.

FIG. 1 is a diagram illustrating an example of an information processing apparatus according to a first embodiment.
The information processing apparatus 10 according to the first embodiment analyzes a graph including a plurality of nodes and edges between nodes. The information processing device 10 is sometimes called a computer. Further, the information processing device 10 may be a client device or a server device. The graph analyzed by the information processing apparatus 10 is a large-scale graph in which entities such as people, companies, and devices are represented by nodes, and relationships between the entities are represented by edges. Examples of graphs include a corporate network that expresses transaction relationships between people and companies, a communication network that expresses connection relationships between communication devices, and a Web network that expresses link relationships between websites. The information processing apparatus 10 may perform search processing for searching the graph for nodes or edges that satisfy a predetermined condition. For example, as the search process, a route search, such as a shortest route search, may be performed to search for a route from one node to another node via one or more edges.

The information processing device 10 has a storage unit 11 and a processing unit 12 . The storage unit 11 may be a volatile semiconductor memory such as a RAM (Random Access Memory), or may be a non-volatile storage such as an HDD (Hard Disk Drive) or flash memory. The processing unit 12 is, for example, a processor such as a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), or a DSP (Digital Signal Processor). However, the processing unit 12 may include electronic circuits for specific purposes such as ASICs (Application Specific Integrated Circuits) and FPGAs (Field Programmable Gate Arrays). A collection of multiple processors is sometimes called a "multiprocessor" or simply a "processor."

The storage unit 11 stores graph data 13 . The graph data 13 includes multiple nodes and multiple edges connecting the nodes. The processing unit 12 converts the graph data 13 into graph data 14 . The graph data 14 is obtained by simplifying the graph data 13 in order to reduce the calculation amount of the search processing, and like the graph data 13, includes a plurality of nodes and a plurality of edges connecting the nodes. The graph data 14 is stored, for example, in the storage unit 11 and used by the processing unit 12 for search processing such as route search. For example, nodes included in graph data 13 and 14 are identified by node IDs, and edges included in graph data 13 and 14 are identified by a combination of nodes at both ends.

In converting the graph data 13 into the graph data 14, the processing unit 12 detects, from among the nodes indicated by the graph data 13, a plurality of hub nodes whose number of connected edges is greater than a threshold. A hub node represents a large entity with a large number of other entities with which it has relationships. The processing unit 12 determines a core node set 15 including two or more hub nodes connected by edges among the plurality of detected hub nodes. The core node set 15 is densely connected hub nodes and represents a set of large-scale entities. For example, the processing unit 12 extracts hub nodes and edges connecting the hub nodes from the graph data 13 , and converts the connected subgraph (connected component) formed by the hub nodes into a core node set 15 that has the largest number of hub nodes. I judge.

For example, suppose graph data 13 includes nodes A, B, C, D, E, F, G, and H. Node A has 4 edges (order), Node B has 4 edges, Node C has 6 edges, Node D has 4 edges, Node E has 5 edges, and Node F has 1 edge. , node G has one edge, and node H has one edge. The processing unit 12 detects, for example, the nodes A, B, C, D, and E as hub nodes, and determines the connected subgraph formed by the nodes A, B, C, D, and E as the core node set 15 .

The processing unit 12 sets the central node 16 for the core node set 15 based on the distance between hub nodes belonging to the core node set 15 . The central node 16 may be one of the hub nodes included in the core node set 15 in the graph data 13 or may be a new node not included in the core node set 15 in the graph data 13 . The processing unit 12 deletes edges connecting hub nodes belonging to the core node set 15 other than the central node 16 . Instead, the processing unit 12 adds edges connecting hub nodes belonging to the core node set 15 other than the central node 16 and the central node 16 . As a result, the core node set 15 is transformed into a star-shaped connected subgraph.

The processing unit 12 generates graph data 14 including a core node set 15 transformed into a star shape. A major difference between the graph data 13 and the graph data 14 is the connection relationship between hub nodes belonging to the core node set 15 . Graph data 14 may include nodes included in graph data 13 . In the graph data 14 , edges connecting nodes that do not belong to the core node set 15 may be the same as in the graph data 13 . In the graph data 14 , edges connecting nodes not belonging to the core node set 15 and hub nodes belonging to the core node set 15 other than the central node 16 may be the same as in the graph data 13 .

As described above, the distance between hub nodes belonging to the core node set 15 is referred to when setting the central node 16 . For example, the processing unit 12 sets the new node as the central node 16, and unifies the edge weights between the central node 16 and each hub node to a constant value. Edge weights may be determined based on the distance between hub nodes belonging to the core node set 15 . One-half of the average distance between hub nodes may be used as the edge weight. Also, for example, the processing unit 12 sets one of the existing hub nodes as the center node 16, and determines the weight of the edge between the center node 16 and each of the other hub nodes as the distance calculated on the graph data 13. can be considered. Central nodes 16 may select among hub nodes based on the distance between hub nodes, such as proximity centrality.

For example, the processing unit 12 adds a new core node 16 to the core node set 15 . The processing unit 12 deletes 10 edges between the nodes A, B, C, D, and E belonging to the core node set 15, and instead adds 10 edges between the central node 16 and the nodes A, B, C, D, and E. Add 5 edges. In the graph data 14 generated in this manner, the nodes A, B, C, D, and E belonging to the core node set 15 are maintained. Also, the edge between node C in core node set 15 and nodes F and G outside core node set 15 is maintained, and the edge between node E in core node set 15 and node H outside core node set 15 is maintained. be done.

The processing unit 12 may use the graph data 14 to perform search processing such as route search. For example, the processing unit 12 may search for a route from node F outside the core node set 15 to node H outside the core node set 15 . The path to be searched may pass through core node set 15 . However, multiple hub nodes belonging to the core node set 15 are expected to be closely connected to each other, and there is little need to strictly search for routes within the core node set 15 . On the other hand, even if the core node set 15 is simplified into a star shape, the connection relationship between hub nodes belonging to the core node set 15 and nodes outside the core node set 15 is maintained. Therefore, two nodes outside the core node set 15 can be distinguished between being connected to the same hub node and being connected to different hub nodes. Therefore, performing search processing using the graph data 14 is useful from the viewpoint of efficiency and accuracy.

According to the information processing apparatus 10 of the first embodiment, a plurality of hub nodes are detected from the graph data 13, and a core node set 15 including two or more hub nodes connected by edges is determined. Then, a central node 16 is set based on the distance between hub nodes belonging to the core node set 15, and graph data 14 is generated in which hub nodes belonging to the core node set 15 other than the central node 16 and the central node 16 are connected in a star shape. be done.

Accordingly, by performing search processing such as route search using the graph data 14, the amount of calculation can be reduced more than when the graph data 13 is used. In addition, compared to the case of extreme simplification such as replacing the core node set 15 with one node, information about the connection relationship between hub nodes in the core node set 15 and nodes outside the core node set 15 is greatly lost. can be suppressed. Therefore, the influence on the accuracy of search processing can be reduced.

[Second embodiment]
Next, a second embodiment will be described.
The analysis device of the second embodiment analyzes the risk of fraudulent transactions that may occur between people and companies using a company network, which is a graph representing relationships between people and companies. . The analysis device of the second embodiment is also called an information processing device or a computer. The analysis device may be a client device or a server device.

FIG. 2 is a block diagram showing an example of hardware of an analysis device according to the second embodiment.
The analyzer 100 has a CPU 101, a RAM 102, an HDD 103, an image signal processor 104, an input signal processor 105, a medium reader 106, and a communication interface 107 connected to a bus. The analysis device 100 corresponds to the information processing device 10 of the first embodiment. A CPU 101 corresponds to the processing unit 12 of the first embodiment. A RAM 102 or HDD 103 corresponds to the storage unit 11 of the first embodiment.

The CPU 101 is a processor that executes program instructions. The CPU 101 loads at least part of the programs and data stored in the HDD 103 into the RAM 102 and executes the programs. Note that the CPU 101 may include multiple processor cores, and the analysis device 100 may include multiple processors. A collection of multiple processors is sometimes called a "multiprocessor" or simply a "processor."

The RAM 102 is a volatile semiconductor memory that temporarily stores programs executed by the CPU 101 and data used by the CPU 101 for calculation. Note that the analysis device 100 may be provided with a type of memory other than the RAM, and may be provided with a plurality of memories.

The HDD 103 is a nonvolatile storage that stores an OS (Operating System), software programs such as middleware and application software, and data. Note that the analysis device 100 may include other types of storage such as flash memory and SSD (Solid State Drive), or may include multiple storages.

The image signal processing unit 104 outputs an image to the display 111 connected to the analysis device 100 according to commands from the CPU 101 . As the display 111, any type of display such as a CRT (Cathode Ray Tube) display, a liquid crystal display (LCD: Liquid Crystal Display), an organic EL (OEL: Organic Electro-Luminescence) display, or the like can be used.

The input signal processing unit 105 receives input signals from the input device 112 connected to the analysis device 100 . Input device 112 can be any type of input device, such as a mouse, touch panel, touchpad, keyboard, or the like. Also, multiple types of input devices may be connected to the analyzer 100 .

The medium reader 106 is a reading device that reads programs and data recorded on the recording medium 113 . Examples of the recording medium 113 include magnetic disks such as flexible disks (FDs) and HDDs, optical disks such as CDs (Compact Discs) and DVDs (Digital Versatile Discs), magneto-optical disks (MOs), A semiconductor memory or the like can be used. The medium reader 106 stores programs and data read from the recording medium 113 in the RAM 102 or the HDD 103, for example.

The communication interface 107 is connected to the network 114 and communicates with other information processing apparatuses via the network 114 . The communication interface 107 may be a wired communication interface connected to a wired communication device such as a switch or router, or a wireless communication interface connected to a wireless communication device such as a base station or access point.

Next, the corporate network will be explained.
FIG. 3 is a diagram showing an example of relationship analysis of a corporate network.
The enterprise network 30 is an undirected or directed graph that includes multiple nodes and multiple edges connecting between the nodes. However, the second embodiment assumes an undirected graph. Each node included in enterprise network 30 represents a person or enterprise. Each edge included in enterprise network 30 represents a relationship between enterprises or a relationship between a person and an enterprise.

The corporate network 30 can be generated from public investment information disclosed by public databases such as EDINET (Electronic Disclosure for Investor's Network) and TDNET (Timely Disclosure Network). Companies represented by nodes include operating companies such as stock companies and equity companies, institutional investors investing in operating companies, and auditing firms that audit operating companies. Persons represented by nodes include directors, executive officers, auditors, and other executives engaged in operating companies, as well as individual investors investing in operating companies. Relationships between companies represented by edges include group relationships such as parent-subsidiary relationships and affiliated company relationships, investment in operating companies by institutional investors, audits of operating companies by auditing firms, and other important business relationships. . The relationship between a person and a company represented by an edge includes the appointment of a director of a business company, an investment in a business company by a private investor, and other significant business relationships between a business company and an individual.

A corporate network 30 is a large-scale graph containing tens of thousands to hundreds of thousands of nodes. The analysis device 100 uses the corporate network 30 to perform relationship analysis. Relationship analysis detects sensitive relationships that may lead to fraudulent transactions such as insider trading and money laundering. For the relationship analysis, the analysis device 100 searches the corporate network 30 for a route connecting two nodes via one or more other nodes. A path may represent a sequential business relationship involving three or more entities. At this time, not only short routes (obvious routes) that pass through nodes with many edges, such as nodes representing institutional investors and nodes representing audit firms, but also long routes that bypass nodes with many edges ( It is preferable to search for routes that are not taken for granted. This makes it possible to discover relationships with a high risk of fraud, such as one company influencing the other company through its executives.

As an example, corporate network 30 includes node 31 representing company C1, node 32 representing company C2, node 33 representing company C3, node 34 representing institutional investor I, and node 35 representing executive K. There are edges between nodes 31 and 34 , nodes 31 and 33 , nodes 32 and 34 , nodes 32 and 35 , and nodes 33 and 35 .

The edge between nodes 31 and 34 represents an investment by institutional investor I in firm C1. The edge between nodes 32 and 34 represents an investment by institutional investor I in firm C2. Therefore, the route from node 31 to node 32 via node 34 is a "natural route" and is of relatively low importance in analyzing the relationship between company C1 and company C2. On the other hand, the route from the node 31 to the node 32 via the nodes 33 and 35 is an "unobvious route". Since there is a risk of fraudulent transactions being carried out due to the influence of officer K on companies C2 and C3, the importance of relationship analysis between companies C1 and C2 is relatively high.

In order to facilitate the discovery of “unobvious routes”, the analysis device 100 performs a degree-weighted route search for the corporate network 30 .
Assume that a weight w(e) is assigned to an edge e included in an undirected graph. It is also assumed that a certain route passes through h+1 nodes of nodes v ₀ , v ₁ , . . . , v _h in order. Node _v0 is the starting node s and node _vh is the ending node t. _{Let k} = ₁ , 2, . Then, the length of the path (path length) is defined as in Equation (1).

When weight w(v) is assigned to node v included in the undirected graph, weight w(e) of edge e can be calculated from weight w(v) of node v. Node v _i and node v _j are connected by edge e _i,j , node v _i is assigned weight w(v _i ), and node v _j is assigned weight w(v _j ) and Then, the weight w(e _i,j ) of the edge e _i,j is defined as Equation (2). That is, the weight of an edge is the average of the weights of the nodes at both ends of that edge.

In the degree-weighted route search, the number of edges connected to the node v, ie, the degree deg(v) of the node v, is used as the weight w(v) of the node v. Suppose that nodes v _i and v _j are connected by an edge e _i,j , the degree of node v _i is deg(v _i ), and the degree of node v _j is deg(v _j ). Then, the weight w(e _i,j ) of the edge e _i,j is defined as Equation (3). That is, the weight of an edge is the average degree of the nodes at both ends of the edge.

In order-weighted route search, the length of a route passing through a node with a large order such as a node representing an institutional investor or a node representing an audit firm is calculated to be large. Therefore, by combining a route search with degree weight and a route search algorithm that preferentially searches for short routes, it becomes easier to discover not only "obvious routes" but also "abnormal routes". Therefore, in the second embodiment, a route search with an order weight is adopted.

FIG. 4 is a diagram showing an example of the shape of a corporate network.
Corporate networks representing relationships between people and companies often take the form shown in FIG. Corporate network 40 includes core 41 and perimeter 42 .

The core 41 is a connected subgraph (a subgraph in which there is a path connecting any two nodes) in which many hub nodes are tightly coupled. A hub node is a node whose degree exceeds a threshold among the nodes included in the corporate network 40 . The hub node is assumed to be a node representing a hub company having relationships with many other companies, such as a node representing an institutional investor or a node representing an audit firm. A few percent to several tens of percent of the nodes included in the corporate network 40 may belong to the core 41 . In FIG. 4, the hub nodes belonging to the core 41 are arranged on the outer circumference of the circle.

Periphery 42 is a subgraph formed from peripheral nodes that are each connected by edges to only a few other nodes. Periphery 42 may include two layers. Nodes belonging to the first layer of the peripheral part 42 are connected to a small number of hub nodes belonging to the core 41 by edges. However, nodes belonging to the first layer may be directly connected to each other. Nodes belonging to the first hierarchy are assumed to represent general business companies that have relationships with hub companies such as institutional investors and audit firms. Nodes belonging to the second layer of the peripheral portion 42 are connected by edges to a small number of hub nodes belonging to the core 41 and a small number of peripheral nodes belonging to the first layer of the peripheral portion 42 . As a node belonging to the second hierarchy, a node representing a person such as an executive is assumed.

FIG. 5 is a distribution diagram showing a characteristic example of a corporate network.
The scatter diagram 50 represents the relationship between the degrees of nodes included in the corporate network 40 and the relative frequencies of the nodes. The horizontal axis of the scatter diagram 50 is a logarithmic representation of the degree of a node, that is, the number of edges connected to the node. The vertical axis of the scatter diagram 50 is the logarithmic representation of the appearance frequency of nodes with a certain degree, that is, the ratio of nodes with a certain degree to all nodes. Scatter diagram 50 includes area 51 and area 52 .

Region 51 corresponds to perimeter 42 of enterprise network 40 . As indicated by region 51, peripheral portion 42 can be said to have the characteristics of a scale-free network. A scale-free network is a network characterized in that most nodes have edges with only a few partners, and some nodes have edges with many partners.

Region 52 , on the other hand, corresponds to core 41 of enterprise network 40 . As indicated by region 52, core 41 can be said to have the characteristics of a random graph. A random graph is a graph in which an edge is drawn between any two nodes with a certain probability p. The relationship between the degree and relative frequency of nodes included in the random graph follows the Poisson distribution.

The analysis apparatus 100 preferentially searches for a plurality of routes from the corporate network having such characteristics by order-weighted route search in order of shortest route length.
FIG. 6 is a diagram showing an example of route search.

A route search algorithm such as the Dijkstra method or the two-way Dijkstra method can be applied to the route search. However, in the second embodiment, not only the shortest route with the shortest route length, but also other routes that are not the shortest route are searched. Therefore, we use a route search algorithm capable of searching multiple routes, such as an extension of the pure Dijkstra algorithm.

For example, when updating the information indicating the path length from the starting node and the preceding node for each node according to the Dijkstra algorithm, not only the information with the minimum path length but also the information with the non-minimum path length are left as history. Then, a plurality of patterns of information of the next-level node are created using the information that the path length is not the minimum. As information for each node, up to a predetermined number of pieces of information from the shortest path length are held. As a result, it is possible to search not only the shortest path but also the semi-shortest path with a relatively small path length as the path from the start node to the end node.

As an example, graph 70 includes nodes 71-77 (nodes a, b, c, d, e, f, g). There is an edge of weight 1 between node 71 and node 72 . There is an edge of weight 7 between nodes 71 and 73 . There is an edge of weight 2 between nodes 71 and 74 . There is an edge of weight 4 between nodes 72 and 75 . There is an edge of weight 2 between nodes 73 and 75 . Between nodes 73 and 76 there is an edge of weight 3; Between nodes 74 and 76 there is an edge of weight 5; There is an edge of weight 6 between nodes 75 and 77 . Between nodes 76 and 77 there is a weight 2 edge.

It is assumed that a route search is performed according to Dijkstra's algorithm, with the node 71 as the start node and the node 77 as the end node. First, node 71 is selected and a label of length 0 is assigned to node 71 . Then, the node 72 is given a label of length 1 and preceding node a, the node 73 is given a length of 7 and a label of preceding node a, and the node 74 is given a length of 2 and preceding node a. No label is given.

Next, the node 72 with the smallest path length is selected. Then, node 75 is given a label of length 5 and preceding node b. Next, the node 74 with the smallest path length is selected. Then, the node 76 is given a label of length 7 and the preceding node d. Next, the node 75 with the smallest path length is selected. Then, the length 7 and the label of the preceding node e are added to the node 73 while the length 7 and the label of the preceding node a are left. Also, the label of the length 11 and the preceding node e is given to the node 77 .

Now assume that node 73 is selected as the node with the smallest path length. Then, a label of length 10 and preceding node c is added to node 76 corresponding to the first label of node 73 . Also, corresponding to the second label of node 73, a label of length 10 and preceding node c is added. At this time, the length is 7 and the label of the preceding node d is left. Next, the node 76 with the minimum path length is selected. Then, a label of length 9 and preceding node f is added to node 77 corresponding to the first label of node 76 . Also, corresponding to the second label of node 76, a label of length 12 and preceding node f is added. Also, corresponding to the third label of node 76, a label of length 12 and preceding node f is added. At this time, the length 11 and the label of the preceding node e are left.

As a result, the shortest route of length 9 is extracted as the route following the nodes 71 , 74 , 76 and 77 in order. Also, a path that follows the nodes 71, 72, 75, and 77 in order is extracted as a path of length 11. FIG. Also, the path that follows the nodes 71, 72, 75, 73, 76, and 77 in order is extracted as a path of length 12. FIG. Also, the path that follows the nodes 71, 73, 76, and 77 in order is extracted as a path of length 12. FIG. In this way, it is possible to search up to a predetermined number of routes from the graph 70 preferentially in ascending order of route length.

Next, the problem of route search in corporate networks will be described.
In the above-described fraud investigation using the corporate network 40 of FIG. For example, there is a case where it is desired to comprehensively search for a route from a node representing a person to a node representing another person, which is not extremely detoured. Some paths to be searched do not pass through the core 41 . For example, there may be a path from the start node to the end node via nodes representing one or more general business companies. On the other hand, some routes to be searched pass through the core 41 . For example, there may be a path from a starting node through nodes representing one or more hub companies to an ending node.

However, since the hub nodes are densely connected within the core 41 and there are many selection patterns of hub nodes to pass through, there is a problem that the amount of calculation for searching for a route passing through the core 41 becomes large. On the other hand, in fraud investigations using the corporate network 40, it is "natural" that the hub nodes in the core 41 are interconnected, so it is very important which nodes are routed in the peripheral part 42. It is less important which node is passed through in the core 41 of the object. That is, there is little need to perform a rigorous search within core 41 . Therefore, the analysis device 100 simplifies the core 41 of the enterprise network 40 and performs route search using the simplified enterprise network to reduce the amount of calculation.

However, an extreme simplification, such as replacing the core 41 with a single virtual node, may result in a large loss of information about the relationship between the core 41 and the periphery 42 that the corporate network 40 had. be. For example, one node of the periphery 42 and another node of the periphery 42 may be connected to different hub nodes of the core 41 . Also, one node in the peripheral part 42 and another node in the peripheral part 42 may be connected to the same hub node of the core 41 . Replacing the core 41 with one virtual node equates the above two cases. This equates the case where two or more executives or general operating companies have relationships with the same hub company and the case where two or more executives or general operating companies have relationships with different hub companies. As a result, there is a problem that the accuracy of route search is lowered.

Therefore, the analysis device 100 generates a corporate network in which the core 41 is simplified by reducing the edges included in the core 41 while leaving the hub nodes belonging to the core 41 . A simplified corporate network includes a star-shaped core.

FIG. 7 is a diagram showing a simplified example of a corporate network.
Enterprise network 60 is a simplified version of enterprise network 40 . Corporate network 60 includes core 61 and perimeter 62 . Core 61 corresponds to core 41 of enterprise network 40 and perimeter 62 corresponds to perimeter 42 of enterprise network 40 .

Core 61 contains the same hub nodes as core 41 . Core 61 also includes central node 63 . The central node 63 may be a new node not included in the core 41 or any one hub node included in the core 41 . In core 61, the edges between hub nodes included in core 41 are deleted. Instead, in the core 61, the set central node 63 and each hub node are directly connected by edges to form a star subgraph.

Perimeter 62 is similar to perimeter 42 . Nodes belonging to the periphery 62 and hub nodes belonging to the core 61 are connected by edges similar to the corporate network 40 . However, if the central node 63 is one of the hub nodes belonging to the core 41, the edges between the central node 63 and the nodes belonging to the periphery 62 are deleted. That is, the core node 63 is connected only to the hub nodes belonging to the core 61 and not to the nodes belonging to the periphery 62 .

When the center node 63 is a new node, the analysis device 100 unifies the weights of the edges between the center node 63 and hub nodes belonging to the core 61 to a constant value.
Specifically, the analysis device 100 calculates the average path length (distance) of the shortest path between hub nodes belonging to the core 41 before simplification. At this time, as the shortest route between hub nodes belonging to the core 41, a route that follows only the edges connecting the hub nodes may be searched, and the route via the peripheral portion 42 need not be considered. The analysis device 100 may calculate the distances for all combinations of hub nodes and obtain an actual average value. Further, the analysis device 100 may sample some combinations of hub nodes from the core 41, calculate the distances of only the sampled combinations, and obtain an estimated average value. The analysis device 100 takes half of the calculated average value as the weight of the edge between the center node 63 and each hub node. This allows the average distance between hub nodes to pass through the core 61 .

On the other hand, if the central node 63 is one of the existing hub nodes, the analysis device 100 selects any one hub node from among the cores 41 as the central node 63 . Analysis device 100 then sets the weight of the edge between central node 63 and each of the other hub nodes to the distance between the two nodes in core 41 .

Specifically, the analysis device 100 calculates proximity centrality as an index representing centrality for each hub node belonging to the core 41 . Closeness centrality is a measure of how close a node is to the center of the graph in relation to other nodes. Let v _i be the node of interest, v _j be another node, and d(v _i , v _j ) be the distance between node v _i and v _j . Then, the proximity centrality C _c (v _i ) of node v _i is defined as Equation (4). The proximity centrality C _c (v _i ) in Equation (4) is the reciprocal of the sum of distances to other nodes. However, it is also possible to define the closeness centrality C _c (v _i ) of node v _i as shown in Equation (5), where n is the number of nodes. The proximity centrality C _c (v _i ) in Equation (5) is the reciprocal of the average distance between other nodes.

The analysis device 100 selects the hub node with the maximum proximity centrality from the core 41 as the central node 63 . As the weight of the edge between the central node 63 and another hub node of the core 61, the distance between the two hub nodes calculated when obtaining the close centrality may be used. Therefore, in the case of using the central node 63 as a new node, the weights of the edges included in the core 61 are unified to a constant value, whereas in the case of using the central node 63 as one of the existing hub nodes, the core 61 Contained edges do not have uniform weights.

In the method in which the central node 63 is one of the existing hub nodes, each of the multiple edges included in the core 61 has a different weight considering the relationship between hub nodes of the core 41 . Therefore, the personality of the hub node of the core 41 can be reflected in the core 61, and the accuracy of route search using the corporate network 60 can be improved. On the other hand, in the method of setting the center node 63 as a new node, processing for selecting the center node 63 such as calculation of proximity centrality is reduced. Moreover, it is possible to estimate the average value of the distances between hub nodes by sampling, and it is also possible to reduce the distance calculation between hub nodes.

Next, functions and processing procedures of the analyzer 100 will be described.
FIG. 8 is a block diagram showing an example of functions of the analyzer.
The analysis device 100 has a graph data storage unit 121 , a connection information generation unit 122 , a connection information storage unit 123 , a route search unit 124 and a search result display unit 125 . The graph data storage unit 121 and the connection information storage unit 123 are implemented using storage areas of the RMA 102 or the HDD 103, for example. The connection information generation unit 122, the route search unit 124, and the search result display unit 125 are implemented using programs executed by the CPU 101, for example.

The graph data storage unit 121 stores graph data representing a corporate network before simplification. Graph data is generated from public investment information disclosed by public databases such as EDINET and TDNET. The graph data may be generated by the analysis device 100 or by another information processing device. The graph data includes multiple nodes, each representing a person or company, and multiple edges, representing relationships between the people or companies. Edge weights are automatically calculated from the graph data in the connection information generator 122 .

The connection information generation unit 122 generates connection information indicating connection relationships between nodes from the graph data stored in the graph data storage unit 121 . Connection information is expressed as an adjacency matrix. At this time, the connection information generating unit 122 calculates the degree of each node as a weight, and uses the weight of each node to calculate the weight of each edge connecting the nodes.

In generating the connection information, the connection information generation unit 122 receives option information including a simplification flag and a degree threshold from the user. The simplification flag is a flag indicating whether or not to simplify the corporate network. The degree threshold is a parameter applied when simplifying a corporate network, and is a threshold for the degree of a node regarded as a hub node. When the simplification flag is OFF, the connection information generator 122 outputs the original adjacency matrix corresponding to the corporate network before simplification indicated by the graph data. On the other hand, if the simplification flag is ON, the connection information generation unit 122 converts the unsimplified corporate network into a simplified corporate network, and outputs a simplified adjacency matrix corresponding to the simplified corporate network. do.

The connection information storage unit 123 stores connection information generated by the connection information generation unit 122 . When the simplification flag is OFF, the connection information storage unit 123 stores the original adjacency matrix corresponding to the corporate network before simplification. When the simplification flag is ON, the connection information storage unit 123 stores a simplified adjacency matrix corresponding to the corporate network after simplification. Once connection information is generated, route searches can be repeatedly executed using the generated connection information.

The route search unit 124 uses the connection information stored in the connection information storage unit 123 to search for routes on the corporate network. When searching for a route, the route searching unit 124 receives from the user option information including a start node, an end node, the number of routes to be output, and a flag indicating whether or not to consider weights. Then, the route search unit 124 searches for a plurality of routes from the start node to the end node, preferentially starting from the route having the shortest route length, using a route search algorithm based on Dijkstra's algorithm. When the flag indicating whether or not to consider the weight is OFF, the route search unit 124 considers the weight of each edge to be 1 regardless of the weight indicated by the connection information, and performs the route search. When the flag indicating whether or not to consider the weight is ON, the route search unit 124 performs route search based on the weight indicated by the connection information.

A search result display unit 125 displays the search result of the route search unit 124 on the display 111 . For example, the search result display unit 125 displays a corporate network including a plurality of nodes and a plurality of edges as graphic information, and highlights the searched route on the corporate network, such as by using a thick line. Further, for example, the search result display unit 125 expresses a route with a character string listing nodes to be passed through, and displays a list in which a plurality of character strings representing a plurality of routes are arranged. Further, the search result display unit 125 may store the search result in a storage such as the HDD 103, may transmit the search result to another information processing apparatus via the network 114, or may transmit the search result to another information processing apparatus possessed by the analysis apparatus 100. You may make it output to a device.

FIG. 9 is a diagram showing an example of graph data.
A node table 131 indicates the nodes included in the corporate network. The node table 131 is stored in the graph data storage unit 121. FIG. The node table 131 includes items of node ID, node name and weight. A node ID is an identifier that identifies a node. A node name is a character string representing the meaning of a node, such as a person's name or company name. The weight is the degree of the node calculated by the connection information generator 122 .

Edge table 132 shows the edges involved in the corporate network. The edge table 132 is stored in the graph data storage unit 121. FIG. The edge table 132 includes items of edge ID, start point, end point and weight. An edge ID is an identifier that identifies an edge. A starting point is an identifier that identifies a node at one end of an edge. An endpoint is an identifier that identifies a node at the other end of an edge. The weight is the edge weight calculated from the weights of the nodes at both ends by the connection information generating unit 122 .

FIG. 10 is a diagram showing an example of connection information.
The adjacency matrix 133 is connection information indicating edges existing between nodes included in the corporate network. The adjacency matrix 133 is stored in the connection information storage unit 123 . When the simplification flag is designated as OFF at the time of generation, the adjacency matrix 133 stored in the connection information storage unit 123 is the original adjacency matrix corresponding to the corporate network before simplification. If the simplification flag is set to ON at the time of generation, the adjacency matrix 133 stored in the connection information storage unit 123 is a simplified adjacency matrix corresponding to the corporate network after simplification.

Rows of adjacency matrix 133 are associated with node IDs that identify nodes included in the corporate network. Similarly, the columns of adjacency matrix 133 are associated with node IDs that identify nodes included in the corporate network. One element of the adjacency matrix 133 indicates the weight of an edge existing between the node corresponding to the row number of the element and the node corresponding to the column number of the element. An element value of 0 indicates that no edge exists. The connection information generator 122 first generates an original adjacency matrix representing the corporate network before simplification. When the simplification flag is designated to be ON, the connection information generating unit 122 generates a simplified adjacency matrix indicating the corporate network after simplification by updating the original adjacency matrix.

Next, simplification of the corporate network by the connection information generation unit 122 will be described. A first method of adding a new node to a core as a central node is first described, and then a second method of selecting one of the existing hub nodes among the cores as the central node is described.

FIG. 11 is a flow chart showing an example procedure for graph simplification.
(S10) The connection information generation unit 122 reads from the graph data storage unit 121 graph data generated in advance based on public investment information disclosed by EDINET or TDNET. Also, the connection information generation unit 122 reads option information input by the user. Optional information includes a simplification flag and a degree threshold.

(S11) Based on the graph data, the connection information generator 122 counts the edges connected to each node and calculates the degree of each node as a weight (degree weight). The connection information generation unit 122 calculates the weight of each edge by averaging the weights of the nodes at both ends of the edge.

(S12) The connection information generation unit 122 generates an original adjacency matrix indicating the corporate network before simplification. The number of rows and the number of columns of the original adjacency matrix are the number of nodes indicated by the graph data. Elements of the original adjacency matrix are edge weights calculated in step S11.

(S13) The connection information generator 122 determines whether the simplification flag included in the option information read in step S10 is ON. If the simplification flag is ON, the process proceeds to step S14, and if the simplification flag is OFF, the process proceeds to step S21.

(S14) Based on the graph data or the original adjacency matrix, the connection information generation unit 122 extracts a node whose degree is greater than the threshold as a hub node from the enterprise network. The threshold used here is the order threshold included in the option information read in step S10.

(S15) The connection information generator 122 extracts a connected subgraph in which two or more hub nodes are connected by edges. A connected subgraph can be identified, for example, by extracting only the rows and columns corresponding to hub nodes from the original adjacency matrix. At this time, two or more discontinuous connected subgraphs may be extracted. The connection information generation unit 122 determines that the extracted connected subgraph with the largest number of hub nodes is the core.

(S16) The connection information generator 122 calculates the average distance between hub nodes belonging to the core. For example, the connection information generation unit 122 uses each hub node belonging to the core as a starting node and calculates the distance to other hub nodes by a route search algorithm such as the Dijkstra method. The connection information generation unit 122 may exhaustively calculate the distances of all hub node pairs belonging to the core and obtain an average value. Also, the connection information generator 122 may obtain an estimate of the average distance by sampling several sets of hub nodes belonging to the core.

(S17) The connection information generator 122 adds a new core node to the core. For example, the connection information generator 122 adds one row and one column to the adjacency matrix.
(S18) The connection information generator 122 deletes edges between hub nodes within the core, that is, edges from a hub node within the core to another hub node within the core. For example, among the elements included in the adjacency matrix, the connection information generation unit 122 rewrites the values of elements having row numbers corresponding to hub nodes in the core and column numbers corresponding to hub nodes in the core to zero. The connection information generating unit 122 then adds edges between each hub node and the central node in the core. The edge to be added is an element in the adjacency matrix with the row number corresponding to the central node and the column number corresponding to the hub node in the core, and the row number corresponding to the hub node in the core and the column number corresponding to the central node. corresponds to an element with

(S19) The connection information generator 122 sets weights for the edges added in step S18. The weight of the added edge is half the average distance calculated in step S16. For example, the connection information generating unit 122 sets the value of the element corresponding to the additional edge identified in step S18 among the elements included in the adjacency matrix to half the average distance.

(S20) The connection information generation unit 122 outputs the simplified adjacency matrix generated through steps S14 to S20 to the connection information storage unit 123. FIG. Then the graph simplification ends.
(S21) The connection information generation unit 122 outputs the original adjacency matrix generated in step S12 to the connection information storage unit 123. FIG.

FIG. 12 is a flowchart showing another procedure example of graph simplification.
Since the processes of steps S30 to S35, S40 and S41 are the same as those of steps S10 to S15, S20 and S21 of FIG. 11, description thereof will be omitted.

(S36) The connection information generator 122 calculates the proximity centrality of each hub node belonging to the core. For example, the connection information generation unit 122 uses each hub node belonging to the core as a starting node and calculates the distance to other hub nodes by a route search algorithm such as the Dijkstra method. For example, the connection information generation unit 122 calculates, for each hub node, the reciprocal of the sum of distances to other hub nodes or the reciprocal of the average distance as proximity centrality.

(S37) The connection information generating unit 122 selects the hub node and central node having the maximum proximity centrality calculated in step S36 from the hub nodes in the core.
(S38) The connection information generator 122 deletes the edge between the hub nodes within the core, that is, the edge from the hub node within the core to another hub node within the core. The connection information generator 122 then adds edges between the center node selected in step S37 and other hub nodes within the core. The edges to be added are elements in the adjacency matrix that have the row number corresponding to the central node and the column number corresponding to the other hub node, and the elements that have the row number corresponding to the other hub node and the column number corresponding to the central node. corresponds to

(S39) The connection information generator 122 sets weights for the edges added in step S38. The weight of the added edge is the distance between hub nodes at both ends of the edge. This distance is a distance calculated based on the connection relationship of the corporate network before simplification, and the distance calculated in the process of obtaining the close centrality in step S36 can be used. For example, the connection information generation unit 122 sets the value of the element corresponding to the additional edge identified in step S38 among the elements included in the adjacency matrix to the distance according to the nodes at both ends.

According to the analysis apparatus 100 of the second embodiment, a hub node with a large degree is detected from a corporate network, and a core connecting a plurality of hub nodes is detected. A central node is set in the core, and the corporate network is simplified to form a star core in which hub nodes belonging to the core are connected via the core. This reduces the amount of computation for finding a route through the core and speeds up the route finding on the corporate network. Also, compared to extreme simplification such as replacing the core with one virtual node, the hub node belonging to the core is not deleted, and the information on the connection relationship between the hub node belonging to the core and the peripheral node belonging to the periphery is lost. maintained. Therefore, it is possible to suppress a decrease in route search accuracy.

REFERENCE SIGNS LIST 10 information processing device 11 storage unit 12 processing unit 13, 14 graph data 15 core node set 16 central node

Claims (6)

the computer
obtaining graph data including a plurality of nodes and a plurality of edges connecting the nodes;
detecting, from among the plurality of nodes indicated by the graph data, a plurality of hub nodes each having a number of connected edges greater than a threshold value, and a core node including three or more hub nodes connected by edges among the plurality of detected hub nodes; determine the set,
Based on the distance between each hub node belonging to the core node set and other hub nodes belonging to the core node set, a core node is selected from hub nodes belonging to the core node set, and belonging to the core node set other than the core node set. generating other graph data including edges connecting hub nodes belonging to the core node set other than the central node and the central node instead of the edges connecting the hub nodes;
Graph simplification method. In setting the core node, the hub node belonging to the core node set other than the core node and the core node are connected based on the distance between the core node and the hub node belonging to the core node set other than the core node. determine the edge weight,
The graph simplification method of claim 1 . searching for a path between a first node that does not belong to the core node set and a second node that does not belong to the core node set based on the other graph data;
The graph simplification method of claim 1. at least some of the plurality of nodes are indicative of an enterprise;
at least a portion of the plurality of edges are indicative of relationships between companies;
The plurality of hub nodes indicate hub companies with which there are more other companies with which they have a relationship than the companies indicated by the nodes other than the plurality of hub nodes,
The graph simplification method of claim 1. to the computer,
obtaining graph data including a plurality of nodes and a plurality of edges connecting the nodes;
detecting, from among the plurality of nodes indicated by the graph data, a plurality of hub nodes each having a number of connected edges greater than a threshold value, and a core node including three or more hub nodes connected by edges among the plurality of detected hub nodes; determine the set,
Based on the distance between each hub node belonging to the core node set and other hub nodes belonging to the core node set, a core node is selected from hub nodes belonging to the core node set, and belonging to the core node set other than the core node set. generating other graph data including edges connecting hub nodes belonging to the core node set other than the central node and the central node instead of the edges connecting the hub nodes;
A graph simplification program that does the work. a storage unit that stores graph data including a plurality of nodes and a plurality of edges connecting the nodes;
detecting, from among the plurality of nodes indicated by the graph data, a plurality of hub nodes each having a number of connected edges greater than a threshold value, and a core node including three or more hub nodes connected by edges among the plurality of detected hub nodes; determining a set , selecting a core node from hub nodes belonging to the core node set based on the distance between each hub node belonging to the core node set and other hub nodes belonging to the core node set; a processing unit that generates other graph data including edges connecting hub nodes belonging to the core node set other than the core node and the core node instead of the edges connecting the hub nodes belonging to the core node set;
Information processing device having

Images