TWI662421B - Community division method and device based on feature matching network - Google Patents

Abstract

The invention belongs to the field of data processing, in particular to a method and device for classifying communities based on a feature matching network, and is used for classifying communities. In the embodiment of the present invention, according to the preset K hash functions, a K-bit hash vector corresponding to each account information is determined; the hash vector corresponding to each account information is sequentially divided into m = K / k sub-hash vectors. ; For each class, divide the account information with the same sub-hash vector into the same group; calculate the similarity between the account information in the same group; if the similarity between the account information is greater than the threshold, the account information is An interconnection edge is established between them to form a feature matching network. According to the feature matching network, the account information is divided into communities, and the community analysis can be performed according to the divided communities to find abnormal communities.

Description

   Community division method and device based on feature matching network   

The invention belongs to the field of data processing, in particular to a method and a device for classifying communities based on a feature matching network.

At present, the domestic credit card market is facing an increasingly serious risk situation, and cases of credit card cashing, counterfeit card fraud, and card theft are increasing. Specifically, credit card cashing refers to cardholders obtaining cash through false consumption transactions or collusion with merchants to swipe their cards. Refunds or purchases of goods that are easy to realise and then sell them for cash, counterfeit card fraud refers to the fraudulent behavior of writing a magnetic card in accordance with the magnetic stripe information format of a bank card, embossing or lithography to forge a real and valid bank card for transactions; card theft Fraud refers to an act where a fraudster obtains some or all of the information of a real cardholder and impersonates the real cardholder to change the account information to achieve the purpose of fraud. The method of credit card crime is constantly developing towards high technology, groupization, and professionalization. The case implementation process is more hidden and the methods are constantly being renovated. This poses a threat to the safety of banks and cardholders' funds and has become an important factor restricting the long-term healthy development of the credit card industry.

Faced with a variety of fraud methods, in the prior art, a clustering method is usually used to deal with it. However, this method has various disadvantages. For example, on the one hand, if subsequent data is added to the anti-fraud model, the anti-fraud model will be affected. Updating the data causes difficulties. On the other hand, after clustering, although the nodes can be divided into several categories, the structure within the group and the relationships between the structures are still difficult to describe.

To sum up, there is a problem in the prior art that if subsequent data is added to the anti-fraud model, it is difficult to update the data of the anti-fraud model; after clustering, the structure within the group and the relationship between the structures are still difficult to describe. Therefore, Effective measures are needed to solve the above problems.

Embodiments of the present invention provide a method and a device for dividing a community based on a feature matching network, which are used to solve the existing problems in the prior art. The structure of the structure and the relationships between the structures remain difficult to describe.

An embodiment of the present invention provides a community division method based on a feature matching network, which includes: determining a K-bit hash vector corresponding to each account information according to preset K hash functions; and assigning a hash vector corresponding to each account information, The order is divided into m = K / k sub-hash vectors; for each class, the account information with the same sub-hash vector is divided into the same group; the similarity between each account information in the same group is calculated; If the similarity between them is greater than the threshold, an interconnection edge is established between each account information to form a feature matching network; according to the feature matching network, each account information is divided into communities.

Optionally, calculating the similarity between the account information in the same group includes: If the i-th account information and the j-th account information are in the same n-type group, n / m is used as the i-th account information and the j-th account information Similarity between account information; the i-th account information and the j-th account information are any of the account information.

Optionally, calculating the similarity between the account information in the same group includes: if the i-th account information and the j-th account information are in the same group, counting the hash vector of the i-th account information and the hash of the j-th account information The number h in the vector that is the same bit and has the same hash vector value; the i-th account information and the j-th account information are any of the account information; the similarity between the i-th account information and the j-th account information s = h / K .

Optionally, determining the K-bit hash vector corresponding to each account information according to the preset K hash functions includes: determining the K-bit hash vector H ( ); Where 2 ' b represents H ( ) Is a binary number, h _i ( ) Is one of the preset K hash functions, Feature vector representing account information, where, , C ₁ , c ₂ …, c _d represent the characteristic attributes of account information, Represents a randomly selected non-zero vector, .

Optionally, grouping the account information according to the feature matching network includes: (1) dividing each account information into different communities in the feature matching network; (2) based on the similarity between the account information Degree, calculate the similarity strength of each account information, thereby generating a node similarity strength matrix; (3) for each account information, from the row where the account information is located in the node similarity strength matrix, try in the order of similarity strength from large to small Assign the account information to other communities; if the module information difference from the p-th cell to the q-th cell is positive, the account information is divided into the q-th cell and the process ends; (4) Repeat until The cell structure no longer changes.

Optionally, calculating the similarity strength of each account information according to the similarity between each account includes: calculating the similarity strength s _{i, j} between the i-th account information and the j-th account information according to formula (2); Among them, Γ ( i ) represents the neighbor set of the i-th account information, Γ ( i ) ∩Γ ( j ) represents the common neighbor set of the i-th account information and the j-th account information, and w _{ai, z} are arbitrary account information ai and the first Sum of the weights of edges between account information.

An embodiment of the present invention further provides a community partitioning device based on a feature matching network, including: a determining unit for determining a K-bit hash vector corresponding to each account information according to preset K hash functions; a first partitioning unit; : Used to divide the hash vector corresponding to each account information into order m = K / k sub-hash vectors; the second division unit: used to divide the account information with the same sub-hash vector into the same group for each class ; Calculation unit: used to calculate the similarity between the account information in the same group; forming a network unit for establishing an interconnection edge between the account information if the similarity between the account information is greater than a threshold To form a feature matching network; the third division unit is used to classify each account information according to the feature matching network.

Optionally, the calculation unit is specifically configured to: if the i-th account information and the j-th account information are in the same group of n , use n / m as the similarity between the i-th account information and the j-th account information; The account information and the j-th account information are any of the account information.

Optionally, the calculation unit is further configured to: if the i-th account information and the j-th account information are in the same group, the hash vector of the i-th account information and the j-th information of the j-th account information are located in the same bit and the hash vector value is The same number h; the i-th account information and the j-th account information are any of the account information; the similarity s = h / K between the i-th account information and the j-th account information.

Optionally, the determining unit is configured to determine, according to formula (3), a K-bit hash vector H ( ); Where 2 ' b represents H ( ) Is a binary number, h _i ( ) Is one of the preset K hash functions, Feature vector representing account information, where, , C ₁ , c ₂ …, c _d represent the characteristic attributes of account information, Represents a randomly selected non-zero vector, .

Optionally, the third dividing unit is specifically configured to: (1) divide each account information into different cells in the feature matching network; (2) calculate each account information according to the similarity between the account information Similar strength to generate the node similarity matrix; (3) For each account information, from the row where the account information is located in the node similarity matrix, try to assign the account information to other communities in the order of similarity from large to small. ; If the module information difference between the account information from the p-th cell to the q-th cell is a positive number, the account information is divided into the q-th cell and ends; (4) Repeat until the cell structure no longer changes.

Optionally, the calculation unit is further configured to calculate the similarity strength s _{i, j} between the i-th account information and the j-th account information according to formula (4); Among them, Γ ( i ) represents the neighbor set of the i-th account information, Γ ( i ) ∩Γ ( j ) represents the common neighbor set of the i-th account information and the j-th account information, and w _{ai, z} are arbitrary account information ai and the first Sum of the weights of edges between account information.

An embodiment of the present invention provides a community division method and device based on a feature matching network. According to preset K hash functions, a K-bit hash vector corresponding to each account information is determined; a hash corresponding to each account information is determined. Vector, divided into sub-hash vectors of m = K / k order; for each class, divide account information with the same sub-hash vector into the same group; calculate the similarity between account information in the same group; if each account If the similarity between the information is greater than the threshold, an interconnection edge is established between the account information to form a feature matching network. According to the feature matching network, the account information is divided into communities. In the embodiment of the present invention, the K-bit hash vector corresponding to each account information is first determined according to the preset K hash functions. For a large amount of account information in the network, only two hash values of the hash function are generated. It is not enough, so it is necessary to determine the K-bit hash vector corresponding to each account information to cope with the complicated network account information. For each class, the account information with the same sub-hash vector is divided into a group, and the similarity between any account information in the same group is calculated, which can avoid the calculation of similarity between any account information in the entire network. The disadvantage is that the calculation amount is very large; the technical solution of the present invention can effectively reduce the calculation amount of the similarity between account information, and only calculate the similarity between the account information in the same group. Finally, it is determined that the similarity between the account information is greater than the threshold, and an interconnection edge is established between the account information to form a feature matching network. According to the feature matching network, the account information is divided into communities, which can more accurately compare Divide the account information into communities, which not only makes the association relationship between the communities clear, but also analyzes the divided communities to find abnormal communities, and then conducts abnormal account investigation on the accounts in the abnormal communities, which is more targeted. Identify fraudulent accounts and improve efficiency in dealing with fraudulent accounts. In addition, if you need to add account information to the divided community, you only need to repeat the above simple steps for the added account information, and update the added account information to the corresponding location, which will not cause update difficulties. problem.

S101-106, S201-S206‧‧‧ steps

301‧‧‧ Confirmation unit

302‧‧‧First Division

303‧‧‧Second Division

304‧‧‧ Computing Unit

305‧‧‧form network unit

306‧‧‧Third Division

In order to explain the technical solution in the embodiments of the present invention more clearly, the drawings used in the description of the embodiments will be briefly introduced below.

FIG. 1 is a schematic flowchart of a community classification method based on a feature matching network according to an embodiment of the present invention; FIG. 2 is a flowchart of an overall idea of the present invention provided by an embodiment of the present invention; and FIG. 3 is a flowchart based on an embodiment of the present invention. Schematic diagram of community classification device for feature matching network.

In order to make the objectives, technical solutions, and beneficial effects of the present invention clearer, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

It should be understood that the technical solutions of the embodiments of the present invention can be applied to various scenarios of online fraud methods at banks, such as credit card product fraud, bank card product fraud, card theft fraud, counterfeit card fraud, cash fraud, etc. . The application scenarios of the technical solutions of the embodiments of the present invention may also be the discovery of abnormal account information communities, the commonality of finding specific types of fraud, the discovery of other fraudulent account information based on fraudulent account information samples, and the explanation of the discovery of unknown types of fraud.

FIG. 1 exemplarily illustrates a schematic flowchart of a community division method based on a feature matching network according to an embodiment of the present invention. As shown in FIG. 1, the method includes the following steps: Step S101: Determine each of the K hash functions according to presets. K-bit hash vector corresponding to each account information; step S102: sequentially divide the hash vector corresponding to each account information into m = K / k sub-hash vectors; step S103: for each class, sub-hash vectors are the same The account information is divided into the same group; Step S104: Calculate the similarity between the account information in the same group; Step S105: If the similarity between the account information is greater than the threshold, establish an interconnection between the account information Edge to form a feature matching network; step S106: classify each account information according to the feature matching network.

In step S101, a K-bit hash vector corresponding to each account information is determined according to the preset K hash functions. Specifically, a hash vector can be obtained after processing of each preset hash function. Then, According to the preset K hash functions, a K-bit hash vector can be generated, and each account information corresponds to a K-bit hash vector. In specific implementation, each account information contains multiple characteristic attributes. If only the existing technology is used, If only one hash function is used to represent one account information, there will be a shortcoming that is not enough to express multiple characteristic attributes of one account information. Therefore, this step can effectively avoid this shortcoming. The value of K can be set according to the specific situation of each account information in the specific implementation. For example, K can be set to 4, then the account information can be expressed as a 4-bit hash vector.

Step S102: sequentially divide the hash vector corresponding to each account information into m = K / k sub-hash vectors, which can also be understood as dividing the K hash functions into m-class sub-hash vectors. Each type of sub-hash vector includes several hash functions, and the number of hash functions assigned to each type of sub-hash vector is equal to k. In other words, k = K / m. Specifically, for example, K = 4, k = 2, then the 4-bit hash vector of each account information is divided into 2 types of sub-hash vectors. The benefit of the division is that the similarity between accounts is reduced in subsequent calculations. The calculation amount avoids the disadvantage that the calculation amount caused by directly performing similarity calculation on any two account numbers in all account information is not divided as in the prior art, and the hash vector of the account information is not divided.

Step S103: For each class, the account information with the same sub-hash vector is divided into the same group. Specifically, after each account information is divided into various types, the account with the same sub-hash vector is divided for each class. The information is divided into the same group. For example, if K = 4 and k = 2, in the first category, the first two bits of the 4-bit hash vector in all account information are the same. Also, in the second category, The account information with the same two last two digits in the 4-digit hash vector in all account information is a group. The purpose of this division is also to reduce the amount of calculation of similarity calculation, and only calculate the similarity between account information with the same sub-hash vector between various types.

Step S104: Calculate the similarity between the account information in the same group. In specific implementation, the ratio of the same number of bits to the size of the hash vector of each account information in the same group can be counted. For example, account information The hash vector of 1 is 0010, and the hash vector of account information 2 is 0011. According to K = 4, k = 2, then the two account information are in the same group in the first category, then it is determined that the two account information are in the same group. Similarity; then, the number of bits in the hash vector of the two account information is 3, and the size of the bit is 4 bits. Therefore, the similarity between the two account information is 3/4. The similarity calculation formula is used to calculate the similarity between any two account information in the same group. For example, the similarity calculation formula can be Euclidean distance, cosine distance, Jeckard distance formula, etc. On the one hand, compared to calculating the similarity of any two account information in all account information, calculating only the similarity between any two account information in the same group can greatly reduce the amount of calculation. For example, if N account information samples are taken, then the N account information samples are divided into 2 ^k groups, and the number of account information samples in each group is N / 2 ^k . Any two account information samples are performed in each group. The number of similarity calculations is , The number of similarity calculations of 2 ^k groups for any two account information is Therefore, the number of similarity calculations required for all classes is ,among them, Is the number of classes divided, this value is a constant that can be controlled according to the actual situation, and the traditional method of calculating any two account information in all accounts for similarity calculation needs to be performed To sum up, it can be seen that the amount of calculation of the similarity between any two account information in the same group using the present invention is approximately larger than that of the calculation of the similarity between any two account information in all accounts by the traditional method. Reduce multiples of 2 ^k levels. On the other hand, the similarity of account information in each group is relatively large, so similarity calculation of account information in the same group can also improve the efficiency and accuracy of network establishment.

Step S105: If the similarity between the account information is greater than the threshold, establish an interconnection edge between the account information to form a feature matching network. Specifically, if the similarity between any two account information is greater than the threshold , An interconnecting edge is established between any two account information, and the weight of the edge is the similarity value between the two account information, and finally a feature matching network is formed. In specific implementation, a higher value can be selected for the selection of the threshold, so that a sparse feature matching network can be finally generated to facilitate subsequent calculations. In addition, the value of the threshold can be adjusted according to actual conditions.

Step S106: According to the feature matching network, the account information is divided into communities. Specifically, according to the calculated similarity value between the account information, the closer the similarity value is, the easier it is to be classified into the same society. . After the community is divided, it is easier to investigate fraudulent accounts on the Internet. The proportion of fraudulent account samples in each community can be calculated. The larger the proportion, the greater the probability that the community is an abnormal community. Relevant investigations are needed, and then the accounts in the abnormal communities are calculated according to some indicators to find representative accounts, and relevant cases are investigated for these representative accounts. Among them, some indicators can be account information in the communities. Degree centrality, closeness centrality, feature vector centrality, etc .; or you can also perform feature reanalysis on account information in the community, in order to find some characteristics of the community's common behavior and conduct targeted fraud prevention. In addition, if the newly added account information forms a new community, it can be compared according to the abnormal community detected earlier, which is of great benefit to the detection and prevention of unknown fraud.

Calculate the similarity between the account information in the same group, which can be calculated in the following two methods: Method 1: Optionally, calculate the similarity between the account information in the same group, including: if the i-th account Information and jth account information are in the same group of n , then n / m is used as the similarity between the ith account information and the jth account information; the ith account information and the jth account information are any of the account information. One, specifically, take two account information arbitrarily from all account information, such as account information 1 and account information 2, m is 3, that is, account information 1 and account information 2 are divided into 3 categories, this The three categories are called category 1, category 2, and category 3, assuming that the two account information are in the same group in category 1 and category 3. Then, the similarity of the two account information in these 3 categories It is 2/3; Method 2: Optionally, calculate the similarity between the account information in the same group, including: if the i-th account information and the j-th account information are in the same group, calculate the hash of the i-th account information The vector is in the same place as the hash vector of the jth account information and the hash vector value is the same The number of H; i-j account information and account information of each account to any one of the information; s i-th similarity account information and account information of the j-th = h / K, particularly, if all of the account information in any Of the two account information, account information 1 and account information 2 are in the same group, and account information 1 and account information 2 are both 4-bit, that is, K is 4, the 4-digit hash of account information 1 and account information 2 In the vector, the first three digits are exactly the same, and the fourth digit is different. Then, the similarity s between account information 1 and account information 2 is 3/4.

The above two calculation methods for calculating the similarity between various account information in the same group can be obtained that the first method is to calculate the similarity of the two account information in each category, and the second method is to calculate It is classified into the similarity between two account information in the same group in each category. It can be seen that in these two methods, compared to the second method, the first method is a rough calculation of the two accounts. The similarity between the class to which the information belongs, and the similarity between the two account information in the second group calculated in the same group is more accurate. However, these two methods have significantly improved the calculation amount compared with the conventional technique using the European distance formula and the like to calculate the similarity between any two account information in all account information on the network, further accelerating. Network establishment.

Optionally, determining the K-bit hash vector corresponding to each account information according to the preset K hash functions includes: determining the K-bit hash vector H ( );

Where 2 ' b represents H ( ) Is a binary number, h _i ( ) Is one of the preset K hash functions,

Feature vector representing account information, where, , C ₁ , c ₂ …, c _d represent the characteristic attributes of account information, Represents a randomly selected non-zero vector, . Specifically, the default hash function is h _i ( ), H _i ( ) Is any of the preset K hash functions. The hash function h _i ( The value of) is represented by 0 or 1. That is to say, such a hash function can only generate two hash values, which is obviously not enough for a large amount of account information. Therefore, each hash function is used to determine each K-bit hash vector H of account number ( ), H ( ) Is a K-digit binary number. For example, it can be a 6-digit binary number. Specifically, it can be 010110. Then, , , , , , ,among them, Feature vector representing account information, , C ₁ , c ₂ …, c _d represent characteristic attributes of account information, and specific account information characteristic attributes may be transaction amount, transaction time, transaction location, number of transaction locations, transfer location, transfer amount, number of transfers, and the like. Among them, the feature vector of each account information can be filtered in the specific implementation to obtain a batch of feature vectors that theoretically have the best effect. Specifically, a sample of fraudulent account information and a sample of normal account information will be extracted within a certain period of time. The sample of fraudulent account information and the sample of normal account information are combined into a sample of overall account information. After performing the steps of data preprocessing, feature selection, and attribute correlation analysis of the overall account information based on business experience, a batch of theoretically the best results are selected. Feature vector. According to the preset K hash functions, the K-bit hash vector corresponding to each account information is determined, and the characteristic attributes of each account information can be fully extracted and represented by the feature vector, which can cope with the huge amount of account information in a complex network. Happening. In addition, it should be noted that, first, the K-bit hash vector H ( ) Is actually determined through a process of mapping a random hash come, by h _i ( H is obtained by hash mapping ( ), The main purpose of using hash random mapping here is to make the feature vector of account information be mapped to a unified representation of 0 or 1, for subsequent processing, instead of simple dimensionality reduction; second, the original feature vector Mapping to the new hash space will make it very likely that data with similar original feature vectors will have similar data in the new hash space. This probability is: , In accordance with the monotonically increasing mapping relationship from similarity s to probability p.

In the above embodiment, for the relationship between the K-bit hash vector corresponding to each account information and the order in which the hash vector corresponding to each account information is divided into m = K / k sub-hash vectors, the following table will be used to divide them. As shown, Table 1 exemplarily shows the relationship between sample account information and classes, as shown in Table 1:

In Table 1, the relationship between account information samples and classes can be expressed as a matrix of K rows and N columns, where N is the number of account information samples taken, and c ₁ to c _{N are} N account information samples. The sample is divided into m = K / k classes, where each row except the first row in the table represents a class, and N account information samples are divided into 2 ^k groups.

Optionally, grouping the account information according to the feature matching network includes: (1) dividing each account information into different communities in the feature matching network; (2) based on the similarity between the account information Degree, calculate the similarity strength of each account information to generate a node similarity strength matrix; (3) for each account information, from the row where the account information is located in the node similarity strength matrix, try in the order of similarity strength from large to small Assign the account information to other communities; if the module information difference from the p-th cell to the q-th cell is positive, the account information is divided into the q-th cell and the process ends; (4) Repeat until The cell structure no longer changes.

Optionally, calculating the similarity strength of each account information according to the similarity between each account includes: calculating the similarity strength s _{i, j} between the i-th account information and the j-th account information according to formula (2);

Among them, Γ ( i ) represents the neighbor set of the i-th account information, Γ ( i ) ∩Γ ( j ) represents the common neighbor set of the i-th account information and the j-th account information, and w _{ai, z} are arbitrary account information ai and the first Sum of the weights of edges between account information.

In specific implementation, in step (1), a feature matching network is initialized, and each account information is divided into different communities. The division in this step may be randomly divided. In step (2), according to formula (2 ) To calculate the similarity strength of each account information. Specifically, if the common neighbor of account information 1 and account information 2 is account information 3, the weight of the edge of account information 1 and account information 2 combined with account information 3 is 5, then The weight of any account information ai connected to account information 3 is 5, so the similarity between account information 1 and account information 2 is 1/5, and similarly, other account information is also calculated using this method. Suppose that 4 account information samples are taken and after calculation, a 4 * 4 matrix is formed. If this matrix is From this matrix, it can be seen that the similarity between account information 1 and account information 2 is 0.25, the similarity between account information 1 and account information 3 is 0.7, and the similarity between account information 2 and account information 3 is 0.4; ) Step, from the row where the account information is located in the similarity matrix, try to divide the account information into other communities in the order of similarity from large to small. For example, you can see from the first row of the similarity matrix that you want to When the account information 1 is divided into some other community, priority is given to the community in which the account information 3 (the largest 0.6 in the first row) with a large similarity is located. If △ Q <0, try to divide account information 1 into the community where account information 4 (0.4 times large in the first row) is located. If △ Q <0, then try to divide account information 1 into the community where account information 2 is located. If △ Q <0, account information 1 is retained as an independent community, and the matrix is not updated, and then the calculation in line 2 is performed. If only △ Q > 0 is found during the above attempt, for example, after trying to divide account 1 into the community with the account information 3 (0.6 largest in the first row) with a similar degree, it is found that △ Q > 0. Then the attempt is successful, and the first line of calculation is over. Since the status of account 1 has changed at this time, deleting all data in the first row and first column in the matrix means that subsequent account information is no longer compared with account information 1, that is, become , And then start a new round of trial calculations in the same process, that is, to divide the account information 2 into communities. Among them, the calculation formula of the module degree difference △ Q : To verify that the above attempt to divide the account information into cells is correct, where n represents all the weights in the network, k _i represents the weight of the edge connected to vertex i, and k _{i, in} represents the weight of account information i within the cell. Sum _in , Σ _in represents the sum of the edge weights inside the cell, Σ _tot represents the sum of the weights of the edges connected to the account information inside the cell, including the edges inside the cell and the edges outside the cell. If △ Q is positive, the current If it is not a positive number, the current division is abandoned. Through the calculation of the similarity matrix of account information, the account information is preferentially divided into the communities with the most similar neighbor account information, which greatly saves the number of attempts to divide the community and further improves the speed of the algorithm. In addition, the account information Whether the attempted division is reasonable is verified by the module degree difference formula, which more effectively guarantees the rationality and accuracy of the attempted division.

In order to better understand the technical solution of the present invention, FIG. 2 exemplarily shows a flowchart of the overall idea of the present invention, as shown in FIG. 2: Step S201: Map the characteristic attributes of each account information into a hash map method. Multi-bit hash map vector; step S202: classify the hash map vector of each account information; step S203: for each class, divide account information with the same hash map vector into one group; step S204: The similarity calculation of any two account information is performed; step S205: if the similarity of any two account information in each group is greater than a threshold, an interconnection edge between the two account information is established, and the weight of the edge is the similarity, Thus, a feature matching network is formed, wherein the formed feature matching network is a sparse feature matching network; step S206: the feature matching network is divided into communities according to the similarity intensity matrix of each account information in the feature matching network.

Compared with the prior art, in the embodiment of the present invention, first, the characteristic attributes of each account information are mapped into a new hash space by a random hash mapping method to form a hash map vector of each account information, and for each account information Classifying the hash map vector, can establish edges between account information with high similarity, effectively avoid a large number of similarity calculations between any two account information, and efficiently establish a credible weight value for each edge , Can improve the accuracy and speed of subsequent community classification; second, a feature matching network is established based on the similarity of each account information, and then the feature matching network is classified into communities based on the similarity matrix of each account information in the network. It can effectively find anomalous communities and take targeted measures. At the same time, it can detect unknown types of fraud. It also uses the similarity strength matrix to classify the feature matching network, that is, it preferentially divides account information to the nearest neighbor account. Information society, greatly reducing the number of community division attempts and further improving The speed of the algorithm. Third, by forming a feature matching network, the similarity between related account information is permanently stored as the edge weight. Even if more new account information comes in, it will not affect the original The interconnection edge has an impact, and only new account information needs to be inserted into the original feature matching network. When adding new account information to the original feature matching network graph, the random hash mapping method is used to classify each account information, and then the similarity calculation is performed with the account information in the class. If the similarity is greater than the threshold, then Add new edges. Subsequent only need to perform a smaller but more accurate community division algorithm to achieve the function. At the same time, the structure of the feature matching network can more clearly show the association structure within and between communities, which cannot be achieved by traditional clustering methods.

Based on the same concept, an embodiment of the present invention provides a community classification device based on a feature matching network. As shown in FIG. 3, the device includes a determination unit 301, a first division unit 302, a second division unit 303, a calculation unit 304, A network unit 305 and a third division unit 306 are formed. Wherein: the determining unit 301 is configured to determine the K-bit hash vector corresponding to each account information according to the preset K hash functions; the first dividing unit 302 is configured to sequentially divide the hash vector corresponding to each account information M = K / k sub-hash vector; second division unit 303: for each class, divide account information with the same sub-hash vector into the same group; calculation unit 304: used to calculate each account in the same group Similarity between information; forming a network unit 305: used to establish an interconnection edge between each account information if the similarity between the account information is greater than a threshold value, to form a feature matching network; a third division unit 306 : It is used to classify the account information based on the characteristics matching network.

Optionally, the calculation unit 304 is specifically configured to: if the i-th account information and the j-th account information are in the same group of n , use n / m as the similarity between the i-th account information and the j-th account information; The i account information and the jth account information are any of the account information.

Optionally, the calculation unit 304 is further specifically configured to: if the i-th account information and the j-th account information are in the same group, the hash vector of the i-th account information and the j-th account information are in the same bit and the hash vector The number h with the same value; the i-th account information and the j-th account information are any of the account information; the similarity s = h / K between the i-th account information and the j-th account information.

Optionally, the determining unit 301 is configured to determine, according to formula (3), a K-bit hash vector H ( );

Where 2 ' b represents H ( ) Is a binary number, h _i ( ) Is one of the preset K hash functions,

Feature vector representing account information, where, , C ₁ , c ₂ …, c _d represent the characteristic attributes of account information, Represents a randomly selected non-zero vector, .

Optionally, the third dividing unit 306 is specifically configured to: (1) divide each account information into different cells in the feature matching network; (2) calculate each account information according to the similarity between the account information (3) For each account information, from the row where the account information in the node similarity matrix is located, try to assign the account information to other communities in the order of the similarity from large to small. Medium; if the module degree difference between the account information from the p-th cell to the q-th cell is positive, the account information is divided into the q-th cell and ended; (4) Repeat until the cell structure no longer changes.

Optionally, the calculation unit 304 is further configured to calculate the similarity strength s _{i, j} between the i-th account information and the j-th account information according to formula (4);

Among them, Γ ( i ) represents the neighbor set of the i-th account information, Γ ( i ) ∩Γ ( j ) represents the common neighbor set of the i-th account information and the j-th account information, and w _{ai, z} are arbitrary account information ai and the first Sum of the weights of edges between account information.

It can be seen from the foregoing that an embodiment of the present invention provides a community classification device based on a feature matching network, and determines a K-bit hash vector corresponding to each account information according to preset K hash functions; The hash vector corresponding to the information is sequentially divided into class sub-hash vectors; for each class, the account information with the same sub-hash vector is divided into the same group; the similarity between the account information in the same group is calculated; if the account information If the similarity between them is greater than the threshold, an interconnection edge is established between the account information to form a feature matching network. According to the feature matching network, the account information is divided into communities. According to the similarity between the account information, Each account information is divided into communities. In the embodiment of the present invention, the K-bit hash vector corresponding to each account information is first determined according to the preset K hash functions. For a large amount of account information in the network, only two hash values of the hash function are generated. It is not enough, so it is necessary to determine the K-bit hash vector corresponding to each account information to cope with the complicated network account information. For each class, the account information with the same sub-hash vector is divided into a group, and the similarity between any account information in the same group is calculated, which can avoid the calculation of similarity between any account information in the entire network. The disadvantage is that the calculation amount is very large; the technical solution of the present invention can effectively reduce the calculation amount of the similarity between account information, and only calculate the similarity between the account information in the same group. Finally, it is determined that the similarity between the account information is greater than the threshold, and an interconnection edge is established between the account information to form a feature matching network. According to the feature matching network, the account information is divided into communities, which can more accurately compare Divide the account information into communities, which not only makes the association relationship between the communities clear, but also analyzes the divided communities to find abnormal communities, and then conducts abnormal account investigation on the accounts in the abnormal communities, which is more targeted. Identify fraudulent accounts and improve efficiency in dealing with fraudulent accounts. In addition, if you need to add account information to the divided community, you only need to repeat the above simple steps for the added account information, and update the added account information to the corresponding location, which will not cause update difficulties. problem.

Those skilled in the art should understand that the embodiments of the present invention may be provided as a method or a computer program product. Therefore, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk memory, CD-ROM, optical memory, etc.) containing computer-usable code therein. .

The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, and a combination of the process and / or block in the flowchart and / or block diagram may be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to generate a machine for instructions executed by the processor of the computer or other programmable data processing device Means are generated for implementing the functions specified in one or more of the flowcharts and / or one or more of the block diagrams.

These computer program instructions can also be stored in computer readable memory that can guide a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured article including a command device The instruction device implements the functions specified in a flowchart or a plurality of processes and / or a block or a plurality of blocks in the block diagram.

These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operating steps can be performed on the computer or other programmable equipment to generate computer-implemented processing, and thus on the computer or other programmable equipment The instructions executed on the steps provide steps for implementing the functions specified in one or more of the flowcharts and / or one or more of the block diagrams.

Although the preferred embodiments of the present invention have been described, those skilled in the art can make other changes and modifications to these embodiments once they know the basic inventive concepts. Therefore, the scope of the appended patent applications is intended to be construed to include the preferred embodiments and all changes and modifications that fall within the scope of the invention.

Obviously, those skilled in the art can make various modifications and variations to the present invention without departing from the spirit and scope of the present invention. In this way, if these modifications and variations of the present invention fall within the scope of the patent application for the present invention and the scope of the equivalent technology, the present invention also intends to include these modifications and variations.

Claims (12)

A community division method based on a feature matching network, comprising: determining a K-bit hash vector K corresponding to each account information greater than 1 according to preset K hash functions; and assigning a hash corresponding to each account information Vector, divided into m = K / k sub-hash vectors, k is not greater than K; for each class, divide account information with the same sub-hash vector into the same group; calculate the similarity between account information in the same group If the similarity between the account information is greater than the threshold value, an interconnection edge is established between the account information to form a feature matching network; according to the feature matching network, the account information is divided into communities. The method for segmenting a community based on a feature matching network according to claim 1, wherein calculating the similarity between account information in the same group includes: if the i-th account information and the j-th account information are in the same n-type group , The n / m is used as the similarity between the i-th account information and the j-th account information; the i-th account information and the j-th account information are any of the account information. The method for dividing a community based on a feature matching network according to claim 1, wherein calculating the similarity between account information in the same group includes: if the i-th account information and the j-th account information are in the same group, Count the number h of the hash vector of the i-th account information and the hash vector of the j-th account information that are in the same position and have the same hash vector value; the i-th account information and the j-th account information are among the account information. Any one; the similarity s = h / K between the i-th account information and the j-th account information. The community division method based on feature matching network according to claim 1, wherein the K-bit hash vector corresponding to each account information is determined according to the preset K hash functions, including: determining the formula according to formula (1) K-bit hash vector corresponding to each account information ; Where 2 ' b represents Is a binary number, Is one of the preset K hash functions, Feature vector representing account information, where, , C ₁ , c ₂ …, c _d represent the characteristic attributes of account information, Represents a randomly selected non-zero vector, . The method for classifying a community based on a feature matching network according to any one of claims 1 to 4, wherein classifying each account information based on the feature matching network includes: (1) grouping account information Divided into different communities in the feature matching network; (2) Calculate the similarity strength of each account information based on the similarity between the account information to generate a node similarity matrix; (3) For each account information , From the row where the account information is located in the node's similar strength matrix, try to assign the account information to other cells in the order of similar strength from large to small; if the account information is divided from the p-th cell to the q-th cell After the difference in module degrees is positive, the account information is divided into the q-th cell and ended; (4) Repeat until the cell structure is no longer changed. The community division method based on feature matching network according to claim 5, wherein calculating the similarity strength of each account information according to the similarity between the account information includes: calculating the i-th item according to formula (2) The similarity intensity s _{i, j} between the account information and the jth account information; ,among them, ; Where Γ ( i ) represents the neighbor set of the i-th account information, Γ ( i ) ∩Γ ( j ) represents the common neighbor set of the i-th account information and the j-th account information, w _{ai, z} is an arbitrary account The sum of the weights of the edges between the information ai and the zth account information. A community segmentation device based on a feature matching network, comprising: a determining unit, configured to determine a K-bit hash vector corresponding to each account information according to preset K hash functions, where K is greater than 1; Dividing unit, which is used to divide the hash vector corresponding to each account information into m = K / k sub-hash vectors, k is not greater than K; the second dividing unit is used to make the sub-hash vector the same for each class The account information is divided into the same group; the calculation unit is used to calculate the similarity between the account information in the same group; the network unit is formed to be used if the similarity between the account information is greater than the threshold. An interconnection edge is established between the account information to form a feature matching network; a third division unit is configured to divide the account information into communities according to the feature matching network. The community classification device based on the feature matching network according to claim 7, wherein the calculation unit is specifically configured to: if the i-th account information and the j-th account information are in the same group of n , use n / m as the The similarity between the i-th account information and the j-th account information; the i-th account information and the j-th account information are any of the account information. The community classification device based on the feature matching network according to claim 7, wherein the calculation unit is further configured to specifically calculate the hash of the i-th account information if the i-th account information and the j-th account information are in the same group. The number h is the same number in the hash vector of the j-th account information and the same hash vector value; the i-th account information and the j-th account information are any of the account information; the i-th account information The degree of similarity with the j-th account information is s = h / K. The community classification device based on the feature matching network according to claim 7, wherein the determining unit is configured to determine a K-bit hash vector corresponding to each account information according to formula (3) ; Where 2 ' b represents Is a binary number, Is one of the preset K hash functions, Feature vector representing account information, where, , C ₁ , c ₂ …, c _d represent the characteristic attributes of account information, Represents a randomly selected non-zero vector, . The community division device based on the feature matching network according to any one of claims 7 to 10, wherein the third division unit is specifically configured to: (1) divide each account information into the feature matching network In different communities; (2) Calculate the similarity strength of each account information according to the similarity between the account information to generate a node similarity matrix; (3) For each account information, from the node similarity matrix In the row where the account information is located, try to assign the account information to other communities in the order of similar strength from large to small; if the module information difference from the p-th cell to the q-th cell is a positive number , Then the account information is divided into the q-th cell and ended; (4) Repeatedly performed until the cell structure no longer changes. The community classification device based on the feature matching network according to claim 11, wherein the calculation unit is further configured to calculate the similarity strength s between the i-th account information and the j-th account information according to formula (4). _{i, j} ; , Where w (z) = w _{ai, z} formula (4); where Γ ( i ) represents the neighbor set of the i-th account information, and Γ ( i ) ∩Γ ( j ) represents the i-th account information and the The common neighbor set of the j-th account information, w _{ai, z} is the sum of the weights of edges between any account information ai and the z-th account information.