WO2021159834A1 - Abnormal information processing node analysis method and apparatus, medium and electronic device - Google Patents

Abstract

The present application relates to an abnormal information processing node analysis method and apparatus, a medium and an electronic device, and belongs to the technical field of computers. The method comprises the steps of: classifying information processing nodes according to attributes of abnormal information processing events; obtaining abnormal feature tags of all information processing nodes, and constructing node tag sets; eliminating tags having the occurrence probability lower than a preset threshold in the node tag sets to obtain frequent item tag sets; according to a predetermined class association relationship of the classes of the information processing node groups, obtaining the same tags in the frequent item tag sets of the information processing node groups corresponding to the associated classes to obtain same tag subsets; associating group association feature tags for the same tag subsets to obtain association relationship tag sets; and inputting related information of the abnormal information processing events in an abnormal node analysis request and the association relationship tag sets into a risk node analysis model to obtain an abnormal information processing node relationship. The present application can efficiently and accurately analyze the abnormal information processing node relationship.

Description

Abnormal information processing node analysis method, device, medium and electronic equipment

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on February 14, 2020, the application number is 202010092140.1, and the invention title is "Analysis methods, devices, media and electronic equipment for abnormal information processing nodes". The entire content of the application is approved The reference is incorporated in this application.

Technical field

This application relates to the field of computer technology, and specifically, to an abnormal information processing node analysis method, device, medium, and electronic equipment.

Background technique

Anomaly information processing node analysis is to perform information processing nodes in related entities (such as enterprises). When an abnormal information processing event occurs (such as information leakage, loss, management error, etc.), it is analyzed to determine the suspicion in all abnormal information processing events The joint relationship between nodes.

The inventor realizes that when analyzing abnormal information processing nodes, the risk analysis of security incidents only stays at non-quantitative analysis such as empirical theory and scattered case induction analysis, and cannot dig out the hidden risk rules and abnormal information processing. The analysis efficiency of nodes is low, and there is no foresight of abnormal events that occur.

It should be noted that the information disclosed in the background art section above is only used to enhance the understanding of the background of the application, and therefore may include information that does not constitute the prior art known to those of ordinary skill in the art.

technical problem

The purpose of this application is to provide a solution for analyzing abnormal information processing nodes, so as to achieve efficient and accurate analysis of the relationship between abnormal information processing nodes at least to a certain extent.

Technical solutions

According to one aspect of the present application, an abnormal information processing node analysis method is provided, which includes: when receiving an abnormal node analysis request in an abnormal information processing event, associating all information processing nodes in the abnormal information processing node database according to the abnormal information The attributes of the processing event are classified to obtain multiple types of information processing node groups; the abnormal feature labels of all information processing nodes in the information processing node group are obtained, and the node label set of the information processing node group is constructed; A label whose probability of occurrence in the node label set of the information processing node group is lower than a predetermined threshold is obtained, and a frequent item label set of each information processing node group is obtained; according to the predetermined category association relationship of the category of the information processing node group, The same label in the frequent item label set of the information processing node group corresponding to the associated class is obtained, and the same label subset is obtained; according to the association relationship between the associated classes corresponding to the same label subset, the same label is Collect the associated group association feature tags to obtain an association relationship tag set, wherein the group association feature tags do not belong to the node tag set; analyze the related information of the abnormal information processing event in the abnormal node request and the association relationship tag Set the input risk node analysis model to obtain the abnormal information processing node relationship.

According to one aspect of the present application, an abnormal information processing node analysis device is provided, which includes: a classification module for, when receiving an abnormal node analysis request in an abnormal information processing event, associate abnormal information with all information in the processing node database The processing nodes are classified according to the attributes of the abnormal information processing event to obtain multiple types of information processing node groups; the building module is used to obtain the abnormal feature labels of all the information processing nodes in the information processing node group to construct the information Processing the node label set of the node group; the elimination module is used to eliminate the labels whose probability of occurrence in the node label set of each information processing node group is lower than a predetermined threshold to obtain the frequent item label set of each information processing node group Obtaining module, used to obtain the same label in the frequent item label set of the information processing node group corresponding to the associated class according to the predetermined class association relationship of the category of the information processing node group, to obtain the same label subset; associating module , Used to obtain an association relationship tag set according to the association relationship between the associated classes corresponding to the same tag subset, for the association group association of the same tag subset to obtain an association relationship tag set, wherein the group association feature tags do not belong to The node label set; an analysis module for inputting the relevant information of the abnormal information processing event in the abnormal node analysis request and the association relationship label set into the risk node analysis model to obtain the abnormal information processing node relationship.

According to one aspect of the present application, there is provided a computer-readable storage medium on which an abnormal information processing node analysis program is stored, wherein the abnormal information processing node analysis program is executed by a processor to implement the following method: When an abnormal node in an information processing event analyzes a request, all information processing nodes in the abnormal information associated processing node library are classified according to the attributes of the abnormal information processing event to obtain multiple types of information processing node groups; to obtain the information processing node The abnormal feature labels of all information processing nodes in the group are constructed to construct the node label set of the information processing node group; the labels whose probability of occurrence in the node label set of each information processing node group is lower than a predetermined threshold are removed, and each node label set is obtained. The frequent item label set of the information processing node group; according to the predetermined category association relationship of the category of the information processing node group, the same label in the frequent item label set of the information processing node group corresponding to the associated category is obtained to obtain the same label Subset; according to the association relationship between the associated classes corresponding to the same tag subset, associating feature tags for the same tag subset association group to obtain an association relationship tag set, wherein the group association feature tags do not belong to The node label set; the related information of the abnormal information processing event in the abnormal node analysis request and the association relationship label set are input into the risk node analysis model to obtain the abnormal information processing node relationship.

According to one aspect of the present application, there is provided an electronic device, which includes: a processor; and a memory for storing an abnormal information processing node analysis program of the processor; wherein the processor is configured to execute the The abnormal information processing node analysis program executes the following method: when an abnormal node analysis request in an abnormal information processing event is received, all information processing nodes in the abnormal information associated processing node library are classified according to the attributes of the abnormal information processing event to obtain Multiple categories of information processing node groups; acquiring the abnormal feature labels of all information processing nodes in the information processing node group, and constructing the node label set of the information processing node group; removing the node label of each information processing node group Collect labels whose occurrence probability is lower than a predetermined threshold to obtain the frequent item label set of each information processing node group; obtain the information corresponding to the associated category according to the predetermined category association relationship of the category of the information processing node group Process the same labels in the frequent item label set of the node group to obtain the same label subset; according to the association relationship between the associated classes corresponding to the same label subset, associate the feature labels for the association group of the same label subset to obtain The association relationship tag set, wherein the group association feature tag does not belong to the node tag set; the related information of the abnormal information processing event in the abnormal node analysis request and the association relationship tag set are input into the risk node analysis model to obtain Abnormal information processing node relationship.

Beneficial effect

This application can efficiently and accurately analyze the abnormal information processing node relationship based on the related information of the abnormal information processing event and the corresponding association relationship label set of the constructed node, and the risk node analysis model can be used to efficiently and accurately analyze.

It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the application.

Description of the drawings

The drawings herein are incorporated into the specification and constitute a part of the specification, show embodiments that conform to the application, and are used together with the specification to explain the principle of the application. Obviously, the drawings in the following description are only some embodiments of the application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work.

Fig. 1 schematically shows a flow chart of an abnormal information processing node analysis method.

Fig. 2 schematically shows an example diagram of an application scenario of an abnormal information processing node analysis method.

Fig. 3 schematically shows a flow chart of a method for obtaining an association relationship label set.

Fig. 4 schematically shows a block diagram of an abnormal information processing node analysis device.

Fig. 5 schematically shows an example block diagram of an electronic device for implementing the above-mentioned abnormal information processing node analysis method.

Fig. 6 schematically shows a computer-readable storage medium for implementing the above-mentioned abnormal information processing node analysis method.

Embodiments of the present invention

Example embodiments will now be described more fully with reference to the accompanying drawings. However, the example embodiments can be implemented in various forms, and should not be construed as being limited to the examples set forth herein; on the contrary, the provision of these embodiments makes this application more comprehensive and complete, and fully conveys the concept of the example embodiments To those skilled in the art. The described features, structures or characteristics can be combined in one or more embodiments in any suitable way. In the following description, many specific details are provided to give a sufficient understanding of the embodiments of the present application. However, those skilled in the art will realize that the technical solutions of the present application can be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. can be used. In other cases, the well-known technical solutions are not shown or described in detail to avoid overwhelming the crowd and obscure all aspects of the present application.

In addition, the drawings are only schematic illustrations of the application and are not necessarily drawn to scale. The same reference numerals in the figures denote the same or similar parts, and thus their repeated description will be omitted. Some of the block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in the form of software, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and/or processor devices and/or microcontroller devices.

The technical solution of this application can be applied to the fields of artificial intelligence, smart city, blockchain and/or big data technology to realize intelligent information recommendation. Optionally, the data involved in this application, such as tags and/or abnormal information processing node relationships, can be stored in a database, or can be stored in a blockchain, such as distributed storage through a blockchain, which is not limited in this application.

This example embodiment first provides an abnormal information processing node analysis method. The abnormal information processing node analysis method can be run on a server, a server cluster or a cloud server, etc. Of course, those skilled in the art can also use other methods according to their needs. The platform runs the method of this application, which is not particularly limited in this exemplary embodiment. Referring to FIG. 1, the method for analyzing abnormal information processing nodes may include the following steps.

Step S110: When receiving the abnormal node analysis request in the abnormal information processing event, classify all the information processing nodes in the abnormal information association processing node database according to the attributes of the abnormal information processing event to obtain multiple types of information processing node groups .

Step S120: Obtain abnormal feature labels of all information processing nodes in the information processing node group, and construct a node label set of the information processing node group.

In step S130, the labels whose probability of appearing in the node label set of each information processing node group are lower than a predetermined threshold are removed, and a frequent item label set of each information processing node group is obtained.

Step S140: Obtain the same label in the frequent item label set of the information processing node group corresponding to the associated category according to the predetermined category association relationship of the category of the information processing node group, and obtain the same label subset.

Step S150: According to the association relationship between the associated classes corresponding to the same tag subset, associate feature tags for the association group of the same tag subset to obtain an association relationship tag set, wherein the group association feature tags do not belong to The set of node labels.

Step S160: Input the related information of the abnormal information processing event in the abnormal node analysis request and the associated relationship label set into the risk node analysis model to obtain the abnormal information processing node relationship.

In the above-mentioned abnormal information processing node analysis method, first, when an abnormal node analysis request in an abnormal information processing event is received, all information processing nodes in the abnormal information association processing node library are classified according to the attributes of the abnormal information processing event, and multiple information processing nodes are obtained. Category of information processing node group; realize the classification of nodes according to their attributes in abnormal information processing events. Then, the abnormal feature labels of all the information processing nodes in the information processing node group are acquired, and the node label set of the information processing node group is constructed; the node label sets of the abnormal characteristics of the information processing node group of different categories can be constructed. Then, by removing labels whose probability of occurrence in the node label set of each information processing node group is lower than a predetermined threshold, the frequent item label set of each information processing node group is obtained; the high probability corresponding to each type of information processing node group can be obtained The set of labels for the unusual characteristics of the Then, according to the predetermined category association relationship of the category of the information processing node group, the same label in the frequent item label set of the information processing node group corresponding to the associated category is obtained to obtain the same label subset; The association relationship of, obtains the labels that are between multiple information processing node groups that have an association relationship, that is, a subset of the same labels. Then, according to the association relationship between the associated classes corresponding to the same tag subset, associating feature tags for the same tag subset association group to obtain an association relationship tag set, where the group association feature tags do not belong to the node tag set; The group association feature tags can be supplemented for the same tag subset according to the association relationship to obtain association relationship tag sets with multiple strong association features. Finally, the related information of the abnormal information processing event in the abnormal node analysis request and the associated relationship label set are input into the risk node analysis model to obtain the abnormal information processing node relationship. Realize that the related information of abnormal information processing events is constrained through the association relationship tag set of strong association characteristics, and the relationship between abnormal information processing nodes in abnormal information processing events is efficiently and accurately analyzed based on the risk node analysis model.

Hereinafter, each step in the above-mentioned abnormal information processing node analysis method in this exemplary embodiment will be explained and described in detail with reference to the accompanying drawings.

In step S110, when the abnormal node analysis request in the abnormal information processing event is received, all the information processing nodes in the abnormal information associated processing node library are classified according to the attributes of the abnormal information processing event to obtain multiple types of information processing Node group.

In the embodiment of this example, referring to FIG. 2, when the server 201 receives the abnormal node analysis request in the abnormal information processing event sent by the server 202, it associates all the information processing nodes in the abnormal information processing node database on the server 201 according to the abnormal information processing The attributes of the event are classified, and multiple types of information processing node groups are obtained. In this way, in subsequent steps, the server 201 analyzes the relationship between abnormal information processing nodes according to multiple types of information processing node groups. It can be understood that the server 201 and the server 202 may be any devices with processing capabilities, such as computers, microprocessors, etc., which are not specifically limited herein.

The abnormal information association processing node database stores the work records of all information processing nodes when an abnormal information processing event occurs. For example, the relational information database stores each node identification and related information corresponding to each information processing event. Abnormal information processing events such as information leakage events, information processing error events, etc.

An information processing node is, for example, an information storage node of an enterprise or any node that has a task association relationship with the enterprise information storage node. The node can be any node with information processing functions such as a server, an application, or a computer. The attributes of the abnormal information processing event are the attributes of the nodes associated with the event in different abnormal events. For example, leakage incidents are classified according to attributes: preliminary attribute classification, such as: first-level management nodes, second-level management nodes, information conversion nodes, information sending nodes, information receiving nodes, etc.; information fusion error events are classified according to attributes: information acquisition Nodes, information processing nodes, information storage nodes, information management nodes, etc. Corresponding node attributes can be set for different events to ensure that the nodes corresponding to each event are accurately classified according to each event.

In step S120, the abnormal feature labels of all the information processing nodes in the information processing node group are acquired, and the node label set of the information processing node group is constructed.

In the implementation of this example, by crawling the keyword (abnormal feature tag) in the related information of each node, it is possible to obtain whether the feature tag exists in the related information and the number of times when each node performs information processing. The abnormal feature label can be all the keyword features corresponding to the analysis of the abnormal node, for example, information management authority (type A information), node joint time (1 year-2 years), etc.

Construct the node label set of the information processing node group, for example, determine the information node category: secondary management node. Then, the feature label is quantified and disassembled: the information management authority (type A information) is quantified as 1, the information management authority (type B information) is quantified as 2, the internal node of the enterprise is 3, the external enterprise node is 4, and the node joint time (1 year-2 Year) 5, etc., and obtain the feature set {1...25} based on the quantitative disassembly of the label. Construct a node label set for the secondary management nodes in all abnormal information processing events in the past, for example: node A: {1,4,6,8,13,15,17,18,20}, node B: {2,5 ,7,9,11,12,17,19,21}, node C: {1,3,6,8,10,13,16}. In this way, it is possible to construct a node label set of abnormal characteristics of different types of information processing node groups.

In step S130, the labels whose probability of occurrence in the node label set of each information processing node group are lower than a predetermined threshold are removed, and the frequent item label set of each information processing node group is obtained.

In the implementation of this example, tags whose probability of occurrence in the node tag set of each information processing node group is lower than a predetermined threshold can be eliminated, and tags with low occurrence probability can be eliminated to ensure the accuracy of the tag analysis for abnormal events. For example, you can scan and count the frequency of occurrence of items in the node label set: {1}65; {2}35; {3}10; {4}30; {5}60; {6}90; {7}10, etc. , And then eliminate items with a probability of less than 50% to get: {1}65; {5}60; {6}90, etc. In this way, a frequent item label set with high representation accuracy for abnormal features of each information processing node group can be obtained.

In an implementation manner of this example, the tags whose probability of appearing in the node label set of each information processing node group are lower than a predetermined threshold are removed to obtain the frequent item label set of each information processing node group, The method includes: removing the labels whose occurrence probability of the node label set of the information processing node group is lower than a predetermined threshold to obtain a second node label set; after calculating the occurrence probability of each label in the second node label set, removing the labels lower than all the labels. The label of the predetermined threshold is used to obtain a third node label set, and when the occurrence probability of all labels in the third node label set is higher than the predetermined threshold, the frequent item label set of the information processing node group is obtained.

For example, the second node label set is obtained after the above items whose occurrence probability is less than 50% are eliminated: {1}65; {5}60; {6}90, etc. Then, for each label in the second node label set, calculate the probability of appearing in the second label set, and continue to eliminate items with an appearance probability of less than 50% to obtain the third node label set. At this time, the probability of each label in the third label set is calculated. When there is no label in the third label set with a probability of less than 50%, the frequent item label set of the information processing node group is obtained. It can be understood that if there are less than 50% of the labels in the third label set, then continue to eliminate until the frequent item label set is obtained.

In step S140, the same label in the frequent item label set of the information processing node group corresponding to the associated category is obtained according to the predetermined category association relationship of the category of the information processing node group, and the same label subset is obtained.

In the embodiment of this example, the predetermined association relationship is the joint relationship of information processing nodes in the information processing event between different information processing node groups. For example, the information processing event usually consists of two or more information processing node groups. The information processing nodes cooperate with each other to complete information processing events. When information processing nodes belonging to different information processing node groups cooperate to complete a risk event, the cooperative information processing nodes will have the same core characteristics in terms of information processing node characteristics, for example, complete the theft of a certain type of information It needs to go from the first-level management node to the second-level management node and then to the information sending node. At the same time, these nodes need to have information management authority (type A information), internal nodes of the enterprise, and node management time 3-5 years, etc.

In this way, by obtaining the same label in the frequent item label set of the information processing node group corresponding to the associated class, the information processing node characteristic label of the core of the information processing node group corresponding to the associated class can be determined. The core label is obtained based on the association relationship of the risk information processing node group, which reduces the number of labels while ensuring the accuracy of analysis.

In step S150, according to the association relationship between the associated classes corresponding to the same tag subset, associating feature tags for the association group of the same tag subset to obtain an association relationship tag set, wherein the group associated feature tags Does not belong to the node label set.

The association relationship between the associated classes corresponding to the same label subset. For example, if the associated classes corresponding to the same label subset include first-level management nodes, second-level management nodes, and information fusion nodes, the association relationship is the first-level management node- Secondary management node-information fusion node.

The group association feature label is the information processing node joint label between different information processing node groups, which is used to instruct the information processing node to cooperate to complete the joint relationship characteristic label of the risk event, such as controlling the lower-level node, controlling the upper-level node, cooperating with each other, Being attacked (for example, only one of the two nodes is attacked to reveal information), etc. The associated feature tag can be found from the related information of the information processing node recorded in the information association processing node database. In this way, by associating group feature labels for the same label subset corresponding to the core information processing node labels, it is possible to accurately describe the relatively complete association relationship label set of abnormal information processing events, and ensure the accuracy and reliability of the analysis of abnormal information processing nodes. .

In an implementation of this example, according to the association relationship between the associated classes corresponding to the same tag subset, the feature tags are associated with the association group of the same tag subset to obtain the association relationship tag set, refer to FIG. 3 As shown, it includes: step S310, obtaining an association relationship label template corresponding to the association relationship between the associated classes corresponding to the same tag subset, and the association relationship label template includes group association feature tags and characteristics of information processing nodes Label; step S320, search for an association relationship label template that includes feature tags consistent with the same tag subset from the association relationship label template library, to obtain a matching association relationship label template; step S330, based on the matched association relationship The label template obtains the association relationship label set.

The association relationship label template corresponding to each association relationship is preset. The association relationship label template can include group association feature tags and feature tags of information processing nodes, that is, the association relationship template includes feature tags of multiple information processing nodes, and the multiple features The information processing node represented by the tag cooperates to complete the typical group association feature tag corresponding to the joint relationship feature of the risk event. Furthermore, it is possible to search for an association relationship label template that includes feature tags consistent with the same tag subset from the association relationship label template library to obtain a matching association relationship label template; obtain abnormal information based on the matched association relationship label template and handle the event occurrence A relatively complete set of association relationship labels.

In an implementation manner of this example, the obtaining an association relationship label set based on the matched association relationship label template includes: obtaining an association relationship whose number of tags exceeds a predetermined threshold from the matched association relationship label template The label template is used as the association relationship label set.

There can be multiple matching association relationship label templates. The association relationship label template whose number of tags exceeds a predetermined threshold is obtained. For example, an association relationship label template containing at least 50 tags is obtained as an association relationship label. The association relationship label set includes A subset of the same tags is included, and group association feature tags are included.

In an implementation of this example, obtaining an association relationship label set based on the matched association relationship label template includes: obtaining an association relationship label template containing the least number of tags from the matched association relationship label templates , As the association relationship label set.

In step S160, the related information of the abnormal information processing event in the abnormal node analysis request and the associated relationship label set are input into the risk node analysis model to obtain the abnormal information processing node relationship.

The association relationship label set can simply and accurately describe the association relationship of relatively complete node information in which historical abnormal information processing events occur. Information related to the abnormal information processing event may include: suspect node information of the abnormal information processing event, for example, information about all nodes that may participate in the event; information related content in the event, for example, enterprise nodes that the information may involve. The abnormal information processing node relationship is the joint relationship between multiple nodes with risks in the predicted abnormal information processing event. For example, the first-level management node cooperates with the external node to attack the second-level management node in the internal management node. The association relationship label set is the information processing node corresponding to each category, that is, the association relationship label set of the input risk node analysis model is at least one.

Through the pre-trained risk node analysis model, the abnormal information processing node relationship of the abnormal event can be quickly and accurately predicted based on the abnormal information processing event under the constraints of the corresponding association relationship label set.

In an implementation of this example, the training method of the risk node analysis model may include: collecting an abnormal information processing event information sample set, where the abnormal information processing event information sample includes an association relationship label set and the association relationship label set correspondence The abnormal information processing node relationship; input the association relationship label set of each sample in the sample set into the risk node analysis model to obtain the predicted abnormal information processing node relationship corresponding to each sample; when there are samples in the risk node analysis model The predicted abnormal information processing node relationship corresponding to the obtained sample is inconsistent with the abnormal information processing node relationship calibrated in advance for the sample, then adjust the coefficients of the business risk node analysis model until they are consistent; when all samples are entered into the risk node analysis model, the results are obtained When the similarity between the predicted abnormal information processing node relationship and the abnormal information processing node relationship calibrated in advance for the sample is greater than a predetermined threshold, the training ends.

In an implementation of this example, in the association relationship between the associated classes corresponding to the same tag subset, associating feature tags for the association group of the same tag subset to obtain an association relationship tag set, Wherein, after the group association feature tag does not belong to the node tag set, the method further includes: determining the target risk information according to the association relationship tag set corresponding to the target risk information processing node group and the frequent item tag set The risk information processing node of the processing node group.

The target risk information processing node group is the node group that one or more users want to analyze among the information processing node groups of multiple categories obtained after classification according to the attributes of the abnormal information processing event. Each information processing node group can obtain the corresponding association relationship label set and frequent item label set after processing. In this way, it is possible to analyze the risk information processing nodes in the target group that have the risk of the abnormal information processing event according to the associated relationship label set and the frequent item label set corresponding to the target risk information processing node group.

In an implementation of this example, determining the risk information processing node of the target risk information processing node group according to the association relationship label set and the frequent item label set corresponding to the target risk information processing node group includes: Determine the first set of risk information processing nodes in the target risk information processing node group according to the association relationship label set corresponding to the target risk information processing node group; The frequent item label set determines the second risk information processing node set of the target risk information processing node group; obtains the target risk information processing node group according to the association relationship label set corresponding to the target risk information processing node group The third risk information processing node set of the risk information processing node group corresponding to the class associated with the class; the intersection of the risk information processing nodes of the first risk information processing node set and the second risk information processing node set is obtained The third risk information processing node is a centralized risk information processing node with a risk information processing node that has a risk connection, and serves as a risk information processing node of the target risk information processing node group.

The information processing nodes in the target risk information processing node group that have all or a predetermined number of labels in the association relationship label set can be determined according to the association relationship label set, to obtain the first risk information processing node set; in this way, it can be determined based on the association relationship label set The first set of suspected risk information processing nodes with complete abnormal information processing features. Then, according to the frequent item label set corresponding to the target risk information processing node group, the information processing nodes in the target risk information processing node group that have all or a predetermined number of labels in the frequent item label set can be determined to obtain the second risk information processing node set ; In this way, the second set of risk information processing nodes with strong abnormal information processing characteristics can be determined based on the frequent item tag set. Then, based on the intersection of the first risk information processing node set and the second risk information processing node set, the suspected information processing node having both strong features and complete abnormal information processing features can be determined.

Through the association relationship label set corresponding to the target risk information processing node group, the risk information processing node group corresponding to the class associated with the target risk information processing node group is obtained (that is, the risk information processing node group that has a predetermined class association relationship with the target information processing node group The third risk information processing node set of the node group) can obtain the complete abnormal information processing characteristics characterized by the association relationship label set corresponding to the target risk information processing node group in other risk information processing node groups with predetermined association relationships. The third set of risk information processing nodes. At this time, by obtaining the intersection of the risk information processing nodes of the first risk information processing node set and the second risk information processing node set, the risk information processing nodes that have a risk connection with the third risk information processing node centralized risk information processing node, that is, through By searching for nodes with interactive relationships in abnormal information processing events, the risk information processing nodes of the target risk information processing node group can be determined.

The application also provides an abnormal information processing node analysis device. Referring to FIG. 4, the abnormal information processing node analysis device may include a classification module 410, a construction module 420, a rejection module 430, an acquisition module 440, an association module 450, and an analysis module 460.

The classification module 410 is configured to classify all the information processing nodes in the abnormal information association processing node database according to the attributes of the abnormal information processing event when receiving the abnormal node analysis request in the abnormal information processing event, to obtain multiple types of information processing Node group.

The construction module 420 is configured to obtain the abnormal feature labels of all the information processing nodes in the information processing node group, and construct the node label set of the information processing node group.

The removing module 430 is used to remove labels whose probability of occurrence in the node label set of each information processing node group is lower than a predetermined threshold to obtain a frequent item label set of each information processing node group.

The obtaining module 440 is configured to obtain the same label in the frequent item label set of the information processing node group corresponding to the associated category according to the predetermined category association relationship of the category of the information processing node group, to obtain the same label subset.

The associating module 450 is configured to associate feature tags for the association group of the same tag subset according to the association relationship between the associated classes corresponding to the same tag subset to obtain an association relationship tag set, wherein the group associated feature tags Does not belong to the node label set.

The analysis module 460 is configured to input the related information of the abnormal information processing event in the abnormal node analysis request and the associated relationship label set into the risk node analysis model to obtain the abnormal information processing node relationship.

The specific details of each module in the above-mentioned abnormal information processing node analysis device have been described in detail in the corresponding abnormal information processing node analysis method, so it will not be repeated here.

It should be noted that although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above may be embodied in one module or unit. Conversely, the features and functions of a module or unit described above can be further divided into multiple modules or units to be embodied.

In addition, although the various steps of the method in the present application are described in a specific order in the drawings, this does not require or imply that these steps must be performed in the specific order, or that all the steps shown must be performed to achieve the desired result. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step for execution, and/or one step may be decomposed into multiple steps for execution, etc.

Through the description of the above embodiments, those skilled in the art can easily understand that the example embodiments described here can be implemented by software, or can be implemented by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, U disk, mobile hard disk, etc.) or on the network , Including several instructions to make a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) execute the method according to the embodiment of the present application.

In an exemplary embodiment of the present application, an electronic device capable of implementing the above method is also provided. The electronic device may include a processor and a memory. Wherein, the memory is used to store a program such as an abnormal information processing node analysis program; the processor is configured to execute part or all of the steps in the above method by executing the abnormal information processing node analysis program. Optionally, the memory may also be referred to as a storage unit, and the processor may also be referred to as a processing unit.

Those skilled in the art can understand that various aspects of the present application can be implemented as a system, a method, or a program product. Therefore, each aspect of the present application can be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, which can be collectively referred to herein as "Circuit", "Module" or "System".

For example, the electronic device 500 according to this embodiment of the present application will be described below with reference to FIG. 5. The electronic device 500 shown in FIG. 5 is only an example, and should not bring any limitation to the function and scope of use of the embodiments of the present application.

As shown in FIG. 5, the electronic device 500 is represented in the form of a general-purpose computing device. The components of the electronic device 500 may include, but are not limited to: the aforementioned at least one processing unit 510, the aforementioned at least one storage unit 520, and a bus 530 connecting different system components (including the storage unit 520 and the processing unit 510).

Wherein, the storage unit stores program code, and the program code can be executed by the processing unit 510, so that the processing unit 510 executes the various exemplary methods described in the “Exemplary Method” section of this specification. Steps of implementation. For example, the processing unit 510 may perform the steps shown in FIG. 1.

For example, the processor or initial unit is configured to execute the following method via the execution program: when receiving an abnormal node analysis request in an abnormal information processing event, associate the abnormal information with all the information processing nodes in the processing node library according to the abnormal information The attributes of the processing event are classified to obtain multiple types of information processing node groups; the abnormal feature labels of all information processing nodes in the information processing node group are obtained, and the node label set of the information processing node group is constructed; A label whose probability of occurrence in the node label set of the information processing node group is lower than a predetermined threshold is obtained, and a frequent item label set of each information processing node group is obtained; according to the predetermined category association relationship of the category of the information processing node group, The same label in the frequent item label set of the information processing node group corresponding to the associated class is obtained, and the same label subset is obtained; according to the association relationship between the associated classes corresponding to the same label subset, the same label is Collect the associated group association feature tags to obtain an association relationship tag set, wherein the group association feature tags do not belong to the node tag set; analyze the related information of the abnormal information processing event in the abnormal node request and the association relationship tag Set the input risk node analysis model to obtain the abnormal information processing node relationship. Optionally, the processor or processing unit may also execute other steps of the method in the foregoing embodiment, which will not be repeated here.

The storage unit 520 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 5201 and/or a cache storage unit 5202, and may further include a read-only storage unit (ROM) 5203.

The storage unit 520 may also include a program/utility tool 5204 having a set of (at least one) program module 5205. Such program module 5205 includes but is not limited to: an operating system, one or more application programs, other program modules, and program data, Each of these examples or some combination may include the implementation of a network environment.

The bus 530 may represent one or more of several types of bus structures, including a storage unit bus or a storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local area using any bus structure among multiple bus structures. bus.

The electronic device 500 can also communicate with one or more external devices 700 (such as keyboards, pointing devices, Bluetooth devices, etc.), and can also communicate with one or more devices that enable customers to interact with the electronic device 500, and/or communicate with Any device (such as a router, modem, etc.) that enables the electronic device 500 to communicate with one or more other computing devices. This communication can be performed through an input/output (I/O) interface 550. In addition, the electronic device 500 may also communicate with one or more networks (for example, a local area network (LAN), a wide area network (WAN), and/or a public network, such as the Internet) through the network adapter 560. As shown in the figure, the network adapter 560 communicates with other modules of the electronic device 500 through the bus 530. It should be understood that although not shown in the figure, other hardware and/or software modules can be used in conjunction with the electronic device 500, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives And data backup storage system, etc.

Through the description of the above embodiments, those skilled in the art can easily understand that the example embodiments described here can be implemented by software, or can be implemented by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, U disk, mobile hard disk, etc.) or on the network , Including several instructions to make a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) execute the method according to the embodiment of the present application.

In the exemplary embodiment of the present application, a computer-readable storage medium is also provided, on which is stored a program product (such as an abnormal information processing node analysis program) that can implement the above-mentioned method in this specification. In some possible implementation manners, each aspect of the present application can also be implemented in the form of a program product, which includes program code. When the program product runs on a terminal device, the program code is used to make the The terminal device executes the steps according to various exemplary embodiments of the present application described in the above-mentioned "Exemplary Method" section of this specification. For example, when the program code is executed, the following method can be implemented: when an abnormal node analysis request in an abnormal information processing event is received, all information processing nodes in the abnormal information association processing node library are classified according to the attributes of the abnormal information processing event , Obtain multiple types of information processing node groups; obtain the abnormal feature labels of all the information processing nodes in the information processing node group, construct the node label set of the information processing node group; remove the information processing node group of each information processing node group If the probability of occurrence in the node label set is lower than the predetermined threshold, the frequent item label set of each information processing node group is obtained; according to the predetermined category association relationship of the category of the information processing node group, all the corresponding categories of the information processing node group are obtained. The same tags in the frequent item tag set of the information processing node group are obtained to obtain the same tag subset; according to the association relationship between the associated classes corresponding to the same tag subset, the associated feature tags are associated with the association group of the same tag subset , Obtain an association relationship tag set, wherein the group association feature tag does not belong to the node tag set; input the related information of the abnormal information processing event in the abnormal node analysis request and the association relationship tag set into the risk node analysis model , Get the relationship between abnormal information processing nodes.

Optionally, when the program code is executed, other steps of the method in the foregoing embodiment can also be implemented, which will not be repeated here. Further optionally, the storage medium involved in this application, such as a computer-readable storage medium, may be non-volatile or volatile.

Referring to FIG. 6, a program product 600 for implementing the above method according to an embodiment of the present application is described. It can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be installed in a terminal device, For example, running on a personal computer. However, the program product of this application is not limited to this. In this document, the readable storage medium can be any tangible medium that contains or stores a program, and the program can be used by or in combination with an instruction execution system, device, or device.

The program product can use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or a combination of any of the above. More specific examples (non-exhaustive list) of readable storage media include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read only memory (ROM), erasable Type programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.

The computer-readable signal medium may include a data signal propagated in baseband or as a part of a carrier wave, and readable program code is carried therein. This propagated data signal can take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. The readable signal medium may also be any readable medium other than a readable storage medium, and the readable medium may send, propagate, or transmit a program for use by or in combination with the instruction execution system, apparatus, or device.

The program code contained on the readable medium can be transmitted by any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

The program code used to perform the operations of the present application can be written in any combination of one or more programming languages. The programming languages include object-oriented programming languages—such as Java, C++, etc., as well as conventional procedural programming languages. Programming language-such as "C" language or similar programming language. The program code can be executed entirely on the client computing device, partly executed on the client device, executed as an independent software package, partly executed on the client computing device and partly executed on the remote computing device, or entirely on the remote computing device or server Executed on. In the case of a remote computing device, the remote computing device can be connected to a client computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (for example, using Internet service providers). Business to connect via the Internet).

In addition, the above-mentioned drawings are merely schematic illustrations of the processing included in the method according to the exemplary embodiments of the present application, and are not intended for limitation. It is easy to understand that the processing shown in the above drawings does not indicate or limit the time sequence of these processings. In addition, it is easy to understand that these processes can be executed synchronously or asynchronously in multiple modules, for example.

After considering the specification and practicing the invention disclosed herein, those skilled in the art will easily think of other embodiments of the present application. This application is intended to cover any variations, uses, or adaptive changes of this application. These variations, uses, or adaptive changes follow the general principles of this application and include common knowledge or customary technical means in the technical field that are not disclosed in this application. . The description and the embodiments are only regarded as exemplary, and the true scope and spirit of the application are pointed out by the claims.

Claims (20)

1. An abnormal information processing node analysis method, which includes:

   When receiving an abnormal node analysis request in an abnormal information processing event, classify all information processing nodes in the abnormal information associated processing node library according to the attributes of the abnormal information processing event to obtain multiple types of information processing node groups;

   Acquiring abnormal feature labels of all information processing nodes in the information processing node group, and constructing a node label set of the information processing node group;

   Removing labels whose probability of occurrence in the node label set of each information processing node group is lower than a predetermined threshold to obtain a frequent item label set of each information processing node group;

   Acquiring, according to the predetermined category association relationship of the category of the information processing node group, the same label in the frequent item label set of the information processing node group corresponding to the associated category to obtain the same label subset;

   According to the association relationship between the associated classes corresponding to the same tag subset, associate feature tags for the association group of the same tag subset to obtain an association relationship tag set, wherein the group associated feature tags do not belong to the node Label set

   The related information of the abnormal information processing event in the abnormal node analysis request and the associated relationship label set are input into the risk node analysis model to obtain the abnormal information processing node relationship.
2. The method according to claim 1, wherein said removing labels whose probability of occurrence in the node label set of each information processing node group is lower than a predetermined threshold is obtained to obtain a frequent item label set of each information processing node group ,include:

   Removing labels whose probability of occurrence in the node label set of the information processing node group is lower than a predetermined threshold to obtain a second node label set;

   After calculating the occurrence probability of each label in the second node label set, the labels below the predetermined threshold are removed to obtain the third node label set. When the probability of all the labels in the third node label set is higher than the When a predetermined threshold is set, the frequent item label set of the information processing node group is obtained.
3. 2. The method according to claim 1, wherein the associating feature tags for the association group of the same tag subset according to the association relationship between the associated classes corresponding to the same tag subset, to obtain an association relationship tag set, include:

   Acquiring an association relationship label template corresponding to an association relationship between associated classes corresponding to the same tag subset, where the association relationship label template includes group association feature tags and feature tags of information processing nodes;

   Searching for an association relationship tag template that includes a feature tag consistent with the same tag subset from the association relationship tag template library, to obtain a matching association relationship tag template;

   Obtain an association relationship label set based on the matched association relationship label template.
4. The method according to claim 3, wherein the obtaining an association relationship label set based on the matched association relationship label template comprises:

   From the matched association relationship label templates, obtain association relationship label templates with the number of tags exceeding a predetermined threshold as the association relationship label set.
5. The method according to claim 3, wherein the obtaining an association relationship label set based on the matched association relationship label template comprises:

   From the matched association relationship label templates, obtain an association relationship label template containing the least number of tags as the association relationship label set.
6. The method according to claim 1, wherein, in the association relationship between the associated classes corresponding to the same tag subset, the feature tags are associated with the association group of the same tag subset to obtain an association relationship tag set , Wherein, after the group associated feature label does not belong to the node label set, the method further includes:

   The risk information processing node of the target risk information processing node group is determined according to the association relationship label set corresponding to the target risk information processing node group and the frequent item label set.
7. The method according to claim 6, wherein the risk information processing node of the target risk information processing node group is determined according to the association relationship label set and the frequent item label set corresponding to the target risk information processing node group ,include:

   Determining the first set of risk information processing nodes in the target risk information processing node group according to the association relationship label set corresponding to the target risk information processing node group;

   Determining a second set of risk information processing nodes of the target risk information processing node group according to the frequent item label set corresponding to the target risk information processing node group;

   Acquiring, according to the association relationship label set corresponding to the target risk information processing node group, a third risk information processing node set of the risk information processing node group corresponding to the class associated with the target risk information processing node group;

   Acquiring the risk information processing nodes in the intersection of the first risk information processing node set and the risk information processing nodes of the second risk information processing node set that have a risk connection with the third risk information processing node centralized risk information processing node, As the risk information processing node of the target risk information processing node group.
8. An abnormal information processing node analysis device, which includes:

   The classification module is used to classify all the information processing nodes in the abnormal information association processing node database according to the attributes of the abnormal information processing event when receiving the abnormal node analysis request in the abnormal information processing event to obtain multiple types of information processing Node group

   The construction module is used to obtain the abnormal feature labels of all the information processing nodes in the information processing node group, and construct the node label set of the information processing node group;

   A removing module, configured to remove labels whose probability of occurrence in the node label set of each information processing node group is lower than a predetermined threshold to obtain a frequent item label set of each information processing node group;

   An obtaining module, configured to obtain the same label in the frequent item label set of the information processing node group corresponding to the associated class according to the predetermined class association relationship of the category of the information processing node group, to obtain the same label subset;

   The associating module is configured to associate feature labels for the association group of the same tag subset according to the association relationship between the associated classes corresponding to the same tag subset to obtain an association relationship tag set, wherein the group associated feature tags Does not belong to the node label set;

   The analysis module is used to input the related information of the abnormal information processing event in the abnormal node analysis request and the associated relationship label set into the risk node analysis model to obtain the abnormal information processing node relationship.
9. A computer-readable storage medium having an abnormal information processing node analysis program stored thereon, wherein the abnormal information processing node analysis program is executed by a processor to implement the following method:

   When receiving an abnormal node analysis request in an abnormal information processing event, classify all information processing nodes in the abnormal information associated processing node library according to the attributes of the abnormal information processing event to obtain multiple types of information processing node groups;

   Acquiring abnormal feature labels of all information processing nodes in the information processing node group, and constructing a node label set of the information processing node group;

   Removing labels whose probability of occurrence in the node label set of each information processing node group is lower than a predetermined threshold to obtain a frequent item label set of each information processing node group;

   Acquiring, according to the predetermined category association relationship of the category of the information processing node group, the same label in the frequent item label set of the information processing node group corresponding to the associated category to obtain the same label subset;

   According to the association relationship between the associated classes corresponding to the same tag subset, associate feature tags for the association group of the same tag subset to obtain an association relationship tag set, wherein the group associated feature tags do not belong to the node Label set

   The related information of the abnormal information processing event in the abnormal node analysis request and the associated relationship label set are input into the risk node analysis model to obtain the abnormal information processing node relationship.
10. 8. The computer-readable storage medium according to claim 9, wherein said removing labels whose probability of occurrence in the node label set of each information processing node group is lower than a predetermined threshold is obtained to obtain the information processing node group In the case of frequent item tag set, the specific implementation is as follows:

    Removing labels whose probability of occurrence in the node label set of the information processing node group is lower than a predetermined threshold to obtain a second node label set;

    After calculating the occurrence probability of each label in the second node label set, the labels below the predetermined threshold are removed to obtain the third node label set. When the probability of all the labels in the third node label set is higher than the When a predetermined threshold is set, the frequent item label set of the information processing node group is obtained.
11. The computer-readable storage medium according to claim 9, wherein the associated feature tags are associated with the association group of the same tag subset according to the association relationship between the associated classes corresponding to the same tag subset to obtain the association When the relationship label set, the specific realization:

    Acquiring an association relationship label template corresponding to an association relationship between associated classes corresponding to the same tag subset, where the association relationship label template includes group association feature tags and feature tags of information processing nodes;

    Searching for an association relationship tag template that includes a feature tag consistent with the same tag subset from the association relationship tag template library, to obtain a matching association relationship tag template;

    Obtain an association relationship label set based on the matched association relationship label template.
12. 11. The computer-readable storage medium according to claim 11, wherein, when obtaining the association relationship label set based on the matched association relationship label template, the specific implementation is as follows:

    From the matched association relationship label templates, obtain the association relationship label templates with the number of tags exceeding a predetermined threshold as the association relationship label set; or,

    From the matched association relationship label templates, obtain an association relationship label template containing the least number of tags as the association relationship label set.
13. 8. The computer-readable storage medium according to claim 9, wherein, in the association relationship between the associated classes corresponding to the same tag subset, associating feature tags for the association group of the same tag subset, to obtain The association relationship tag set, wherein after the group association feature tag does not belong to the node tag set, the abnormal information processing node analysis program is also used to realize when the abnormal information processing node analysis program is executed by the processor:

    The risk information processing node of the target risk information processing node group is determined according to the association relationship label set corresponding to the target risk information processing node group and the frequent item label set.
14. The computer-readable storage medium according to claim 13, wherein said determining the value of said target risk information processing node group based on said association relationship label set corresponding to said target risk information processing node group and said frequent item label set When the risk information processing node, the specific realization:

    Determining the first set of risk information processing nodes in the target risk information processing node group according to the association relationship label set corresponding to the target risk information processing node group;

    Determining a second set of risk information processing nodes of the target risk information processing node group according to the frequent item label set corresponding to the target risk information processing node group;

    Acquiring, according to the association relationship label set corresponding to the target risk information processing node group, a third risk information processing node set of the risk information processing node group corresponding to the class associated with the target risk information processing node group;

    Acquiring the risk information processing nodes in the intersection of the first risk information processing node set and the risk information processing nodes of the second risk information processing node set that have a risk connection with the third risk information processing node centralized risk information processing node, As the risk information processing node of the target risk information processing node group.
15. An electronic device, including:

    Processor; and

    The memory is used to store the abnormal information processing node analysis program of the processor; wherein the processor is configured to execute the following method by executing the abnormal information processing node analysis program:

    When receiving an abnormal node analysis request in an abnormal information processing event, classify all information processing nodes in the abnormal information associated processing node library according to the attributes of the abnormal information processing event to obtain multiple types of information processing node groups;

    Acquiring abnormal feature labels of all information processing nodes in the information processing node group, and constructing a node label set of the information processing node group;

    Removing labels whose probability of occurrence in the node label set of each information processing node group is lower than a predetermined threshold to obtain a frequent item label set of each information processing node group;

    Acquiring, according to the predetermined category association relationship of the category of the information processing node group, the same label in the frequent item label set of the information processing node group corresponding to the associated category to obtain the same label subset;

    According to the association relationship between the associated classes corresponding to the same tag subset, associate feature tags for the association group of the same tag subset to obtain an association relationship tag set, wherein the group associated feature tags do not belong to the node Label set

    The related information of the abnormal information processing event in the abnormal node analysis request and the associated relationship label set are input into the risk node analysis model to obtain the abnormal information processing node relationship.
16. The electronic device according to claim 15, wherein said removing labels whose probability of occurrence in the node label set of each information processing node group is lower than a predetermined threshold is obtained to obtain the frequent item label of each information processing node group When set, the specific implementation:

    Removing labels whose probability of occurrence in the node label set of the information processing node group is lower than a predetermined threshold to obtain a second node label set;

    After calculating the occurrence probability of each label in the second node label set, the labels below the predetermined threshold are removed to obtain the third node label set. When the probability of all the labels in the third node label set is higher than the When a predetermined threshold is set, the frequent item label set of the information processing node group is obtained.
17. The electronic device according to claim 15, wherein the associated feature tags are associated with the association group of the same tag subset according to the association relationship between the associated classes corresponding to the same tag subset to obtain an association relationship tag set When, the specific implementation:

    Acquiring an association relationship label template corresponding to an association relationship between associated classes corresponding to the same tag subset, where the association relationship label template includes group association feature tags and feature tags of information processing nodes;

    Searching for an association relationship tag template that includes a feature tag consistent with the same tag subset from the association relationship tag template library, to obtain a matching association relationship tag template;

    Obtain an association relationship label set based on the matched association relationship label template.
18. The electronic device according to claim 17, wherein, when obtaining an association relationship label set based on the matched association relationship label template, specifically executes:

    From the matched association relationship label templates, obtain the association relationship label templates with the number of tags exceeding a predetermined threshold as the association relationship label set; or,

    From the matched association relationship label templates, obtain an association relationship label template containing the least number of tags as the association relationship label set.
19. The electronic device according to claim 15, wherein the association relationship between the associated classes corresponding to the same tag subset is associated with a feature tag for the association group of the same tag subset, and an association relationship tag is obtained The processor is further configured to execute: after the group associated feature label does not belong to the node label set,

    The risk information processing node of the target risk information processing node group is determined according to the association relationship label set corresponding to the target risk information processing node group and the frequent item label set.
20. The electronic device according to claim 19, wherein the risk information processing of the target risk information processing node group is determined based on the association relationship label set corresponding to the target risk information processing node group and the frequent item label set When node, the specific execution:

    Determining the first set of risk information processing nodes in the target risk information processing node group according to the association relationship label set corresponding to the target risk information processing node group;

    Determining a second set of risk information processing nodes of the target risk information processing node group according to the frequent item label set corresponding to the target risk information processing node group;

    Acquiring, according to the association relationship label set corresponding to the target risk information processing node group, a third risk information processing node set of the risk information processing node group corresponding to the class associated with the target risk information processing node group;

    Acquiring the risk information processing nodes in the intersection of the first risk information processing node set and the risk information processing nodes of the second risk information processing node set that have a risk connection with the third risk information processing node centralized risk information processing node, As the risk information processing node of the target risk information processing node group.