WO2022142021A1 - 基于可疑社团的刷单行为检测方法、装置、设备及介质 - Google Patents

基于可疑社团的刷单行为检测方法、装置、设备及介质 Download PDF

Info

Publication number
WO2022142021A1
WO2022142021A1 PCT/CN2021/090721 CN2021090721W WO2022142021A1 WO 2022142021 A1 WO2022142021 A1 WO 2022142021A1 CN 2021090721 W CN2021090721 W CN 2021090721W WO 2022142021 A1 WO2022142021 A1 WO 2022142021A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
suspicious
node
global
suspiciousness
Prior art date
Application number
PCT/CN2021/090721
Other languages
English (en)
French (fr)
Inventor
萧梓健
杜宇衡
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2022142021A1 publication Critical patent/WO2022142021A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/018—Certifying business or products
    • G06Q30/0185—Product, service or business identity fraud
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/953—Querying, e.g. by the use of web search engines
    • G06F16/9536—Search customisation based on social or collaborative filtering
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/06—Buying, selling or leasing transactions
    • G06Q30/0601—Electronic shopping [e-shopping]
    • G06Q30/0609—Buyer or seller confidence or verification

Definitions

  • the present application relates to the field of big data technology, and in particular, to a method, device, device and medium for detecting a swiping behavior based on a suspicious community.
  • the Fraudar algorithm can be used for community detection.
  • Community detection usually refers to finding out the closely related parts of the network, and the found parts are called communities. Therefore, the connections within the community are dense, while the connections between the communities are sparse.
  • Fraudar algorithm is a suspicious community identification method based on greedy algorithm. In the iterative process of gradually greedily removing nodes with the smallest suspicious degree, the remaining nodes with the largest global suspicious degree form the dense sub-network with the highest suspicious degree.
  • the global suspicious degree of the fraudar algorithm is only the average of the suspicious degree of the node and the suspicious degree of the edge, which is insensitive to the number of nodes and the number of edges, which leads to the algorithm sometimes overfitting to maximize the suspicious degree, resulting in an unreasonable network scale, and then It is impossible to find the optimal dense subnet, and it is impossible to effectively identify suspicious communities that have fraudulent behaviors.
  • a first aspect of the present application provides a method for detecting swiping behavior based on suspicious communities, the method comprising:
  • the update network is iterated until the volume of the current network is zero, and the iteration is stopped to obtain at least one candidate network and the global suspicious degree of each candidate network;
  • a second aspect of the present application provides an electronic device comprising a memory and a processor, the memory being used to store at least one computer-readable instruction, and the processor being configured to execute the at least one computer-readable instruction to Implement the following steps:
  • the update network is iterated until the volume of the current network is zero, and the iteration is stopped to obtain at least one candidate network and the global suspicious degree of each candidate network;
  • a third aspect of the present application provides a computer-readable storage medium, where the computer-readable storage medium stores at least one computer-readable instruction, and when the at least one computer-readable instruction is executed by a processor, implements the following steps:
  • the update network is iterated until the volume of the current network is zero, and the iteration is stopped to obtain at least one candidate network and the global suspicious degree of each candidate network;
  • a fourth aspect of the present application provides a device for detecting swiping behavior based on suspicious communities, the device comprising:
  • an acquiring unit configured to acquire data to be processed according to the order-swiping behavior detection instruction when receiving the order-swiping behavior detection instruction
  • a construction unit for constructing an initial network according to the data to be processed
  • a computing unit configured to calculate the node suspiciousness of each node in the initial network, and determine a configured number of target nodes according to the node suspiciousness
  • a removing unit configured to remove the target node and the edge connected to the target node from the initial network to obtain an updated network
  • the computing unit is further configured to calculate the global suspiciousness of the update network based on the improved Fraudar algorithm
  • an iterative unit configured to iterate the update network until the volume of the current network is zero, stop the iteration, and obtain at least one candidate network and the global suspicious degree of each candidate network;
  • a screening unit configured to screen out suspicious communities from the update network and the at least one candidate network according to the global suspiciousness of the update network and the global suspiciousness of each candidate network;
  • the generating unit is configured to generate the detection result of the order brushing behavior according to the suspicious community.
  • the present application can acquire data to be processed according to the order brushing behavior detection instruction when receiving the order brushing behavior detection instruction, construct an initial network according to the pending data, and calculate the value of the initial network.
  • the node suspicious degree of each node and determine a configured number of target nodes according to the node suspicious degree, remove the target node and the edge connected to the target node from the initial network, and obtain an updated network, based on
  • the improved fraudar algorithm calculates the global suspicious degree of the update network, and introduces a penalty term in the fraudar algorithm to control the scale of the network, effectively avoid overfitting the suspicious degree function, and make the selected community more reasonable.
  • the network is iterated until the volume of the current network is zero, and the iteration is stopped to obtain at least one candidate network and the global suspicious degree of each candidate network.
  • the global suspicious degree of the updated network and the global suspicious degree of each candidate network Screen out suspicious communities from the update network and the at least one candidate network, and detect suspicious communities in combination with greedy algorithms and penalty terms, so that the detected suspicious communities have higher accuracy, and generate suspicious communities according to the suspicious communities.
  • the result of the fraudulent behavior detection, and then the automatic detection of the fraudulent behavior is realized to assist the judgment of the fraudulent risk.
  • FIG. 1 is a flow chart of a preferred embodiment of the method for detecting order brushing behavior based on suspicious communities of the present application.
  • FIG. 2 is a functional block diagram of a preferred embodiment of the device for detecting a swiping behavior based on a suspicious community in the present application.
  • FIG. 3 is a schematic structural diagram of an electronic device according to a preferred embodiment of the present application for implementing a method for detecting a swiping behavior based on a suspicious community.
  • FIG. 1 it is a flow chart of a preferred embodiment of the method for detecting swiping behavior based on suspicious communities of the present application. According to different requirements, the order of the steps in this flowchart can be changed, and some steps can be omitted.
  • the suspicious community-based brushing behavior detection method is applied to one or more electronic devices, and the electronic device is a device that can automatically perform numerical calculation and/or information processing according to pre-set or stored instructions, Its hardware includes but is not limited to microprocessors, application specific integrated circuits (ASICs), programmable gate arrays (Field-Programmable Gate Arrays, FPGAs), digital processors (Digital Signal Processors, DSPs), embedded devices Wait.
  • ASICs application specific integrated circuits
  • FPGAs Field-Programmable Gate Arrays
  • DSPs Digital Signal Processors
  • the electronic device can be any electronic product that can interact with the user, such as a personal computer, a tablet computer, a smart phone, a personal digital assistant (PDA), a game console, an interactive network television ( Internet Protocol Television, IPTV), smart wearable devices, etc.
  • a personal computer a tablet computer
  • a smart phone a personal digital assistant (PDA)
  • PDA personal digital assistant
  • IPTV interactive network television
  • smart wearable devices etc.
  • the electronic equipment may also include network equipment and/or user equipment.
  • the network device includes, but is not limited to, a single network server, a server group formed by multiple network servers, or a cloud formed by a large number of hosts or network servers based on cloud computing (Cloud Computing).
  • the network where the electronic device is located includes, but is not limited to, the Internet, a wide area network, a metropolitan area network, a local area network, a virtual private network (Virtual Private Network, VPN), and the like.
  • VPN Virtual Private Network
  • the order brushing behavior detection instruction may be triggered by a relevant staff member responsible for the order brushing detection, or may be triggered by a relevant person in charge of network security, which is not limited in this application.
  • the data to be processed may include, but is not limited to: a buyer and a purchased item.
  • the obtaining data to be processed according to the order brushing behavior detection instruction includes:
  • the information carried in the order brushing behavior detection instruction is searched, and the searched information is determined as the target database identifier;
  • the target database is called according to the target database identifier, and data is acquired from the target database as the data to be processed.
  • the preset label can be customized and configured, and the preset label has a corresponding relationship with a database identifier, and is used to locate the target database.
  • the target database may store all online shopping information on a designated platform, or all order information on a designated outlet, which is not limited in this application.
  • the data to be processed can be obtained by parsing the order brushing behavior detection instruction, which can be used for subsequent analysis and calculation.
  • the constructing an initial network according to the data to be processed includes:
  • the constructed directed bipartite graph is determined as the initial network.
  • a directed graph can be first established as an initial network according to purchase behavior, so as to perform analysis based on the initial network.
  • S12 Calculate the node suspiciousness of each node in the initial network, and determine a configured number of target nodes according to the node suspiciousness.
  • the calculating the node suspiciousness of each node in the initial network includes:
  • the in-degree of the end point of each edge refers to the sum of the times that a node in the directed graph serves as the end point of the edge in the graph. The more the number of edges connected to a node, the higher the in-degree.
  • the end point of each edge is determined according to the direction of the edge. For example, for a purchase behavior, the node where the purchased item is located is the end point.
  • the following formula can be used to calculate the edge suspicious degree of each edge according to the in-degree of the end point of each edge:
  • Node suspiciousness ⁇ edge ⁇ all edges and edges connected by nodes (edge)
  • edge represents an edge
  • the following formula can be used to determine a configured number of target nodes according to the node suspiciousness:
  • N max(1, the number of existing nodes/1000)
  • N is the configuration number.
  • S13 Remove the target node and the edge connected to the target node from the initial network to obtain an updated network.
  • the target node and the edge connected to the target node are the detected nodes with the lowest degree of suspicion, and the target node and the edge connected to the target node are removed from the initial network.
  • the global suspiciousness of the obtained update network can be made higher.
  • the following formula is used to calculate the global suspiciousness of the update network based on the improved fraudar algorithm:
  • the above embodiment introduces a penalty term into the fraudar algorithm to control the scale of the network (including the scale of nodes and edges), effectively avoid overfitting the suspicious degree function, and make the selected communities more reasonable.
  • each iteration is carried out on the basis of the network obtained after the previous iteration, and each iteration will obtain a smaller network than the previous network, until the current network volume is zero, then stop the iteration, and get the same At least one candidate network corresponding to each iteration and the global suspiciousness of each candidate network.
  • the second iteration is to reduce the network on the basis of the updated network
  • the third iteration is to reduce the network on the basis of the network obtained in the second time, and so on, until the volume of the network is If it is zero, the iteration is stopped, the networks obtained in each iteration are integrated as the at least one candidate network, and the global suspiciousness of each candidate network is obtained.
  • S16 Screen out suspicious communities from the update network and the at least one candidate network according to the global suspiciousness of the updated network and the global suspiciousness of each candidate network.
  • the filtering out suspicious communities from the update network and the at least one candidate network according to the global suspiciousness of the update network and the global suspiciousness of each candidate network includes: :
  • the network corresponding to the target global suspicious degree is determined as the suspicious community.
  • the network with the highest global suspicious degree may correspond to the network generated after a certain iteration, rather than the network obtained by the last iteration. Therefore, in this embodiment, each network obtained (that is, the updated network and the From the at least one candidate network), the network with the highest global suspiciousness is screened out as the final screened suspicious community.
  • suspicious communities can be detected in combination with the greedy algorithm and the penalty item, so that the detected suspicious communities have higher accuracy.
  • the suspicious community found by the improved fraudar algorithm is more reasonable than the suspicious community found by the original fraudar algorithm.
  • the purchasers in the suspicious community can be determined as the executors of the fraudulent behavior, and the purchased items in the suspicious community can be determined as the purchases of the fraudulent behavior target to generate the detection result of the order brushing behavior.
  • the detection result of the order brushing behavior can be saved to the blockchain.
  • the method further includes:
  • Detecting suspicious communities based on the updated network includes: detecting the updated network based on an improved fraudar algorithm, obtaining suspicious dense communities, and removing the suspicious dense communities from the updated network , and update the network;
  • the obtained suspicious community is the most suspicious sub-network, but there may be other suspicious sub-networks in the remaining networks. Although the suspicious degree of these sub-networks is lower than that of the suspicious community, they are still It has reference value. Therefore, in this embodiment, after the suspicious community is screened out, other suspicious communities can be further screened out, so as to ensure the comprehensiveness of detection.
  • this embodiment is based on the detection of each suspicious dense community.
  • the at least one suspicious dense community is sorted in order, and a sequence of suspicious dense communities is formed, so that the suspicious degree of each community is more specific.
  • the suspicious dense community sequence is fed back to a designated terminal device (such as a terminal device of a relevant person responsible for the detection of the swiping behavior, etc.) for reference, and assisting in the detection of the swiping behavior.
  • a designated terminal device such as a terminal device of a relevant person responsible for the detection of the swiping behavior, etc.
  • the suspicious community detection algorithm used in this case can also be used for other tasks, such as fraud group detection, criminal group detection, etc.
  • the corresponding data in the scheme can be changed according to specific tasks, such as fraud group detection.
  • the initial network may be a social relationship network between people, or a relationship network between prospective recruits and recommenders, and so on.
  • the present application can acquire data to be processed according to the order brushing behavior detection instruction when receiving the order brushing behavior detection instruction, construct an initial network according to the pending data, and calculate the value of the initial network.
  • the node suspicious degree of each node and determine a configured number of target nodes according to the node suspicious degree, remove the target node and the edge connected to the target node from the initial network, and obtain an updated network, based on
  • the improved fraudar algorithm calculates the global suspicious degree of the update network, and introduces a penalty term in the fraudar algorithm to control the scale of the network, effectively avoid overfitting the suspicious degree function, and make the selected community more reasonable.
  • the network is iterated until the volume of the current network is zero, and the iteration is stopped to obtain at least one candidate network and the global suspicious degree of each candidate network.
  • the global suspicious degree of the updated network and the global suspicious degree of each candidate network Screen out suspicious communities from the update network and the at least one candidate network, and detect suspicious communities in combination with greedy algorithms and penalty terms, so that the detected suspicious communities have higher accuracy, and generate suspicious communities according to the suspicious communities.
  • the result of the fraudulent behavior detection, and then the automatic detection of the fraudulent behavior is realized to assist the judgment of the fraudulent risk.
  • the suspicious community-based brushing behavior detection device 11 includes an acquisition unit 110 , a construction unit 111 , a calculation unit 112 , a removal unit 113 , an iterative unit 114 , a screening unit 115 , and a generation unit 116 .
  • the modules/units referred to in this application refer to a series of computer program segments that can be executed by the processor 13 and can perform fixed functions, and are stored in the memory 12 . In this embodiment, the functions of each module/unit will be described in detail in subsequent embodiments.
  • the acquiring unit 110 When receiving the order brushing behavior detection instruction, acquires the data to be processed according to the order brushing behavior detection instruction.
  • the order brushing behavior detection instruction may be triggered by a relevant staff member responsible for the order brushing detection, or may be triggered by a relevant person in charge of network security, which is not limited in this application.
  • the data to be processed may include, but is not limited to: a buyer and a purchased item.
  • the acquiring unit 110 acquiring the data to be processed according to the order brushing behavior detection instruction includes:
  • the information carried in the order brushing behavior detection instruction is searched, and the searched information is determined as the target database identifier;
  • the target database is called according to the target database identifier, and data is acquired from the target database as the data to be processed.
  • the preset label can be customized and configured, and the preset label has a corresponding relationship with a database identifier, and is used to locate the target database.
  • the target database may store all online shopping information on a designated platform, or all order information on a designated outlet, which is not limited in this application.
  • the data to be processed can be obtained by parsing the order brushing behavior detection instruction, which can be used for subsequent analysis and calculation.
  • the construction unit 111 constructs an initial network according to the data to be processed.
  • the construction unit 111 constructing an initial network according to the data to be processed includes:
  • the constructed directed bipartite graph is determined as the initial network.
  • a directed graph can be first established as an initial network according to purchase behavior, so as to perform analysis based on the initial network.
  • the calculating unit 112 calculates the node suspiciousness of each node in the initial network, and determines a configured number of target nodes according to the node suspiciousness.
  • the computing unit 112 computing the node suspiciousness of each node in the initial network includes:
  • the in-degree of the end point of each edge refers to the sum of the times that a node in the directed graph serves as the end point of the edge in the graph. The more the number of edges connected to a node, the higher the in-degree.
  • the end point of each edge is determined according to the direction of the edge. For example, for a purchase behavior, the node where the purchased item is located is the end point.
  • the following formula can be used to calculate the edge suspicious degree of each edge according to the in-degree of the end point of each edge:
  • Node suspiciousness ⁇ edge ⁇ all edges and edges connected by nodes (edge)
  • edge represents an edge
  • the following formula can be used to determine a configured number of target nodes according to the node suspiciousness:
  • N max(1, the number of existing nodes/1000)
  • N is the configuration number.
  • the removing unit 113 removes the target node and the edge connected to the target node from the initial network to obtain an updated network.
  • the target node and the edge connected to the target node are the detected nodes with the lowest degree of suspicion, and the target node and the edge connected to the target node are removed from the initial network.
  • the global suspiciousness of the obtained update network can be made higher.
  • the calculation unit 112 calculates the global suspiciousness of the update network based on the improved Fraudar algorithm.
  • the calculating unit 112 uses the following formula to calculate the global suspiciousness of the update network based on the improved Fraudar algorithm:
  • the above embodiment introduces a penalty term into the fraudar algorithm to control the scale of the network (including the scale of nodes and edges), effectively avoid overfitting the suspicious degree function, and make the selected communities more reasonable.
  • the iterative unit 114 iterates the update network until the volume of the current network is zero, stops the iteration, and obtains at least one candidate network and the global suspicious degree of each candidate network.
  • a node with a low degree of suspicion in the current network and an edge connected to the node are deleted to obtain a new network.
  • each iteration is carried out on the basis of the network obtained after the previous iteration, and each iteration will obtain a smaller network than the previous network, until the current network volume is zero, then stop the iteration, and get the same At least one candidate network corresponding to each iteration and the global suspiciousness of each candidate network.
  • the second iteration is to reduce the network on the basis of the updated network
  • the third iteration is to reduce the network on the basis of the network obtained in the second time, and so on, until the volume of the network is If it is zero, the iteration is stopped, the networks obtained in each iteration are integrated as the at least one candidate network, and the global suspiciousness of each candidate network is obtained.
  • the screening unit 115 filters out suspicious communities from the updated network and the at least one candidate network according to the global suspiciousness of the updated network and the global suspiciousness of each candidate network.
  • the screening unit 115 filters out the update network and the at least one candidate network according to the global suspicious degree of the update network and the global suspicious degree of each candidate network Suspicious societies include:
  • the network corresponding to the target global suspicious degree is determined as the suspicious community.
  • the network with the highest global suspicious degree may correspond to the network generated after a certain iteration, rather than the network obtained by the last iteration. Therefore, in this embodiment, each network obtained (that is, the updated network and the From the at least one candidate network), the network with the highest global suspiciousness is screened out as the final screened suspicious community.
  • suspicious communities can be detected in combination with the greedy algorithm and the penalty item, so that the detected suspicious communities have higher accuracy.
  • the suspicious community found by the improved fraudar algorithm is more reasonable than the suspicious community found by the original fraudar algorithm.
  • the generating unit 116 generates the detection result of the swiping behavior according to the suspicious community.
  • the purchasers in the suspicious community can be determined as the executors of the fraudulent behavior, and the purchased items in the suspicious community can be determined as the purchases of the fraudulent behavior target to generate the detection result of the order brushing behavior.
  • the detection result of the order brushing behavior may be saved to the blockchain.
  • the suspicious community is removed from the initial network to obtain an updated network
  • Detecting suspicious communities based on the updated network includes: detecting the updated network based on an improved fraudar algorithm, obtaining suspicious dense communities, and removing the suspicious dense communities from the updated network , and update the network;
  • the obtained suspicious community is the most suspicious sub-network, but there may be other suspicious sub-networks in the remaining networks. Although the suspicious degree of these sub-networks is lower than that of the suspicious community, they are still It has reference value. Therefore, in this embodiment, after the suspicious community is screened out, other suspicious communities can be further screened out, so as to ensure the comprehensiveness of detection.
  • this embodiment is based on the detection of each suspicious dense community.
  • the at least one suspicious dense community is sorted in order, and a sequence of suspicious dense communities is formed, so that the suspicious degree of each community is more specific.
  • the suspicious dense community sequence is fed back to a designated terminal device (such as a terminal device of a relevant person responsible for the detection of the swiping behavior, etc.) for reference, and assisting in the detection of the swiping behavior.
  • a designated terminal device such as a terminal device of a relevant person responsible for the detection of the swiping behavior, etc.
  • the suspicious community detection algorithm used in this case can also be used for other tasks, such as fraud group detection, criminal group detection, etc.
  • the corresponding data in the scheme can be changed according to specific tasks, such as fraud group detection.
  • the initial network may be a social relationship network between people, or a relationship network between prospective recruits and recommenders, and so on.
  • the present application can acquire data to be processed according to the order brushing behavior detection instruction when receiving the order brushing behavior detection instruction, construct an initial network according to the pending data, and calculate the value of the initial network.
  • the node suspicious degree of each node and determine a configured number of target nodes according to the node suspicious degree, remove the target node and the edge connected to the target node from the initial network, and obtain an updated network, based on
  • the improved fraudar algorithm calculates the global suspicious degree of the update network, and introduces a penalty term in the fraudar algorithm to control the scale of the network, effectively avoid overfitting the suspicious degree function, and make the selected community more reasonable.
  • the network is iterated until the volume of the current network is zero, and the iteration is stopped to obtain at least one candidate network and the global suspicious degree of each candidate network.
  • the global suspicious degree of the updated network and the global suspicious degree of each candidate network Screen out suspicious communities from the update network and the at least one candidate network, and detect suspicious communities in combination with greedy algorithms and penalty terms, so that the detected suspicious communities have higher accuracy, and generate suspicious communities according to the suspicious communities.
  • the result of the fraudulent behavior detection, and then the automatic detection of the fraudulent behavior is realized to assist the judgment of the fraudulent risk.
  • FIG. 3 it is a schematic structural diagram of an electronic device according to a preferred embodiment of the present application for implementing a method for detecting a swiping behavior based on a suspicious community.
  • the electronic device 1 may include a memory 12, a processor 13 and a bus, and may also include a computer program stored in the memory 12 and running on the processor 13, such as a suspicious community-based brushing behavior detection program .
  • the electronic device 1 can be either a bus-type structure or a star-shaped structure.
  • the device 1 may also include more or less other hardware or software than shown, or different component arrangements, for example, the electronic device 1 may also include input and output devices, network access devices, and the like.
  • the electronic device 1 is only an example. If other existing or possible electronic products can be adapted to this application, they should also be included in the protection scope of this application, and are incorporated herein by reference. .
  • the memory 12 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, mobile hard disk, multimedia card, card-type memory (for example: SD or DX memory, etc.), magnetic memory, magnetic disk, optical disk, etc. .
  • the memory 12 may be an internal storage unit of the electronic device 1 in some embodiments, such as a mobile hard disk of the electronic device 1 .
  • the memory 12 may also be an external storage device of the electronic device 1 in other embodiments, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) equipped on the electronic device 1 ) card, Flash Card, etc.
  • the memory 12 may also include both an internal storage unit of the electronic device 1 and an external storage device.
  • the memory 12 can not only be used to store application software and various data installed in the electronic device 1 , such as code of a suspicious community-based swipe behavior detection program, etc., but also can be used to temporarily store data that has been output or will be output.
  • the processor 13 may be composed of integrated circuits in some embodiments, for example, may be composed of a single packaged integrated circuit, or may be composed of multiple integrated circuits packaged with the same function or different functions, including one or more central processing units.
  • CPU Central Processing Unit
  • the processor 13 is the control core (Control Unit) of the electronic device 1, and uses various interfaces and lines to connect the various components of the entire electronic device 1, by running or executing the programs or modules stored in the memory 12 (such as executing Based on a suspicious community-based swipe behavior detection program, etc.), and call the data stored in the memory 12 to execute various functions of the electronic device 1 and process data.
  • the processor 13 executes the operating system of the electronic device 1 and various installed application programs.
  • the processor 13 executes the application program to implement the steps in each of the above embodiments of the suspicious community-based method for detecting order brushing behavior, for example, the steps shown in FIG. 1 .
  • the computer program may be divided into one or more modules/units, and the one or more modules/units are stored in the memory 12 and executed by the processor 13 to complete the present invention.
  • the one or more modules/units may be a series of computer-readable instruction segments capable of performing specific functions, and the instruction segments are used to describe the execution process of the computer program in the electronic device 1 .
  • the computer program may be divided into an acquisition unit 110 , a construction unit 111 , a calculation unit 112 , a removal unit 113 , an iteration unit 114 , a screening unit 115 , and a generation unit 116 .
  • the above-mentioned integrated units implemented in the form of software functional modules may be stored in a computer-readable storage medium.
  • the above-mentioned software function modules are stored in a storage medium, and include several instructions to enable a computer device (which may be a personal computer, a computer device, or a network device, etc.) or a processor (processor) to execute the based on the various embodiments of the present application. Part of the detection method of swiping behavior of suspicious communities.
  • modules/units integrated in the electronic device 1 are implemented in the form of software functional units and sold or used as independent products, they may be stored in a computer-readable storage medium. Based on this understanding, the present application can implement all or part of the processes in the methods of the above embodiments, and can also be completed by instructing relevant hardware devices through a computer program, and the computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above method embodiments can be implemented.
  • the computer program includes computer program code
  • the computer program code may be in the form of source code, object code, executable file or some intermediate form, and the like.
  • the computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, removable hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory) , random access memory, etc.
  • the computer-readable storage medium may mainly include a stored program area and a stored data area, wherein the stored program area may store an operating system, an application program required for at least one function, and the like; Use the created data, etc.
  • the computer-readable storage medium of the present application may be non-volatile or volatile.
  • the blockchain referred to in this application is a new application mode of computer technologies such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm.
  • Blockchain essentially a decentralized database, is a series of data blocks associated with cryptographic methods. Each data block contains a batch of network transaction information to verify its Validity of information (anti-counterfeiting) and generation of the next block.
  • the blockchain can include the underlying platform of the blockchain, the platform product service layer, and the application service layer.
  • the bus may be a peripheral component interconnect (PCI for short) bus or an extended industry standard architecture (EISA for short) bus or the like.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the bus can be divided into address bus, data bus, control bus and so on. For ease of representation, only one arrow is shown in FIG. 3, but it does not mean that there is only one bus or one type of bus.
  • the bus is arranged to enable connection communication between the memory 12 and at least one processor 13 and the like.
  • the electronic device 1 may also include a power source (such as a battery) for supplying power to various components, preferably, the power source may be logically connected to the at least one processor 13 through a power management device, so as to be implemented by the power management device Charge management, discharge management, and power management functions.
  • the power source may also include one or more DC or AC power sources, recharging devices, power failure detection circuits, power converters or inverters, power status indicators, and any other components.
  • the electronic device 1 may further include various sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be repeated here.
  • the electronic device 1 may also include a network interface, optionally, the network interface may include a wired interface and/or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), which is usually used in the electronic device 1 Establish a communication connection with other electronic devices.
  • a network interface optionally, the network interface may include a wired interface and/or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), which is usually used in the electronic device 1 Establish a communication connection with other electronic devices.
  • the electronic device 1 may further include a user interface, and the user interface may be a display (Display), an input unit (eg, a keyboard (Keyboard)), optionally, the user interface may also be a standard wired interface or a wireless interface.
  • the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode, organic light-emitting diode) touch device, and the like.
  • the display may also be appropriately called a display screen or a display unit, which is used for displaying information processed in the electronic device 1 and for displaying a visualized user interface.
  • FIG. 3 only shows the electronic device 1 with components 12-13. Those skilled in the art can understand that the structure shown in FIG. 3 does not constitute a limitation on the electronic device 1, and may include less than shown in the figure. Or more components, or a combination of certain components, or a different arrangement of components.
  • the memory 12 in the electronic device 1 stores a plurality of computer-readable instructions to implement a method for detecting swiping behavior based on suspicious communities, and the processor 13 can execute the plurality of instructions to implement :
  • the update network is iterated until the volume of the current network is zero, and the iteration is stopped to obtain at least one candidate network and the global suspicious degree of each candidate network;
  • modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional module in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units can be implemented in the form of hardware, or can be implemented in the form of hardware plus software function modules.

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Theoretical Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Databases & Information Systems (AREA)
  • Physics & Mathematics (AREA)
  • Finance (AREA)
  • General Physics & Mathematics (AREA)
  • Marketing (AREA)
  • Development Economics (AREA)
  • Economics (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Entrepreneurship & Innovation (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

一种基于可疑社团的刷单行为检测方法、装置、设备及介质，涉及大数据领域。能够基于改进的fraudar算法计算所述更新网络的全局可疑度，在fraudar算法中引入了惩罚项，以控制网络的规模，有效避免过拟合可疑度函数，使筛选出的社团更加合理，并结合贪心算法及惩罚项检测出可疑社团，使检测到的可疑社团具有更高的准确性，根据所述可疑社团生成刷单行为检测结果，进而实现对刷单行为的自动检测，以辅助进行刷单风险的判断。还涉及区块链技术，刷单行为检测结果可存储于区块链。

Description

基于可疑社团的刷单行为检测方法、装置、设备及介质
本申请要求于2020年12月30日提交中国专利局，申请号为202011643235.4申请名称为“基于可疑社团的刷单行为检测方法、装置、设备及介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及大数据技术领域，尤其涉及一种基于可疑社团的刷单行为检测方法、装置、设备及介质。
背景技术
随着网上购物的不断发展，刷单现象也不断涌现，发明人意识到给消费者带来较大困扰。
为了杜绝刷单行为，需要从大量的订单中检测出异常订单，通常采用的方式是检测购买者IP(Internet Protocol，网际互连协议)、购买量等，再进一步分析，以确定是否有刷单行为，但这种方式容易有漏洞，准确率不高。
或者也可以采用fraudar算法进行社团检测。社团检测通常是指将网络中联系紧密的部分找出来，被找出的部分则被称之为社团，因此，社团内部联系稠密，而社团之间联系稀疏。fraudar算法是一种基于贪婪算法的可疑社团识别方法，其在逐步贪心移除可疑度最小节点的迭代过程中，使全局可疑度达到最大的留存节点组成了可疑度最高的致密子网络。但是，fraudar算法的全局可疑度仅是节点可疑度和边可疑度的平均值，对节点数量和边数量不敏感，导致该算法有时会过度拟合可疑度最大化，导致网络规模不合理，进而无法找出最优的致密子网，也就无法有效识别到存在刷单行为的可疑社团。
发明内容
鉴于以上内容，有必要提供一种基于可疑社团的刷单行为检测方法、装置、设备及介质，能够实现对刷单行为的自动检测，以辅助进行刷单风险的判断。
本申请的第一方面提供一种基于可疑社团的刷单行为检测方法，所述方法包括：
当接收到刷单行为检测指令时，根据所述刷单行为检测指令获取待处理数据；
根据所述待处理数据构建初始网络；
计算所述初始网络中每个节点的节点可疑度，并根据所述节点可疑度确定配置数量的目标节点；
将所述目标节点及与所述目标节点连接的边从所述初始网络中移除，得到更新网络；
基于改进的fraudar算法计算所述更新网络的全局可疑度；
对所述更新网络进行迭代，直至当前网络的体积为零，停止迭代，得到至少一个备选网络及每个备选网络的全局可疑度；
根据所述更新网络的全局可疑度及每个备选网络的全局可疑度从所述更新网络及所述至少一个备选网络中筛选出可疑社团；
根据所述可疑社团生成刷单行为检测结果。
本申请的第二方面提供一种电子设备，所述电子设备包括存储器及处理器，所述存储器用于存储至少一个计算机可读指令，所述处理器用于执行所述至少一个计算机可读指令以实现以下步骤：
当接收到刷单行为检测指令时，根据所述刷单行为检测指令获取待处理数据；
根据所述待处理数据构建初始网络；
计算所述初始网络中每个节点的节点可疑度，并根据所述节点可疑度确定配置数量的目标节点；
将所述目标节点及与所述目标节点连接的边从所述初始网络中移除，得到更新网络；
基于改进的fraudar算法计算所述更新网络的全局可疑度；
对所述更新网络进行迭代，直至当前网络的体积为零，停止迭代，得到至少一个备选网络及每个备选网络的全局可疑度；
根据所述更新网络的全局可疑度及每个备选网络的全局可疑度从所述更新网络及所述至少一个备选网络中筛选出可疑社团；
根据所述可疑社团生成刷单行为检测结果。
本申请的第三方面提供一种计算机可读存储介质，所述计算机可读存储介质存储有至少一个计算机可读指令，所述至少一个计算机可读指令被处理器执行时实现以下步骤：
当接收到刷单行为检测指令时，根据所述刷单行为检测指令获取待处理数据；
根据所述待处理数据构建初始网络；
计算所述初始网络中每个节点的节点可疑度，并根据所述节点可疑度确定配置数量的目标节点；
将所述目标节点及与所述目标节点连接的边从所述初始网络中移除，得到更新网络；
基于改进的fraudar算法计算所述更新网络的全局可疑度；
对所述更新网络进行迭代，直至当前网络的体积为零，停止迭代，得到至少一个备选网络及每个备选网络的全局可疑度；
根据所述更新网络的全局可疑度及每个备选网络的全局可疑度从所述更新网络及所述至少一个备选网络中筛选出可疑社团；
根据所述可疑社团生成刷单行为检测结果。
本申请的第四方面提供一种基于可疑社团的刷单行为检测装置，所述装置包括：
获取单元，用于当接收到刷单行为检测指令时，根据所述刷单行为检测指令获取待处理数据；
构建单元，用于根据所述待处理数据构建初始网络；
计算单元，用于计算所述初始网络中每个节点的节点可疑度，并根据所述节点可疑度确定配置数量的目标节点；
移除单元，用于将所述目标节点及与所述目标节点连接的边从所述初始网络中移除，得到更新网络；
所述计算单元，还用于基于改进的fraudar算法计算所述更新网络的全局可疑度；
迭代单元，用于对所述更新网络进行迭代，直至当前网络的体积为零，停止迭代，得到至少一个备选网络及每个备选网络的全局可疑度；
筛选单元，用于根据所述更新网络的全局可疑度及每个备选网络的全局可疑度从所述更新网络及所述至少一个备选网络中筛选出可疑社团；
生成单元，用于根据所述可疑社团生成刷单行为检测结果。
由以上技术方案可以看出，本申请能够当接收到刷单行为检测指令时，根据所述刷单行为检测指令获取待处理数据，根据所述待处理数据构建初始网络，计算所述初始网络中每个节点的节点可疑度，并根据所述节点可疑度确定配置数量的目标节点，将所述目标节点及与所述目标节点连接的边从所述初始网络中移除，得到更新网络，基于改进的fraudar算法计算所述更新网络的全局可疑度，在fraudar算法中引入了惩罚项，以控制网络的规模，有效避免过拟合可疑度函数，使筛选出的社团更加合理，对所述更新网络进行迭代，直至当前网络的体积为零，停止迭代，得到至少一个备选网络及每个备选网络的全局可疑度，根据所述更新网络的全局可疑度及每个备选网络的全局可疑度从所述更新网络及所述至少一个备选网络中筛选出可疑社团，结合贪心算法及惩罚项检测出 可疑社团，使检测到的可疑社团具有更高的准确性，根据所述可疑社团生成刷单行为检测结果，进而实现对刷单行为的自动检测，以辅助进行刷单风险的判断。
附图说明
图1是本申请基于可疑社团的刷单行为检测方法的较佳实施例的流程图。
图2是本申请基于可疑社团的刷单行为检测装置的较佳实施例的功能模块图。
图3是本申请实现基于可疑社团的刷单行为检测方法的较佳实施例的电子设备的结构示意图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面结合附图和具体实施例对本申请进行详细描述。
如图1所示，是本申请基于可疑社团的刷单行为检测方法的较佳实施例的流程图。根据不同的需求，该流程图中步骤的顺序可以改变，某些步骤可以省略。
所述基于可疑社团的刷单行为检测方法应用于一个或者多个电子设备中，所述电子设备是一种能够按照事先设定或存储的指令，自动进行数值计算和/或信息处理的设备，其硬件包括但不限于微处理器、专用集成电路(Application Specific Integrated Circuit，ASIC)、可编程门阵列(Field－Programmable Gate Array，FPGA)、数字处理器(Digital Signal Processor，DSP)、嵌入式设备等。
所述电子设备可以是任何一种可与用户进行人机交互的电子产品，例如，个人计算机、平板电脑、智能手机、个人数字助理(Personal Digital Assistant，PDA)、游戏机、交互式网络电视(Internet Protocol Television，IPTV)、智能式穿戴式设备等。
所述电子设备还可以包括网络设备和/或用户设备。其中，所述网络设备包括，但不限于单个网络服务器、多个网络服务器组成的服务器组或基于云计算(Cloud Computing)的由大量主机或网络服务器构成的云。
所述电子设备所处的网络包括但不限于互联网、广域网、城域网、局域网、虚拟专用网络(Virtual Private Network，VPN)等。
S10，当接收到刷单行为检测指令时，根据所述刷单行为检测指令获取待处理数据。
在本实施例中，所述刷单行为检测指令可以由负责刷单检测的相关工作人员触发，也可以由网络安全的相关负责人触发，本申请不限制。
在本申请的至少一个实施例中，所述待处理数据可以包括，但不限于：购买者、被购买物品。
在本申请的至少一个实施例中，所述根据所述刷单行为检测指令获取待处理数据包括：
解析所述刷单行为检测指令的方法体，得到所述刷单行为检测指令的携带信息；
获取与数据库标识对应的预设标签；
根据所述预设标签建立正则表达式；
根据所述正则表达式在所述刷单行为检测指令的携带信息中进行搜索，并将搜索到的信息确定为目标数据库标识；
根据所述目标数据库标识调用目标数据库，并从所述目标数据库中获取数据作为所述待处理数据。
其中，所述预设标签可以进行自定义配置，所述预设标签与数据库标识具有对应关系，用于定位到所述目标数据库。
其中，所述目标数据库中可以存储着指定平台上的所有网购信息，或者指定网点的所有订单信息，本申请不限制。
通过上述实施方式，能够通过解析刷单行为检测指令以获取到待处理数据，以供后续分析计算使用。
S11，根据所述待处理数据构建初始网络。
在本申请的至少一个实施例中，所述根据所述待处理数据构建初始网络包括：
从所述待处理数据中识别购买行为；
确定每个购买行为的购买者及被购买物品；
以每个购买行为的购买者及被购买物品为节点，以每个购买行为的指向为边构建有向二部图；
将构建的所述有向二部图确定为所述初始网络。
通过上述实施方式，能够根据购买行为首先建立有向图作为初始网络，以便以所述初始网络为基础进行分析。
S12，计算所述初始网络中每个节点的节点可疑度，并根据所述节点可疑度确定配置数量的目标节点。
在本申请的至少一个实施例中，所述计算所述初始网络中每个节点的节点可疑度包括：
获取所述初始网络中的每条边及每条边的终点；
确定每条边的终点的入度；
根据每条边的终点的入度计算每条边的边可疑度；
确定每个节点所连接的边；
计算每个节点所连接的边的边可疑度的累加和作为每个节点的节点可疑度。
其中，每条边的终点的入度是指有向图中某节点作为图中边的终点的次数之和，节点所连接的边的数量越多，则入度越高。
在本实施例中，每条边的终点是根据边的方向而定的，例如：对于购买行为，被购买物品所在的节点即为终点。
具体地，可以采用如下公式根据每条边的终点的入度计算每条边的边可疑度：
Figure PCTCN2021090721-appb-000001
进一步地，可以采用如下公式计算每个节点所连接的边的边可疑度的累加和作为每个节点的节点可疑度：
节点可疑度＝∑ edge∈节点连接的所有边边可疑度(edge)
其中，edge表示边。
在本申请的至少一个实施例中，可以采用下述公式根据所述节点可疑度确定配置数量的目标节点：
N＝max(1,现有的节点数/1000)
其中，N为所述配置数量。
S13，将所述目标节点及与所述目标节点连接的边从所述初始网络中移除，得到更新网络。
可以理解的是，所述目标节点及与所述目标节点连接的边是被检测出的可疑度最低的节点，将所述目标节点及与所述目标节点连接的边从所述初始网络中移除，能够使得到的所述更新网络的全局可疑度更高。
在上述实施方式中，通过每次移除配置数量的节点，以提高整体的计算效率。
S14，基于改进的fraudar算法计算所述更新网络的全局可疑度。
在本申请的至少一个实施例中，采用下述公式基于改进的fraudar算法计算所述更新网络的全局可疑度：
Figure PCTCN2021090721-appb-000002
其中，
Figure PCTCN2021090721-appb-000003
上述实施方式在fraudar算法中引入了惩罚项，以控制网络的规模(包括节点规模和边的规模)，有效避免过拟合可疑度函数，使筛选出的社团更加合理。
S15，对所述更新网络进行迭代，直至当前网络的体积为零，停止迭代，得到至少一个备选网络及每个备选网络的全局可疑度。
具体地，可以参照S12-S14，以所述更新网络为基础，执行S12-S14，每次迭代过程中，删除当前的网络中可疑度低的节点及与该节点连接的边，以得到新的网络。
也就是说，每次迭代都在上一次迭代后所得到网络的基础上进行，每次迭代都会获得一个比上一个网络更小的网络，直至当前网络的体积为零，则停止迭代，得到与每次迭代对应的至少一个备选网络及每个备选网络的全局可疑度。
例如：第二次迭代是在所述更新网络的基础上进行网络的缩小，第三次迭代则是在第二次得到的网络的基础上进行网络的缩小，以此类推，直至网络的体积为零，则停止迭代，将每次迭代得到的网络进行整合，作为所述至少一个备选网络，并获取每个备选网络的全局可疑度。
S16，根据所述更新网络的全局可疑度及每个备选网络的全局可疑度从所述更新网络及所述至少一个备选网络中筛选出可疑社团。
在本申请的至少一个实施例中，所述根据所述更新网络的全局可疑度及每个备选网络的全局可疑度从所述更新网络及所述至少一个备选网络中筛选出可疑社团包括：
将所述更新网络的全局可疑度及每个备选网络的全局可疑度按照由高到低的顺序进行排序；
将排在首位的全局可疑度确定为目标全局可疑度；
将所述目标全局可疑度对应的网络确定为所述可疑社团。
可以理解的是，虽然网络在不断迭代的过程中不断缩小，但并不代表全局可疑度也随之不断提高，即很有可能仅仅缩小了网络体积，但得到的网络的全局可疑度反而降低了。
也就是说，全局可疑度最高的网络可能对应于某次迭代后产生的网络，而不是最后一次迭代得到的网络，因此，本实施方式还需要对得到的每个网络(即所述更新网络及所述至少一个备选网络)中筛选出全局可疑度最高的网络作为最终筛选出的可疑社团。
通过上述实施方式，能够结合贪心算法及惩罚项检测出可疑社团，使检测到的可疑社团具有更高的准确性。
需要说明的是，采用原有的fraudar算法检测出的可疑社团内部连接密切，与外部几乎不连接，所以fraudar算法将该子网络找了出来。但是，由于fraudar过分拟合致密性，而没有找出中间那个更合理的子网络。
为了克服这个问题，在原有的fraudar算法中引入了惩罚项，对致密子网络的规模做了限制，当子网络过分小时，会对此进行惩罚，确保致密子网络维持一定规模。
改进的fraudar算法找到的可疑社团比采用原有的fraudar算法找到的可疑社团更加合理。
S17，根据所述可疑社团生成刷单行为检测结果。
在本实施例中，在找到所述可疑社团后，即可将所述可疑社团中的购买者确定为刷单行为执行者，将所述可疑社团中的被购买物品确定为刷单行为的购买目标，以生成所述刷单行为检测结果。
在本实施例中，为了进一步确保数据被恶意篡改，可以将所述刷单行为检测结果保 存至区块链。
在本申请的至少一个实施例中，所述方法还包括：
将所述可疑社团从所述初始网络中移除，得到更新后的网络；
基于所述更新后的网络进行可疑社团检测，包括：基于改进的fraudar算法对所述更新后的网络进行检测，得到可疑致密社团，将所述可疑致密社团从所述更新后的网络中移除，并更新网络；
重复基于所述更新后的网络进行可疑社团检测，得到至少一个所述可疑致密社团；
按照每个可疑致密社团的检测顺序对所述至少一个所述可疑致密社团进行排序，得到可疑致密社团序列；
反馈所述可疑致密社团序列至指定终端设备。
可以理解的是，得到的所述可疑社团为最可疑的子网络，但是，在剩余的网络中还可能存在其他可疑的子网络，虽然这些子网络的可疑度低于所述可疑社团，但仍然具有参考价值，因此，本实施例还可以在筛选出所述可疑社团后，再进一步筛选出其他可疑社团，以保证检测的全面性。
进一步地，由于每次筛选出的都是当前网络中全局可疑度最高的子网络，因此，检测顺序越靠前，则证明可疑度越高，因此，本实施方式按照每个可疑致密社团的检测顺序对所述至少一个所述可疑致密社团进行排序，并形成可疑致密社团序列，使每个社团的可疑度更加明确。
更进一步地，反馈所述可疑致密社团序列至指定终端设备(如负责刷单行为检测的相关人员的终端设备等)，以供参考，并辅助进行刷单行为检测。
需要说明的是，本案中所采用的可疑社团检测算法也可以用于其他任务，如欺诈团体检测、犯罪团体检测等，方案中对应的数据可根据具体地任务改变，如欺诈团体检测时，所述初始网络可以为人与人之间的社交关系网络，或者准增员和推荐人之间的关系网络等。
由以上技术方案可以看出，本申请能够当接收到刷单行为检测指令时，根据所述刷单行为检测指令获取待处理数据，根据所述待处理数据构建初始网络，计算所述初始网络中每个节点的节点可疑度，并根据所述节点可疑度确定配置数量的目标节点，将所述目标节点及与所述目标节点连接的边从所述初始网络中移除，得到更新网络，基于改进的fraudar算法计算所述更新网络的全局可疑度，在fraudar算法中引入了惩罚项，以控制网络的规模，有效避免过拟合可疑度函数，使筛选出的社团更加合理，对所述更新网络进行迭代，直至当前网络的体积为零，停止迭代，得到至少一个备选网络及每个备选网络的全局可疑度，根据所述更新网络的全局可疑度及每个备选网络的全局可疑度从所述更新网络及所述至少一个备选网络中筛选出可疑社团，结合贪心算法及惩罚项检测出可疑社团，使检测到的可疑社团具有更高的准确性，根据所述可疑社团生成刷单行为检测结果，进而实现对刷单行为的自动检测，以辅助进行刷单风险的判断。
如图2所示，是本申请基于可疑社团的刷单行为检测装置的较佳实施例的功能模块图。所述基于可疑社团的刷单行为检测装置11包括获取单元110、构建单元111、计算单元112、移除单元113、迭代单元114、筛选单元115、生成单元116。本申请所称的模块/单元是指一种能够被处理器13所执行，并且能够完成固定功能的一系列计算机程序段，其存储在存储器12中。在本实施例中，关于各模块/单元的功能将在后续的实施例中详述。
当接收到刷单行为检测指令时，获取单元110根据所述刷单行为检测指令获取待处理数据。
在本实施例中，所述刷单行为检测指令可以由负责刷单检测的相关工作人员触发，也可以由网络安全的相关负责人触发，本申请不限制。
在本申请的至少一个实施例中，所述待处理数据可以包括，但不限于：购买者、被购买物品。
在本申请的至少一个实施例中，所述获取单元110根据所述刷单行为检测指令获取待处理数据包括：
解析所述刷单行为检测指令的方法体，得到所述刷单行为检测指令的携带信息；
获取与数据库标识对应的预设标签；
根据所述预设标签建立正则表达式；
根据所述正则表达式在所述刷单行为检测指令的携带信息中进行搜索，并将搜索到的信息确定为目标数据库标识；
根据所述目标数据库标识调用目标数据库，并从所述目标数据库中获取数据作为所述待处理数据。
其中，所述预设标签可以进行自定义配置，所述预设标签与数据库标识具有对应关系，用于定位到所述目标数据库。
其中，所述目标数据库中可以存储着指定平台上的所有网购信息，或者指定网点的所有订单信息，本申请不限制。
通过上述实施方式，能够通过解析刷单行为检测指令以获取到待处理数据，以供后续分析计算使用。
构建单元111根据所述待处理数据构建初始网络。
在本申请的至少一个实施例中，所述构建单元111根据所述待处理数据构建初始网络包括：
从所述待处理数据中识别购买行为；
确定每个购买行为的购买者及被购买物品；
以每个购买行为的购买者及被购买物品为节点，以每个购买行为的指向为边构建有向二部图；
将构建的所述有向二部图确定为所述初始网络。
通过上述实施方式，能够根据购买行为首先建立有向图作为初始网络，以便以所述初始网络为基础进行分析。
计算单元112计算所述初始网络中每个节点的节点可疑度，并根据所述节点可疑度确定配置数量的目标节点。
在本申请的至少一个实施例中，所述计算单元112计算所述初始网络中每个节点的节点可疑度包括：
获取所述初始网络中的每条边及每条边的终点；
确定每条边的终点的入度；
根据每条边的终点的入度计算每条边的边可疑度；
确定每个节点所连接的边；
计算每个节点所连接的边的边可疑度的累加和作为每个节点的节点可疑度。
其中，每条边的终点的入度是指有向图中某节点作为图中边的终点的次数之和，节点所连接的边的数量越多，则入度越高。
在本实施例中，每条边的终点是根据边的方向而定的，例如：对于购买行为，被购买物品所在的节点即为终点。
具体地，可以采用如下公式根据每条边的终点的入度计算每条边的边可疑度：
Figure PCTCN2021090721-appb-000004
进一步地，可以采用如下公式计算每个节点所连接的边的边可疑度的累加和作为每个节点的节点可疑度：
节点可疑度＝∑ edge∈节点连接的所有边边可疑度(edge)
其中，edge表示边。
在本申请的至少一个实施例中，可以采用下述公式根据所述节点可疑度确定配置数量的目标节点：
N＝max(1,现有的节点数/1000)
其中，N为所述配置数量。
移除单元113将所述目标节点及与所述目标节点连接的边从所述初始网络中移除，得到更新网络。
可以理解的是，所述目标节点及与所述目标节点连接的边是被检测出的可疑度最低的节点，将所述目标节点及与所述目标节点连接的边从所述初始网络中移除，能够使得到的所述更新网络的全局可疑度更高。
在上述实施方式中，通过每次移除配置数量的节点，以提高整体的计算效率。
所述计算单元112基于改进的fraudar算法计算所述更新网络的全局可疑度。
在本申请的至少一个实施例中，所述计算单元112采用下述公式基于改进的fraudar算法计算所述更新网络的全局可疑度：
Figure PCTCN2021090721-appb-000005
其中，
Figure PCTCN2021090721-appb-000006
上述实施方式在fraudar算法中引入了惩罚项，以控制网络的规模(包括节点规模和边的规模)，有效避免过拟合可疑度函数，使筛选出的社团更加合理。
迭代单元114对所述更新网络进行迭代，直至当前网络的体积为零，停止迭代，得到至少一个备选网络及每个备选网络的全局可疑度。
具体地，以所述更新网络为基础，每次迭代过程中，删除当前的网络中可疑度低的节点及与该节点连接的边，以得到新的网络。
也就是说，每次迭代都在上一次迭代后所得到网络的基础上进行，每次迭代都会获得一个比上一个网络更小的网络，直至当前网络的体积为零，则停止迭代，得到与每次迭代对应的至少一个备选网络及每个备选网络的全局可疑度。
例如：第二次迭代是在所述更新网络的基础上进行网络的缩小，第三次迭代则是在第二次得到的网络的基础上进行网络的缩小，以此类推，直至网络的体积为零，则停止迭代，将每次迭代得到的网络进行整合，作为所述至少一个备选网络，并获取每个备选网络的全局可疑度。
筛选单元115根据所述更新网络的全局可疑度及每个备选网络的全局可疑度从所述更新网络及所述至少一个备选网络中筛选出可疑社团。
在本申请的至少一个实施例中，所述筛选单元115根据所述更新网络的全局可疑度及每个备选网络的全局可疑度从所述更新网络及所述至少一个备选网络中筛选出可疑社团包括：
将所述更新网络的全局可疑度及每个备选网络的全局可疑度按照由高到低的顺序进行排序；
将排在首位的全局可疑度确定为目标全局可疑度；
将所述目标全局可疑度对应的网络确定为所述可疑社团。
可以理解的是，虽然网络在不断迭代的过程中不断缩小，但并不代表全局可疑度也随之不断提高，即很有可能仅仅缩小了网络体积，但得到的网络的全局可疑度反而降低了。
也就是说，全局可疑度最高的网络可能对应于某次迭代后产生的网络，而不是最后 一次迭代得到的网络，因此，本实施方式还需要对得到的每个网络(即所述更新网络及所述至少一个备选网络)中筛选出全局可疑度最高的网络作为最终筛选出的可疑社团。
通过上述实施方式，能够结合贪心算法及惩罚项检测出可疑社团，使检测到的可疑社团具有更高的准确性。
需要说明的是，采用原有的fraudar算法检测出的可疑社团内部连接密切，与外部几乎不连接，所以fraudar算法将该子网络找了出来。但是，由于fraudar过分拟合致密性，而没有找出中间那个更合理的子网络。
为了克服这个问题，在原有的fraudar算法中引入了惩罚项，对致密子网络的规模做了限制，当子网络过分小时，会对此进行惩罚，确保致密子网络维持一定规模。
改进的fraudar算法找到的可疑社团比采用原有的fraudar算法找到的可疑社团更加合理。
生成单元116根据所述可疑社团生成刷单行为检测结果。
在本实施例中，在找到所述可疑社团后，即可将所述可疑社团中的购买者确定为刷单行为执行者，将所述可疑社团中的被购买物品确定为刷单行为的购买目标，以生成所述刷单行为检测结果。
在本实施例中，为了进一步确保数据被恶意篡改，可以将所述刷单行为检测结果保存至区块链。
在本申请的至少一个实施例中，将所述可疑社团从所述初始网络中移除，得到更新后的网络；
基于所述更新后的网络进行可疑社团检测，包括：基于改进的fraudar算法对所述更新后的网络进行检测，得到可疑致密社团，将所述可疑致密社团从所述更新后的网络中移除，并更新网络；
重复基于所述更新后的网络进行可疑社团检测，得到至少一个所述可疑致密社团；
按照每个可疑致密社团的检测顺序对所述至少一个所述可疑致密社团进行排序，得到可疑致密社团序列；
反馈所述可疑致密社团序列至指定终端设备。
可以理解的是，得到的所述可疑社团为最可疑的子网络，但是，在剩余的网络中还可能存在其他可疑的子网络，虽然这些子网络的可疑度低于所述可疑社团，但仍然具有参考价值，因此，本实施例还可以在筛选出所述可疑社团后，再进一步筛选出其他可疑社团，以保证检测的全面性。
进一步地，由于每次筛选出的都是当前网络中全局可疑度最高的子网络，因此，检测顺序越靠前，则证明可疑度越高，因此，本实施方式按照每个可疑致密社团的检测顺序对所述至少一个所述可疑致密社团进行排序，并形成可疑致密社团序列，使每个社团的可疑度更加明确。
更进一步地，反馈所述可疑致密社团序列至指定终端设备(如负责刷单行为检测的相关人员的终端设备等)，以供参考，并辅助进行刷单行为检测。
需要说明的是，本案中所采用的可疑社团检测算法也可以用于其他任务，如欺诈团体检测、犯罪团体检测等，方案中对应的数据可根据具体地任务改变，如欺诈团体检测时，所述初始网络可以为人与人之间的社交关系网络，或者准增员和推荐人之间的关系网络等。
由以上技术方案可以看出，本申请能够当接收到刷单行为检测指令时，根据所述刷单行为检测指令获取待处理数据，根据所述待处理数据构建初始网络，计算所述初始网络中每个节点的节点可疑度，并根据所述节点可疑度确定配置数量的目标节点，将所述目标节点及与所述目标节点连接的边从所述初始网络中移除，得到更新网络，基于改进的fraudar算法计算所述更新网络的全局可疑度，在fraudar算法中引入了惩罚项，以控 制网络的规模，有效避免过拟合可疑度函数，使筛选出的社团更加合理，对所述更新网络进行迭代，直至当前网络的体积为零，停止迭代，得到至少一个备选网络及每个备选网络的全局可疑度，根据所述更新网络的全局可疑度及每个备选网络的全局可疑度从所述更新网络及所述至少一个备选网络中筛选出可疑社团，结合贪心算法及惩罚项检测出可疑社团，使检测到的可疑社团具有更高的准确性，根据所述可疑社团生成刷单行为检测结果，进而实现对刷单行为的自动检测，以辅助进行刷单风险的判断。
如图3所示，是本申请实现基于可疑社团的刷单行为检测方法的较佳实施例的电子设备的结构示意图。
所述电子设备1可以包括存储器12、处理器13和总线，还可以包括存储在所述存储器12中并可在所述处理器13上运行的计算机程序，例如基于可疑社团的刷单行为检测程序。
本领域技术人员可以理解，所述示意图仅仅是电子设备1的示例，并不构成对电子设备1的限定，所述电子设备1既可以是总线型结构，也可以是星形结构，所述电子设备1还可以包括比图示更多或更少的其他硬件或者软件，或者不同的部件布置，例如所述电子设备1还可以包括输入输出设备、网络接入设备等。
需要说明的是，所述电子设备1仅为举例，其他现有的或今后可能出现的电子产品如可适应于本申请，也应包含在本申请的保护范围以内，并以引用方式包含于此。
其中，存储器12至少包括一种类型的可读存储介质，所述可读存储介质包括闪存、移动硬盘、多媒体卡、卡型存储器(例如：SD或DX存储器等)、磁性存储器、磁盘、光盘等。存储器12在一些实施例中可以是电子设备1的内部存储单元，例如该电子设备1的移动硬盘。存储器12在另一些实施例中也可以是电子设备1的外部存储设备，例如电子设备1上配备的插接式移动硬盘、智能存储卡(Smart Media Card,SMC)、安全数字(Secure Digital,SD)卡、闪存卡(Flash Card)等。进一步地，存储器12还可以既包括电子设备1的内部存储单元也包括外部存储设备。存储器12不仅可以用于存储安装于电子设备1的应用软件及各类数据，例如基于可疑社团的刷单行为检测程序的代码等，还可以用于暂时地存储已经输出或者将要输出的数据。
处理器13在一些实施例中可以由集成电路组成，例如可以由单个封装的集成电路所组成，也可以是由多个相同功能或不同功能封装的集成电路所组成，包括一个或者多个中央处理器(Central Processing unit，CPU)、微处理器、数字处理芯片、图形处理器及各种控制芯片的组合等。处理器13是所述电子设备1的控制核心(Control Unit)，利用各种接口和线路连接整个电子设备1的各个部件，通过运行或执行存储在所述存储器12内的程序或者模块(例如执行基于可疑社团的刷单行为检测程序等)，以及调用存储在所述存储器12内的数据，以执行电子设备1的各种功能和处理数据。
所述处理器13执行所述电子设备1的操作系统以及安装的各类应用程序。所述处理器13执行所述应用程序以实现上述各个基于可疑社团的刷单行为检测方法实施例中的步骤，例如图1所示的步骤。
示例性的，所述计算机程序可以被分割成一个或多个模块/单元，所述一个或者多个模块/单元被存储在所述存储器12中，并由所述处理器13执行，以完成本申请。所述一个或多个模块/单元可以是能够完成特定功能的一系列计算机可读指令段，该指令段用于描述所述计算机程序在所述电子设备1中的执行过程。例如，所述计算机程序可以被分割成获取单元110、构建单元111、计算单元112、移除单元113、迭代单元114、筛选单元115、生成单元116。
上述以软件功能模块的形式实现的集成的单元，可以存储在一个计算机可读取存储介质中。上述软件功能模块存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机、计算机设备，或者网络设备等)或处理器(processor)执行本 申请各个实施例所述基于可疑社团的刷单行为检测方法的部分。
所述电子设备1集成的模块/单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请实现上述实施例方法中的全部或部分流程，也可以通过计算机程序来指示相关的硬件设备来完成，所述的计算机程序可存储于一计算机可读存储介质中，该计算机程序在被处理器执行时，可实现上述各个方法实施例的步骤。
其中，所述计算机程序包括计算机程序代码，所述计算机程序代码可以为源代码形式、对象代码形式、可执行文件或某些中间形式等。所述计算机可读介质可以包括：能够携带所述计算机程序代码的任何实体或装置、记录介质、U盘、移动硬盘、磁碟、光盘、计算机存储器、只读存储器(ROM，Read-Only Memory)、随机存取存储器等。
进一步地，计算机可读存储介质可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序等；存储数据区可存储根据区块链节点的使用所创建的数据等。
本申请计算机可读存储介质可以是非易失性，也可以是易失性。
本申请所指区块链是分布式数据存储、点对点传输、共识机制、加密算法等计算机技术的新型应用模式。区块链(Blockchain)，本质上是一个去中心化的数据库，是一串使用密码学方法相关联产生的数据块，每一个数据块中包含了一批次网络交易的信息，用于验证其信息的有效性(防伪)和生成下一个区块。区块链可以包括区块链底层平台、平台产品服务层以及应用服务层等。
总线可以是外设部件互连标准(peripheral component interconnect，简称PCI)总线或扩展工业标准结构(extended industry standard architecture，简称EISA)总线等。该总线可以分为地址总线、数据总线、控制总线等。为便于表示，在图3中仅用一根箭头表示，但并不表示仅有一根总线或一种类型的总线。所述总线被设置为实现所述存储器12以及至少一个处理器13等之间的连接通信。
尽管未示出，所述电子设备1还可以包括给各个部件供电的电源(比如电池)，优选地，电源可以通过电源管理装置与所述至少一个处理器13逻辑相连，从而通过电源管理装置实现充电管理、放电管理、以及功耗管理等功能。电源还可以包括一个或一个以上的直流或交流电源、再充电装置、电源故障检测电路、电源转换器或者逆变器、电源状态指示器等任意组件。所述电子设备1还可以包括多种传感器、蓝牙模块、Wi-Fi模块等，在此不再赘述。
进一步地，所述电子设备1还可以包括网络接口，可选地，所述网络接口可以包括有线接口和/或无线接口(如WI-FI接口、蓝牙接口等)，通常用于在该电子设备1与其他电子设备之间建立通信连接。
可选地，该电子设备1还可以包括用户接口，用户接口可以是显示器(Display)、输入单元(比如键盘(Keyboard))，可选地，用户接口还可以是标准的有线接口、无线接口。可选地，在一些实施例中，显示器可以是LED显示器、液晶显示器、触控式液晶显示器以及OLED(Organic Light-Emitting Diode，有机发光二极管)触摸器等。其中，显示器也可以适当的称为显示屏或显示单元，用于显示在电子设备1中处理的信息以及用于显示可视化的用户界面。
应该了解，所述实施例仅为说明之用，在专利申请范围上并不受此结构的限制。
图3仅示出了具有组件12-13的电子设备1，本领域技术人员可以理解的是，图3示出的结构并不构成对所述电子设备1的限定，可以包括比图示更少或者更多的部件，或者组合某些部件，或者不同的部件布置。
结合图1，所述电子设备1中的所述存储器12存储多个计算机可读指令以实现一种基于可疑社团的刷单行为检测方法，所述处理器13可执行所述多个指令从而实现：
当接收到刷单行为检测指令时，根据所述刷单行为检测指令获取待处理数据；
根据所述待处理数据构建初始网络；
计算所述初始网络中每个节点的节点可疑度，并根据所述节点可疑度确定配置数量的目标节点；
将所述目标节点及与所述目标节点连接的边从所述初始网络中移除，得到更新网络；
基于改进的fraudar算法计算所述更新网络的全局可疑度；
对所述更新网络进行迭代，直至当前网络的体积为零，停止迭代，得到至少一个备选网络及每个备选网络的全局可疑度；
根据所述更新网络的全局可疑度及每个备选网络的全局可疑度从所述更新网络及所述至少一个备选网络中筛选出可疑社团；
根据所述可疑社团生成刷单行为检测结果。
具体地，所述处理器13对上述指令的具体实现方法可参考图1对应实施例中相关步骤的描述，在此不赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述模块的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
所述作为分离部件说明的模块可以是或者也可以不是物理上分开的，作为模块显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能模块可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能模块的形式实现。
对于本领域技术人员而言，显然本申请不限于上述示范性实施例的细节，而且在不背离本申请的精神或基本特征的情况下，能够以其他的具体形式实现本申请。
因此，无论从哪一点来看，均应将实施例看作是示范性的，而且是非限制性的，本申请的范围由所附权利要求而不是上述说明限定，因此旨在将落在权利要求的等同要件的含义和范围内的所有变化涵括在本申请内。不应将权利要求中的任何附关联图标记视为限制所涉及的权利要求。
此外，显然“包括”一词不排除其他单元或步骤，单数不排除复数。说明书中陈述的多个单元或装置也可以由一个单元或装置通过软件或者硬件来实现。第一、第二等词语用来表示名称，而并不表示任何特定的顺序。
最后应说明的是，以上实施例仅用以说明本申请的技术方案而非限制，尽管参照较佳实施例对本申请进行了详细说明，本领域的普通技术人员应当理解，可以对本申请的技术方案进行修改或等同替换，而不脱离本申请技术方案的精神和范围。

Claims (20)

  1. 一种基于可疑社团的刷单行为检测方法，其中，所述基于可疑社团的刷单行为检测方法包括：
    当接收到刷单行为检测指令时，根据所述刷单行为检测指令获取待处理数据；
    根据所述待处理数据构建初始网络；
    计算所述初始网络中每个节点的节点可疑度，并根据所述节点可疑度确定配置数量的目标节点；
    将所述目标节点及与所述目标节点连接的边从所述初始网络中移除，得到更新网络；
    基于改进的fraudar算法计算所述更新网络的全局可疑度；
    对所述更新网络进行迭代，直至当前网络的体积为零，停止迭代，得到至少一个备选网络及每个备选网络的全局可疑度；
    根据所述更新网络的全局可疑度及每个备选网络的全局可疑度从所述更新网络及所述至少一个备选网络中筛选出可疑社团；
    根据所述可疑社团生成刷单行为检测结果。
  2. 如权利要求1所述的基于可疑社团的刷单行为检测方法，其中，所述根据所述刷单行为检测指令获取待处理数据包括：
    解析所述刷单行为检测指令的方法体，得到所述刷单行为检测指令的携带信息；
    获取与数据库标识对应的预设标签；
    根据所述预设标签建立正则表达式；
    根据所述正则表达式在所述刷单行为检测指令的携带信息中进行搜索，并将搜索到的信息确定为目标数据库标识；
    根据所述目标数据库标识调用目标数据库，并从所述目标数据库中获取数据作为所述待处理数据。
  3. 如权利要求1所述的基于可疑社团的刷单行为检测方法，其中，所述根据所述待处理数据构建初始网络包括：
    从所述待处理数据中识别购买行为；
    确定每个购买行为的购买者及被购买物品；
    以每个购买行为的购买者及被购买物品为节点，以每个购买行为的指向为边构建有向二部图；
    将构建的所述有向二部图确定为所述初始网络。
  4. 如权利要求1所述的基于可疑社团的刷单行为检测方法，其中，所述计算所述初始网络中每个节点的节点可疑度包括：
    获取所述初始网络中的每条边及每条边的终点；
    确定每条边的终点的入度；
    根据每条边的终点的入度计算每条边的边可疑度；
    确定每个节点所连接的边；
    计算每个节点所连接的边的边可疑度的累加和作为每个节点的节点可疑度。
  5. 如权利要求1所述的基于可疑社团的刷单行为检测方法，其中，采用下述公式基于改进的fraudar算法计算所述更新网络的全局可疑度：
    Figure PCTCN2021090721-appb-100001
    其中，
    Figure PCTCN2021090721-appb-100002
  6. 如权利要求1所述的基于可疑社团的刷单行为检测方法，其中，所述根据所述更新网 络的全局可疑度及每个备选网络的全局可疑度从所述更新网络及所述至少一个备选网络中筛选出可疑社团包括：
    将所述更新网络的全局可疑度及每个备选网络的全局可疑度按照由高到低的顺序进行排序；
    将排在首位的全局可疑度确定为目标全局可疑度；
    将所述目标全局可疑度对应的网络确定为所述可疑社团。
  7. 如权利要求1所述的基于可疑社团的刷单行为检测方法，其中，所述方法还包括：
    将所述可疑社团从所述初始网络中移除，得到更新后的网络；
    基于所述更新后的网络进行可疑社团检测，包括：基于改进的fraudar算法对所述更新后的网络进行检测，得到可疑致密社团，将所述可疑致密社团从所述更新后的网络中移除，并更新网络；
    重复基于所述更新后的网络进行可疑社团检测，得到至少一个所述可疑致密社团；
    按照每个可疑致密社团的检测顺序对所述至少一个所述可疑致密社团进行排序，得到可疑致密社团序列；
    反馈所述可疑致密社团序列至指定终端设备。
  8. 一种电子设备，其中，所述电子设备包括存储器及处理器，所述存储器用于存储至少一个计算机可读指令，所述处理器用于执行所述至少一个计算机可读指令以实现以下步骤：
    当接收到刷单行为检测指令时，根据所述刷单行为检测指令获取待处理数据；
    根据所述待处理数据构建初始网络；
    计算所述初始网络中每个节点的节点可疑度，并根据所述节点可疑度确定配置数量的目标节点；
    将所述目标节点及与所述目标节点连接的边从所述初始网络中移除，得到更新网络；
    基于改进的fraudar算法计算所述更新网络的全局可疑度；
    对所述更新网络进行迭代，直至当前网络的体积为零，停止迭代，得到至少一个备选网络及每个备选网络的全局可疑度；
    根据所述更新网络的全局可疑度及每个备选网络的全局可疑度从所述更新网络及所述至少一个备选网络中筛选出可疑社团；
    根据所述可疑社团生成刷单行为检测结果。
  9. 如权利要求8所述的电子设备，其中，所述处理器执行所述至少一个计算机可读指令以实现所述根据所述刷单行为检测指令获取待处理数据时，具体包括：
    解析所述刷单行为检测指令的方法体，得到所述刷单行为检测指令的携带信息；
    获取与数据库标识对应的预设标签；
    根据所述预设标签建立正则表达式；
    根据所述正则表达式在所述刷单行为检测指令的携带信息中进行搜索，并将搜索到的信息确定为目标数据库标识；
    根据所述目标数据库标识调用目标数据库，并从所述目标数据库中获取数据作为所述待处理数据。
  10. 如权利要求8所述的电子设备，其中，所述处理器执行所述至少一个计算机可读指令以实现所述根据所述待处理数据构建初始网络时，具体包括：
    从所述待处理数据中识别购买行为；
    确定每个购买行为的购买者及被购买物品；
    以每个购买行为的购买者及被购买物品为节点，以每个购买行为的指向为边构建有向二部图；
    将构建的所述有向二部图确定为所述初始网络。
  11. 如权利要求8所述的电子设备，其中，所述处理器执行所述至少一个计算机可读指令以实现所述计算所述初始网络中每个节点的节点可疑度时，具体包括：
    获取所述初始网络中的每条边及每条边的终点；
    确定每条边的终点的入度；
    根据每条边的终点的入度计算每条边的边可疑度；
    确定每个节点所连接的边；
    计算每个节点所连接的边的边可疑度的累加和作为每个节点的节点可疑度。
  12. 如权利要求8所述的电子设备，其中，所述处理器执行所述至少一个计算机可读指令以实现采用下述公式基于改进的fraudar算法计算所述更新网络的全局可疑度：
    Figure PCTCN2021090721-appb-100003
    其中，
    Figure PCTCN2021090721-appb-100004
  13. 如权利要求8所述的电子设备，其中，所述处理器执行所述至少一个计算机可读指令以实现所述根据所述更新网络的全局可疑度及每个备选网络的全局可疑度从所述更新网络及所述至少一个备选网络中筛选出可疑社团时，具体包括：
    将所述更新网络的全局可疑度及每个备选网络的全局可疑度按照由高到低的顺序进行排序；
    将排在首位的全局可疑度确定为目标全局可疑度；
    将所述目标全局可疑度对应的网络确定为所述可疑社团。
  14. 一种计算机可读存储介质，其中，所述计算机可读存储介质存储有至少一个计算机可读指令，所述至少一个计算机可读指令被处理器执行时实现以下步骤：
    当接收到刷单行为检测指令时，根据所述刷单行为检测指令获取待处理数据；
    根据所述待处理数据构建初始网络；
    计算所述初始网络中每个节点的节点可疑度，并根据所述节点可疑度确定配置数量的目标节点；
    将所述目标节点及与所述目标节点连接的边从所述初始网络中移除，得到更新网络；
    基于改进的fraudar算法计算所述更新网络的全局可疑度；
    对所述更新网络进行迭代，直至当前网络的体积为零，停止迭代，得到至少一个备选网络及每个备选网络的全局可疑度；
    根据所述更新网络的全局可疑度及每个备选网络的全局可疑度从所述更新网络及所述至少一个备选网络中筛选出可疑社团；
    根据所述可疑社团生成刷单行为检测结果。
  15. 如权利要求14所述的存储介质，其中，所述至少一个计算机可读指令被所述处理器执行以实现所述根据所述刷单行为检测指令获取待处理数据时，具体包括：
    解析所述刷单行为检测指令的方法体，得到所述刷单行为检测指令的携带信息；
    获取与数据库标识对应的预设标签；
    根据所述预设标签建立正则表达式；
    根据所述正则表达式在所述刷单行为检测指令的携带信息中进行搜索，并将搜索到的信息确定为目标数据库标识；
    根据所述目标数据库标识调用目标数据库，并从所述目标数据库中获取数据作为所述待处理数据。
  16. 如权利要求14所述的存储介质，其中，所述至少一个计算机可读指令被所述 处理器执行以实现所述根据所述待处理数据构建初始网络时，具体包括：
    从所述待处理数据中识别购买行为；
    确定每个购买行为的购买者及被购买物品；
    以每个购买行为的购买者及被购买物品为节点，以每个购买行为的指向为边构建有向二部图；
    将构建的所述有向二部图确定为所述初始网络。
  17. 如权利要求14所述的存储介质，其中，所述至少一个计算机可读指令被所述处理器执行以实现所述计算所述初始网络中每个节点的节点可疑度时，具体包括：
    获取所述初始网络中的每条边及每条边的终点；
    确定每条边的终点的入度；
    根据每条边的终点的入度计算每条边的边可疑度；
    确定每个节点所连接的边；
    计算每个节点所连接的边的边可疑度的累加和作为每个节点的节点可疑度。
  18. 如权利要求14所述的存储介质，其中，所述至少一个计算机可读指令被所述处理器执行以实现采用下述公式基于改进的fraudar算法计算所述更新网络的全局可疑度：
    Figure PCTCN2021090721-appb-100005
    其中，
    Figure PCTCN2021090721-appb-100006
  19. 如权利要求14所述的存储介质，其中，所述至少一个计算机可读指令被所述处理器执行以实现所述根据所述更新网络的全局可疑度及每个备选网络的全局可疑度从所述更新网络及所述至少一个备选网络中筛选出可疑社团时，具体包括：
    将所述更新网络的全局可疑度及每个备选网络的全局可疑度按照由高到低的顺序进行排序；
    将排在首位的全局可疑度确定为目标全局可疑度；
    将所述目标全局可疑度对应的网络确定为所述可疑社团。
  20. 一种基于可疑社团的刷单行为检测装置，其中，所述基于可疑社团的刷单行为检测装置包括：
    获取单元，用于当接收到刷单行为检测指令时，根据所述刷单行为检测指令获取待处理数据；
    构建单元，用于根据所述待处理数据构建初始网络；
    计算单元，用于计算所述初始网络中每个节点的节点可疑度，并根据所述节点可疑度确定配置数量的目标节点；
    移除单元，用于将所述目标节点及与所述目标节点连接的边从所述初始网络中移除，得到更新网络；
    所述计算单元，还用于基于改进的fraudar算法计算所述更新网络的全局可疑度；
    迭代单元，用于对所述更新网络进行迭代，直至当前网络的体积为零，停止迭代，得到至少一个备选网络及每个备选网络的全局可疑度；
    筛选单元，用于根据所述更新网络的全局可疑度及每个备选网络的全局可疑度从所述更新网络及所述至少一个备选网络中筛选出可疑社团；
    生成单元，用于根据所述可疑社团生成刷单行为检测结果。
PCT/CN2021/090721 2020-12-30 2021-04-28 基于可疑社团的刷单行为检测方法、装置、设备及介质 WO2022142021A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011643235.4A CN112700261B (zh) 2020-12-30 2020-12-30 基于可疑社团的刷单行为检测方法、装置、设备及介质
CN202011643235.4 2020-12-30

Publications (1)

Publication Number Publication Date
WO2022142021A1 true WO2022142021A1 (zh) 2022-07-07

Family

ID=75514177

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/090721 WO2022142021A1 (zh) 2020-12-30 2021-04-28 基于可疑社团的刷单行为检测方法、装置、设备及介质

Country Status (2)

Country Link
CN (1) CN112700261B (zh)
WO (1) WO2022142021A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115037561A (zh) * 2022-08-10 2022-09-09 杭州悦数科技有限公司 一种网络安全检测方法和系统

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112700261B (zh) * 2020-12-30 2023-06-06 平安科技（深圳）有限公司 基于可疑社团的刷单行为检测方法、装置、设备及介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107590504A (zh) * 2017-07-31 2018-01-16 阿里巴巴集团控股有限公司 异常主体识别方法和装置、服务器
CN108259637A (zh) * 2017-11-30 2018-07-06 湖北大学 一种基于决策树的nat设备识别方法及装置
CN109753797A (zh) * 2018-12-10 2019-05-14 中国科学院计算技术研究所 针对流式图的密集子图检测方法及系统
CN112700261A (zh) * 2020-12-30 2021-04-23 平安科技（深圳）有限公司 基于可疑社团的刷单行为检测方法、装置、设备及介质

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9787640B1 (en) * 2014-02-11 2017-10-10 DataVisor Inc. Using hypergraphs to determine suspicious user activities
CN109949046B (zh) * 2018-11-02 2023-06-09 创新先进技术有限公司 风险团伙的识别方法和装置
CN111951021B (zh) * 2019-05-15 2024-07-02 财付通支付科技有限公司 一种可疑社团的发现方法和装置、存储介质及计算机设备
CN112016934B (zh) * 2019-05-31 2023-12-29 慧安金科（北京）科技有限公司 用于检测异常数据的方法、设备和计算机可读存储介质
CN112116377A (zh) * 2020-08-13 2020-12-22 北京三快在线科技有限公司 刷单检测方法、装置、电子设备及可读存储介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107590504A (zh) * 2017-07-31 2018-01-16 阿里巴巴集团控股有限公司 异常主体识别方法和装置、服务器
CN108259637A (zh) * 2017-11-30 2018-07-06 湖北大学 一种基于决策树的nat设备识别方法及装置
CN109753797A (zh) * 2018-12-10 2019-05-14 中国科学院计算技术研究所 针对流式图的密集子图检测方法及系统
CN112700261A (zh) * 2020-12-30 2021-04-23 平安科技（深圳）有限公司 基于可疑社团的刷单行为检测方法、装置、设备及介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
ANONYMOUS: "How to use Fraudar to counter fraudulent billing under complex network relationships?", IT610, 20 November 2020 (2020-11-20), XP055949291, Retrieved from the Internet <URL:www.it610.com/article/1347370166752718848.htm> *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115037561A (zh) * 2022-08-10 2022-09-09 杭州悦数科技有限公司 一种网络安全检测方法和系统

Also Published As

Publication number Publication date
CN112700261A (zh) 2021-04-23
CN112700261B (zh) 2023-06-06

Similar Documents

Publication Publication Date Title
WO2021174944A1 (zh) 基于目标对象活跃度的消息推送方法及相关设备
WO2022142021A1 (zh) 基于可疑社团的刷单行为检测方法、装置、设备及介质
CN111782900B (zh) 异常业务检测方法、装置、电子设备及存储介质
CN111427971B (zh) 用于计算机系统的业务建模方法、装置、系统和介质
CN111142863B (zh) 一种页面生成的方法及装置
CN112667825B (zh) 基于知识图谱的智能推荐方法、装置、设备及存储介质
CN113806434B (zh) 大数据处理方法、装置、设备及介质
CN111666415A (zh) 话题聚类方法、装置、电子设备及存储介质
WO2020151321A1 (zh) 基于图计算技术的理赔反欺诈方法、装置、设备及存储介质
CN110555172A (zh) 用户关系挖掘方法及装置、电子设备和存储介质
CN112181386B (zh) 一种基于软件持续集成的代码构建方法、装置及终端
CN112733531B (zh) 虚拟资源分配方法、装置、电子设备及计算机存储介质
CN113051480A (zh) 资源推送方法、装置、电子设备及存储介质
CN112380454A (zh) 培训课程推荐方法、装置、设备及介质
CN116541883A (zh) 基于信任的差分隐私保护方法、装置、设备及存储介质
CN115081538A (zh) 基于机器学习的客户关系识别方法、装置、设备及介质
CN114612194A (zh) 产品推荐方法、装置、电子设备及存储介质
CN112199483B (zh) 信息录入辅助方法、装置、电子设备及存储介质
CN111950707B (zh) 基于行为共现网络的行为预测方法、装置、设备及介质
CN113591881A (zh) 基于模型融合的意图识别方法、装置、电子设备及介质
CN111429085A (zh) 合同数据生成方法、装置、电子设备及存储介质
CN112597752A (zh) 投诉文本的处理方法、装置、电子设备及存储介质
CN109949090A (zh) 客户推荐方法、装置、电子设备及介质
CN111667018A (zh) 一种对象聚类的方法、装置、计算机可读介质及电子设备
CN111652741B (zh) 用户偏好分析方法、装置及可读存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21912783

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21912783

Country of ref document: EP

Kind code of ref document: A1