WO2021239004A1 - Abnormal community detection method and apparatus, computer device, and storage medium - Google Patents

Abstract

An abnormal community detection method comprises: constructing a guarantee relationship network, and segmenting the guarantee relationship network so as to obtain communities having abnormal guarantee relationships (S200); determining feature information of each of the communities, wherein the feature information comprises at least one of the following: a node scale, an edge scale, a clustering coefficient, the number of connected triangles, and an average degree (S300); determining, according to the feature information, communities having similar features to be a relationship cluster (S400); calculating the respective Euclidean distances of relationship clusters (S500); classifying the relationship clusters according to the Euclidean distances, and determining whether or not a relationship cluster is an abnormal cluster on the basis of a classification result (S600); and if so, determining that communities in the abnormal cluster are abnormal communities, and extracting the abnormal communities (S700). The method achieves efficient extraction of abnormal communities. In addition, the method relates to blockchain technology as the feature information can be stored in a blockchain.

Description

Abnormal community detection method, device, computer equipment and storage medium

This application is required to be submitted to the Chinese Patent Office on May 27, 2020, the application number is 202010462900.3, the name of the invention The priority of the Chinese patent application called "abnormal community detection method, device, computer equipment and storage medium", which The entire content is incorporated into this application by reference.

Technical field

This application relates to the field of data processing technology, and in particular to an abnormal community detection method, device, computer equipment, and storage medium.

Background technique

At present, various insurance fraud methods emerge in an endless stream in the financial scene, and insurance fraudsters mainly commit fraud through single-person crimes and continuous guarantees by multiple persons. The abnormal risk control methods for these two guarantee modes are also different. For single-person crimes, individuals are usually used as a single point of data, and accounts with certain abnormal characteristics are found through methods such as clustering and isolated forests to determine the perpetrators. , The risk control method is attribute-based prediction, and the analysis method has become mature; for the method of multi-person collaborative crime, the analyst defines the possible abnormal guarantee structure according to business rules, and then manually compares the data in the data Analysis and other operations to determine the perpetrators, this risk control method is based on structure prediction.

At present, the perpetrators are gradually leaning towards multi-person collaborative crimes. The inventor found that in the case of multi-guarantee relations, the community is complicated. When the situation occurs, it is necessary to summarize and solve the new fraudulent insurance situation. This method requires a large amount of data and the analysis takes a long time. As a result, when multiple people commit crimes, the current case cannot be quickly targeted and analyzed, leading to the case The analysis efficiency is low, and the abnormal communities in the community cannot be efficiently and quickly extracted.

Summary of the invention

The purpose of the embodiments of the present application is to propose an abnormal community detection method, device, computer equipment, and storage medium, which aims to solve the technical problem that the abnormal community cannot be efficiently extracted under the condition of multiple guarantee relationships.

In order to solve the above technical problems, an embodiment of the present application provides an abnormal community detection method, which adopts the following technical solutions:

An abnormal community detection method includes the following steps:

Construct a network of guarantee relations, segment the said network of guarantee relations, and obtain communities with abnormal guarantee relations;

Determining feature information of the community, where the feature information includes at least one of node size, edge size, aggregation coefficient, number of connected triangles, and average degree;

According to the feature information, a community with similar features is determined as a relationship cluster;

Calculating the Euclidean distance of the relation cluster;

Classify the relationship clusters according to the Euclidean distance, and determine whether the relationship clusters are abnormal clusters based on the classification results;

When it is determined that the relationship cluster is an abnormal cluster, it is determined that the community in the abnormal cluster is an abnormal community, and the abnormal community is extracted.

In order to solve the above technical problems, an embodiment of the present application also provides an abnormal community detection device, which adopts the following technical solutions:

The segmentation module is used to construct a guarantee relationship network, segment the guarantee relationship network, and obtain communities with abnormal guarantee relationships;

The first confirmation module is configured to determine feature information of the community, where the feature information includes at least one of node size, edge size, aggregation coefficient, number of connected triangles, and average degree;

The second confirmation module is used to determine a community with similar characteristics as a relationship cluster according to the characteristic information;

A calculation module for calculating the Euclidean distance of the relationship cluster;

A classification module, configured to classify the relationship clusters according to the Euclidean distance, and determine whether the relationship clusters are abnormal clusters based on the classification results;

The extraction module is used to extract the abnormal community when the community in the abnormal cluster is determined to be an abnormal cluster.

In order to solve the above technical problems, an embodiment of the present application also provides a computer device, including a memory and a processor, and computer-readable instructions stored in the memory and capable of running on the processor, and the processor executes The computer-readable instructions further implement the following steps:

Construct a network of guarantee relations, segment the said network of guarantee relations, and obtain communities with abnormal guarantee relations;

Determining feature information of the community, where the feature information includes at least one of node size, edge size, aggregation coefficient, number of connected triangles, and average degree;

According to the feature information, a community with similar features is determined as a relationship cluster;

Calculating the Euclidean distance of the relation cluster;

Classify the relationship clusters according to the Euclidean distance, and determine whether the relationship clusters are abnormal clusters based on the classification results;

When it is determined that the relationship cluster is an abnormal cluster, it is determined that the community in the abnormal cluster is an abnormal community, and the abnormal community is extracted.

In order to solve the above technical problems, the embodiments of the present application also provide a computer-readable storage medium, the computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the processing The device also performs the following steps:

Construct a network of guarantee relations, segment the said network of guarantee relations, and obtain communities with abnormal guarantee relations;

Determining feature information of the community, where the feature information includes at least one of node size, edge size, aggregation coefficient, number of connected triangles, and average degree;

According to the feature information, a community with similar features is determined as a relationship cluster;

Calculating the Euclidean distance of the relation cluster;

Classify the relationship clusters according to the Euclidean distance, and determine whether the relationship clusters are abnormal clusters based on the classification results;

When it is determined that the relationship cluster is an abnormal cluster, it is determined that the community in the abnormal cluster is an abnormal community, and the abnormal community is extracted.

The above-mentioned abnormal community detection method, device, computer equipment and storage medium, by constructing a guarantee relationship network and segmenting the guarantee relationship network, obtain communities with abnormal guarantee relationships; the communities with abnormal guarantee relationships include those with abnormal guarantee relationships The collection of accounts, in a large-scale guarantee relationship network, will be divided into communities of the order of millions or even tens of millions. Therefore, when the community with the abnormal guarantee relationship is obtained, the characteristic information of the community is determined. Among them, The feature information includes at least one of node size, edge size, clustering coefficient, number of connected triangles, and average degree; according to the feature information, a community with similar features is determined to be a relationship cluster, and there are communities with similar features. It may be the same abnormal communities. Therefore, the communities with similar characteristics are grouped into a relationship cluster; the Euclidean distance of the relationship cluster is calculated, and the abnormal communities in the relationship cluster are further determined according to the Euclidean distance, that is, according to the Euclidean distance. Categorize the relationship clusters based on the distance, determine whether the relationship cluster is an abnormal cluster based on the classification result, when determining that the relationship cluster is an abnormal cluster, determine that the community in the abnormal cluster is an abnormal community, and extract the abnormal community , Thereby achieving the effect of efficiently extracting abnormal communities in the case of multi-guarantee relationships.

Description of the drawings

In order to explain the solution in this application more clearly, the following will briefly introduce the drawings used in the description of the embodiments of the application. Obviously, the drawings in the following description are some embodiments of the application. Ordinary technicians can obtain other drawings based on these drawings without creative work.

Figure 1 is an exemplary system architecture diagram to which the present application can be applied;

FIG. 2 is a schematic flowchart of a method for detecting abnormal communities provided by an embodiment of the present application;

Fig. 3 is a schematic diagram of a guarantee relationship network in an embodiment of the present application;

Fig. 4 is a schematic diagram of a guarantee mode in an embodiment of the present application;

FIG. 5 is a schematic structural diagram of an embodiment of the abnormal community detection device of the present application;

Fig. 6 is a schematic structural diagram of an embodiment of the computer device of the present application.

Reference signs: segmentation module 910, first confirmation module 920, second confirmation module 930, calculation module 940, classification module 950, extraction module 960.

Detailed ways

Unless otherwise defined, all technical and scientific terms used herein have the same meanings as commonly understood by those skilled in the technical field of the application; the terms used in the specification of the application herein are only for describing specific embodiments. The purpose is not to limit the application; the terms "including" and "having" in the description and claims of the application and the above-mentioned description of the drawings and any variations thereof are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of this application or the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific sequence.

Reference to "embodiments" herein means that a specific feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment mutually exclusive with other embodiments. Those skilled in the art clearly and implicitly understand that the embodiments described herein can be combined with other embodiments.

In order to make the objectives, technical solutions, and advantages of this application clearer, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present application, and are not used to limit the present application. Based on the embodiments in this application, all other embodiments obtained by a person of ordinary skill in the art without creative work shall fall within the protection scope of this application.

As shown in FIG. 1, the system architecture 100 may include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, and so on.

The user can use the terminal devices 101, 102, and 103 to interact with the server 105 through the network 104 to receive or send messages and so on. Various communication client applications, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, and social platform software, can be installed on the terminal devices 101, 102, and 103.

The terminal devices 101, 102, 103 may be various electronic devices with display screens and support for web browsing, including but not limited to smart phones, tablets, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III, dynamic Video experts compress standard audio layer 3), MP4 (Moving Picture Experts Group Audio Layer IV, dynamic image experts compress standard audio layer 4) players, laptop portable computers and desktop computers, etc.

The server 105 may be a server that provides various services, for example, a background server that provides support for pages displayed on the terminal devices 101, 102, and 103.

It should be noted that the abnormal community detection method provided in the embodiments of the present application is generally executed by the server/terminal, and accordingly, the abnormal community detection device is generally set in the server/terminal device.

It should be understood that the numbers of terminals, networks, and servers in FIG. 1 are merely illustrative. According to implementation needs, there can be any number of terminal devices, networks, and servers.

Continuing to refer to FIG. 2, a flowchart of an embodiment of the abnormal community detection method according to the present application is shown. The abnormal community detection method includes the following steps:

Step S200, construct a guarantee relationship network, segment the guarantee relationship network, and obtain communities with abnormal guarantee relationships;

The guarantee relationship network is composed of nodes and guarantee relationships. The nodes include a source node and a target node. The source node represents the guarantor, and the target node represents the guarantor. Taking the guarantee loop structure formed by users A, B, and C as an example, user A guarantees user B, user B guarantees user C, and user C guarantees user A. The guarantee relationship network is constructed as shown in Figure 3, where Set(A,B) It means that user A belongs to community A and B, Set(A) means that user C belongs to community A, Set(B) means that user B belongs to community B, Edge(C,A,1) means that user C guarantees user A, user There is only one guarantee relationship between A and user C. Edge(B,A,1) means that user B guarantees user C. There is only one guarantee relationship between user B and user C. Edge(A,B,1) means user A guarantees user B, and there is only one guarantee relationship between user A and user B. When the construction of the guarantee network is completed, the guarantee network is segmented, and the guarantee network can be segmented based on the LPANNI algorithm (a large-scale heterogeneous information network community discovery algorithm). Specifically, calculate the influence of each node (NI), the similarity between nodes (Sim) and the influence of neighbor nodes (NNI), and then iteratively update the label set of the community based on the influence of neighbor nodes (NNI) and the membership coefficient, according to This tag set has a community with an abnormal guarantee relationship.

Step S300: Determine feature information of the community, where the feature information includes at least one of node size, edge size, aggregation coefficient, number of connected triangles, and average degree;

When a community with an abnormal guarantee relationship is obtained, each community is regarded as a subgraph. Based on the graphx calculation under the spark framework, the feature generation is performed on each subgraph, and the 26-dimensional feature is obtained. The 26-dimensional feature is Characteristic information of the community. Among them, graphx is a component of graphs and graph calculations in the spark framework. The feature information specifically includes: number of nodes, number of edges, average degree, maximum degree, minimum degree, degree standard deviation, total in-degree, average in-degree, and maximum in-degree , Minimum in-degree, in-degree standard deviation, total out-degree, average out-degree, maximum out-degree, minimum out-degree, out-degree standard deviation, average in-degree ratio, maximum in-degree ratio, minimum in-degree ratio, in-degree ratio standard Difference, total number of triangles, average number of triangles, maximum number of triangles, minimum number of triangles, triangle standard deviation coefficient, clustering coefficient.

Among them, the number of nodes is the number of nodes in the current community; the edge connects the source node (guarantor) and the target node (guarantee), the number of edges is the number of edges in the current community; the average degree is the total of the current community The value of the number of angles divided by the total number of nodes; the maximum degree and the minimum degree are the maximum and minimum degrees between the edges in the current community; the standard deviation of the degrees is the standard deviation of the degrees; one guarantor is one guarantor Guaranty, the guarantor is an in-degree of the guaranteed person, and the total in-degree is the total in-degree in the community; the average in-degree is the ratio of the total in-degree to the total number of nodes; one guaranteed person is a guarantor For guarantee, the guaranteed person is an out-degree of the guarantor; the standard deviation of the in-degree ratio is the standard deviation of the ratio of the number of in-degrees of the node in the current community to the sum of the in-degree and out-degree of the node.

In order to ensure the privacy and security of the above-mentioned feature information, the above-mentioned feature information can also be stored in a blockchain, and the feature information can be shared between different platforms through the blockchain. Blockchain is a new application mode of computer technology such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm. Blockchain is essentially a decentralized database. It is a series of data blocks associated with cryptographic methods. Each data block contains a batch of network transaction information for verification. The validity of the information (anti-counterfeiting) and the generation of the next block. The blockchain can include the underlying platform of the blockchain, the platform product service layer, and the application service layer.

Step S400: Determine, according to the feature information, a community with similar features as a relationship cluster;

In the actual guarantee scenario, the number of users involved is huge, and the relationship network may include hundreds of millions of users and guarantee relationships; the result of the division of the community is a group with close connections, and the size of the community usually only includes a few people or There are dozens of people. In a large-scale guarantee relationship network, there will be communities on the order of millions or even tens of millions. In addition, the mutual guarantee between two users, the joint guarantee between multiple users and the guarantee chain and other guarantee modes are relatively risky. Therefore, when dividing the community and its characteristic information, you need to Communities with similar characteristics are gathered into a relationship cluster to improve the efficiency of risk control. In the guarantee scenario, as shown in Fig. 4, Fig. 4 is a schematic diagram of the guarantee mode in this embodiment, in which Fig. 4(a) shows the mutual guarantee mode formed by A and B, and Fig. 4(b) shows A, B, The long-chain guarantee model formed by C, Figure 4(c) shows the joint guarantee circle model formed by A, B, and C, and Figure 4(d) shows the multi-party guarantee model formed by A, B, and C; Communities are communities with distinct characteristics, that is, four different relationship clusters.

When the characteristic information of the community is obtained, the characteristic information can accurately describe the typical structure of the community. Take the community structure of the joint guarantee circle as an example. The characteristic information includes 3 nodes and 1 total triangle, etc. , Through this feature information, communities with similar features can be clustered into a relationship cluster. Specifically, whether the community is similar to the community can be calculated by calculating the average error between the communities, comparing the average error with a preset threshold, and if the average error is not greater than the preset threshold, it is determined that the two The communities are similar; if the error average is greater than the preset threshold, it is determined that the two communities are not similar. Among them, the error average value can be calculated according to the feature vector of the community, and the feature vector is obtained by normalizing the feature information.

Step S500, calculating the Euclidean distance of the relation cluster;

In this embodiment, the Euclidean distance is the distance from the feature of the i-th relation cluster to the origin {0,0,...0}, denoted by dis _i . The formula for calculating the Euclidean distance is as follows:

Among them, the feature vector of the i-th relationship cluster is {x _i1 ,x _i2 ,...,x _i26 }, and the Euclidean distance of each relationship cluster is calculated according to the calculation formula.

Step S600: Classify the relationship clusters according to the Euclidean distance, and determine whether the relationship clusters are abnormal clusters based on the classification results;

When calculating the Euclidean distance of each relational cluster, sort the relational clusters according to the Euclidean distance. In this embodiment, sorting the relational clusters according to the Euclidean distance can be sorted according to a preset sorting method according to the Euclidean distance. , The preset sorting method includes a method of descending or descending according to the size of Euclidean distance, and a method of dividing and sorting according to a certain threshold. The relationship clusters are classified according to the Euclidean distance, and the size of the Euclidean distance of each relationship cluster determines whether the relationship cluster belongs to an abnormal cluster. Among them, if the Euclidean distance of the relational cluster is within the Euclidean distance interval corresponding to the abnormal cluster (including the Euclidean distance of the relational cluster falls at both ends of the interval), then the relational cluster is an anomalous cluster; if the Euclidean distance of the relational cluster is not Within the Euclidean distance interval corresponding to the abnormal cluster, the relational cluster is a normal cluster.

Step S700: When it is determined that the relationship cluster is an abnormal cluster, determine that the community in the abnormal cluster is an abnormal community, and extract the abnormal community.

When it is determined that the relationship cluster is an abnormal cluster, it means that the community in the relationship cluster is an abnormal guarantee, and all the communities in the relationship cluster are abnormal communities, and all abnormal communities are extracted from the relationship cluster.

In this embodiment, the intelligent automatic screening of abnormal guarantee structures is realized, and the processing efficiency of multi-order guarantee relationships under coordinated multi-account crimes is improved, and it can be executed under the framework of big data analysis and can be parallelized at one time. The large-scale guarantee network that handles millions of users has good scalability, and further improves the efficiency and accuracy of data processing under the large-scale guarantee network.

In some embodiments of the present application, before segmenting the guarantee relationship network, the abnormal community detection method further includes:

Obtain the guarantee relationship in the guarantee relationship network, and determine the guarantor and the guaranteed party in the guarantee relationship;

Determine whether the intersection length of the tag set between the guarantor and the guaranteed person is less than a preset length;

If the intersection length is less than the preset length, it is determined that the guarantor and the guaranteed person do not belong to the same community, and the unnecessary relationship that the guarantor and the guaranteed person do not belong to the same community is deleted.

In the guarantee network, there are many different relationships. In order to reduce unnecessary data processing, it is necessary to delete the non-essential relationship in which the guarantor and the guaranteed party do not belong to the same community when segmenting the guarantee network. Specifically, when segmenting the guarantee relationship network, each node is given the label set of the community to which it belongs. The same node may belong to multiple communities with different label sets. For example, there is a node A belonging to the label set. It is the two communities of A and B. Node B belongs to the two communities with label sets B and C. Deleting the non-essential relationship between node A and node B does not belong to the same community is to delete node B and community C Relationship, the relationship between node A and community A, only the relationship between node A and community B, and the relationship between node B and community B are retained. The triplets format data in the Graphx module contains both relationship information and node attribute information. For each guarantee relationship, call the .srcAttr method to obtain the label set of the guarantor, which is the source node, and call the .dstAttr method to obtain the guarantor, which is the target. The label set of the node. If the intersection length of the label set of the source node and the target node is not less than the preset length, that is, the intersection of the label set of the source node and the target node is not empty, it means that the source node and the target node have at least the same community label, which means they belong to The same community; if the length of the intersection of the source node and the target node label set is less than the preset length, it is determined that the source node and the target node do not belong to the same community, and the unnecessary relationship between the source node and the target node is deleted; The preset length is any length set in advance.

In this embodiment, the guarantor and the guarantor who do not belong to the same community relationship are deleted, which saves redundant data processing procedures, and improves data processing accuracy and data processing efficiency.

In some embodiments of the present application, step 400, determining a community with similar characteristics as a relationship cluster according to the characteristic information includes:

Acquire structured data corresponding to the community according to the characteristic information;

Based on the structured data, the communities with similar characteristics are clustered into a relationship cluster.

The structured data includes the community number and characteristic information of the community. The structured data is usually stored in a relational database. The community number and the characteristic information of the community are packaged, and the community number and the characteristic information are organized into structured data. data. When determining whether the community is directly similar to the community, the structured data is called based on the relational database, and various clustering analysis algorithms are called at the same time to analyze the structured data, thereby obtaining a composition of communities with similar characteristics Relationship clusters. For example, the k-means (k-means clustering algorithm, k-means clustering) algorithm is called, based on this algorithm, communities with similar characteristics can be clustered into a relationship cluster.

In this embodiment, the organization of the structured data of the community is realized, so that the structured data can be used to process communities with similar characteristics more quickly and efficiently, and the structured data can further improve the characteristics of the community. The processing efficiency of similar communities.

In some embodiments of the present application, the foregoing acquiring structured data corresponding to the community based on the characteristic information includes:

Obtain the community number of the community;

Organizing the community number and the feature information into structured data.

The community number is the logo information of the community. When the community is divided, each community will be assigned its corresponding community number, and different communities correspond to different community numbers. The feature information is the number of nodes, number of edges, average degree, maximum degree, minimum degree, degree standard deviation, total in degree, average in degree, maximum in degree, minimum in degree, and in degree standard deviation included in each community , Total out-degree, average out-degree, maximum out-degree, minimum out-degree, out-degree standard deviation, average in-degree ratio, maximum in-degree ratio, minimum in-degree ratio, in-degree ratio standard deviation, total triangle number, average triangle number , Maximum number of triangles, minimum number of triangles, triangle standard deviation coefficient, clustering coefficient and other information. Call the community number of the community, package the community number and feature information, and obtain structured data.

In this embodiment, the structured data of each community is obtained according to the community number and characteristic information, so that the structured data can be used to process communities with similar characteristics more quickly and efficiently, and the data is improved. The speed of processing.

In some embodiments of the present application, step S500, calculating the Euclidean distance of the relationship cluster includes:

Calculating an average value of each feature in the relationship cluster, and calculating a feature vector of the relationship cluster according to the average value;

According to the feature vector, the Euclidean distance from the origin of the relationship cluster is calculated.

Calculate the feature vector of each relationship cluster, and its corresponding feature represents the average value of the corresponding features of all communities in the relationship cluster. If the relationship cluster 1 includes three communities, the number of nodes is 3, 3, and 4 respectively, then the average value of the feature-node number of the cluster is (3+3+4)/3=3.33. Calculate the 26 features included in the relationship cluster to obtain the average value of different features in the relationship cluster, and normalize the average value of all features in the relationship cluster to obtain the feature vector of the relationship cluster { x _i1 , x _i2 ,..., x _i26 }; where x _i1 represents the average value of feature 1 in the feature information.

When the feature vector is calculated, the Euclidean distance from the feature of the i-th relation cluster to the origin {0, 0,..., 0} is calculated according to the Euclidean distance calculation method.

In this embodiment, the calculation of the Euclidean distance of the relationship clusters is realized, and the Euclidean distance of each relationship cluster is used to divide the relationship clusters, so as to accurately obtain the abnormal relationship clusters according to the Euclidean distance.

In some embodiments of the present application, the foregoing classification of the relationship clusters according to the Euclidean distance includes:

Obtaining the lower quartile and the upper quartile in the Euclidean distance according to the size of the Euclidean distance;

The relationship clusters are classified according to the lower quartile and the upper quartile.

When calculating the Euclidean distance of each relationship cluster, sort in order according to the size of the Euclidean distance, so as to obtain the lower quartile and the upper quartile of the Euclidean distance. Among them, the lower quartile and the upper quartile are the lower quartile and the upper quartile obtained by sorting from small to large according to Euclidean distance. The value of the lower quartile is smaller than the value of the upper quartile, and the relationship cluster can be classified according to the interval range of the lower quartile and the upper quartile. If the relationship clusters that belong to the upper quartile and the lower quartile range are classified as abnormal clusters, the relationship clusters that do not belong to the upper quartile and the lower quartile range are classified as non Abnormal clusters. By dividing the relationship cluster according to the upper quartile and the lower quartile, it can be determined whether the relationship cluster is an abnormal cluster.

In this embodiment, the division of the relationship clusters according to the upper quartile and the lower quartile in the Euclidean distance is realized, which further realizes the accurate judgment of abnormal clusters in the relationship cluster.

In some embodiments of the present application, the foregoing classification of the relationship clusters according to the lower quartile and the upper quartile includes:

If the Euclidean distance is less than or equal to the lower quartile or greater than or equal to the upper quartile, determining that the relationship cluster is an abnormal cluster;

If the Euclidean distance is greater than the lower quartile and smaller than the upper quartile, it is determined that the relationship cluster is a normal cluster.

Abnormal clusters include extreme relationship clusters and suspected relationship clusters. Among them, the extreme relationship cluster is a certain abnormal relationship cluster, and the suspected relationship cluster is a possible abnormal relationship cluster. Denote the lower quartile and upper quartile of Euclidean distance with Q1 and Q3, respectively. Calculate the difference between the lower quartile (Q1) and the upper quartile (Q3) as the interquartile range (IQR), and calculate the interquartile range between the lower quartile and the preset multiple The difference gets the minimum threshold, and the sum of the upper quartile and the interquartile range of the preset multiple gets the maximum threshold. Taking the preset multiple equal to 1.5 as an example, the minimum threshold H1=Q1-1.5*IQR, and the maximum threshold H2=Q3+1.5*IQR.

If the Euclidean distance of the relationship cluster is not within the range of the minimum threshold and the maximum threshold, and the Euclidean distance of the relationship cluster is not equal to the minimum or maximum threshold, that is, disi<H1, or disi>H2, then the relationship cluster is determined Is an extreme relationship cluster; if the Euclidean distance of the relationship cluster is within the interval between the minimum threshold and Q1 (the Euclidean distance can be equal to the value of Q1), or the Euclidean distance of the relationship cluster is within the interval between Q3 and the maximum threshold (the Euclidean distance The distance can be equal to the value of Q3), that is, H1≤disi≤Q1, or Q3≤disi≤H2, then the relationship cluster is determined to be a suspected relationship cluster. If the Euclidean distance of the relational cluster is within the interval of Q1 and Q3, and is not equal to the value of Q1 or Q3, that is, Q1<disi<Q3, the relational cluster is determined to be a normal cluster.

In this embodiment, further accurate division and judgment of the relationship clusters based on the upper quartile and the lower quartile is realized, which improves the rapid extraction of abnormal communities in the abnormal clusters.

A person of ordinary skill in the art can understand that all or part of the processes in the methods of the foregoing embodiments can be implemented by instructing relevant hardware through computer-readable instructions, which can be stored in a computer-readable storage medium. When the computer-readable instructions are executed, they may include the processes of the above-mentioned method embodiments. Among them, the aforementioned storage medium may be a non-volatile storage medium such as a magnetic disk, an optical disc, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random Access Memory, RAM), etc.

It should be understood that although the various steps in the flowchart of the drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily performed in sequence in the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and they can be executed in other orders. Moreover, at least part of the steps in the flowchart of the drawings may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the order of execution is also It is not necessarily performed sequentially, but may be performed alternately or alternately with at least a part of other steps or sub-steps or stages of other steps.

With further reference to FIG. 5, as an implementation of the method shown in FIG. 2, this application provides an embodiment of an abnormal community detection device. The device embodiment corresponds to the method embodiment shown in FIG. Specifically, it can be applied to various electronic devices.

As shown in FIG. 5, the abnormal community detection device 900 in this embodiment includes a segmentation module 910, a first confirmation module 920, a second confirmation module 930, a calculation module 940, a classification module 950, and an extraction module 960. :

The segmentation module 910 is used to construct a guarantee relationship network, segment the guarantee relationship network, and obtain communities with abnormal guarantee relationships;

Among them, the segmentation module 910 includes:

The first obtaining unit is configured to obtain the guarantee relationship in the guarantee relationship network, and determine the guarantor and the guaranteed party in the guarantee relationship;

The first confirmation unit is used to determine whether the intersection length of the label set between the guarantor and the guaranteed person is less than a preset length;

A deletion unit, configured to determine that the guarantor and the guaranteed person do not belong to the same community if the intersection length is less than the preset length, and delete that the guarantor and the guaranteed person do not belong to the same community Non-essential relationship.

The guarantee relationship network is composed of nodes and guarantee relationships. The nodes include a source node and a target node. The source node represents the guarantor, and the target node represents the guarantor. Taking users A, B, and C forming a guarantee loop structure as an example, user A guarantees user B, user B guarantees user C, and user C guarantees user A. The guarantee relationship network is constructed as shown in Figure 3, where Set(A,B) It means that user A belongs to community A and B, Set(A) means that user C belongs to community A, Set(B) means that user B belongs to community B, Edge(C,A,1) means that user C guarantees user A, user There is only one guarantee relationship between A and user C. Edge(B,A,1) means that user B guarantees user C. There is only one guarantee relationship between user B and user C. Edge(A,B,1) means user A guarantees user B, and there is only one guarantee relationship between user A and user B. When the construction of the guarantee network is completed, the guarantee network is segmented, and the guarantee network can be segmented based on the LPANNI algorithm (a large-scale heterogeneous information network community discovery algorithm). Specifically, calculate the influence of each node (NI), the similarity between nodes (Sim) and the influence of neighbor nodes (NNI), and then iteratively update the label set of the community based on the influence of neighbor nodes (NNI) and the membership coefficient, according to This tag set has a community with an abnormal guarantee relationship.

The first confirmation module 920 is configured to determine feature information of the community, where the feature information includes at least one of node size, edge size, aggregation coefficient, number of connected triangles, and average degree;

When a community with an abnormal guarantee relationship is obtained, each community is regarded as a subgraph. Based on the graphx calculation under the spark framework, the feature generation is performed on each subgraph, and the 26-dimensional feature is obtained. The 26-dimensional feature is Characteristic information of the community. Among them, graphx is a component of graphs and graph calculations in the spark framework. The feature information specifically includes: number of nodes, number of edges, average degree, maximum degree, minimum degree, degree standard deviation, total in-degree, average in-degree, and maximum in-degree , Minimum in-degree, in-degree standard deviation, total out-degree, average out-degree, maximum out-degree, minimum out-degree, out-degree standard deviation, average in-degree ratio, maximum in-degree ratio, minimum in-degree ratio, in-degree ratio standard Difference, total number of triangles, average number of triangles, maximum number of triangles, minimum number of triangles, triangle standard deviation coefficient, clustering coefficient.

Among them, the number of nodes is the number of nodes in the current community; the edge connects the source node (guarantor) and the target node (guarantee), the number of edges is the number of edges in the current community; the average degree is the total of the current community The value of the number of angles divided by the total number of nodes; the maximum degree and the minimum degree are the maximum and minimum degrees between the edges in the current community; the standard deviation of the degrees is the standard deviation of the degrees; one guarantor is one guarantor Guaranty, the guarantor is an in-degree of the guaranteed person, and the total in-degree is the total in-degree in the community; the average in-degree is the ratio of the total in-degree to the total number of nodes; one guaranteed person is a guarantor For guarantee, the guaranteed person is an out-degree of the guarantor; the standard deviation of the in-degree ratio is the standard deviation of the ratio of the number of in-degrees of the node in the current community to the sum of the in-degree and out-degree of the node.

The second confirmation module 930 is configured to determine, according to the characteristic information, a community with similar characteristics as a relationship cluster;

Wherein, the second confirmation module 930 includes:

The second acquiring unit is configured to acquire structured data corresponding to the community according to the characteristic information;

The clustering unit is used to group communities with similar characteristics into a relationship cluster based on the structured data.

Wherein, the second acquiring unit includes:

The third obtaining unit is used to obtain the community number of the community;

The sorting unit is used to sort the community number and the feature information into structured data.

In the actual guarantee scenario, the number of users involved is huge, and the relationship network may include hundreds of millions of users and guarantee relationships; the result of the division of the community is a group with close connections, and the size of the community usually only includes a few people or There are dozens of people. In a large-scale guarantee relationship network, there will be communities on the order of millions or even tens of millions. In addition, the mutual guarantee between two users, the joint guarantee between multiple users and the guarantee chain and other guarantee modes are relatively risky. Therefore, when dividing the community and its characteristic information, you need to Communities with similar characteristics are gathered into a relationship cluster to improve the efficiency of risk control. In the guarantee scenario, as shown in Fig. 4, Fig. 4 is a schematic diagram of the guarantee mode in this embodiment, in which Fig. 4(a) shows the mutual guarantee mode formed by A and B, and Fig. 4(b) shows A, B, The long-chain guarantee model formed by C, Figure 4(c) shows the joint guarantee circle model formed by A, B, and C, and Figure 4(d) shows the multi-party guarantee model formed by A, B, and C; Communities are communities with distinct characteristics, that is, four different relationship clusters.

When the characteristic information of the community is obtained, the characteristic information can accurately describe the typical structure of the community. Take the community structure of the joint guarantee circle as an example. The characteristic information includes 3 nodes and 1 total triangle, etc. , Through this feature information, communities with similar features can be clustered into a relationship cluster. Specifically, whether the community is similar to the community can be calculated by calculating the average error between the communities, comparing the average error with a preset threshold, and if the average error is not greater than the preset threshold, it is determined that the two The communities are similar; if the error average is greater than the preset threshold, it is determined that the two communities are not similar. Among them, the error average value can be calculated according to the feature vector of the community, and the feature vector is obtained by normalizing the feature information.

A calculation module 940, configured to calculate the Euclidean distance of the relationship cluster;

Among them, the calculation module 940 includes:

The first calculation unit is configured to calculate the average value of each feature in the relationship cluster, and calculate the feature vector of the relationship cluster according to the average value;

The second calculation unit is configured to calculate the Euclidean distance from the origin of the relationship cluster according to the feature vector.

In this embodiment, the Euclidean distance is the distance from the feature of the i-th relation cluster to the origin {0,0,...0}, denoted by dis _i . The formula for calculating the Euclidean distance is as follows:

Among them, the feature vector of the i-th relationship cluster is {x _i1 ,x _i2 ,...,x _i26 }, and the Euclidean distance of each relationship cluster is calculated according to the calculation formula.

The classification module 950 is configured to classify the relationship clusters according to the Euclidean distance, and determine whether the relationship clusters are abnormal clusters based on the classification results;

Among them, the classification module 950 includes:

The fourth acquiring unit is configured to acquire the lower quartile and the upper quartile in the Euclidean distance according to the size of the Euclidean distance;

The classification unit is used to classify the relationship clusters according to the lower quartile and the upper quartile.

Among them, the classification unit includes;

The second confirmation unit is configured to determine that the relationship cluster is an abnormal cluster if the Euclidean distance is less than or equal to the lower quartile or greater than or equal to the upper quartile;

The third confirmation unit is configured to determine that the relationship cluster is a normal cluster if the Euclidean distance is greater than the lower quartile and smaller than the upper quartile.

When calculating the Euclidean distance of each relational cluster, sort the relational clusters according to the Euclidean distance. In this embodiment, sorting the relational clusters according to the Euclidean distance can be sorted according to a preset sorting method according to the Euclidean distance. , The preset sorting method includes a method of descending or descending according to the size of Euclidean distance, and a method of dividing and sorting according to a certain threshold. The relationship clusters are classified according to the Euclidean distance, and the size of the Euclidean distance of each relationship cluster determines whether the relationship cluster belongs to an abnormal cluster. Among them, if the Euclidean distance of the relational cluster is within the Euclidean distance interval corresponding to the abnormal cluster (including the Euclidean distance of the relational cluster falls at both ends of the interval), then the relational cluster is an anomalous cluster; if the Euclidean distance of the relational cluster is not Within the Euclidean distance interval corresponding to the abnormal cluster, the relational cluster is a normal cluster.

The extraction module 960 is configured to determine that the community in the abnormal cluster is an abnormal community when it is determined that the relationship cluster is an abnormal cluster, and extract the abnormal community.

When it is determined that the relationship cluster is an abnormal cluster, it means that the community in the relationship cluster is an abnormal guarantee, and all the communities in the relationship cluster are abnormal communities, and all abnormal communities are extracted from the relationship cluster.

In this embodiment, the automatic screening of abnormal guarantee structures is realized, and the processing efficiency of multi-order guarantee relationships under coordinated multi-account crimes is improved, and it can be executed under the framework of big data analysis and can be processed in parallel at one time. The large-scale guarantee network with millions of users has good scalability, which further improves the efficiency and accuracy of data processing under the large-scale guarantee network.

In order to solve the above technical problems, the embodiments of the present application also provide computer equipment. Please refer to FIG. 6 for details. FIG. 6 is a block diagram of the basic structure of the computer device in this embodiment.

The computer device 6 includes a memory 61, a processor 62, and a network interface 63 that communicate with each other through a system bus. It should be pointed out that the figure only shows the computer device 6 with components 61-63, but it should be understood that it is not required to implement all the components shown, and more or fewer components may be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculation and/or information processing in accordance with pre-set or stored instructions. Its hardware includes, but is not limited to, a microprocessor, a dedicated Integrated Circuit (Application Specific Integrated Circuit, ASIC), Programmable Gate Array (Field-Programmable Gate Array, FPGA), Digital Processor (Digital Signal Processor, DSP), embedded equipment, etc.

The computer device may be a computing device such as a desktop computer, a notebook, a palmtop computer, and a cloud server. The computer device can interact with the user through a keyboard, a mouse, a remote control, a touch panel, or a voice control device.

The memory 61 includes at least one type of readable storage medium, the readable storage medium includes flash memory, hard disk, multimedia card, card type memory (for example, SD or DX memory, etc.), random access memory (RAM), static Random access memory (SRAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), programmable read only memory (PROM), magnetic memory, magnetic disks, optical disks, etc. The computer-readable storage medium may be non-volatile or volatile. In some embodiments, the memory 61 may be an internal storage unit of the computer device 6, such as a hard disk or a memory of the computer device 6. In other embodiments, the memory 61 may also be an external storage device of the computer device 6, such as a plug-in hard disk equipped on the computer device 6, a smart media card (SMC), a secure digital (Secure Digital, SD) card, flash card (Flash Card), etc. Of course, the memory 61 may also include both the internal storage unit of the computer device 6 and its external storage device. In this embodiment, the memory 61 is generally used to store an operating system and various application software installed in the computer device 6, such as computer-readable instructions for an abnormal community detection method. In addition, the memory 61 can also be used to temporarily store various types of data that have been output or will be output.

The processor 62 may be a central processing unit (Central Processing Unit, CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 62 is generally used to control the overall operation of the computer device 6. In this embodiment, the processor 62 is configured to run computer-readable instructions or processed data stored in the memory 61, for example, computer-readable instructions for running the abnormal community detection method.

The network interface 63 may include a wireless network interface or a wired network interface, and the network interface 63 is generally used to establish a communication connection between the computer device 6 and other electronic devices.

In this embodiment, the computer device realizes the automatic screening of abnormal guarantee structures, improves the processing efficiency of multi-order guarantee relations under multi-account collaborative crimes, and can be executed under the framework of big data analysis. The large-scale guarantee network that can process millions of users in parallel at one time has good scalability, and further improves the efficiency and accuracy of data processing under the large-scale guarantee network.

This application also provides another implementation manner, that is, to provide a computer-readable storage medium that stores computer-readable instructions for detecting abnormal communities, and the computer-readable instructions for detecting abnormal communities are The instructions may be executed by at least one processor, so that the at least one processor executes the steps of the abnormal community detection method described above.

In this embodiment, the computer-readable storage medium realizes the automatic screening of abnormal guarantee structures, improves the processing efficiency of multi-order guarantee relations under multi-account collaborative crimes, and can be used in the big data analysis framework It can process large-scale guarantee networks of millions of users in parallel at one time, and has good scalability, which further improves the efficiency and accuracy of data processing under large-scale guarantee networks.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method of the above embodiments can be implemented by means of software plus the necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is better.的实施方式。 Based on this understanding, the technical solution of this application essentially or the part that contributes to the existing technology can be embodied in the form of a software product, and the computer software product is stored in a storage medium (such as ROM/RAM, magnetic disk, The optical disc) includes several instructions to enable a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the method described in each embodiment of the present application.

Obviously, the above-described embodiments are only a part of the embodiments of the application, rather than all of the embodiments. The drawings show preferred embodiments of the application, but do not limit the patent scope of the application. This application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of this application more thorough and comprehensive. Although this application has been described in detail with reference to the foregoing embodiments, for those skilled in the art, they can still modify the technical solutions described in the foregoing specific embodiments, or equivalently replace some of the technical features. . All equivalent structures made by using the contents of the description and drawings of this application, directly or indirectly used in other related technical fields, are similarly within the scope of patent protection of this application.

Claims (20)

An abnormal community detection method includes the following steps: Construct a network of guarantee relations, segment the said network of guarantee relations, and obtain communities with abnormal guarantee relations; Determining feature information of the community, where the feature information includes at least one of node size, edge size, aggregation coefficient, number of connected triangles, and average degree; According to the feature information, a community with similar features is determined as a relationship cluster; Calculating the Euclidean distance of the relation cluster; Classify the relationship clusters according to the Euclidean distance, and determine whether the relationship clusters are abnormal clusters based on the classification results; When it is determined that the relationship cluster is an abnormal cluster, it is determined that the community in the abnormal cluster is an abnormal community, and the abnormal community is extracted. The abnormal community detection method according to claim 1, wherein, before the step of segmenting the guarantee relationship network, the abnormal community detection method further comprises: Obtain the guarantee relationship in the guarantee relationship network, and determine the guarantor and the guaranteed party in the guarantee relationship; Determine whether the intersection length of the tag set between the guarantor and the guaranteed person is less than a preset length; If the intersection length is less than the preset length, it is determined that the guarantor and the guaranteed person do not belong to the same community, and the unnecessary relationship that the guarantor and the guaranteed person do not belong to the same community is deleted. The abnormal community detection method according to claim 1, wherein the step of determining a community with similar characteristics as a relationship cluster according to the characteristic information comprises: Acquire structured data corresponding to the community according to the characteristic information; Based on the structured data, the communities with similar characteristics are clustered into a relationship cluster. The abnormal community detection method according to claim 3, wherein the step of obtaining structured data corresponding to the community according to the characteristic information comprises: Obtain the community number of the community; Organizing the community number and the feature information into structured data. The abnormal community detection method according to claim 1, wherein the step of calculating the Euclidean distance of the relationship cluster comprises: Calculating an average value of each feature in the relationship cluster, and calculating a feature vector of the relationship cluster according to the average value; According to the feature vector, the Euclidean distance from the origin of the relationship cluster is calculated. The abnormal community detection method according to claim 1, wherein the step of classifying the relationship clusters according to the Euclidean distance comprises: Obtaining the lower quartile and the upper quartile in the Euclidean distance according to the size of the Euclidean distance; The relationship clusters are classified according to the lower quartile and the upper quartile. The abnormal community detection method according to claim 6, wherein the step of classifying the relationship clusters according to the lower quartile and the upper quartile comprises: If the Euclidean distance is less than or equal to the lower quartile or greater than or equal to the upper quartile, determining that the relationship cluster is an abnormal cluster; If the Euclidean distance is greater than the lower quartile and smaller than the upper quartile, it is determined that the relationship cluster is a normal cluster. An abnormal community detection device, including: The segmentation module is used to construct a guarantee relationship network, segment the guarantee relationship network, and obtain communities with abnormal guarantee relationships; The first confirmation module is configured to determine feature information of the community, where the feature information includes at least one of node size, edge size, aggregation coefficient, number of connected triangles, and average degree; The second confirmation module is used to determine a community with similar characteristics as a relationship cluster according to the characteristic information; A calculation module for calculating the Euclidean distance of the relationship cluster; A classification module, configured to classify the relationship clusters according to the Euclidean distance, and determine whether the relationship clusters are abnormal clusters based on the classification results; The extraction module is used to extract the abnormal community when the community in the abnormal cluster is determined to be an abnormal cluster. A computer device includes a memory and a processor, wherein computer readable instructions are stored in the memory, and the processor further implements the following steps when executing the computer readable instructions: Construct a network of guarantee relations, segment the said network of guarantee relations, and obtain communities with abnormal guarantee relations; Determining feature information of the community, where the feature information includes at least one of node size, edge size, aggregation coefficient, number of connected triangles, and average degree; According to the feature information, a community with similar features is determined as a relationship cluster; Calculating the Euclidean distance of the relation cluster; Classify the relationship clusters according to the Euclidean distance, and determine whether the relationship clusters are abnormal clusters based on the classification results; When it is determined that the relationship cluster is an abnormal cluster, it is determined that the community in the abnormal cluster is an abnormal community, and the abnormal community is extracted. 9. The computer device according to claim 9, wherein, before the step of segmenting the guarantee relationship network, the processor further implements the following steps when executing the computer-readable instructions: Obtain the guarantee relationship in the guarantee relationship network, and determine the guarantor and the guaranteed party in the guarantee relationship; Determine whether the intersection length of the tag set between the guarantor and the guaranteed person is less than a preset length; If the intersection length is less than the preset length, it is determined that the guarantor and the guaranteed person do not belong to the same community, and the unnecessary relationship that the guarantor and the guaranteed person do not belong to the same community is deleted. 9. The computer device according to claim 9, wherein the step of determining a community with similar characteristics as a relationship cluster according to the characteristic information comprises: Acquire structured data corresponding to the community according to the characteristic information; Based on the structured data, the communities with similar characteristics are clustered into a relationship cluster. 11. The computer device according to claim 11, wherein the step of obtaining structured data corresponding to the community according to the characteristic information comprises: Obtain the community number of the community; Organizing the community number and the feature information into structured data. The computer device according to claim 9, wherein the step of calculating the Euclidean distance of the relationship cluster comprises: Calculating an average value of each feature in the relationship cluster, and calculating a feature vector of the relationship cluster according to the average value; According to the feature vector, the Euclidean distance from the origin of the relationship cluster is calculated. The computer device according to claim 9, wherein the step of classifying the relationship clusters according to the Euclidean distance comprises: Obtaining the lower quartile and the upper quartile in the Euclidean distance according to the size of the Euclidean distance; The relationship clusters are classified according to the lower quartile and the upper quartile. The computer device according to claim 14, wherein the step of classifying the relationship clusters according to the lower quartile and the upper quartile comprises: If the Euclidean distance is less than or equal to the lower quartile or greater than or equal to the upper quartile, determining that the relationship cluster is an abnormal cluster; If the Euclidean distance is greater than the lower quartile and smaller than the upper quartile, it is determined that the relationship cluster is a normal cluster. A computer-readable storage medium having computer-readable instructions stored thereon, and when the computer-readable instructions are executed by a processor, the processor further executes the following steps: Construct a network of guarantee relations, segment the said network of guarantee relations, and obtain communities with abnormal guarantee relations; Determining feature information of the community, where the feature information includes at least one of node size, edge size, aggregation coefficient, number of connected triangles, and average degree; According to the feature information, a community with similar features is determined as a relationship cluster; Calculating the Euclidean distance of the relation cluster; Classify the relationship clusters according to the Euclidean distance, and determine whether the relationship clusters are abnormal clusters based on the classification results; When it is determined that the relationship cluster is an abnormal cluster, it is determined that the community in the abnormal cluster is an abnormal community, and the abnormal community is extracted. The computer-readable storage medium according to claim 16, wherein, before the step of segmenting the guarantee relationship network, when the computer-readable instructions are executed by a processor, the processor further executes the following steps : Obtain the guarantee relationship in the guarantee relationship network, and determine the guarantor and the guaranteed party in the guarantee relationship; Determine whether the intersection length of the tag set between the guarantor and the guaranteed person is less than a preset length; If the intersection length is less than the preset length, it is determined that the guarantor and the guaranteed person do not belong to the same community, and the unnecessary relationship that the guarantor and the guaranteed person do not belong to the same community is deleted. 16. The computer-readable storage medium according to claim 16, wherein the step of determining, based on the characteristic information, a community with similar characteristics as a relationship cluster comprises: Acquire structured data corresponding to the community according to the characteristic information; Based on the structured data, the communities with similar characteristics are clustered into a relationship cluster. 18. The computer-readable storage medium according to claim 18, wherein the step of obtaining structured data corresponding to the community according to the characteristic information comprises: Obtain the community number of the community; Organizing the community number and the feature information into structured data. The computer-readable storage medium according to claim 16, wherein the step of calculating the Euclidean distance of the relationship cluster comprises: Calculating an average value of each feature in the relationship cluster, and calculating a feature vector of the relationship cluster according to the average value; According to the feature vector, the Euclidean distance from the origin of the relationship cluster is calculated.

Images