CN108768742B - Network construction method and device, electronic equipment and storage medium - Google Patents
Network construction method and device, electronic equipment and storage medium Download PDFInfo
- Publication number
- CN108768742B CN108768742B CN201810587168.5A CN201810587168A CN108768742B CN 108768742 B CN108768742 B CN 108768742B CN 201810587168 A CN201810587168 A CN 201810587168A CN 108768742 B CN108768742 B CN 108768742B
- Authority
- CN
- China
- Prior art keywords
- nodes
- network
- target
- feature network
- initial feature
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/12—Discovery or management of network topologies
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The disclosure relates to a network construction method and device, electronic equipment and a storage medium, and relates to the technical field of machine learning, wherein the method comprises the following steps: extracting characteristic data of current data in the message queue to obtain a plurality of nodes; connecting the nodes according to the corresponding relation among the nodes to form a plurality of edges; and constructing a target feature network according to the edges and the nodes contained by each edge based on an initial feature network. The method and the device can quickly construct the target feature network and improve the real-time performance of the target feature network.
Description
Technical Field
The present disclosure relates to the field of machine learning technologies, and in particular, to a network construction method, a network construction apparatus, an electronic device, and a computer-readable storage medium.
Background
The fraud behaviors of internet finance are characterized by group operations more and more, and the fraud behaviors of black-yielding group operations need to be identified in time in order to prevent fund loss.
In the related art, the fraudulent behavior may be characterized based on a rule engine to distinguish the fraudulent behavior from normal operation, but the rule engine is updated according to the latest criminal behavior of black products. In order to avoid updating the rules in real time, a large amount of historical data can be used for training the anti-fraud model, and then fraud behavior recognition is carried out through the anti-fraud model. However, since most historical data is unlabeled, unsupervised models are typically used and domain experts are required to verify the predictions and provide feedback to adjust the model in a timely manner.
When the anti-fraud model is established, the calculation and adjustment of the model generally need a long time and cannot be established quickly; in addition, because the traditional complex network construction mode has huge data volume, the calculation result of the full data of the previous day can not be returned until the next day, and certain hysteresis exists, so that the complex network for real-time monitoring is difficult to obtain.
It is to be noted that the information disclosed in the above background section is only for enhancement of understanding of the background of the present disclosure, and thus may include information that does not constitute prior art known to those of ordinary skill in the art.
Disclosure of Invention
An object of the present disclosure is to provide a network construction method and apparatus, an electronic device, and a storage medium, which overcome, at least to some extent, the problem of slow network establishment due to the limitations and disadvantages of the related art.
Additional features and advantages of the disclosure will be set forth in the detailed description which follows, or in part will be obvious from the description, or may be learned by practice of the disclosure.
According to an aspect of the present disclosure, there is provided a network construction method including: extracting characteristic data of current data in the message queue to obtain a plurality of nodes; connecting the nodes according to the corresponding relation among the nodes to form a plurality of edges; and constructing a target feature network according to the edges and the nodes contained by each edge based on an initial feature network.
In an exemplary embodiment of the present disclosure, the method further comprises: extracting characteristic data of the historical data in the message queue to obtain a plurality of historical nodes; and connecting the plurality of history nodes to form a plurality of history edges so as to construct the initial feature network according to the plurality of history edges.
In an exemplary embodiment of the present disclosure, constructing the target feature network according to the plurality of edges and the node included in each edge based on an initial feature network includes: analyzing each edge into two nodes, and judging whether the two nodes exist in the initial characteristic network or not; and constructing a target connected branch according to the existing states of the two nodes in the initial feature network, and constructing the target feature network through a plurality of target connected branches.
In an exemplary embodiment of the present disclosure, constructing a target connected branch according to the presence states of the two nodes in the initial feature network includes: if the two nodes do not exist in the initial feature network, adding the two nodes to a new connected branch to obtain the target connected branch; if the target node of the two nodes exists in the initial feature network, adding the node which does not exist in the initial feature network in the two nodes to a connected branch of the target node in the initial feature network to obtain a target connected branch; and if the two nodes exist in the initial feature network, adjusting the connected branches of the two nodes in the initial feature network to obtain the target connected branch.
In an exemplary embodiment of the present disclosure, adjusting the connected branches of the two nodes in the initial feature network to obtain the target connected branch includes: determining whether the connected branches where the two nodes are located are the same or not according to the attribute parameters of the two nodes in the initial feature network; if the connected branches of the two nodes in the initial characteristic network are the same, adding edges between the two nodes to obtain the target connected branch; and if the connected branches of the two nodes in the initial characteristic network are different, combining the connected branches of the two nodes to obtain the target connected branch.
In an exemplary embodiment of the present disclosure, merging the connected branches where the two nodes are located to obtain the target connected branch includes: adding edges between the connected branches where the two nodes are located, and merging the connected branches containing less nodes into the connected branches containing more nodes to obtain the target connected branches.
In an exemplary embodiment of the present disclosure, the method further comprises: and before the target communication branch is constructed, locking the communication branches of the two nodes according to the sequence from the communication branches to the nodes.
In an exemplary embodiment of the present disclosure, the method further comprises: and when the connected branches where the two nodes are located are combined, updating the node identification of each node in the connected branches where the two nodes are located, wherein the connected branches contain fewer nodes.
In an exemplary embodiment of the present disclosure, the method further comprises: and when the target connected branch is constructed, updating the number of nodes contained in the connected branch added with the node in the connected branches where the two nodes are positioned.
In an exemplary embodiment of the present disclosure, the method further comprises: and identifying and analyzing the user data through the target characteristic network to determine whether the user data is abnormal data.
According to an aspect of the present disclosure, there is provided a network construction apparatus including: the node extraction module is used for extracting characteristic data of current data in the message queue to obtain a plurality of nodes; the edge acquisition module is used for connecting the nodes according to the corresponding relation among the nodes to form a plurality of edges; and the network generation module is used for constructing a target feature network according to the edges and the nodes contained in each edge based on an initial feature network.
According to an aspect of the present disclosure, there is provided an electronic device including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform any of the above network construction methods via execution of the executable instructions.
According to an aspect of the present disclosure, there is provided a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements a network construction method as recited in any one of the above.
In a network construction method, a network construction apparatus, an electronic device, and a computer-readable storage medium provided in exemplary embodiments of the present disclosure, on one hand, a target feature network can be quickly constructed for recognition analysis by constructing the target feature network based on an initial feature network according to a plurality of edges and nodes included in each edge; on the other hand, the time for constructing the target feature network can be shortened, so that the real-time performance of the target feature network is improved.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.
Drawings
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and together with the description, serve to explain the principles of the disclosure. It is to be understood that the drawings in the following description are merely exemplary of the disclosure, and that other drawings may be derived from those drawings by one of ordinary skill in the art without the exercise of inventive faculty.
Fig. 1 schematically illustrates a system architecture diagram for implementing a network construction method in an exemplary embodiment of the disclosure;
FIG. 2 schematically illustrates a network construction method in an exemplary embodiment of the disclosure;
FIG. 3 schematically illustrates a block diagram of a network construction in an exemplary embodiment of the disclosure;
FIG. 4 schematically illustrates a detailed flow chart of constructing a target feature network in an exemplary embodiment of the present disclosure;
fig. 5 schematically illustrates a block diagram of a network construction apparatus in an exemplary embodiment of the present disclosure;
FIG. 6 schematically illustrates a block diagram of an electronic device in an exemplary embodiment of the disclosure;
fig. 7 schematically illustrates a program product in an exemplary embodiment of the disclosure.
Detailed Description
Example embodiments will now be described more fully with reference to the accompanying drawings. Example embodiments may, however, be embodied in many different forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a thorough understanding of embodiments of the disclosure. One skilled in the relevant art will recognize, however, that the subject matter of the present disclosure can be practiced without one or more of the specific details, or with other methods, components, devices, steps, and the like. In other instances, well-known technical solutions have not been shown or described in detail to avoid obscuring aspects of the present disclosure.
Furthermore, the drawings are merely schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and thus their repetitive description will be omitted. Some of the block diagrams shown in the figures are functional entities and do not necessarily correspond to physically or logically separate entities. These functional entities may be implemented in the form of software, or in one or more hardware modules or integrated circuits, or in different networks and/or processor devices and/or microcontroller devices.
The present exemplary embodiment first provides a system architecture for implementing a network construction method, which can be applied to various recognition scenarios, such as image recognition, behavior recognition, and the like. Referring to fig. 1, the system architecture 100 may include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 serves as a medium for providing communication links between the terminal devices 101, 102, 103 and the server 105. Network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, to name a few.
The user may use the terminal devices 101, 102, 103 to interact with the server 105 via the network 104 to receive or send request instructions or the like. The terminal devices 101, 102, 103 may have various communication client applications installed thereon, such as a photo processing application, a shopping application, a web browser application, a search application, an instant messaging tool, a mailbox client, social platform software, and the like.
The terminal devices 101, 102, 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop portable computers, desktop computers, and the like.
The server 105 may be a server providing various services, such as a background management server (for example only) providing support for shopping-like websites browsed by users using the terminal devices 101, 102, 103. The backend management server may analyze and perform other processing on the received data such as the product information query request, and feed back a processing result (for example, target push information, product information — just an example) to the terminal device.
It should be noted that the network construction method provided in the embodiment of the present application is generally executed by the server 105, and accordingly, the network construction apparatus is generally disposed in the terminal device 101.
Based on the system architecture 100, a network construction method is provided in this example, and as shown in fig. 2, the network construction method may include the following steps:
in step S210, feature data extraction is performed on the current data in the message queue to obtain a plurality of nodes;
in step S220, connecting the plurality of nodes according to the corresponding relationship between the plurality of nodes to form a plurality of edges;
in step S230, based on an initial feature network, a target feature network is constructed according to the edges and the nodes included in each edge.
On one hand, according to the network construction method provided by the present exemplary embodiment, on the basis of the initial feature network, the target feature network is constructed according to the plurality of edges and the nodes included in each edge, so that the target feature network for identification and analysis can be quickly constructed; on the other hand, the time for constructing the target feature network can be shortened, so that the real-time performance of the target feature network is improved.
Next, a network construction method in the present exemplary embodiment will be described in detail with reference to the drawings.
In step S210, feature data extraction is performed on the current data in the message queue to obtain a plurality of nodes.
In the exemplary embodiment, the data source may be used to store historical data for all users of a business system. All data in the data source may be exposed by way of the message queue. Referring to fig. 3, data in a data source is divided into registration information, login information, and ordering information according to service types. In order to meet the real-time requirement of a service system, a data source can store data in a message queue mode, and a data processing framework can adopt a stream type processing framework such as a Storm platform, so that the data on the day can be extracted, processed and calculated, the result is dynamically returned, and the hysteresis in the related technology is avoided.
For a message queue, there may be a separation into historical data that already exists and current data that is newly added. In step S210, feature data extraction may be performed on each newly added current data, resulting in a plurality of nodes representing features thereof. The nodes herein may be minimal nodes, the types of which include, but are not limited to, accounts, phones, mailboxes, IPs, bank cards, device IDs, and the like. The generated nodes can be directly stored in the graph database in a key-value pair mode.
In step S220, the nodes are connected according to the corresponding relationship between the nodes to form a plurality of edges.
In the present exemplary embodiment, if there is a correspondence between two nodes, the nodes having a correspondence may be connected to each other to form an edge; if there is a corresponding relationship between the nodes, the nodes with the corresponding relationship can be connected to form a plurality of edges. Any two nodes can be selected to generate edges according to the service requirements. The plurality of edges may be undirected edges, and each edge represents a corresponding relationship. For example, for a node account, phone, mailbox, IP, bank card, device ID, the generated edges include, but are not limited to, an account-phone relationship, an account-mailbox relationship, an account-device ID relationship, an account-bank card relationship, and the like. From the parsed nodes and edges generated therein, graph objects can be constructed, and the nodes, edges, and graph objects can all be stored in a graph database.
Next, in step S230, based on an initial feature network, a target feature network is constructed according to the edges and the nodes included in each edge.
In this exemplary embodiment, the initial feature network may be constructed from all historical data already present in the message queue, and the initial feature network may be a convolutional neural network or other network structure. Specifically, feature data extraction can be performed on historical data in the message queue to obtain a plurality of historical nodes; and connecting the plurality of history nodes to form a plurality of history edges so as to construct the initial feature network according to the plurality of history edges. The method for obtaining the history node is the same as that described in step S210, and the method for forming the history edge is the same as that described in step S220, and is not described herein again. An initial feature network may then be constructed from the plurality of historical edges and the historical nodes. The initial feature network may, for example, include history nodes A, B, C, D, E, F, G and a plurality of history edges composed of these history nodes.
After the initial characteristic network is built, for each current data newly added into the message queue, adjustment can be performed on the basis of the initial characteristic network, so that a target characteristic network is built according to a plurality of edges generated by the current data and nodes contained by each edge. The method specifically comprises the following steps: analyzing each edge into two nodes, and judging whether the two nodes exist in the initial characteristic network or not; and constructing a target connected branch according to the existing states of the two nodes in the initial feature network, and constructing the target feature network through a plurality of target connected branches. The existence state of the two nodes in the initial feature network can be judged by comparing the two nodes with all historical nodes in the initial feature network. The target connected branch refers to an edge generated by current data on the basis of the initial feature network, and may be a newly added edge or an original edge in the initial feature network, and may be specifically determined according to the obtained existing states of the two nodes in the initial feature network.
The methods for generating the target connected branch corresponding to the three states of two nodes, only one of the two nodes and no existence of the two nodes in the initial characteristic network are different. The method specifically comprises the following steps: and if the two nodes do not exist in the initial feature network, adding a new connected branch to the two nodes to obtain the target connected branch. For example, in the current data, two nodes of the edge 1 include A, B, which are compared with historical nodes in the initial feature network, and if it is determined that neither node a nor node B exists in the initial feature network, a new connected branch is added between node a and node B, for example, an edge connecting node a and node B is generated, so as to obtain a target connected branch, and simultaneously, node a and node B may be respectively stored in a point table of the graph database, for example, a KEY VALUE table KEY-VALUE, and an edge between node a and node B may be stored in an edge table in the graph database.
If the target node of the two nodes exists in the initial feature network, adding the node which does not exist in the initial feature network in the two nodes to a connected branch of the target node in the initial feature network to obtain a target connected branch. The target node may be either of the two nodes. For example, in the current data, two nodes of the edge 2 include a node C and a node D, and are compared with the historical nodes in the initial feature network, and if the node C exists in the initial feature network, the node C is the target node. At this time, the node D that does not exist in the initial feature network may be added to the connected branch of the target node in the initial feature network, that is, the node D is added to the connected branch of the node C in the initial feature network, so as to obtain the target connected branch. And if the node D exists in the initial characteristic network, adding the node C to the connected branch where the node D is located in the initial characteristic network to obtain a target connected branch. Meanwhile, node D may be stored to a point table of the graph database, and an edge between node C and node D may be stored to an edge table of the graph database.
And if the two nodes exist in the initial feature network, adjusting the connected branches of the two nodes in the initial feature network to obtain the target connected branch. The method specifically comprises the following steps: and determining whether the connected branches where the two nodes are located are the same or not through the attribute parameters of the two nodes in the initial feature network. The attribute parameter refers to each connected branch ID in the initial feature network, and if the connected branch IDs of the two nodes are the same, the connected branches of the two nodes are determined to be the same. And if the connected branches of the two nodes in the initial characteristic network are the same, directly adding edges between the two nodes to obtain the target connected branch. For example, in the current data, two nodes of the edge 3 include a node E and a node F, and if both the node E and the node F exist in the initial feature network and the connected branch where the node E is located is the same as the connected branch where the node F is located, an edge may be directly added between the node E and the node F to obtain a target connected branch.
And if the connected branches of the two nodes in the initial characteristic network are different, combining the connected branches of the two nodes to obtain the target connected branch. The concrete steps of merging include: adding edges between the connected branches where the two nodes are located, and merging the connected branches containing less nodes into the connected branches containing more nodes to obtain the target connected branches. The connected branches with a small number of nodes may be referred to as small connected branches, and the connected branches with a large number of nodes may be referred to as large connected branches. For example, node a and node B, C, D are connected to form connected branch 1, and node E and node FG are connected to form connected branch 2. The connected branch where the node E is located is called a small connected branch because the number of nodes on the connected branch is small; if there are more nodes on the connected branch where the node a is located, the connected branch is called a large connected branch, and at this time, the connected branch 2 where the node E is located may be merged to the connected branch 1 where the node a is located, so as to obtain a target connected branch. And when the connected branches where the two nodes are located are merged, updating the connected branch identification of each node in the connected branches where the two nodes are located, wherein the connected branches contain fewer nodes. That is, if the connected branch 2 where the node E is located is merged to the connected branch 1 where the node a is located, the connected branch identities of all nodes, e.g., FG, on the connected branch 1 where the node E is located are updated to the identity of the connected branch 1.
Each newly added current data can correspond to a plurality of edges, each edge can be analyzed into two nodes, the two nodes on each edge can construct a target connected branch through the method, and then a target characteristic network can be constructed by combining the obtained target connected branches with the initial characteristic network.
The connected branches in the present exemplary embodiment are incremental connected branches, and when incremental connected branches of a complex network are constructed, algorithms and data structures such as a real-time maximum connected branch, a minimum connected branch, a maximum spanning tree, a minimum spanning tree, and the like may be adopted.
The algorithm adopts an increment mode to calculate the connected branches, extracts side information from newly arrived messages in the message queue, completes the combination of the connected branches, avoids repeated static calculation for many times, and can reduce the time delay of graph query to millisecond level. The storage of the connected branches uses a graph database, and the index of the graph data is used for searching the graph structure in an accelerated mode. The present exemplary embodiment is capable of building a connected branch of a target feature network in real time. The time for calculating the communication branch of the network is shortened, the delay time is avoided, and the requirements of monitoring the network in real time and rapidly intercepting malicious behaviors can be met.
Before a target connectivity branch is constructed in any of the above manners, the transactional nature of the operation may be protected using a distributed lock to prevent simultaneous operations on the same node by other threads. And locking the connected branches where the two nodes are located according to the sequence from the connected branches to the nodes. That is, before the update operations of the connected branch and the node, the connected branch is locked first, and then the node is locked. The order of releasing the lock is reversed.
In addition, when the target connected branch is constructed, if a new node is added to any one of the connected branches where the two nodes are located, the number of nodes included in the connected branch where the node is added is updated. Specifically, each time a new node is added to a connected branch ID, the number of nodes included in the connected branch is increased by one.
Further, the user data can be subjected to identification analysis through the constructed target feature network so as to determine whether the user data is abnormal data. For example, the user data may be input into the target feature network, and the result thereof may be scored, specifically, the fraud scoring condition of the connected branch may be comprehensively determined according to the modularity of the connected branch, that is, the attribute of each node and the number of entries and exits of the node, so as to determine whether the user data is abnormal data related to fraud.
Referring to fig. 4, a specific method for constructing a complex network in the present exemplary embodiment may include the following steps:
in step S40, a registration page is opened.
In step S41, the registration information in the registration page is extracted.
In step S42, the acquired registration information is parsed into edges to extract the corresponding relationships in the registration information, such as account-phone, account-mailbox, account-IP.
In step S43, the correspondence is resolved into a plurality of nodes, such as an account, a phone, a mailbox, an IP, and the like.
In step S44, determining whether two nodes on the edge exist in the initial feature network constructed from the history data specifically includes:
in the first case S441, neither node exists, including:
s4411, adding the same new connected branch into the two nodes.
S4412, storing the two nodes into a point table of the graph database.
S4413, storing the edges between the nodes into an edge table of the graph database.
In a second case S442, there is only one node, including:
s4411, adding the non-existing node to the connected branch of the already existing node.
S4412, the nonexistent nodes are stored in the point table of the graph database.
S4413, storing the edges between the nodes into an edge table of the graph database.
In a third case S443, if two nodes exist, determining whether the two nodes are in the same connected branch through S444 includes:
s4441, if two nodes are in the same connected branch, adding an edge between the two nodes.
S4442, if the two nodes are not in the same connected branch, combining the connected branches where the two nodes are located, wherein the combining process includes steps S4443 to S4445.
Wherein, in S4443, a side is added between the two connected branches.
S4444, merging the small connected branch into the large connected branch.
S4445, updating the connected branch ID of the node in the small connected branch.
Through the steps in fig. 4, the connected branch of the complex network can be constructed in real time, the time for calculating the connected branch of the network is reduced, the delay time is avoided, and the requirements for monitoring the network in real time and rapidly intercepting malicious behaviors can be met.
The disclosure also provides a network construction device. Referring to fig. 5, the network construction apparatus 500 may include:
the node extraction module 501 may be configured to perform feature data extraction on current data in the message queue to obtain a plurality of nodes;
an edge obtaining module 502, configured to connect a plurality of nodes according to a correspondence between the plurality of nodes to form a plurality of edges;
the network generating module 503 may be configured to construct a target feature network according to the plurality of edges and the nodes included in each edge based on an initial feature network.
It should be noted that, the specific details of each module in the network construction apparatus have been described in detail in the corresponding network construction method, and therefore are not described herein again.
It should be noted that although in the above detailed description several modules or units of the device for action execution are mentioned, such a division is not mandatory. Indeed, the features and functionality of two or more modules or units described above may be embodied in one module or unit, according to embodiments of the present disclosure. Conversely, the features and functions of one module or unit described above may be further divided into embodiments by a plurality of modules or units.
Moreover, although the steps of the methods of the present disclosure are depicted in the drawings in a particular order, this does not require or imply that the steps must be performed in this particular order, or that all of the depicted steps must be performed, to achieve desirable results. Additionally or alternatively, certain steps may be omitted, multiple steps combined into one step execution, and/or one step broken down into multiple step executions, etc.
In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.
As will be appreciated by one skilled in the art, aspects of the present invention may be embodied as a system, method or program product. Thus, various aspects of the invention may be embodied in the form of: an entirely hardware embodiment, an entirely software embodiment (including firmware, microcode, etc.) or an embodiment combining hardware and software aspects that may all generally be referred to herein as a "circuit," module "or" system.
An electronic device 600 according to this embodiment of the invention is described below with reference to fig. 6. The electronic device 600 shown in fig. 6 is only an example, and should not bring any limitation to the functions and the scope of use of the embodiments of the present invention.
As shown in fig. 6, the electronic device 600 is embodied in the form of a general purpose computing device. The components of the electronic device 600 may include, but are not limited to: the at least one processing unit 610, the at least one memory unit 620, and a bus 630 that couples the various system components including the memory unit 620 and the processing unit 610.
Wherein the storage unit stores program code that is executable by the processing unit 610 to cause the processing unit 610 to perform steps according to various exemplary embodiments of the present invention as described in the above section "exemplary methods" of the present specification. For example, the processing unit 610 may perform the steps as shown in fig. 2.
The storage unit 620 may include readable media in the form of volatile memory units, such as a random access memory unit (RAM)6201 and/or a cache memory unit 6202, and may further include a read-only memory unit (ROM) 6203.
The memory unit 620 may also include a program/utility 6204 having a set (at least one) of program modules 6205, such program modules 6205 including, but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which, or some combination thereof, may comprise an implementation of a network environment.
The electronic device 600 may also communicate with one or more external devices 800 (e.g., keyboard, pointing device, bluetooth device, etc.), with one or more devices that enable a user to interact with the electronic device 600, and/or with any devices (e.g., router, modem, etc.) that enable the electronic device 600 to communicate with one or more other computing devices. Such communication may occur via an input/output (I/O) interface 650. Also, the electronic device 600 may communicate with one or more networks (e.g., a Local Area Network (LAN), a Wide Area Network (WAN), and/or a public network such as the Internet) via the network adapter 660. As shown, the network adapter 660 communicates with the other modules of the electronic device 600 over the bus 630. It should be appreciated that although not shown in the figures, other hardware and/or software modules may be used in conjunction with the electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, among others.
Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein may be implemented by software, or by software in combination with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (which may be a CD-ROM, a usb disk, a removable hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which may be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.
In an exemplary embodiment of the present disclosure, there is also provided a computer-readable storage medium having stored thereon a program product capable of implementing the above-described method of the present specification. In some possible embodiments, aspects of the invention may also be implemented in the form of a program product comprising program code means for causing a terminal device to carry out the steps according to various exemplary embodiments of the invention described in the above section "exemplary methods" of the present description, when said program product is run on the terminal device.
Referring to fig. 7, a program product 700 for implementing the above method according to an embodiment of the present invention is described, which may employ a portable compact disc read only memory (CD-ROM) and include program code, and may be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited in this regard and, in the present document, a readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.
The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples (a non-exhaustive list) of the readable storage medium include: an electrical connection having one or more wires, a portable disk, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
A computer readable signal medium may include a propagated data signal with readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A readable signal medium may also be any readable medium that is not a readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.
Program code embodied on a readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.
Program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C + + or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computing device (e.g., through the internet using an internet service provider).
Furthermore, the above-described figures are merely schematic illustrations of processes involved in methods according to exemplary embodiments of the invention, and are not intended to be limiting. It will be readily understood that the processes shown in the above figures are not intended to indicate or limit the chronological order of the processes. In addition, it is also readily understood that these processes may be performed synchronously or asynchronously, e.g., in multiple modules.
Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the disclosure disclosed herein. This application is intended to cover any variations, uses, or adaptations of the disclosure following, in general, the principles of the disclosure and including such departures from the present disclosure as come within known or customary practice within the art to which the disclosure pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the disclosure being indicated by the following claims.
Claims (9)
1. A network construction method, comprising:
extracting characteristic data of current data in the message queue to obtain a plurality of nodes;
connecting the nodes according to the corresponding relation among the nodes to form a plurality of edges;
based on an initial feature network, constructing a target feature network according to the edges and the nodes contained by each edge; the initial feature network is constructed according to all historical data existing in the message queue;
based on an initial feature network, constructing a target feature network according to the edges and the nodes contained by each edge comprises the following steps:
analyzing each edge into two nodes, and judging whether the two nodes exist in the initial characteristic network or not;
constructing target connected branches according to the existing states of the two nodes in the initial feature network, and constructing the target feature network through a plurality of target connected branches; the target connected branch is an edge generated by current data on the basis of an initial characteristic network;
wherein constructing a target connected branch according to the existence states of the two nodes in the initial feature network comprises:
if the two nodes do not exist in the initial feature network, adding the two nodes to a new connected branch to obtain the target connected branch;
if the target node of the two nodes exists in the initial feature network, adding the node which does not exist in the initial feature network in the two nodes to a connected branch of the target node in the initial feature network to obtain a target connected branch;
if the two nodes exist in the initial feature network, adjusting the connected branches of the two nodes in the initial feature network to obtain the target connected branch;
wherein adjusting the connected branches of the two nodes in the initial feature network to obtain the target connected branch comprises: determining whether the connected branches where the two nodes are located are the same or not according to the attribute parameters of the two nodes in the initial feature network; if the connected branches of the two nodes in the initial characteristic network are the same, adding edges between the two nodes to obtain the target connected branch; if the connected branches of the two nodes in the initial feature network are different, combining the connected branches of the two nodes to obtain the target connected branch;
merging the connected branches where the two nodes are located to obtain the target connected branch comprises: adding edges between the connected branches where the two nodes are located, and merging the connected branches containing less nodes into the connected branches containing more nodes to obtain the target connected branches.
2. The method of network construction according to claim 1, the method further comprising:
extracting characteristic data of the historical data in the message queue to obtain a plurality of historical nodes;
and connecting the plurality of history nodes to form a plurality of history edges so as to construct the initial feature network according to the plurality of history edges.
3. The method of network construction according to claim 1, the method further comprising:
and before the target communication branch is constructed, locking the communication branches of the two nodes according to the sequence from the communication branches to the nodes.
4. The method of network construction according to claim 1, the method further comprising:
and when the connected branches where the two nodes are located are combined, updating the node identification of each node in the connected branches where the two nodes are located, wherein the connected branches contain fewer nodes.
5. The method of network construction according to claim 1, the method further comprising:
and when the target connected branch is constructed, updating the number of nodes contained in the connected branch added with the node in the connected branches where the two nodes are positioned.
6. The method of network construction according to any of claims 1-2, wherein the method further comprises:
and identifying and analyzing the user data through the target characteristic network to determine whether the user data is abnormal data.
7. A network construction apparatus, comprising:
the node extraction module is used for extracting characteristic data of current data in the message queue to obtain a plurality of nodes;
the edge acquisition module is used for connecting the nodes according to the corresponding relation among the nodes to form a plurality of edges;
the network generation module is used for constructing a target feature network according to the edges and the nodes contained in each edge based on an initial feature network; the initial feature network is constructed according to all historical data existing in the message queue;
based on an initial feature network, constructing a target feature network according to the edges and the nodes contained by each edge comprises the following steps:
analyzing each edge into two nodes, and judging whether the two nodes exist in the initial characteristic network or not;
constructing target connected branches according to the existing states of the two nodes in the initial feature network, and constructing the target feature network through a plurality of target connected branches; the target connected branch is an edge generated by current data on the basis of an initial characteristic network;
wherein constructing a target connected branch according to the existence states of the two nodes in the initial feature network comprises:
if the two nodes do not exist in the initial feature network, adding the two nodes to a new connected branch to obtain the target connected branch;
if the target node of the two nodes exists in the initial feature network, adding the node which does not exist in the initial feature network in the two nodes to a connected branch of the target node in the initial feature network to obtain a target connected branch;
if the two nodes exist in the initial feature network, adjusting the connected branches of the two nodes in the initial feature network to obtain the target connected branch;
wherein adjusting the connected branches of the two nodes in the initial feature network to obtain the target connected branch comprises: determining whether the connected branches where the two nodes are located are the same or not according to the attribute parameters of the two nodes in the initial feature network; if the connected branches of the two nodes in the initial characteristic network are the same, adding edges between the two nodes to obtain the target connected branch; if the connected branches of the two nodes in the initial feature network are different, combining the connected branches of the two nodes to obtain the target connected branch;
merging the connected branches where the two nodes are located to obtain the target connected branch comprises: adding edges between the connected branches where the two nodes are located, and merging the connected branches containing less nodes into the connected branches containing more nodes to obtain the target connected branches.
8. An electronic device, comprising:
a processor; and
a memory for storing executable instructions of the processor;
wherein the processor is configured to perform the network construction method of any of claims 1-6 via execution of the executable instructions.
9. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the network construction method according to any one of claims 1 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810587168.5A CN108768742B (en) | 2018-06-06 | 2018-06-06 | Network construction method and device, electronic equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810587168.5A CN108768742B (en) | 2018-06-06 | 2018-06-06 | Network construction method and device, electronic equipment and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN108768742A CN108768742A (en) | 2018-11-06 |
| CN108768742B true CN108768742B (en) | 2020-09-29 |
Family
ID=63999608
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810587168.5A Active CN108768742B (en) | 2018-06-06 | 2018-06-06 | Network construction method and device, electronic equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108768742B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109726203A (en) * | 2018-12-20 | 2019-05-07 | 四川新网银行股份有限公司 | A kind of date storage method of reconstruct image |
| CN110188871B (en) * | 2019-05-31 | 2021-01-26 | 安徽寒武纪信息科技有限公司 | Operation method, device and related product |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102075352A (en) * | 2010-12-17 | 2011-05-25 | 北京邮电大学 | Method and device for predicting network user behavior |
| CN102932189A (en) * | 2012-11-22 | 2013-02-13 | 中国科学技术大学 | Method and system for seeking maximum bottleneck rate |
| CN106603309A (en) * | 2017-01-04 | 2017-04-26 | 大连大学 | Supernet-based command and control network hierarchical evolution method |
| CN106850346A (en) * | 2017-01-23 | 2017-06-13 | 北京京东金融科技控股有限公司 | Change and assist in identifying method, device and the electronic equipment of blacklist for monitor node |
| CN107291709A (en) * | 2016-03-30 | 2017-10-24 | 阿里巴巴集团控股有限公司 | The construction method and device of relational network |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20150220627A1 (en) * | 2014-02-04 | 2015-08-06 | International Business Machines Corporation | System and method for finding collective interest-based social communities |
-
2018
- 2018-06-06 CN CN201810587168.5A patent/CN108768742B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102075352A (en) * | 2010-12-17 | 2011-05-25 | 北京邮电大学 | Method and device for predicting network user behavior |
| CN102932189A (en) * | 2012-11-22 | 2013-02-13 | 中国科学技术大学 | Method and system for seeking maximum bottleneck rate |
| CN107291709A (en) * | 2016-03-30 | 2017-10-24 | 阿里巴巴集团控股有限公司 | The construction method and device of relational network |
| CN106603309A (en) * | 2017-01-04 | 2017-04-26 | 大连大学 | Supernet-based command and control network hierarchical evolution method |
| CN106850346A (en) * | 2017-01-23 | 2017-06-13 | 北京京东金融科技控股有限公司 | Change and assist in identifying method, device and the electronic equipment of blacklist for monitor node |
Also Published As
| Publication number | Publication date |
|---|---|
| CN108768742A (en) | 2018-11-06 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111343161B (en) | Abnormal information processing node analysis method, abnormal information processing node analysis device, abnormal information processing node analysis medium and electronic equipment | |
| US11613008B2 (en) | Automating a process using robotic process automation code | |
| CN111708938B (en) | Method, apparatus, electronic device, and storage medium for information processing | |
| CN113157545A (en) | Method, device and equipment for processing service log and storage medium | |
| US20200089586A1 (en) | Cognitively triggering recovery actions during a component disruption in a production environment | |
| US11507747B2 (en) | Hybrid in-domain and out-of-domain document processing for non-vocabulary tokens of electronic documents | |
| US11954173B2 (en) | Data processing method, electronic device and computer program product | |
| CN113986864A (en) | Log data processing method and device, electronic equipment and storage medium | |
| CN112861529A (en) | Method and device for managing error codes | |
| CN113836314A (en) | Knowledge graph construction method, device, equipment and storage medium | |
| CN108768742B (en) | Network construction method and device, electronic equipment and storage medium | |
| CN111831682A (en) | Method, device, equipment and computer readable medium for processing accumulation fund service | |
| US20190279228A1 (en) | Suspicious activity report smart validation | |
| CN114358147A (en) | Training method, identification method, device and equipment of abnormal account identification model | |
| CN112528040B (en) | Detection method for guiding drive corpus based on knowledge graph and related equipment thereof | |
| CN111190967B (en) | User multidimensional data processing method and device and electronic equipment | |
| CN113595886A (en) | Instant messaging message processing method and device, electronic equipment and storage medium | |
| CN110782310B (en) | Method, device and system for asynchronously acquiring user attribute information from third-party platform | |
| US20230004715A1 (en) | Method and apparatus for constructing object relationship network, and electronic device | |
| CN113360672B (en) | Method, apparatus, device, medium and product for generating knowledge graph | |
| CN113590447B (en) | Buried point processing method and device | |
| CN115760013A (en) | Operation and maintenance model construction method and device, electronic equipment and storage medium | |
| CN115795345A (en) | Information processing method, device, equipment and storage medium | |
| US20230095634A1 (en) | Apparatuses, methods, and computer program products for ml assisted service risk analysis of unreleased software code | |
| US20220172102A1 (en) | Machine learning model trained using features extracted from n-grams of mouse event data |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| CB02 | Change of applicant information | ||
| CB02 | Change of applicant information |
Address after: Room 221, 2nd floor, Block C, 18 Kechuang 11th Street, Beijing Daxing District, Beijing Applicant after: JINGDONG DIGITAL TECHNOLOGY HOLDINGS Co.,Ltd. Address before: Room 221, 2nd floor, Block C, 18 Kechuang 11th Street, Beijing Ji-Tech Development Zone, 100176 Applicant before: BEIJING JINGDONG FINANCIAL TECHNOLOGY HOLDING Co.,Ltd. |
|
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CP01 | Change in the name or title of a patent holder | ||
| CP01 | Change in the name or title of a patent holder |
Address after: Room 221, 2 / F, block C, 18 Kechuang 11th Street, Daxing District, Beijing, 100176 Patentee after: Jingdong Technology Holding Co.,Ltd. Address before: Room 221, 2 / F, block C, 18 Kechuang 11th Street, Daxing District, Beijing, 100176 Patentee before: Jingdong Digital Technology Holding Co.,Ltd. Address after: Room 221, 2 / F, block C, 18 Kechuang 11th Street, Daxing District, Beijing, 100176 Patentee after: Jingdong Digital Technology Holding Co.,Ltd. Address before: Room 221, 2 / F, block C, 18 Kechuang 11th Street, Daxing District, Beijing, 100176 Patentee before: JINGDONG DIGITAL TECHNOLOGY HOLDINGS Co.,Ltd. |