阅读说明：本技术 基于人工智能的非法行为检测方法、装置、设备及介质 (Illegal behavior detection method, device, equipment and medium based on artificial intelligence ) 是由 罗国辉 郑立君 刘申云 许海金 韦亚雄 罗芳 李海鹏 于 2021-09-16 设计创作，主要内容包括：本发明涉及人工智能技术,揭露了一种基于人工智能的非法行为检测方法,包括：获取待检测用户数据集,并根据所述待检测用户数据集构建用户关系网,基于图聚类法对所述用户关系网进行聚类分析,得到异常用户集；基于模式挖掘算法对所述异常用户集进行挖掘和筛选,得到疑似非法用户集；基于预设的非法行为模式对所述疑似非法用户集进行人群画像分析,得到非法用户集；通过对所述非法用户集进行识别检测,得到非法行为团体。此外,本发明还涉及区块链技术,待检测用户数据集可存储于区块链的节点。本发明还提出一种基于人工智能的非法行为检测装置、电子设备以及存储介质。本发明可以解决非法行为检测的准确性较低的问题。(The invention relates to an artificial intelligence technology, and discloses an illegal behavior detection method based on artificial intelligence, which comprises the following steps: acquiring a user data set to be detected, constructing a user relationship network according to the user data set to be detected, and performing cluster analysis on the user relationship network based on a graph clustering method to obtain an abnormal user set; mining and screening the abnormal user set based on a pattern mining algorithm to obtain a suspected illegal user set; carrying out crowd portrait analysis on the suspected illegal user set based on a preset illegal behavior mode to obtain an illegal user set; and identifying and detecting the illegal user set to obtain an illegal action group. In addition, the invention also relates to a block chain technology, and the user data set to be detected can be stored in the node of the block chain. The invention also provides an illegal behavior detection device based on artificial intelligence, electronic equipment and a storage medium. The invention can solve the problem of lower accuracy of illegal behavior detection.)

1. An illegal behavior detection method based on artificial intelligence, which is characterized by comprising the following steps:

acquiring a user data set to be detected, constructing a user relationship network according to the user data set to be detected, and performing cluster analysis on the user relationship network based on a graph clustering method to obtain an abnormal user set;

mining and screening the abnormal user set based on a pattern mining algorithm to obtain a suspected illegal user set;

carrying out crowd portrait analysis on the suspected illegal user set based on a preset illegal behavior mode to obtain an illegal user set;

and identifying and detecting the illegal user set to obtain an illegal action group.

2. The illegal behavior detection method based on artificial intelligence of claim 1, wherein the obtaining a user data set to be detected and constructing a user relationship network according to the user data set to be detected comprises:

acquiring financial data of a user to be detected from a preset database to obtain a user data set;

constructing a directed graph by taking users in the user data set as nodes and taking transfer data in financial data of each user as edges;

and taking the receiving and paying direction of the transfer data as the pointing direction of the edge in the digraph, and taking the amount of the transfer data as the weight of the edge in the digraph to obtain a user relationship network.

3. The illegal activity detection method based on artificial intelligence of claim 1, wherein the clustering analysis of the user relationship network based on graph clustering method to obtain an abnormal user set comprises:

calculating an adjacency matrix and a degree matrix of the user relationship network;

calculating a Laplace matrix according to the adjacency matrix and the degree matrix;

calculating an eigenvalue and an eigenvector of the Laplace matrix;

selecting eigenvectors corresponding to the first k eigenvalues from the eigenvalues of the Laplace matrix according to the sequence from small to large, and forming an eigenvector matrix by using the selected eigenvectors;

and taking each row of the characteristic matrix as a sample point to perform K-means clustering, and obtaining an abnormal user set according to a clustering result.

4. The illegal activity detection method based on artificial intelligence of claim 1, wherein the mining and screening the abnormal user set based on the pattern mining algorithm to obtain the suspected illegal user set comprises:

acquiring the service data of each user in the abnormal user set, and constructing a sequence behavior data set according to the service data;

and processing the sequence behavior data set by using a frequent pattern mining algorithm to generate a frequent pattern set, and selecting a preset number of frequent patterns in the frequent pattern set to obtain a suspected illegal user set.

5. The illegal activity detection method based on artificial intelligence of claim 4, wherein the processing the sequence activity data set by using a frequent pattern mining algorithm to generate a frequent pattern set, and selecting a preset number of frequent patterns in the frequent pattern set to obtain a suspected illegal user set comprises:

traversing and inquiring: traversing the sequence behavior data set, and searching a frequent item set L1 which meets a preset frequent condition;

connecting and pruning: connecting and pruning the frequent item set L1 to generate a frequent item set L2;

a frequent pattern set step: repeating the traversing query step and the connecting and pruning steps until the generated frequent item set is the maximum item set, and merging the generated frequent item sets to obtain a frequent pattern set;

confirming suspected illegal user sets: and selecting a preset number of frequent item sets in the frequent pattern set, generating an association rule according to the frequent item sets, and screening out user data which accords with the association rule in the abnormal user set to obtain a suspected illegal user set.

6. The illegal activity detection method based on artificial intelligence of claim 1, wherein the analyzing the crowd portraits of the suspected illegal user set based on the preset illegal activity mode to obtain the illegal user set comprises:

extracting behavior characteristics based on a preset illegal behavior mode to generate an image of the funding crowd;

and searching users with user data characteristics meeting the requirements of the image of the capital crowd in the suspected illegal user set to obtain an illegal user set.

7. The illegal activity detection method based on artificial intelligence as claimed in claim 1, wherein said obtaining of illegal activity group by performing identification detection on said illegal user set comprises:

importing the user data in the illegal user set and the transfer records among the users into a graph database to obtain a funding behavior data set;

and detecting and dividing the collective asset behavior data set by using a pattern recognition algorithm based on preset collective asset behavior characteristics to obtain an illegal behavior group.

8. An illegal activity detection device based on artificial intelligence, characterized in that the device comprises:

the cluster analysis module is used for acquiring a user data set to be detected, constructing a user relationship network according to the user data set to be detected, and performing cluster analysis on the user relationship network based on a graph clustering method to obtain an abnormal user set;

the mining and screening module is used for mining and screening the abnormal user set based on a pattern mining algorithm to obtain a suspected illegal user set;

the figure analysis module is used for carrying out crowd figure analysis on the suspected illegal user set based on a preset illegal behavior mode to obtain an illegal user set;

and the identification detection module is used for identifying and detecting the illegal user set to obtain an illegal action group.

9. An electronic device, characterized in that the electronic device comprises:

at least one processor; and the number of the first and second groups,

a memory communicatively coupled to the at least one processor; wherein the content of the first and second substances,

the memory stores a computer program executable by the at least one processor to enable the at least one processor to perform the artificial intelligence based illegal behavior detection method according to any of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the artificial intelligence based illegal behavior detection method according to any one of claims 1 to 7.

Technical Field

The invention relates to the technical field of artificial intelligence, in particular to an illegal behavior detection method and device based on artificial intelligence, electronic equipment and a computer readable storage medium.

Background

Along with the development of economy, the capital allocation efficiency and the financial service quality are improved, good economic benefits and social benefits are generated, and meanwhile, illegal funding behaviors are further expanded.

For the detection of illegal fundraising behaviors, the detection is realized mainly by manually collecting related information, and the accuracy rate and the efficiency are lower; in addition, although it is determined whether there is an illegal funding scenario by analyzing the financial product itself, the funding is not necessarily the product itself, and includes investment activities by individuals and groups, and therefore a method for detecting funding activities with higher accuracy is required.

Disclosure of Invention

The invention provides an illegal behavior detection method and device based on artificial intelligence and a computer readable storage medium, and mainly aims to solve the problem of low accuracy of illegal behavior detection.

In order to achieve the above object, the illegal behavior detection method based on artificial intelligence provided by the present invention comprises:

acquiring a user data set to be detected, constructing a user relationship network according to the user data set to be detected, and performing cluster analysis on the user relationship network based on a graph clustering method to obtain an abnormal user set;

mining and screening the abnormal user set based on a pattern mining algorithm to obtain a suspected illegal user set;

carrying out crowd portrait analysis on the suspected illegal user set based on a preset illegal behavior mode to obtain an illegal user set;

and identifying and detecting the illegal user set to obtain an illegal action group.

Optionally, the obtaining a user data set to be detected, and constructing a user relationship network according to the user data set to be detected includes:

acquiring financial data of a user to be detected from a preset database to obtain a user data set;

constructing a directed graph by taking users in the user data set as nodes and taking transfer data in financial data of each user as edges;

and taking the receiving and paying direction of the transfer data as the pointing direction of the edge in the digraph, and taking the amount of the transfer data as the weight of the edge in the digraph to obtain a user relationship network.

Optionally, the performing cluster analysis on the user relationship network based on a graph clustering method to obtain an abnormal user set includes:

calculating an adjacency matrix and a degree matrix of the user relationship network;

calculating a Laplace matrix according to the adjacency matrix and the degree matrix;

calculating an eigenvalue and an eigenvector of the Laplace matrix;

selecting eigenvectors corresponding to the first k eigenvalues from the eigenvalues of the Laplace matrix according to the sequence from small to large, and forming an eigenvector matrix by using the selected eigenvectors;

and taking each row of the characteristic matrix as a sample point to perform K-means clustering, and obtaining an abnormal user set according to a clustering result.

Optionally, the mining and screening the abnormal user set based on the pattern mining algorithm to obtain a suspected illegal user set includes:

acquiring the service data of each user in the abnormal user set, and constructing a sequence behavior data set according to the service data;

and processing the sequence behavior data set by using a frequent pattern mining algorithm to generate a frequent pattern set, and selecting a preset number of frequent patterns in the frequent pattern set to obtain a suspected illegal user set.

Optionally, the processing the sequence behavior data set by using a frequent pattern mining algorithm to generate a frequent pattern set, and selecting a preset number of frequent patterns in the frequent pattern set to obtain a suspected illegal user set includes:

traversing and inquiring: traversing the sequence behavior data set, and searching a frequent item set L1 which meets a preset frequent condition;

connecting and pruning: connecting and pruning the frequent item set L1 to generate a frequent item set L2;

a frequent pattern set step: repeating the traversing query step and the connecting and pruning steps until the generated frequent item set is the maximum item set, and merging the generated frequent item sets to obtain a frequent pattern set;

confirming suspected illegal user sets: and selecting a preset number of frequent item sets in the frequent pattern set, generating an association rule according to the frequent item sets, and screening out user data which accords with the association rule in the abnormal user set to obtain a suspected illegal user set.

Optionally, the performing crowd portrait analysis on the suspected illegal user set based on a preset illegal behavior pattern to obtain an illegal user set includes:

extracting behavior characteristics based on a preset illegal behavior mode to generate an image of the funding crowd;

and searching users with user data characteristics meeting the requirements of the image of the capital crowd in the suspected illegal user set to obtain an illegal user set.

Optionally, the obtaining an illegal action group by identifying and detecting the illegal user set includes:

importing the user data in the illegal user set and the transfer records among the users into a graph database to obtain a funding behavior data set;

and detecting and dividing the collective asset behavior data set by using a pattern recognition algorithm based on preset collective asset behavior characteristics to obtain an illegal behavior group.

In order to solve the above problem, the present invention further provides an illegal action detection device based on artificial intelligence, the device comprising:

the cluster analysis module is used for acquiring a user data set to be detected, constructing a user relationship network according to the user data set to be detected, and performing cluster analysis on the user relationship network based on a graph clustering method to obtain an abnormal user set;

the mining and screening module is used for mining and screening the abnormal user set based on a pattern mining algorithm to obtain a suspected illegal user set;

the figure analysis module is used for carrying out crowd figure analysis on the suspected illegal user set based on a preset illegal behavior mode to obtain an illegal user set;

and the identification detection module is used for identifying and detecting the illegal user set to obtain an illegal action group.

In order to solve the above problem, the present invention also provides an electronic device, including:

at least one processor; and the number of the first and second groups,

a memory communicatively coupled to the at least one processor; wherein the content of the first and second substances,

the memory stores a computer program executable by the at least one processor to enable the at least one processor to perform the artificial intelligence based illegal behavior detection method described above.

In order to solve the above problem, the present invention further provides a computer-readable storage medium, in which at least one computer program is stored, and the at least one computer program is executed by a processor in an electronic device to implement the artificial intelligence based illegal behavior detection method described above.

The embodiment of the invention determines an abnormal user set by constructing a user relationship network and carrying out cluster analysis on the customer relationship network, then excavates the behavior pattern of the abnormal user and screens out a suspected illegal user set, and then carries out crowd image analysis on the suspected illegal user set to obtain the illegal user set; meanwhile, the scheme is based on people or groups, namely the behavior of the user judges whether the illegal funding behavior exists, and not only judges whether the financial product has the illegal funding behavior scene, so that the detection range is more comprehensive, and the result is more accurate. Therefore, the illegal behavior detection method and device based on artificial intelligence, the electronic equipment and the computer readable storage medium can solve the problem of low accuracy of illegal behavior detection.

Drawings

Fig. 1 is a schematic flow chart of an illegal activity detection method based on artificial intelligence according to an embodiment of the present invention;

fig. 2 is a schematic flow chart of user mining and screening according to an embodiment of the present invention;

FIG. 3 is a functional block diagram of an illegal action detection apparatus based on artificial intelligence according to an embodiment of the present invention;

fig. 4 is a schematic structural diagram of an electronic device implementing the illegal activity detection method based on artificial intelligence according to an embodiment of the present invention.

The implementation, functional features and advantages of the objects of the present invention will be further explained with reference to the accompanying drawings.

Detailed Description

It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

The embodiment of the application provides an illegal behavior detection method based on artificial intelligence. The execution subject of the illegal behavior detection method based on artificial intelligence includes, but is not limited to, at least one of electronic devices such as a server and a terminal, which can be configured to execute the method provided by the embodiment of the present application. In other words, the illegal behavior detection method based on artificial intelligence may be performed by software or hardware installed in the terminal device or the server device, and the software may be a block chain platform. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, and the like. The server may be an independent server, or may be a cloud server that provides basic cloud computing services such as a cloud service, a cloud database, cloud computing, a cloud function, cloud storage, a Network service, cloud communication, a middleware service, a domain name service, a security service, a Content Delivery Network (CDN), a big data and artificial intelligence platform, and the like.

Fig. 1 is a schematic flow chart of an illegal activity detection method based on artificial intelligence according to an embodiment of the present invention. In this embodiment, the illegal behavior detection method based on artificial intelligence includes:

s1, obtaining a user data set to be detected, constructing a user relationship network according to the user data set to be detected, and carrying out cluster analysis on the user relationship network based on a graph clustering method to obtain an abnormal user set.

The user data set in the embodiment of the invention refers to financial data of a plurality of users, including income and expenditure data, investment and financing transaction details and the like. The user relation network is a directed graph formed by nodes and directed edges.

Optionally, to further ensure the security and privacy of the user data set to be detected, the user data set to be detected may also be stored in a node of a block chain.

In detail, the acquiring a user data set to be detected and constructing a user relationship network according to the user data set to be detected includes:

acquiring financial data of a user to be detected from a preset database to obtain a user data set;

constructing a directed graph by taking users in the user data set as nodes and taking transfer data in financial data of each user as edges;

and taking the receiving and paying direction of the transfer data as the pointing direction of the edge in the digraph, and taking the amount of the transfer data as the weight of the edge in the digraph to obtain a user relationship network.

Further, the clustering analysis of the user relationship network based on a graph clustering method to obtain an abnormal user set includes:

calculating an adjacency matrix and a degree matrix of the user relationship network;

calculating a Laplace matrix according to the adjacency matrix and the degree matrix;

calculating an eigenvalue and an eigenvector of the Laplace matrix;

selecting eigenvectors corresponding to the first k eigenvalues from the eigenvalues of the Laplace matrix according to the sequence from small to large, and forming an eigenvector matrix by using the selected eigenvectors;

and taking each row of the characteristic matrix as a sample point to perform K-means clustering, and obtaining an abnormal user set according to a clustering result.

The calculation method of the Laplace matrix is as follows:

L-D-W, L is a laplacian matrix, D is a degree matrix, and W is an adjacency matrix.

According to the embodiment of the invention, through the clustering analysis of the user relationship network, the population with abnormal transfer behaviors can be reduced and identified, so that the range of the user to be analyzed is reduced.

In detail, the performing K-means clustering with each row of the feature matrix as a sample point and obtaining an abnormal user set according to the clustering result includes:

taking each row of the feature matrix as a sample point, and summarizing all the sample points to obtain a sample set;

randomly selecting k sample points in the sample set as clustering centers;

calculating the Euclidean distance from each sample point in the sample set to each clustering center, and allocating each sample point to the cluster of the clustering center with the minimum Euclidean distance to obtain k clusters;

calculating the mean value of each cluster, taking the mean value as a new clustering center of the corresponding cluster, and returning to the step of calculating the Euclidean distance from each sample point in the sample set to each clustering center until reaching the preset iteration times to obtain k clusters;

and searching the user corresponding to each sample point in the k clusters to obtain an abnormal user set.

And S2, mining and screening the abnormal user set based on a pattern mining algorithm to obtain a suspected illegal user set.

In detail, in the embodiment of the present invention, referring to fig. 2, the S2 includes:

s20, acquiring the service data of each user in the abnormal user set, and constructing a sequence behavior data set according to the service data;

and S21, processing the sequence behavior data set by using a frequent pattern mining algorithm, generating a frequent pattern set, and selecting a preset number of frequent patterns in the frequent pattern set to obtain a suspected illegal user set.

Wherein, the service data comprises purchase records, transfer details and the like of the user.

Further, the processing the sequence behavior data set by using a frequent pattern mining algorithm to generate a frequent pattern set, and selecting a preset number of frequent patterns in the frequent pattern set to obtain a suspected illegal user set includes:

traversing and inquiring: traversing the sequence behavior data set, and searching a frequent item set L1 which meets a preset frequent condition;

connecting and pruning: connecting and pruning the frequent item set L1 to generate a frequent item set L2;

a frequent pattern set step: repeating the traversing query step and the connecting and pruning steps until the generated frequent item set is the maximum item set, and merging the generated frequent item sets to obtain a frequent pattern set;

confirming suspected illegal user sets: and selecting a preset number of frequent item sets in the frequent pattern set, generating an association rule according to the frequent item sets, and screening out user data which accords with the association rule in the abnormal user set to obtain a suspected illegal user set.

Wherein the preset frequent condition is that a minimum support degree is satisfied, and the support degree is the probability of the item set appearing in the total data set.

According to the embodiment of the invention, the incidence relation in the user data is excavated through the pattern mining algorithm, and the range of the detected user is further narrowed according to the incidence relation.

And S3, carrying out crowd portrait analysis on the suspected illegal user set based on a preset illegal behavior mode to obtain the illegal user set.

The preset illegal behavior mode in the embodiment of the invention is based on a common behavior characteristic set of funding behaviors, such as a product purchase oriented mode, a fund-like pool mode and the like.

In detail, the analyzing the crowd portraits of the suspected illegal user set based on the preset illegal behavior mode to obtain the illegal user set includes:

extracting behavior characteristics based on a preset illegal behavior mode to generate an image of the funding crowd;

and searching users with user data characteristics meeting the requirements of the image of the capital crowd in the suspected illegal user set to obtain an illegal user set.

Further, the step of extracting behavior features based on a preset illegal behavior pattern to generate a funding crowd image includes: analyzing balance trend of the funding account according to a preset illegal behavior mode to obtain characteristics of the funding account; analyzing the capital flow direction of the funded person according to a preset illegal behavior pattern to obtain capital flow direction characteristics; analyzing the risk condition of the collected people according to a preset illegal behavior pattern to obtain the risk characteristics of the collected people; and generating a funding crowd portrait based on the funding account characteristic, the fund flow characteristic and the funded person risk characteristic.

For example, analyzing the balance trend of the funding account, before and after purchasing a product, before and after redemption, whether there is a large amount of funds transferred for purchase, and returning a large amount of funds transferred for return to the funded person, may extract the funding account characteristics of greater than 5000 dollars of funds transferred in the week before purchasing the product.

And S4, identifying and detecting the illegal user set to obtain an illegal action group.

In detail, the obtaining an illegal action group by identifying and detecting the illegal user set includes:

importing the user data in the illegal user set and the transfer records among the users into a graph database to obtain a funding behavior data set;

and detecting and dividing the collective asset behavior data set by using a pattern recognition algorithm based on preset collective asset behavior characteristics to obtain an illegal behavior group.

Wherein, the illegal action group is a user group with funding action.

Further, the detecting and dividing the funding behavior data set by using a pattern recognition algorithm based on preset funding behavior characteristics includes:

searching user data meeting preset characteristic conditions in the funding behavior data set based on the funding behavior characteristics to obtain funding person data;

and searching user data having a funding relationship with the funding person data in the funding behavior data set, and dividing the corresponding user data and the funding person data into the same funding team.

The preset characteristic condition refers to that other multiple users all have monetary association with the same user; the funding relationship refers to the frequency of transfer records or the amount of money reaching a threshold value.

The embodiment of the invention judges whether a group funding behavior exists or not based on the relationship between the funding persons and the funded persons, and finally obtains a funding team by identifying and detecting the user data and the transfer data concentrated by the illegal user according to the relationship.

The embodiment of the invention determines an abnormal user set by constructing a user relationship network and carrying out cluster analysis on the customer relationship network, then excavates the behavior pattern of the abnormal user and screens out a suspected illegal user set, and then carries out crowd image analysis on the suspected illegal user set to obtain the illegal user set; meanwhile, the scheme is based on people or groups, namely the behavior of the user judges whether the illegal funding behavior exists, and not only judges whether the financial product has the illegal funding behavior scene, so that the detection range is more comprehensive, and the result is more accurate. Therefore, the illegal behavior detection method and device based on artificial intelligence, the electronic equipment and the computer readable storage medium can solve the problem of low accuracy of illegal behavior detection.

Fig. 3 is a functional block diagram of an illegal action detection apparatus based on artificial intelligence according to an embodiment of the present invention.

The illegal action detection device 100 based on artificial intelligence of the present invention can be installed in an electronic device. According to the implemented functions, the illegal behavior detection device 100 based on artificial intelligence can comprise a cluster analysis module 101, a mining and screening module 102, a portrait analysis module 103 and an identification detection module 104. The module of the present invention, which may also be referred to as a unit, refers to a series of computer program segments that can be executed by a processor of an electronic device and that can perform a fixed function, and that are stored in a memory of the electronic device.

In the present embodiment, the functions regarding the respective modules/units are as follows:

the cluster analysis module 101 is configured to acquire a user data set to be detected, construct a user relationship network according to the user data set to be detected, and perform cluster analysis on the user relationship network based on a graph clustering method to obtain an abnormal user set;

the mining and screening module 102 is configured to mine and screen the abnormal user set based on a pattern mining algorithm to obtain a suspected illegal user set;

the portrait analysis module 103 is configured to perform crowd portrait analysis on the suspected illegal user set based on a preset illegal behavior pattern to obtain an illegal user set;

the identification detection module 104 is configured to perform identification detection on the illegal user set to obtain an illegal action group.

In detail, when the modules in the illegal behavior detection device 100 based on artificial intelligence according to the embodiment of the present invention are used, the same technical means as the illegal behavior detection method based on artificial intelligence described in fig. 1 to fig. 2 is adopted, and the same technical effects can be produced, which is not described herein again.

Fig. 4 is a schematic structural diagram of an electronic device for implementing an illegal behavior detection method based on artificial intelligence according to an embodiment of the present invention.

The electronic device 1 may comprise a processor 10, a memory 11, a communication bus 12 and a communication interface 13, and may further comprise a computer program, such as an artificial intelligence based illegal activity detection program, stored in the memory 11 and executable on the processor 10.

In some embodiments, the processor 10 may be composed of an integrated circuit, for example, a single packaged integrated circuit, or may be composed of a plurality of integrated circuits packaged with the same function or different functions, and includes one or more Central Processing Units (CPUs), a microprocessor, a digital Processing chip, a graphics processor, a combination of various control chips, and the like. The processor 10 is a Control Unit (Control Unit) of the electronic device, connects various components of the electronic device by using various interfaces and lines, and executes various functions and processes data of the electronic device by running or executing programs or modules stored in the memory 11 (for example, executing illegal behavior detection programs based on artificial intelligence, etc.), and calling data stored in the memory 11.

The memory 11 includes at least one type of readable storage medium including flash memory, removable hard disks, multimedia cards, card-type memory (e.g., SD or DX memory, etc.), magnetic memory, magnetic disks, optical disks, etc. The memory 11 may in some embodiments be an internal storage unit of the electronic device, for example a removable hard disk of the electronic device. The memory 11 may also be an external storage device of the electronic device in other embodiments, such as a plug-in mobile hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), and the like, which are provided on the electronic device. Further, the memory 11 may also include both an internal storage unit and an external storage device of the electronic device. The memory 11 may be used not only to store application software installed in the electronic device and various types of data, such as codes of illegal activity detection programs based on artificial intelligence, etc., but also to temporarily store data that has been output or is to be output.

The communication bus 12 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. The bus is arranged to enable connection communication between the memory 11 and at least one processor 10 or the like.

The communication interface 13 is used for communication between the electronic device and other devices, and includes a network interface and a user interface. Optionally, the network interface may include a wired interface and/or a wireless interface (e.g., WI-FI interface, bluetooth interface, etc.), which are typically used to establish a communication connection between the electronic device and other electronic devices. The user interface may be a Display (Display), an input unit such as a Keyboard (Keyboard), and optionally a standard wired interface, a wireless interface. Alternatively, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, or the like. The display, which may also be referred to as a display screen or display unit, is suitable, among other things, for displaying information processed in the electronic device and for displaying a visualized user interface.

Fig. 4 only shows an electronic device with components, and it will be understood by those skilled in the art that the structure shown in fig. 4 does not constitute a limitation of the electronic device 1, and may comprise fewer or more components than those shown, or some components may be combined, or a different arrangement of components.

For example, although not shown, the electronic device may further include a power supply (such as a battery) for supplying power to each component, and preferably, the power supply may be logically connected to the at least one processor 10 through a power management device, so that functions of charge management, discharge management, power consumption management and the like are realized through the power management device. The power supply may also include any component of one or more dc or ac power sources, recharging devices, power failure detection circuitry, power converters or inverters, power status indicators, and the like. The electronic device may further include various sensors, a bluetooth module, a Wi-Fi module, and the like, which are not described herein again.

It is to be understood that the described embodiments are for purposes of illustration only and that the scope of the appended claims is not limited to such structures.

The illegal activity detection program based on artificial intelligence stored in the memory 11 of the electronic device 1 is a combination of a plurality of instructions, which when executed in the processor 10, can realize:

acquiring a user data set to be detected, constructing a user relationship network according to the user data set to be detected, and performing cluster analysis on the user relationship network based on a graph clustering method to obtain an abnormal user set;

mining and screening the abnormal user set based on a pattern mining algorithm to obtain a suspected illegal user set;

carrying out crowd portrait analysis on the suspected illegal user set based on a preset illegal behavior mode to obtain an illegal user set;

and identifying and detecting the illegal user set to obtain an illegal action group.

Specifically, the specific implementation method of the instruction by the processor 10 may refer to the description of the relevant steps in the embodiment corresponding to the drawings, which is not described herein again.

Further, the integrated modules/units of the electronic device 1, if implemented in the form of software functional units and sold or used as separate products, may be stored in a computer readable storage medium. The computer readable storage medium may be volatile or non-volatile. For example, the computer-readable medium may include: any entity or device capable of carrying said computer program code, recording medium, U-disk, removable hard disk, magnetic disk, optical disk, computer Memory, Read-Only Memory (ROM).

The present invention also provides a computer-readable storage medium, storing a computer program which, when executed by a processor of an electronic device, may implement:

acquiring a user data set to be detected, constructing a user relationship network according to the user data set to be detected, and performing cluster analysis on the user relationship network based on a graph clustering method to obtain an abnormal user set;

mining and screening the abnormal user set based on a pattern mining algorithm to obtain a suspected illegal user set;

carrying out crowd portrait analysis on the suspected illegal user set based on a preset illegal behavior mode to obtain an illegal user set;

and identifying and detecting the illegal user set to obtain an illegal action group.

In the embodiments provided in the present invention, it should be understood that the disclosed apparatus, device and method can be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the modules is only one logical functional division, and other divisions may be realized in practice.

The modules described as separate parts may or may not be physically separate, and parts displayed as modules may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the present embodiment.

In addition, functional modules in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, or in a form of hardware plus a software functional module.

It will be evident to those skilled in the art that the invention is not limited to the details of the foregoing illustrative embodiments, and that the present invention may be embodied in other specific forms without departing from the spirit or essential attributes thereof.

The present embodiments are therefore to be considered in all respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims rather than by the foregoing description, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein. Any reference signs in the claims shall not be construed as limiting the claim concerned.

The block chain is a novel application mode of computer technologies such as distributed data storage, point-to-point transmission, a consensus mechanism, an encryption algorithm and the like. A block chain (Blockchain), which is essentially a decentralized database, is a series of data blocks associated by using a cryptographic method, and each data block contains information of a batch of network transactions, so as to verify the validity (anti-counterfeiting) of the information and generate a next block. The blockchain may include a blockchain underlying platform, a platform product service layer, an application service layer, and the like.

The embodiment of the application can acquire and process related data based on an artificial intelligence technology. Among them, Artificial Intelligence (AI) is a theory, method, technique and application system that simulates, extends and expands human Intelligence using a digital computer or a machine controlled by a digital computer, senses the environment, acquires knowledge and uses the knowledge to obtain the best result.

Furthermore, it is obvious that the word "comprising" does not exclude other elements or steps, and the singular does not exclude the plural. A plurality of units or means recited in the system claims may also be implemented by one unit or means in software or hardware. The terms first, second, etc. are used to denote names, but not any particular order.

Finally, it should be noted that the above embodiments are only for illustrating the technical solutions of the present invention and not for limiting, and although the present invention is described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that modifications or equivalent substitutions may be made on the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.