CN108170830A - Group event data visualization method and system - Google Patents

Abstract

The present application provides a method and system for visualizing group event data, which is applied in a fraud event detection system. The method includes the following steps: acquiring a data set of a group, and the data features in the data set include at least event type and event Type-associated time information; create the first time axis and the second time axis; based on the encoding of data features, display the first time axis with the first shape as the node, to represent each group in the first time axis The type and quantity of events occurring in the time granularity; display the second shape to represent the total number of each event type occurring in the time interval of the second time axis; display the second time axis to represent the event types represented in the second shape Associate with each time granularity of the event type on the second time axis, and represent the distribution of each event type on the second time axis through the third shape; and display the fourth shape to represent the group on the second time axis The type and number of events that occur in each time granularity of the

Description

Group event data visualization method and system

technical field

The present application relates to the field of computer processing technology, in particular to a method and system for visualizing group event data.

Background technique

Online fraud is a well-known dark side of today's Internet, causing immeasurable losses worldwide every year. In 2015, the Internet Crime Complaint Center received millions of complaints about fraud issues around the world, and online fraud causes billions of economic losses worldwide every year. Fraudulent users usually get help from Promote a specific product, or get paid for spreading spam. In Internet finance, fraudulent users use false identities to apply for loans, use their stolen credit cards to purchase goods, and even carry out illegal activities such as money laundering. Therefore, in Internet business scenarios, finding a suitable anti-fraud algorithm has become more and more critical, and this demand is also increasing day by day.

Although there are many ways to identify fraud on the Internet today, due to the limitations of the fraud event detection system built, the credibility of the screened data corresponding to fraud suspects requires a large amount of subsequent human verification, for example, platform supervisors Need to check and verify one by one. This makes the revision of algorithm parameters, the design of data feature priority, and the selection of algorithm models in the fraud event detection system not only require the software design of algorithm experts, but also the participation of domain experts. Therefore, improving the transparency of fraud identification algorithms can effectively improve the accuracy of fraud event detection, and how to realize data visualization is an urgent problem to be solved in this field.

Contents of the invention

In view of the shortcomings of the prior art described above, the purpose of the present application is to provide a group event data visualization method and system for solving the problem of visualization of fraud identification algorithms in the prior art.

In order to achieve the above purpose and other related purposes, the first aspect of the present application provides a group data visualization method, which is applied to a fraud event detection system, and includes the following steps: acquiring a data set of a group, and the data set in the data set The data feature includes at least an event type and time information associated with the event type; creating a first time axis and a second time axis; based on the encoding of the data feature, displaying the first time axis with the first shape as a node , to represent the type and quantity of events occurring in the group in each time granularity of the first time axis; display a second shape, to represent each event type occurring in the time interval of the second time axis The total number of ; display the second time axis, associate the event types represented in the second shape with the time granularities of the event types on the second time axis, and each event type represented by the third shape in the distribution on the second time axis; and displaying a fourth shape to represent the type and quantity of events occurring in the group within each time granularity of the second time axis.

The second aspect of the present application provides a computer device, including: one or more processors; and a presentation engine executed on the one or more processors, and the presentation engine is used to execute the computer described in the first aspect of the present application. The group data visualization method described above.

The third aspect of the present application provides a group data visualization system, including: an acquisition module that acquires a data set of a group through the network, and the data features in the data set include at least the event type and the time associated with the event type Information; a processing module, creating the first time axis and the second time axis, and encoding the data characteristics; and a display module, displaying the first and second time axes and displaying the first and second time axes in one interface through a display device 2. The third and fourth shapes, wherein, the first shape is used as a node of the first time axis to represent the type of events occurring in each time granularity of the group in the first time axis and Quantity; the second shape represents the total number of each event type that occurs within the time interval of the second time axis; the third shape represents the event type represented in the second shape at the second time distribution on the axis; the fourth shape characterizes the type and quantity of events occurring in the group within each time granularity of the second time axis.

The fourth aspect of the present application provides a client, which is connected to a server through the network, and the client performs the steps of the group data visualization method described in the first aspect of the present application to log in to the server based on sending a request

The fifth aspect of the present application provides a server connected to a client through the network, the server executes the requested operation based on the client, and sends the group data visualization method described in the first aspect of the present application to the client process and display the execution result through the client.

The sixth aspect of the present application provides a browser connected to a server through a network, and the browser logs in to the server based on sending a request to execute the steps of the group data visualization method described in the first aspect of the present application.

The seventh aspect of the present application provides a computer-readable storage medium storing a data visualization computer program, wherein the data visualization computer program implements the steps of the group data visualization method described in the first aspect of the present application when executed .

As mentioned above, the group data visualization method and system of the present application present the data sets of the groups determined in the fraud event detection process based on the time axis, type distribution, classification list, etc., so as to realize the The data characteristics of the groups are displayed in a variety of relational interfaces, which is beneficial for domain experts and algorithm experts to evaluate and revise the detection algorithm of the fraud event detection system.

Description of drawings

FIG. 1 is a flowchart of a group data visualization method in an embodiment of the present application.

FIG. 2 is a flow chart showing the steps of acquiring group data sets in an embodiment of the present application.

FIG. 3 shows an interface including multiple groups displayed in an embodiment of the present application.

FIG. 4 is a schematic diagram of a display interface for visualizing group data in an embodiment of the present application.

FIG. 5 is a schematic diagram of a display interface for visualizing group data in another embodiment of the present application.

Figures 6a-6d respectively show the interface diagrams of several states displayed by the present application for utilizing the visualization method of the present application.

FIG. 7 shows a schematic diagram of a list interface of a group of data sets displayed in an embodiment of the present application.

FIG. 8 is a flow chart showing the interface of the feature distribution of the group data set in an embodiment of the present application.

FIG. 9 shows an interface of a histogram and a comparison chart of the characteristic distribution of registration time in a group displayed in an embodiment of the present application.

FIG. 10 is a flow chart showing the steps of distributing multiple groups in a cluster in one embodiment of the present application.

FIG. 11 shows a schematic diagram of an interface for displaying distribution of multiple groups in a cluster in an embodiment of the present application.

FIG. 12 shows a schematic diagram of the module structure of a computer device provided in an embodiment of the present application.

FIG. 13 is a schematic diagram of a module structure of a group data visualization system provided in an embodiment of the present application.

Detailed ways

The implementation of the present application will be described by specific specific examples below, and those skilled in the art can easily understand other advantages and effects of the present application from the content disclosed in this specification.

In the following description, reference is made to the accompanying drawings, which illustrate several embodiments of the application. It is to be understood that other embodiments may be utilized, and mechanical, structural, electrical, and operational changes may be made without departing from the spirit and scope of the present application. The following detailed description should not be considered limiting, and the scope of the embodiments of the present application is defined only by the claims of the issued patent. The terminology used herein is for describing particular embodiments only and is not intended to limit the application.

Furthermore, as used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context indicates otherwise. It should be further understood that the terms "comprising", "comprising" indicate the presence of stated features, steps, operations, elements, components, items, species, and/or groups, but do not exclude one or more other features, steps, operations, The existence, occurrence or addition of an element, component, item, species, and/or group. The terms "or" and "and/or" as used herein are to be construed as inclusive, or to mean either one or any combination. Thus, "A, B or C" or "A, B and/or C" means "any of the following: A; B; C; A and B; A and C; B and C; A, B and C" . Exceptions to this definition will only arise when combinations of elements, functions, steps or operations are inherently mutually exclusive in some way.

In fraud event detection technology, domain experts provide data classification experience and classification result accuracy requirements for the core technology of fraud event identification, but the algorithm architecture itself and the parameters in the algorithm are not well known to them. Since the domain experts have no way of obtaining the data classification method during the detection period, when the fraud event detection results are obtained by using the fraud event detection system, the domain experts have no way of judging the accuracy of the detection results except for verifying the detection results. In order to improve the accuracy of the fraud event detection system, this application provides a group data visualization method applied to the fraud event detection system, which displays the classified groups and their data sets in the fraud event detection system to the public in a visual way Algorithm experts and domain experts enable different users (such as domain experts or algorithm experts) to explore various fraudulent behaviors through a variety of interactive means, and can conduct different depths of exploration according to their needs.

The group data visualization method is mainly performed by computer equipment. The computer device may be a suitable computer device such as a handheld computer device, a tablet computer device, a notebook computer, a desktop computer, a server or the like. Computer equipment includes displays, input devices, input/output (I/O) ports, one or more processors, memory, non-volatile storage devices, network interfaces, and power supplies, among others. The various components described may include hardware elements (such as chips and circuits), software elements (such as a tangible, non-transitory computer readable medium storing instructions), or a combination of hardware and software elements. Also, note that various components may be combined into fewer components or separated into additional components. For example, memory and non-volatile storage may be included in a single component. The computer device can execute the visualization method alone, or cooperate with other computer devices. In some embodiments, the computer device executes the visualization method and displays a corresponding visualization interface. For example, the computer device includes a processor and a display, wherein, a presentation engine (or display engine) executed on the processor is used to execute the group data visualization method and display it through the display, in Here, the presentation engine includes, but is not limited to, software and hardware capable of analyzing interface display developed based on programming languages, such as XML, HTML and other scripting languages, C language, and the like. In still other embodiments, a computer device executes the visualization method and provides a corresponding visualization interface to another computer device for display. For example, the client initiates a request to the server based on the user's request operation and logs in to the server, the server executes a visualization method to form corresponding interface data, and feeds back the interface data to the client, and the client's browser or The customized application program displays the corresponding icons according to the corresponding interface data.

The visualization method is mainly performed by the fraud event detection system. The fraudulent event detection system may comprise software and hardware in one or more computer devices. In order to provide users with the behavior of a fraudulent group in different time periods, so as to answer the question "what does a group do as a fraudulent group" proposed by domain experts, and "do users in the same group They all have the same behavior." This application provides a visualization method from the time axis. Please refer to FIG. 1 , which is a flowchart of a method for visualizing group data in an embodiment of the present application. As shown in the figure, the group data visualization method includes the following steps:

In step S11, a data set of a group is acquired. The data features in the data set at least include event types and time information associated with the event types. In some embodiments, the method of determining a group is described as follows. Please refer to FIG. 2 , which shows a flow chart of obtaining a group data set in an implementation manner provided by the present application. As shown in the figure, the Step S11 further includes:

Step S111, obtaining the operation log of a cluster composed of multiple network users; in different embodiments, the cluster is a cluster composed of all network users that can be obtained, and the network users in the cluster come from the same website or different , or from different network channels, such as the Internet, one or more intranets, local area network (LAN), wide area network (WLAN), storage area network (SAN), etc. or an appropriate combination thereof, or mobile phone mobile communication network, etc.

Step S112, determining at least one data feature from the operation logs of the plurality of network users, and analyzing the similarity of at least one set of data features in the operation logs to determine the group; in a specific embodiment, for Network fraud will inevitably leave the characteristics of user usage data in the network. The fraud event detection system collects the operation logs of multiple network users from at least one website, and by analyzing the similarity of at least one data feature in the operation logs, Group the users who generate corresponding operation logs to obtain the group and the data set of the group in the operation log.

In some embodiments, the data set in one group includes but not limited to at least two data characteristics of user information, IP address, event type, event source, event responder, and event occurrence time. Wherein, the user information includes mobile phone number, email address, ID number, ID number, gender, user equipment number used by the user, registration time, and the like. Wherein, the same user information may correspond to at least one event type, and each event type corresponds to an event source, an event responder, and an event occurrence time. The event characteristics include but are not limited to: social behaviors such as attention, likes, comments, gifts (or called gifts) between network users, or network users logging in, logging out, updating status, registering, and modifying information at least one of other operations. For example, the same user information may correspond to multiple like event types, and each like event type corresponds to its own event source, event responder, and event occurrence time.

Step S113, acquiring the data set of the group. In some embodiments, the data set can be obtained from a database that stores groups and their data sets. The database is, for example, configured on a remote storage server, or configured in a storage in a local computer device. In the device, the acquired data set of a group can be extracted from the database based on the user's input operation. For example, the fraud event detection system uses an unsupervised detection algorithm to obtain multiple groups, and the user selects one of the groups through the selection interface to obtain the data set of the corresponding group.

Specifically, the fraud event detection system first calculates the similarity of all data in the operation log in the same type of data features, wherein the similarity can be measured by information entropy, for example, the fraud event detection system uses User information calculates the information entropy of IP usage or maximum IP usage dimension, uses the event type to calculate the information entropy of the operation type dimension, and uses the information entropy of the registration time dimension or operation time to calculate the information entropy of the bad operation dimension; through the above calculation , and then use the unsupervised detection method to detect the obtained information entropy and divide it into multiple groups. Wherein, the unsupervised detection method includes, for example, an algorithm based on a dense subgraph, or an algorithm based on a vector space, and the like. The groups presented by the visualization method provided in this application are used to reflect the shared resources used by fraudulent events, user relationships, etc., so that users who use the fraudulent event detection system can more clearly determine the Whether the classification strategy is reasonable. Wherein, the shared resource includes but not limited to shared IP, mailbox, etc., and user relationship includes but not limited to: user attention, interaction relationship, etc.

In one embodiment, the visualization method further includes the step of displaying at least one group interface, and the group size in the group interface is characterized by the size of the displayed geometric figure. Please refer to Fig. 3, which shows an interface comprising multiple groups displayed in an embodiment of the present application. As shown in the figure, there are 11 groups displayed in the interface, and the geometric figure used to represent these groups is a circle Shape, the 11 groups mentioned above are all located in a maximum dotted circle, within the dotted circle, for example, the dotted circle is used to represent a cluster composed of N network users, for example, the group labeled 0, for example It is a normal group, and there are 10 groups of different sizes labeled 1-10 in a smaller dotted circle. Many and small groups indicate a small number of members, for example, groups marked 1-10 are abnormal groups. In various embodiments, the geometry of the group may be of arbitrary shape. The color of the geometry can be set randomly, or relative to the number of groups or the number of members of a group. For example, N colors are preset, and the fraud event detection system randomly corresponds different colors to the geometric figures representing each group. As another example, the fraud event detection system corresponds to the geometric figures representing each group in descending order of the number of members according to the preset color sequence. When the user operates the display interface to select a geometric figure, the fraud event detection system acquires a group of data sets.

In a preferred embodiment, the displaying at least one group interface may also include an information bar displaying group information. When the user selects a group in the group interface, a window or The basic information of the group is displayed in the form of a text box, and the basic information is, for example: group code, number of members, data characteristics used to determine the most preferred group, group attributes (such as normal group or abnormal group) and other information.

In step S12, a first time axis and a second time axis are created. The first time axis and the second time axis are created according to the time information in the data set. For example, the maximum time span in the multiple time information in the data set is 10 days, then the first time axis or the second time axis The maximum time interval is 10 days. In one embodiment, the first time axis and the second time axis are created according to the same time interval and time granularity pair; in another embodiment, the first time axis and the second time axis are created according to different time intervals and time granularity pairs Timeline, detailed later.

In step S13, based on the encoding of the data features, display the first time axis with the first shape as the node, to represent the type of event that occurs in each time granularity of the group in the first time axis and quantity. Wherein, the fraud event detection system counts the number of event types in the data set according to the time granularity of the first time axis, encodes the counted event types into a graph of a preset first shape, and encodes the encoded event types according to time sequence Each first shape of is presented on the first time axis as nodes of the first time axis. Through the display of each node on the first time axis, domain experts can clearly obtain the change process of the distribution or quantity of event types counted according to time. Wherein, the first shape includes but is not limited to: a pie shape, or a columnar shape. In some implementation examples, the fraudulent event detection system may encode the proportion of the number percentage of each event type within a time granularity into a graph of the first shape and display it on the first time axis, wherein the proportion of the same event type Than the same color as the area. Please refer to FIG. 4 , which is a schematic diagram of a display interface for visualizing group data in an embodiment of the present application. As shown in the figure, in the displayed interface, the first time axis T1 is located in the lower area of the display interface, which is displayed as In the 10-day time interval from August 1st to August 10th, with days as the time granularity, the percentage distribution of the number of event types counted each day is encoded into a pie graph and displayed as a node on the first time axis T1, The colors in the pie graph are used to represent event types, for example, those marked with "yellow" in the figure represent attention events, those marked with "red" in the figure represent gift events, and those marked with "blue" in the figure represent Like events, for example, August 7, which is displayed on the first time axis T1 in the figure with a pie graph as a node, among the generated event types, attention events accounted for a large proportion, gift events accounted for a small proportion, and like events accounted for the least.

In step S13, based on the encoding of the data features, a second shape is displayed to represent the total number of each event type occurring within the time interval of the second time axis. Wherein, the fraud event detection system sums the number of event types in the data set according to the time interval of the second time axis, encodes the accumulated event types into a graph of a preset second shape, and displays the The total number of each event type in a time interval of the second time axis. Wherein, the second shape includes but is not limited to: a histogram, a histogram, a line graph, and the like. According to the time interval of the created second time axis, the displayed total quantity of various event types reflects the comparison of the quantity of each event type in the same time interval. When the time interval of the second time axis represents a day or a week, the user can determine three How event types compare in total volume. In addition, the displayed column graph can also determine the comparison of the total number of the three event types according to thickness, transparency, and the like. Referring to Fig. 3 again, as shown in the figure, a horizontal histogram is displayed on the side (the right side in the illustration) near the first time axis T1, and " Red", "yellow" and "blue" three columnar bars, the length of the columnar bar represents the total number of event types generated in the time interval of the second time axis, as can be seen from the second shape, in the second In the time interval of the time axis, the "yellow" colored columnar bars represent the most attention events, followed by the "red" colored columnar bars, and the "blue" colored columnar bars indicate has the fewest likes.

By displaying the total quantity of each event type occurring in the time interval of the second time axis, domain experts can clearly obtain the change process of the event type statistics based on time from another perspective. In order to display the relationship between the first time axis and the second time axis more clearly, in step S13, based on the encoding of the data features, the second time axis is displayed, and the events represented in the second shape The type is associated with each time granularity of the event type on the second time axis, and the distribution of each event type on the second time axis represented by a third shape. Among them, the second time axis is presented as an axis with corresponding time granularity as nodes, and the third shape is used to associate the event types distributed in each adjacent node with the second shape, so that the user can clearly obtain the relationship between the second shape and the second shape. The relationship between the time granularities of the two time axes. Wherein, the third shape may be in the shape of a line, and the color of the line may be determined according to the color of the corresponding event type in the second shape, so as to allow the user to clearly distinguish a unified event type.

Please refer to Figure 3 again, as shown in the figure, the second shape is associated with the second time axis through the third shape, where the third shape takes an arc as an example and spreads to the second time axis based on the time information of each event type in the data set On the nodes of each time granularity of the second time axis. For example, a dotted line (the first type of dotted line) is used in the figure to indicate the association between the gift event represented by the "red" columnar bar and the corresponding time node (time granularity) on the second time axis, and a continuous line is used to indicate the "yellow" color The relationship between the attention event represented by the column bar and the corresponding time node (time granularity) on the second time axis, the line composed of dots and line segments (the second dotted line) represents the like event represented by the "blue" color column bar and the second time node. The association of corresponding time nodes (time granularity) on the two time axes. In different implementations, the third shape uses line thickness or transparency to describe the number of event types generated within a corresponding time granularity interval, thereby facilitating presentation of high-frequency periods or rules of event occurrence.

In order to more intuitively display the types and quantities of events occurring in each time granularity interval on the second time axis, in step S13, a fourth shape is displayed to represent the group at each time of the second time axis The type and number of events that occur within the granularity. Wherein, the fraud event detection system sums or distributes the number of event types in the data set according to the time interval of the second time axis, and encodes the accumulated event types or distribution into a preset fourth-shaped graph , and present the encoded fourth shapes on the second time axis as nodes of the second time axis according to time sequence. Wherein, a corresponding fourth shape is displayed under the guidance of the third shape according to the created time granularity of the second time axis. Through the display of each node on the second time axis, the user can clearly obtain the change process of the number of event types counted according to time from another perspective. Wherein, the fourth shape includes but is not limited to: a pie shape or a columnar shape, and a shape different from the first shape is selected. In some implementation examples, the fraudulent event detection system can accumulate and respectively encode the quantities of each event type in the time granularity of the second time axis into a graph of a fourth shape and display it on the second time axis, wherein the same event type The sum of is the same color as the third shape and the second shape.

The timeline is used as one of the ways to present group data because it is very important for domain experts and algorithm experts to understand the centralized behavior of users within a period of time. For this reason, this centralized behavior is described by performing step S13 to combine the first time axis and the second time axis.

Please refer to Figure 3, as shown in the figure, each pie chart in the first time axis T1 presents different event types (such as following a user or giving a user online sent a gift). Encode each event type into a different color, encode the number of each event type in the unit time granularity of the first time axis T1 into the area ratio of each area in the pie chart to form a pie chart, and encode the time of the second time axis T2 The number of each event type in the interval is encoded as the length of the histogram to form a histogram corresponding to each event type (that is, the second shape), and the number of each event type in the unit time granularity of the second time axis T2 is encoded as the length of the histogram to form a separate histogram (i.e. the fourth shape); when the user selects a pie chart on the first time axis T1, an arc in the color of the event type is emitted from the second shape corresponding to each event type (i.e. the third shape), and correspond to each fourth shape corresponding to the time granularity on the second time axis T2, thereby clearly presenting the time axis relationship of each event type in a group data set to the user.

In one embodiment, the first time axis and the second time axis are created according to the same time interval and time granularity. For example, the fraud event detection system preloads the first time axis and the second time axis with the same time granularity, so that the fraud event detection system can map each event type to each time according to the time information and time granularity in the data set. axis to get at least one time interval of the respective time axis. As another example, the fraud event detection system determines the preset time intervals of the first time axis and the second time axis according to the sorting of the time information in the data set, and classifies each event type according to the time information and time granularity in the data set corresponding to each time axis. Please refer to the interface including the first time axis T1 and the second time axis T2 shown in FIG. 3 . Wherein, the T1 and T2 time axes both use days as the time granularity, and both use 10 days as the time interval. The data features in the data set are displayed on the second time axis T2. For example, as shown in Figure 3, the second time axis T2 takes days as the time granularity, and the fraud event detection system can encode the sum of each event type counted every day into a columnar graph and display it as a node on the second time axis T2 superior.

In another implementation example, the first time axis and the second time axis are created according to different time intervals and time granularity pairs. Wherein, the time interval of the second time axis is the time granularity of the first time axis. For example, the time granularity of the first time axis and the second time axis are preset to be different, and the corresponding relationship between the time granularities between the two time axes is preset, and the fraud event detection system divides each Event types correspond to each time axis. Please refer to FIG. 5 , which shows an interface including a first time axis T1 and a second time axis T2 . Wherein, the T1 time axis takes 10 days as the time interval, with days as the time granularity, and the T2 time axis takes days as the time interval, and takes hours as the time granularity; the fraud event detection system can perform follow-up steps according to the time information in the data set The data features in the data set are displayed on the first time axis T1 and the second time axis T2. For example, in the interface C2 shown in Figure 5, the second time axis T2 takes hours as the time granularity, and the fraud event detection system can encode the sum of the event types counted every hour into a column graph and display it as a node on the second time axis T2 superior.

Encode the quantity of each event type in the time granularity of the first time axis T1 into the area ratio of each area in the pie chart to form a pie chart; when the user selects a pie chart on the first time axis T1, the second The number of each event type (equivalent to each event type corresponding to the selected pie chart) in the time interval of the time axis T2 is encoded as the length of the bar graph to form a histogram (ie, the second shape) corresponding to each event type. The number of each event type in the unit time granularity of the second time axis T2 is coded as the length of the histogram to form a separate histogram (that is, the fourth shape), and from the second shape corresponding to each event type, the event type is colored The arc (that is, the third shape) corresponds to each fourth shape corresponding to the time granularity on the second time axis T2, thereby clearly presenting the time axis relationship of each event type in a group data set to the user.

As shown in the interface C1 in Figure 4, each pie chart in the first time axis T1 shows different event types (such as following a user or sending a message to a user online) at each time granularity (such as every day) a gift). Code each event type into a different color. For example, the color in the pie graph mentioned in the illustration is used to represent the event type. For example, the event marked with "yellow" in the figure indicates an event of concern, and the one marked with "red" in the figure indicates For gift events, those marked with "blue" in the figure represent like events. For example, on the first time axis T1 in the figure, a pie graph is used as a node on August 7th, and the following events are among the event types generated. The proportion is relatively large, the proportion of gift events is relatively small, and the proportion of like events is the least. When the user selects the node August 7th on the first timeline T1, the event types and event types that occur every hour within 24 hours on August 7th are displayed on the second timeline T2 corresponding quantity.

It should be noted that the time intervals and time granularity of the first time axis and the second time axis in the above-mentioned embodiments are not limited to the illustrated cases, and in different embodiments, the user can Set the time interval and time granularity of the first time axis and the second time axis, such as time units such as weeks, months, quarters, or even years.

Users can use the presentation process and displayed statistics to detect the groups classified by the fraud event detection system and use the visualized interface to allow domain experts to discover or correct deficiencies in the detection algorithm. In addition, in order to display the relationship between the two time axes more clearly, the visualization method further includes dynamically, highlighting, or dynamically and highlighting displaying the first shape through the third shape when the first shape is selected. The distribution of event types occurring within the time granularity represented by the first shape on the second time axis. For example, in the interface C1 shown in FIG. 4, when the user selects a pie chart on the first time axis T1, each third shape connected to the histogram corresponding to the selected pie chart on the second time axis T2 flashes Flashing or highlighting for a few seconds or longer, when the user selects another pie chart on the first time axis T1, the previously flashing and highlighted third shape restores its original shape and color, and is the same as the pie chart at the second time Each third shape connected to the histogram corresponding to the selected pie chart on the axis T2 blinks for a few seconds and is highlighted.

In some embodiments, when the user selects a first shape on the first time axis, the visualization method may also perform the step of displaying and zooming in on the first shape when selected, so that the user can view the first shape more clearly. A comparison of the number of event types represented by a shape. In a specific example, when the first shape is selected, it is displayed enlarged on one side of the first time axis. For example, the selected first shape is enlarged and displayed on the upper side of the first time axis, presenting an interface C3 as shown in FIG. 6 a . In another specific example, when the first shape is selected, it is displayed enlarged in the first time axis. For example, the selected first shape is enlarged and displayed at the same center position of the first time axis, presenting an interface C4 as shown in FIG. 6b.

In another specific example, when the user selects a pie chart on the first time axis T1, when the first shape is selected, it will be enlarged and displayed on one side of the first time axis TI. Each third shape connected to the histogram corresponding to the selected pie chart on the second time axis T2 blinks for a few seconds or longer, as shown in interface C5 shown in Figure 6c. When the user selects the first time axis T1 to represent For the pie chart on August 7, when the pie chart representing August 7 is selected, it will be enlarged and displayed on one side of the first time axis TI, and the corresponding representation 8 on the second time axis T2 Each line connected to the histogram of March 7 blinks for a few seconds or longer. Another example is the interface C6 shown in Figure 6d. When the user selects the pie chart representing August 7 on the first time axis T1, the pie chart representing August 10 will appear on the first time axis when selected. One side of TI is displayed enlarged, and each line connected to the histogram corresponding to August 10 on the second time axis T2 is highlighted.

In some embodiments, the user not only cares about the changes of each event type in the group data set according to the time axis, but also cares about whether the assigned group is reasonable, which requires the user to be able to view the detailed data characteristics and The preferred order of each data feature constructed for classifying groups. The visualization method may comprise the step of displaying an interface of a group of data sets. The displayed datasets are displayed in a tabular manner, thereby presenting the user with detailed information on the characteristics of the data in the same group. In order to improve the classification accuracy of the group data sets, the list displayed on the interface can display a list of data features in a group column by column according to the classification priority used by the fraud event detection system for classification. For example, please refer to FIG. 7 , which shows a schematic diagram of a list interface of a group of data sets displayed in an embodiment of the present application. In the schematic diagram of the list interface, the displayed data sets of a group are sorted according to the similarity of data features in order of priority from high to low. When the similarity of the data features in the first priority is the same, sort according to the data features of the second priority. In the embodiment shown in FIG. 7, the order of the priority from high to low is: IP address, Event source (source), event responder (target), event type (event_type) and event time (timestamp). In this embodiment, the header (header) of the table is coded with the importance of different columns, and the more concentrated the value of a feature is, the more important the feature is. In an embodiment provided by the present application, the fraud event detection system represents this feature by calculating the information entropy of each feature. The lower the information entropy, the higher the consistency. Then the fraud event detection system sorts the features in the order of increasing information entropy, and finally puts the list headers with low information entropy in order to prompt the user's attention. Of course, in different implementation situations, it can also be based on the table to be displayed. For example, the color of the column header with low information entropy is finally rendered to the deepest to remind the user that the data characteristics represented by this column are the most important, and so on for color rendering of other data represented by this column Features, and then get the data set list interface shown in the figure. The list interface may be displayed after the step of displaying multiple group interfaces or after step S13, or based on the user's selection operation of selecting the list interface.

In some embodiments, in order to further characterize whether the acquired data set of the group can reflect the characteristics of the fraud event, it needs to be displayed from other dimensions. For example, the accuracy of detected fraudulent events can be further confirmed by comparing normal users' network operation data with group data sets. To this end, the visualization method further includes the step of displaying an interface of the feature distribution of the data sets of the group. Wherein, the feature distribution interface can display the distribution of each data type in the overall network. The overall network is relative. For example, if a cluster is formed by multiple network users, a certain group in the cluster can be displayed through the interface. For the distribution of a data characteristic in a group, please refer to Figure 2. For example, the largest dotted circle in Figure 2 represents a cluster composed of multiple network users. There are 11 groups in this cluster, which are groups numbered 0-10 Group, select a group for information display.

In some embodiments, the data types that can be displayed on the feature distribution interface are, for example: information entropy in the dimension of average operation interval (average operation interval entropy), information entropy in the dimension of IP address usage (IPused amount entropy), information in the dimension of gender Entropy (sex entropy), information entropy of email dimension (emailentropy), information entropy of registration time dimension (reg time entropy), information entropy of operation times dimension (operation times entropy), information entropy of device quantity dimension (device amount entropy) ), the information entropy of the operation type dimension (operation type entropy), the maximum amount of information entropy of the IP used by others (maxIP used be used amount entropy), etc. In the embodiment shown in Figure 7, the information entropy of the dimension of registration time is used as an example to show the data characteristics, that is, Figure 7 shows the characteristics of the information entropy of the dimension of registration time (registration period) in a group in the network cluster distributed. In order to effectively compare the difference in feature distribution between the obtained group data set and the network operation data of normal users, please refer to Figure 8, which is shown as a flow chart of the interface showing the feature distribution of the group data set, as shown in Fig. shown, including the following steps:

In step S211, one of the groups is selected, and at least one data feature is determined from the data set of the group. In one embodiment, for example, the group marked 2 in FIG. 3 is selected, and a data characteristic of user information is determined from the data set in the group marked 2, for example, the user information is registration time.

In step S212, the feature distribution of the determined at least one data feature in the groups and clusters is counted. In this embodiment, the feature distribution of the data feature that is the registration time in the group is counted, and the feature distribution of the data feature that is the registration time in the entire cluster is counted.

In step S213, the histogram of the feature distribution and the distribution comparison diagram corresponding to the histogram in the whole cluster histogram are displayed. In this embodiment, based on the encoding of the data feature, display the histogram of the distribution of the data feature of the registration time in the group, and display the distribution of the data feature of the registration time in the entire A histogram of the distribution of features in the cluster. Please refer to Figure 9, which shows the interface of the histogram and comparison chart of the characteristic distribution of the registration time in a group in an embodiment of the present application, as shown in the figure, in the interface D, Figure (a) shows It is the thumbnail image of the feature distribution of the registration time in the selected group labeled 2, corresponding to the enlargement of the thumbnail image, it is the enlarged image (d) at the bottom of the interface D, as can be seen from the enlarged image, In this group, during the month from August 1st to August 31st, the group members registered on August 5th, August 6th, August 11th, and August 12th. day, and the 5 days of August 16th, and in the interface D, the figure (c) is represented as a histogram of the time distribution of registered users in the cluster performing registration operations in August, from the figure (c) It can be seen that the registration distribution of registered users in the cluster in August has a certain pattern, and the picture (b) in interface D is characterized by overlapping and superimposing pictures (d) and pictures (c) to display the registration time The difference in data characteristics in the entire cluster and in selected groups. In order to enable users to know the differences and connections between different features, the embodiment provided by this application presents the histogram in a three-layer form. After the user clicks one of the thumbnails, the page will scroll to the normalized The distribution comparison chart. Certainly, in a specific application, there may be multiple thumbnail images of the data feature, each representing a different data feature.

In some embodiments, the color rendering of the histogram can also be used to distinguish or emphasize the distribution of a certain data feature in the group and the entire cluster, or dynamically display (such as in a flashing manner) to distinguish or emphasize a certain data feature The data characteristics are distributed characteristically in the group and across the cluster.

In some embodiments, in order to further analyze the differences between multiple groups in a network cluster, the group data visualization method further includes the step of displaying the interface of feature distribution of data sets of multiple groups, see Figure 10 and Figure 11, Figure 10 shows a flow chart of the steps of the application showing the distribution of multiple groups in the cluster in one embodiment, and Figure 11 shows the application showing the distribution of multiple groups in the cluster in one embodiment Distribution interface E, as shown in the figure, the steps include:

In step S311, a plurality of groups are determined in a cluster composed of a plurality of network users, and different shapes, icons, labels and/or colors are used to represent the differences of the plurality of groups; in one embodiment, such as selecting The three groups marked 0, 1 and 2 in Figure 3, wherein the group marked 0 is represented by "green", the group marked 1 is represented by "red", and the group marked 2 is represented by "Blue" color representation.

In step S312, at least one data characteristic is determined from the data sets of the plurality of groups; in this embodiment, one data characteristic, such as an IP address, is determined from the data sets of the three groups.

In step S313, based on the at least one data feature, analyze the relative information entropy between every two network users in each group as a measure of the similarity between every two network users; in this embodiment, The relative information entropy (the information entropy of IP usage dimension, IP used amount entropy) between every two network users in the 3 groups of label 0, 1 and 2 based on described IP address analysis is used as the measure described every two The degree of similarity between network users. For example, the data dimension reduction method t-SNE (t-distribution neighborhood embedding algorithm) is used and the relative entropy between two users is used as an index to measure the distance between these network users.

In step S314, a display interface is output, in which network users are represented by shapes, icons, and/or labels, differences in the multiple groups are represented by different colors, and each group is represented by a displayed distance The degree of similarity between two network users in . In this embodiment, an interface E as shown in Figure 11 is presented, with dots representing network users, "green" color representing the group labeled 0, "red" color representing the group labeled 1, and blue The "blue" color represents the group labeled 2, among which, the "blue" color indicates that the distance between users in the group labeled 2 is relatively short, and the group is distributed in clusters, and the "red" color indicates that the group labeled 1 The distance between users in the group is also relatively short, and the group forms a cluster distribution, and the distribution of normal users randomly sampled is represented by "green" color, and the distance between normal users is farther, and the distribution is more scattered. From this, it can be considered that if a group is a dense cluster, it is more likely to be considered a fraudulent group. For example, in the embodiment shown in Figure 11, the group represented by the "green" color is relatively scattered, and it means that the "green" color group is a normal group, and the users represented by the "green" point Also for normal users. On the contrary, the group represented by "red" color (that is, the group marked 1) and the group represented by "blue" color (that is, the group marked 2) are distributed in clusters, which means that "Red" and "blue" groups are abnormal groups, and users represented by "red" and "blue" dots are abnormal users. In an embodiment, the user using the visualization system can interactively check the specific information and feature values of the users in each group by hovering over the mouse.

In other embodiments, in the output interface, network users can also be represented by, for example, shapes, icons, and/or labels, such as geometric figures such as triangles and rectangles, such as smiling faces or crying faces, skull heads, etc. , robber’s avatar and other icons, such as labels with text or symbols with clear distinctions, etc.

The group data visualization method of the present application presents the data sets of the groups determined in the fraud event detection process based on the time axis, type distribution, classification list, etc., and realizes the data characteristics of the groups grouped during the fraud event detection It is displayed in a variety of relational interfaces, which is beneficial for domain experts and algorithm experts to evaluate and revise the detection algorithm of the fraud event detection system.

The present application also provides a computer device, and the computer device may be the following suitable computer devices, such as a handheld computer device, a tablet computer device, a notebook computer, a desktop computer, a server, and the like. Computer equipment includes displays, input devices, input/output (I/O) ports, one or more processors, memory, non-volatile storage devices, network interfaces, and power supplies, among others. The various components described may include hardware elements (such as chips and circuits), software elements (such as a tangible, non-transitory computer readable medium storing instructions), or a combination of hardware and software elements. Also, note that various components may be combined into fewer components or separated into additional components. For example, memory and non-volatile storage may be included in a single component. The computer device can execute the visualization method alone, or cooperate with other computer devices.

Please refer to FIG. 12 , which shows a schematic diagram of the architecture of a computer device in an embodiment of the present application. As shown in the figure, in this embodiment, the computer device 1 includes one or more processors and on the processors The executed presentation engine is used to execute the above visualization method and display the corresponding visualization interface. For example, a computer device includes a processor, a display, and a rendering engine executed on the processor, wherein the rendering engine (or display engine) executed on the processor is used to execute the display engine in the above-mentioned embodiments. The described group data visualization method is displayed on a display, and for the description of the implementation process of the group data visualization method, refer to the description of FIGS. 1 to 11 . In a specific implementation state, the presentation engine is, for example, stored on a memory of a local computer device or on a remote storage server, and the presentation engine includes but is not limited to software that can analyze software developed based on a programming language for interface display and Hardware, such as XML, HTML and other scripting languages, C language, etc. In still other embodiments, a computer device executes the visualization method and provides a corresponding visualization interface to another computer device for display. For example, the client initiates a request to the server based on the user's request operation and logs in to the server, the server executes a visualization method to form corresponding interface data, and feeds back the interface data to the client, and the client's browser or The customized application program displays the corresponding icons according to the corresponding interface data.

The present application also provides a client, which is connected to a server through a network. In this embodiment, the client is, for example, a web client, and the client is, for example, a web server. The web client The terminal sends a web service request to log in to the web server to execute the group data visualization method described in the above embodiment and display it through the display. For the description of the implementation process of the group data visualization method, refer to FIG. 1 to FIG. 11 descriptions.

The present application also provides a server connected to a client through a network. In this embodiment, the client is, for example, a web client, and the client is, for example, a web server. The web server is executed based on the web client. The requested operation is to send to the client to execute the group data visualization method described in the above embodiment and display it on the display. For the description of the implementation process of the group data visualization method, please refer to the description of Fig. 1 to Fig. 11 .

The present application also provides a browser, which is connected to a server through a network. The browser logs in to the server based on sending a request to execute the group data visualization method described in the above embodiment and display it through a display. For the description of the implementation process of the group data visualization method, refer to the description of FIGS. 1 to 11 . In this embodiment, the browser is, for example, a web browser, including but not limited to QQ browser, Internet Explorer browser, Firefox browser, Safari browser, Opera browser, Google Chrome browser, Baidu browser, Sogou Browser, Cheetah Browser, 360 Browser, UC Browser, Maxthon Browser, Window of the World Browser, etc.

The present application also provides a group data visualization system, which may include software and hardware in one or more computer devices. In order to provide users with the behavior of a fraudulent group in different time periods, so as to answer the question "what does a group do as a fraudulent group" proposed by domain experts, and "do users in the same group They all have the same behavior." This application provides a visual group data visualization system from the time axis. Please refer to FIG. 13 , which shows a schematic diagram of the module structure of the group data visualization system provided by the present application. As shown in the figure, the group data visualization system 3 includes an acquisition module 31 , a processing module 32 and a display module 33 .

Wherein, the obtaining module 31 is used to obtain a data set of a group. The data features in the data set at least include event types and time information associated with the event types.

In some embodiments, the obtaining module 31 obtains the operation log of a cluster composed of multiple network users; in different embodiments, the cluster is a cluster composed of all network users that can be obtained, and the cluster The network users in the network come from the same website or different websites, or from different network channels, such as the Internet, one or more intranets, local area networks (LANs), wide area networks (WLANs), storage area networks (SANs), etc. An appropriate combination may also be a mobile communication network of a mobile phone or the like.

The acquisition module 31 hands over the acquired operation log to the processing module 32, and the processing module 32 determines at least one data feature from the operation logs of the plurality of network users, and analyzes at least one set of data in the operation log The similarity of features to determine the group. In a specific embodiment, in view of the fact that network fraud will inevitably leave user usage data in the network, the group data visualization system collects operation logs of multiple network users from at least one website, and the processing module 32 analyzes the collected According to the similarity of at least one data feature in the operation log, the users who generate the corresponding operation log are grouped to obtain the group and the data set of the group in the operation log.

In some embodiments, the data set in one group includes but not limited to at least two data characteristics of user information, IP address, event type, event source, event responder, and event occurrence time. Wherein, the user information is characterized by such as mobile phone number, email address, ID number, ID card number, gender, user equipment number used by the user, and registration time. Wherein, the same user information may correspond to at least one event type, and each event type corresponds to an event source, an event responder, and an event occurrence time. The event characteristics include but are not limited to: social behaviors such as attention, likes, comments, gifts (or called gifts) between network users, or network users logging in, logging out, updating status, registering, and modifying information at least one of other operations. For example, the same user information may correspond to multiple like event types, and each like event type corresponds to its own event source, event responder, and event occurrence time.

The processing module 32 can store the obtained data sets of each group in a database. In some embodiments, the data set can be obtained from a database that stores groups and their data sets. The database is, for example, configured on a remote storage server, or configured in a storage in a local computer device. In the device, the acquired module 31 can extract and acquire from the database based on the user's input operation. For example, the processing module 32 uses an unsupervised detection algorithm to obtain multiple groups, and the user selects one of the groups through the selection interface to obtain the data set of the corresponding group.

Specifically, the processing module 32 first calculates the similarity of all data in the operation log in the same type of data features, wherein the similarity can be measured by information entropy, for example, the processing module 32 respectively uses user information Calculate the information entropy of the dimension of IP usage or maximum IP usage, use the event type to calculate the information entropy of the operation type dimension, use the information entropy of the registration time dimension or the operation time to calculate the information entropy of the bad operation dimension, etc.; through the above calculation, The processing module 32 then detects the obtained information entropy by an unsupervised detection method and divides them into multiple groups. Wherein, the unsupervised detection method includes, for example, an algorithm based on a dense subgraph, or an algorithm based on a vector space, and the like. Each group presented by the visualization method provided in this application is used to reflect the shared resources used by the fraudulent events, user relationships, etc., so that users who use the group data visualization system 3 can more clearly determine the unsupervised detection Whether the classification strategy in the algorithm is reasonable. Wherein, the shared resource includes but not limited to shared IP, mailbox, etc., and user relationship includes but not limited to: user attention, interaction relationship, etc.

In an embodiment, the display module 33 in the group data visualization system 3 displays at least one group interface, and the group size in the group interface is characterized by the size of the displayed geometric figure. Please refer to Fig. 3, which is shown as an interface comprising multiple groups, as shown in the figure, there are 11 groups shown in the interface, and the geometric figure used to characterize these groups is a circle, and the 11 groups described Groups are located in a maximum dotted circle, within the dotted circle, for example, the dotted circle is used to represent a cluster composed of N network users, for example, the group marked 0 is a normal group, in a relatively There are 10 groups of different sizes labeled 1-10 inside the small dotted circle, and the size of the circle is proportional to the number of members in the group, that is, a larger group means more members, and a smaller group means members The number is small, for example, groups labeled 1-10 are abnormal groups. In various embodiments, the geometry of the group may be of arbitrary shape. The color of the geometry can be set randomly, or relative to the number of groups or the number of members of a group. For example, N colors are preset, and the processing module 32 randomly encodes different colors onto the geometric figures representing each group, and displays them on the display device through the display module 33 . As another example, the processing module 32 sequentially encodes the geometric figures used to represent each group according to the preset color sequence in descending order of the number of members, and displays them on the display device through the display module 33 . When the user selects a geometric figure by operating the display interface, the acquisition module 31 acquires a data set of a group.

In a preferred embodiment, the display module 33 displays at least one group interface and may also include an information bar displaying group information. When the user selects a group in the group interface, a Display the basic information of the group in the form of a window or a text box, such as: group code, number of members, data characteristics used to determine the most preferred group, group attributes (such as normal group group or exception group) and other information. The display module includes, for example, a display.

In order to describe the analysis results of the acquired group data sets by the group data visualization system 3 in a time axis manner, the processing module 32 is used to create a first time axis and a second time axis, and to analyze the data Encoding of features. The display module 33 displays the first and second time axes and the first, second, third and fourth shapes in an interface through a display device, wherein the first shape is used as the first time axis to represent the type and quantity of events occurring within each time granularity of the first time axis of the group; the second shape represents each type of event occurring within the time interval of the second time axis The total number of; the third shape characterizes the distribution of event types represented in the second shape on the second time axis; the fourth shape characterizes the distribution of the group on the second time axis The type and quantity of events that occur within a time granularity. Wherein, the display device may be an external or integrated display screen of a computer device, a driver program of the display screen, and a rendering engine specially configured for processing display data; the rendering engine includes but is not limited to: an image processing chip and a running The display program, etc. in the image processing chip.

Wherein, the first time axis and the second time axis are created according to the time information in the data set, for example, the maximum time span in the multiple time information in the data set is 10 days, then the first time axis or the second time axis The maximum time interval for the axis is 10 days. In one embodiment, the first time axis and the second time axis are created according to the same time interval and time granularity pair; in another embodiment, the first time axis and the second time axis are created according to different time intervals and time granularity pairs Timeline, detailed later.

Wherein, the processing module 32 performs pattern coding on all data such as data characteristics to be presented, event types, number of event types, etc., so that the presented interface is beautiful and clear. Here, the processing module 32 counts the number of event types in the data set according to the time granularity of the first time axis, encodes the counted event types into a graph of a preset first shape, and uses the display module 33 to time-series The encoded first shapes are presented on the first time axis as nodes of the first time axis. Through the display of each node on the first time axis, domain experts can clearly obtain the change process of the distribution or quantity of event types counted according to time. Wherein, the first shape includes but is not limited to: a pie shape, or a columnar shape. In some implementation examples, the processing module 32 can encode the ratio of the number percentage of each event type within a time granularity into a graph of the first shape and display it on the first time axis by the display module 33, wherein the same event The percentage fields of the types are the same color. Please refer to FIG. 4. FIG. 4 is a schematic diagram of an embodiment of the group data visualization system of the present application. As shown in the figure, in the displayed interface, the first time axis T1 is located in the lower area of the display interface. It is displayed as a 10-day time interval from August 1 to August 10, with days as the time granularity, encoding the percentage distribution of the number of event types counted each day into a pie graph and displayed as a node on the first time axis T1 Above, the colors in the pie graph are used to represent event types. For example, events marked with "yellow" in the figure represent attention events, events marked with "red" in the figure represent gift events, and events marked with "blue" in the figure For example, on the first time axis T1 in the illustration, the pie graph is used as a node to display August 7th. Among the event types generated, attention events accounted for a large proportion, and gift events accounted for a small proportion. Like events account for the least amount of events.

In addition, the processing module 32 sums the number of event types in the data set according to the time interval of the second time axis, encodes the accumulated event types into a graph of a preset second shape, and displays it through the display module 33 Displays the total number of each event type in a time interval of the second time axis. Wherein, the second shape includes but is not limited to: a histogram, a histogram, a line graph, and the like. According to the time interval of the created second time axis, the displayed total quantity of various event types reflects the comparison of the quantity of each event type in the same time interval. When the time interval of the second time axis represents a day or a week, the user can determine three How event types compare in total volume. In addition, the displayed column graph can also determine the comparison of the total number of the three event types according to thickness, transparency, and the like. Referring to Fig. 3 again, as shown in the figure, a horizontal histogram is displayed on the side (the right side in the illustration) near the first time axis T1, and " Red", "yellow" and "blue" three columnar bars, the length of the columnar bar represents the total number of event types generated in the time interval of the second time axis, as can be seen from the second shape, in the second In the time interval of the time axis, the "yellow" colored columnar bars represent the most attention events, followed by the "red" colored columnar bars, and the "blue" colored columnar bars indicate has the fewest likes.

By displaying the total quantity of each event type occurring in the time interval of the second time axis, domain experts can clearly obtain the change process of the event type statistics based on time from another perspective. In order to more clearly show the relationship between the first time axis and the second time axis, the processing module 32 is based on the encoding of the data features, and the display module 33 displays the second time axis, and the processing module 32 then The event types represented in the second shape are associated with the time granularities of the event types on the second time axis, and the event types represented by the third shape are displayed on the second time axis through the display module 33 distribution is displayed. Among them, the second time axis is presented as an axis with corresponding time granularity as nodes, and the third shape is used to associate the event types distributed in each adjacent node with the second shape, so that the user can clearly obtain the relationship between the second shape and the second shape. The relationship between the time granularities of the two time axes. Wherein, the third shape may be a line shape, and its color may be determined according to the color of the corresponding event type in the second shape, so as to allow the user to clearly distinguish a unified event type.

Please refer to Figure 3 again, as shown in the figure, the second shape is associated with the second time axis through the third shape, where the third shape takes an arc as an example and spreads to the second time axis based on the time information of each event type in the data set On the nodes of each time granularity of the second time axis. For example, a dotted line (the first type of dotted line) is used in the figure to indicate the association between the gift event represented by the "red" columnar bar and the corresponding time node (time granularity) on the second time axis, and a continuous line is used to indicate the "yellow" color The relationship between the attention event represented by the column bar and the corresponding time node (time granularity) on the second time axis, the line composed of dots and line segments (the second dotted line) represents the like event represented by the "blue" color column bar and the second time node. The association of corresponding time nodes (time granularity) on the two time axes. In different implementations, the third shape uses line thickness or transparency to describe the number of event types generated within a corresponding time granularity interval, thereby facilitating presentation of high-frequency periods or rules of event occurrence.

In order to more intuitively display the type and quantity of events occurring in each time granularity interval on the second time axis, the display module 33 also displays a fourth shape under the control of the processing module 32 to represent the group in the The type and quantity of events occurring in each time granularity of the second time axis. Wherein, the processing module 32 performs summation or distribution statistics on the number of event types in the data set according to the time interval of the second time axis, and encodes the accumulated event types or distribution into a graph of a preset fourth shape, And the display module 33 presents the encoded fourth shapes as nodes of the second time axis on the second time axis according to time sequence. Wherein, the processing module 32 controls the display module 33 to display the corresponding fourth shape under the guidance of the third shape according to the created time granularity of the second time axis. Through the display of each node on the second time axis, the user can clearly obtain the change process of the number of event types counted according to time from another perspective. Wherein, the fourth shape includes but is not limited to: a pie shape or a columnar shape, and a shape different from the first shape is selected. In some implementation examples, the processing module 32 may accumulate and respectively encode the quantities of each event type within the time granularity of the second time axis into a graph of a fourth shape and display it on the second time axis by the display module 33, wherein, The cumulative sum of the same event type takes the same color as the third shape and the second shape.

The timeline is used as one of the ways to present group data, because it is very important to understand the concentrated behavior of users in a period of time, whether it is a domain expert or an algorithm expert. For this reason, the combination of the first time axis and the second time axis is needed to describe this centralized behavior.

Please refer to Figure 3, as shown in the figure, each pie chart in the first time axis T1 presents different event types (such as following a user or giving a user online sent a gift). The processing module 32 encodes each event type into a different color, encodes the quantity of each event type in the unit time granularity of the first time axis T1 into the area ratio of each region in the pie chart to form a pie chart, and encodes the second time axis The number of each event type in the time interval of T2 is coded as the length of the histogram to form a histogram corresponding to each event type (that is, the second shape), and the number of each event type in the unit time granularity of the second time axis T2 is coded as a column The length of the figure to form a separate histogram (that is, the fourth shape); when the user selects a pie chart on the first time axis T1, an arc (colored by the event type) is emitted from the second shape corresponding to each event type ( That is, the third shape), and correspond to the fourth shapes corresponding to the time granularity on the second time axis T2, thereby clearly presenting the time axis relationship of each event type in a group data set to the user.

In one embodiment, the first time axis and the second time axis are created according to the same time interval and time granularity. For example, the processing module 32 preloads the first time axis and the second time axis with the same time granularity, so that the display module 33 can map each event type to each time axis according to the time information and time granularity in the data set , to get at least one time interval of the respective time axis. As another example, the processing module 32 determines the preset time intervals of the first time axis and the second time axis according to the sorting of the time information in the data set, and the display module 33 displays the time interval according to the time information and time granularity in the data set. Each event type corresponds to each time axis. Please refer to the interface including the first time axis T1 and the second time axis T2 shown in FIG. 3 . Wherein, the T1 and T2 time axes both use days as the time granularity, and both use 10 days as the time interval, and the processing module 32 displays data on the first time axis T1 and the second time axis T2 according to the time information in the data set Centralized data characteristics. For example, as shown in FIG. 3 , the second time axis T2 takes days as the time granularity, and the processing module 32 can encode the sum of each event type counted every day into a columnar graph and display it as a node on the second time axis T2 by the display module 33. on the time axis T2.

In another implementation example, the first time axis and the second time axis are created according to different time intervals and time granularity pairs. Wherein, the time interval of the second time axis is the time granularity of the first time axis. For example, the processing module 32 presets that the time granularity of the first time axis and the second time axis are different, and presets the corresponding relationship between the time granularities between the two time axes, and the display module 33 according to the time information in the data set Correspond each event type to each time axis. Please refer to FIG. 5 , which shows an interface including a first time axis T1 and a second time axis T2 . Wherein, the T1 time axis takes 10 days as the time interval, with days as the time granularity, and the T2 time axis takes days as the time interval, and takes hours as the time granularity; Data features in the data set are displayed on the axis T1 and the second time axis T2. For example, with the interface C2 shown in FIG. 5 , the second time axis T2 takes hours as the time granularity, and the processing module 32 can encode the sum of the event types counted every hour into a columnar graph and display it as a node by the display module 33 on the second time axis. on the time axis T2.

The processing module 32 encodes the quantity of each event type in the time granularity of the first time axis T1 as the area ratio of each region in the pie chart to form a pie chart; when the user selects a pie chart on the first time axis T1, The number of each event type (equivalent to each event type corresponding to the selected pie chart) in the time interval of the second time axis T2 is encoded as the length of the histogram to form a histogram corresponding to each event type (that is, the second shape ), the number of each event type in the unit time granularity of the second time axis T2 is encoded as the length of the histogram to form a separate histogram (that is, the fourth shape), and the event type is emitted from the second shape corresponding to each event type is an arc of color (that is, the third shape), and corresponds to each fourth shape corresponding to the time granularity on the second time axis T2, thereby clearly presenting the time axis relationship of each event type in a group data set to user.

As shown in the interface C1 in Figure 4, each pie chart in the first time axis T1 shows different event types (such as following a user or sending a message to a user online) at each time granularity (such as every day) a gift). Code each event type into a different color. For example, the color in the pie graph mentioned in the illustration is used to represent the event type. For example, the event marked with "yellow" in the figure indicates an event of concern, and the one marked with "red" in the figure indicates For gift events, those marked with "blue" in the figure represent like events. For example, on the first time axis T1 in the figure, a pie graph is used as a node on August 7th, and the following events are among the event types generated. The proportion is relatively large, the proportion of gift events is relatively small, and the proportion of like events is the least. When the user selects the node August 7th on the first timeline T1, the event types and event types that occur every hour within 24 hours on August 7th are displayed on the second timeline T2 corresponding quantity.

It should be noted that the above-mentioned time intervals and time granularity of the first time axis and the second time axis are not limited to the examples given. In different embodiments, the user can set the first time according to the actual situation. The time interval and time granularity of the first time axis and the second time axis, such as time units such as weeks, months, quarters, or even years.

Users can use the presentation process and displayed statistics to detect the groups classified by the group data visualization system, and use the visualized interface to allow domain experts to discover or correct deficiencies in the detection algorithm. In addition, in order to display the relationship between the two time axes more clearly, the group data visualization system further includes a first detection module (not shown). When it is detected that the user selects the first shape based on the first detection module, the event type occurring within the time granularity represented by the first shape is displayed dynamically, highlighted, or dynamically and highlighted by the third shape Distribution on the second time axis. For example, in the interface C1 shown in FIG. 4, when the user selects a pie chart on the first time axis T1, each third shape connected to the histogram corresponding to the selected pie chart on the second time axis T2 flashes Flashing or highlighting for a few seconds or longer, when the user selects another pie chart on the first time axis T1, the previously flashing and highlighted third shape restores its original shape and color, and is the same as the pie chart at the second time Each third shape connected to the histogram corresponding to the selected pie chart on the axis T2 blinks for a few seconds and is highlighted.

In some embodiments, the group data visualization system further includes a second detection module. When it is detected that the user selects the first shape based on the second detection module, the display module 33 displays an enlarged display when the first shape is selected, so that the user can more clearly view the event type represented by the first shape Quantitative comparisons. In a specific example, when the first shape is selected, it is displayed enlarged on one side of the first time axis. For example, the selected first shape is enlarged and displayed on the upper side of the first time axis, presenting an interface C3 as shown in FIG. 6 a . In another specific example, when the first shape is selected, it is displayed enlarged in the first time axis. For example, the selected first shape is enlarged and displayed at the same center position of the first time axis, presenting an interface C4 as shown in FIG. 6b.

In some embodiments, the user not only cares about the changes of each event type in the group data set according to the time axis, but also cares about whether the assigned group is reasonable, which requires the user to be able to view the detailed data characteristics and The preferred order of each data feature constructed for classifying groups. The display module 33 is also used for displaying a data set interface of a group. The displayed datasets are displayed in a tabular manner, thereby presenting the user with detailed information on the characteristics of the data in the same group. In order to improve the classification accuracy of the group data sets, the list displayed in the interface can display a list of data features in a group column by column according to the classification priority used by the group data visualization system for classification. For example, please refer to FIG. 6, which shows a schematic diagram of a list interface of a group of data sets. In the schematic diagram of the list interface, the displayed data sets of a group are sorted according to the similarity of data features in order of priority from high to low. When the similarity of the data features in the first priority is the same, sort according to the data features of the second priority. In the embodiment shown in FIG. 7, the order of the priority from high to low is: IP address, Event source (source), event responder (target), event type (event_type) and event time (timestamp). In this embodiment, the processing module 32 encodes the header of the table with the importance of different columns, and if the value of a feature is more concentrated, then this feature is more important. In an embodiment provided in the present application, the group data visualization system represents this feature by calculating the information entropy of each feature. The lower the information entropy, the higher the consistency. Then the processing module 32 sorts the features according to the increasing order of information entropy, and finally the display module 33 puts the list headers with low information entropy in front to prompt the user's attention. Of course, in different implementation situations, it can also be based on the The column headers in the displayed table are color-rendered. For example, the color of the column headers with low information entropy is finally rendered to the deepest to remind users that the data characteristics represented by this column are the most important, and so on. Other data features, and then get the data set list interface shown in the figure. The list interface may be displayed after displaying multiple group interfaces or timeline display interfaces, or based on a selection operation of the user selecting the list interface.

In some embodiments, in order to further characterize whether the acquired data set of the group can reflect the characteristics of the fraud event, it needs to be displayed from other dimensions. For example, the accuracy of detected fraudulent events can be further confirmed by comparing normal users' network operation data with group data sets. To this end, the display module 33 is further configured to display an interface of the feature distribution of the data set of the group, a histogram of the feature distribution and a distribution comparison chart corresponding to the histogram in the whole cluster histogram. Wherein, the feature distribution interface can display the distribution of each data type in the overall network. The overall network is relative. For example, if a cluster is formed by multiple network users, a certain group in the cluster can be displayed through the interface. For the distribution of a data characteristic in a group, please refer to Figure 2. For example, the largest dotted circle in Figure 2 represents a cluster composed of multiple network users. There are 11 groups in this cluster, which are groups numbered 0-10 Group, select a group for information display.

In some embodiments, the data types that can be displayed on the feature distribution interface are, for example: information entropy in the dimension of average operation interval (average operation interval entropy), information entropy in the dimension of IP address usage (IPused amount entropy), information in the dimension of gender Entropy (sex entropy), information entropy of email dimension (emailentropy), information entropy of registration time dimension (reg time entropy), information entropy of operation times dimension (operation times entropy), information entropy of device quantity dimension (device amount entropy) ), the information entropy of the operation type dimension (operation type entropy), the maximum amount of information entropy of the IP used by others (maxIP used be used amount entropy), etc. In the embodiment shown in Figure 7, the information entropy of the registration time dimension is used as an example to show the data characteristics, that is, Figure 7 shows the characteristics of the information entropy (registration period) of the registration time dimension in a group in the network cluster distributed. In order to effectively compare the feature distribution difference between the acquired group data set and the network operation data of normal users, as shown in FIG. The data of the distribution comparison chart in the whole cluster histogram is further displayed by the display module 33 .

In step S211, one of the groups is selected, and at least one data feature is determined from the data set of the group. In one embodiment, for example, the group marked 2 in FIG. 3 is selected, and a data characteristic of user information is determined from the data set in the group marked 2, for example, the user information is registration time.

In step S212, the feature distribution of the determined at least one data feature in the groups and clusters is counted. In this embodiment, the feature distribution of the data feature that is the registration time in the group is counted, and the feature distribution of the data feature that is the registration time in the entire cluster is counted.

In step S213, the histogram of the feature distribution and the distribution comparison diagram corresponding to the histogram in the whole cluster histogram are displayed. In this embodiment, based on the encoding of the data feature, display the histogram of the distribution of the data feature of the registration time in the group, and display the distribution of the data feature of the registration time in the entire A histogram of the distribution of features in the cluster. Please refer to Figure 9, which shows the interface of the histogram and comparison chart of the characteristic distribution of the registration time in a group in an embodiment of the present application, as shown in the figure, in the interface D, Figure (a) shows It is the thumbnail image of the feature distribution of the registration time in the selected group labeled 2, corresponding to the enlargement of the thumbnail image, it is the enlarged image (d) at the bottom of the interface D, as can be seen from the enlarged image, In this group, during the month from August 1st to August 31st, the group members registered on August 5th, August 6th, August 11th, and August 12th. day, and the 5 days of August 16th, and in the interface D, the figure (c) is represented as a histogram of the time distribution of registered users in the cluster performing registration operations in August, from the figure (c) It can be seen that the registration distribution of registered users in the cluster in August has a certain pattern, and the picture (b) in interface D is characterized by overlapping and superimposing pictures (d) and pictures (c) to display the registration time The difference in data characteristics in the entire cluster and in selected groups. In order to enable users to know the differences and connections between different features, the embodiment provided by this application presents the histogram in a three-layer form. After the user clicks one of the thumbnails, the page will scroll to the normalized The distribution comparison chart. Certainly, in a specific application, there may be multiple thumbnail images of the data feature, each representing a different data feature.

In some embodiments, the display module 33 can also render the histogram to distinguish or emphasize the characteristic distribution of a certain data feature in the group and the entire cluster, or dynamically display (such as in a blinking manner) to distinguish or emphasize Emphasize the characteristic distribution of a data characteristic in the group and the whole cluster.

In some embodiments, in order to further analyze the differences among multiple groups in a network cluster, the display module 33 also displays an interface for feature distribution of data sets of multiple groups, please refer to FIG. 10 and FIG. 11 , Fig. 10 shows the steps of the present application displaying the distribution of multiple groups in the cluster in one embodiment, and Fig. 11 shows the interface E of the present application displaying the distribution of multiple groups in the cluster in one embodiment, as shown in the figure As shown, the processing module 32 is executed according to the steps shown in FIG. 10 , and the display module 33 displays the interface shown in FIG. 11 .

In step S311, a plurality of groups are determined in a cluster composed of a plurality of network users, and different shapes, icons, labels and/or colors are used to represent the differences of the plurality of groups; in one embodiment, such as selecting The three groups marked 0, 1 and 2 in Figure 3, wherein the group marked 0 is represented by "green", the group marked 1 is represented by "red", and the group marked 2 is represented by "Blue" color representation.

In step S312, at least one data characteristic is determined from the data sets of the plurality of groups; in this embodiment, one data characteristic, such as an IP address, is determined from the data sets of the three groups.

In step S313, based on the at least one data feature, analyze the relative information entropy between every two network users in each group as a measure of the similarity between every two network users; in this embodiment, The relative information entropy (the information entropy of IP usage dimension, IP used amount entropy) between every two network users in the 3 groups of label 0, 1 and 2 based on described IP address analysis is used as the measure described every two The degree of similarity between network users. For example, the data dimension reduction method t-SNE (t-distribution neighborhood embedding algorithm) is used and the relative entropy between two users is used as an index to measure the distance between these network users.

In step S314, a display interface is output, in which network users are represented by shapes, icons, and/or labels, differences in the multiple groups are represented by different colors, and each group is represented by a displayed distance The degree of similarity between two network users in . In this embodiment, an interface E as shown in FIG. 11 is shown, and network users are represented by dots, "green" color represents the group marked 0, "red" color represents the group marked 1, and " The color "blue" indicates the group labeled 2, among which, the color "blue" indicates that the distance between users in the group labeled 2 is relatively short, and the group is distributed in clusters, and the color "red" indicates the group labeled 1 The distance between users in the group is also relatively short, and the group forms a cluster distribution. The "green" color represents the distribution of randomly sampled normal users. The distance between normal users is farther, and the distribution is more scattered. From this, it can be considered that if a group is a dense cluster, it is more likely to be considered a fraudulent group. For example, in the embodiment shown in Figure 11, the group represented by the "green" color is relatively scattered, and it means that the "green" color group is a normal group, and the users represented by the "green" point Also for normal users. On the contrary, the group represented by "red" color (that is, the group marked 1) and the group represented by "blue" color (that is, the group marked 2) are distributed in clusters, which means that The "red" and "blue" groups are abnormal groups, and users represented by "red" and "blue" dots are abnormal users. In an embodiment, the user using the visualization system can interactively check the specific information and feature values of the users in each group by hovering over the mouse.

In other embodiments, in the output interface, network users can also be characterized by, for example, shapes, icons, and/or labels, such as shapes such as triangles, rectangles and other geometric figures, such as icons that are characterized by smiling faces or crying faces, For example, the label uses words or symbols with clear distinctions.

It should be noted that all the modules in the group data visualization system can be configured on a single computer device. Or the modules in the group data visualization system are respectively configured on the client side on the user side and the server on the network side, and the client side is connected to the server network. For example, the acquisition module and processing module of the group data visualization system are installed in the server, the display module is installed in the client, the client sends a request to log in to the server, and the server executes the request based on the client The operation runs the group data visualization system to the client, and displays a corresponding interface through the client. The client includes, but is not limited to: a browser configured on a user terminal or an interface of dedicated client software, and hardware for executing a display interface program.

It should also be noted that, through the description of the above embodiments, those skilled in the art can clearly understand that part or all of the present application can be implemented by means of software combined with a necessary general hardware platform. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art may be embodied in the form of a software product, and the computer software product may include one or more computer programs on which machine-executable instructions are stored. A machine-readable medium that, when executed by one or more machines, such as a computer, computer network, or other electronic device, causes the one or more machines to perform operations according to embodiments of the present application. Machine-readable media may include, but are not limited to, floppy disks, compact disks, CD-ROM (Compact Disk - Read Only Memory), magneto-optical disks, ROM (Read Only Memory), RAM (Random Access Memory), EPROM (Erasable non-programmable read-only memory), EEPROM (electrically erasable programmable read-only memory), magnetic or optical cards, flash memory, or other types of media/machine-readable media suitable for storing machine-executable instructions.

The application can be used in numerous general purpose or special purpose computing system environments or configurations. Examples: personal computers, server computers, handheld or portable devices, tablet-type devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, including Distributed computing environment of any of the above systems or devices, etc.

This application may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The application may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including storage devices.

It should be noted that those skilled in the art can understand that some of the above components can be programmable logic devices, including: Programmable Array Logic (Programmable Array Logic, PAL), General Array Logic (Generic Array Logic, GAL), Field Programmable Gate One or more of Array (Field-Programmable Gate Array, FPGA), Complex Programmable Logic Device (Complex Programmable Logic Device, CPLD), which is not specifically limited in this application.

In summary, this application presents the grouped data sets in the fraud event detection process based on the time axis, type distribution, classification list, etc., and realizes the data characteristics of the grouped data sets in the fraud event detection process. The display of multiple relationship interfaces is beneficial for domain experts and algorithm experts to evaluate and revise the detection algorithm of the fraud event detection system.

The above-mentioned embodiments are only illustrative to illustrate the principles and effects of the present application, but are not intended to limit the present application. Any person familiar with the technology can modify or change the above-mentioned embodiments without departing from the spirit and scope of the present application. Therefore, all equivalent modifications or changes made by those skilled in the art without departing from the spirit and technical ideas disclosed in the application shall still be covered by the claims of the application.

Claims (27)

1. A group data visualization method, applied in a fraud event detection system, is characterized in that, comprising the following steps: Obtaining a data set of a group, the data features in the data set include at least an event type and time information associated with the event type; Create the first time axis and the second time axis; Based on the encoding of the data features, displaying a first time axis with a first shape as a node to represent the type and quantity of events occurring in each time granularity of the group in the first time axis; displaying a second shape to represent the total number of each event type occurring within the time interval of the second time axis; Displaying the second time axis, associating the event types represented by the second shape with the time granularities of the event types on the second time axis, and each event type represented by the third shape on the second distribution on the time axis; and A fourth shape is displayed to represent the type and quantity of events occurring in the group within each time granularity of the second time axis. 2. The group data visualization method according to claim 1, wherein the step of obtaining a data set of a group comprises: Obtain the operation log of a cluster composed of multiple network users; determining at least one data characteristic from operation logs of the plurality of network users, and analyzing the similarity of at least one set of data characteristics in the operation logs to determine the group; and Get the dataset for the cohort. 3. The group data visualization method according to claim 1 or 2, further comprising the step of displaying at least one group interface, the group size in the group interface is characterized by the size of the displayed geometric figures . 4. The group data visualization method according to claim 1 or 2, further comprising the step of displaying an interface of a group data set, the data characteristics of the group data set include user information, IP The address, event type, event source, event responder, and event occurrence time are at least two data characteristics, and in the interface of the group data set, the group data sets are sorted and displayed after being grouped. 5. The group data visualization method according to claim 2, further comprising the step of displaying the interface of the feature distribution of the data set of the group: selecting one of said groups, and determining at least one data characteristic from the data set of said group, Statistical feature distribution of the determined at least one data feature in the groups and clusters; and A histogram of the feature distribution and a distribution comparison diagram corresponding to the histogram in the whole cluster histogram are displayed. 6. The group data visualization method according to claim 1, further comprising the step of displaying the interface of the feature distribution of the data sets of a plurality of groups: Determining a plurality of groups in a cluster composed of a plurality of network users, respectively using different shapes, icons, labels and/or colors to represent the differences of the plurality of groups; determining at least one data characteristic from the data sets of the plurality of groups; Analyzing the relative information entropy between every two network users in each of the groups based on the at least one data feature as a measure of the similarity between the every two network users; and Outputting a display interface, in which network users are represented by shapes, icons, and/or labels, differences in the plurality of groups are represented by different colors, and two network users in each group are represented by displayed distances the degree of similarity between them. 7. The group data visualization method according to claim 1, further comprising the step of displaying and zooming in on the first shape when selected comprising: The first shape is displayed enlarged on one side of the first time axis when selected; or The first shape is displayed enlarged in the first time axis when selected. 8. The method for visualizing group data according to claim 1, wherein the event types include network users' concerns, likes, comments, gifts, logins, logouts, update status, registration, and modification information at least one. 9. The group data visualization method according to claim 1, wherein the step of creating the first time axis and the second time axis is to create the first time axis and the second time axis according to the same time interval and time granularity Two timelines. 10. The group data visualization method according to claim 1, wherein the step of creating the first time axis and the second time axis is to create the first time axis and the second time axis according to different time intervals and time granularities Two time axes, the time interval of the second time axis is the time granularity of the first time axis. 11. The group data visualization method according to claim 9 or 10, further comprising dynamically and/or highlighting the third shape when the first shape is selected. A distribution of event types occurring within the time granularity represented by a shape on the second time axis. 12. A computer device, characterized in that it comprises: one or more processors; and A presentation engine executed on the one or more processors, the presentation engine is used to execute the group data visualization method according to any one of claims 1-11. 13. A group data visualization system, comprising: The acquisition module acquires a data set of a group through the network, and the data features in the data set include at least an event type and time information associated with the event type; A processing module for creating a first time axis and a second time axis, and encoding the data features; and A display module, displaying the first and second time axes and displaying the first, second, third, and fourth shapes in one interface through a display device, wherein the first shape is used as a node of the first time axis To represent the event type and quantity of the group occurring in each time granularity of the first time axis; the second shape represents the total number of each event type occurring in the time interval of the second time axis Quantity; the third shape characterizes the distribution of event types represented in the second shape on the second time axis; the fourth shape characterizes the group at each time of the second time axis The type and number of events that occur within the granularity. 14. The group data visualization system according to claim 13, wherein the group is the operation log of a plurality of network users obtained by the acquisition module, and the operation log is analyzed by the processing module Determined by the similarity of at least one set of data features in the 15. The group data visualization system according to claim 13, wherein the display module is also used to display at least one group interface, and the group size in the group interface is determined by the size of the displayed geometric figure. characterization. 16. The group data visualization system according to claim 13, wherein the display module is also used to display an interface of a data set of a group, and the data characteristics of the data set of the group include user information, The IP address, event type, event source, event responder, and event occurrence time are at least two data characteristics, and in the interface of the group data set, the group data sets are sorted and displayed after being grouped. 17. The group data visualization system according to claim 13, wherein the display module is also used to display the interface of the feature distribution of the data set of the group, the histogram of the feature distribution and the corresponding The distribution comparison chart of the above histogram in the whole cluster histogram. 18. The group data visualization system according to claim 13, wherein the display module is further used to display network users represented by shapes, icons, and/or labels, and the plurality of groups represented by different colors The difference between the two network users in each group is represented by the distance shown in the interface. 19. The group data visualization system according to claim 13, further comprising a detection module, when it is detected that the user selects the first shape based on the detection module, the first shape displayed in the display module A shape is displayed enlarged on one side of the first time axis; or the first shape displayed in the display module is displayed enlarged on the first time axis. 20. The group data visualization system according to claim 13, wherein the first time axis and the second time axis created by the processing module have the same time interval and time granularity. 21. The group data visualization system according to claim 13, wherein the first time axis and the second time axis created by the processing module are created according to different time intervals and time granularities. A second time axis, where the time interval of the second time axis is the time granularity of the first time axis. 22. The group data visualization system according to claim 20 or 21, further comprising a detection module, when it is detected that the user selects the first shape based on the detection module, the third shape dynamically and /or highlight the distribution of event types occurring within the time granularity represented by the first shape on the second time axis. 23. The group data visualization system according to claim 13, characterized in that, the event types include network users' concerns, likes, comments, gifts, logins, logouts, update status, registration, and modification information at least one. 24. A client, connected to a server through a network, characterized in that the client executes the group data visualization method described in any one of claims 1-11 based on sending a request to log in to the server A step of. 25. A server, connected to a client through a network, characterized in that, the server sends the group according to any one of claims 1-11 to the client based on the operation requested by the client. Group the process of data visualization method and display the execution result through the client. 26. A browser, connected to a server through a network, characterized in that the browser executes the group data visualization method described in any one of claims 1-11 based on sending a request to log in to the server A step of. 27. A computer-readable storage medium storing a data visualization computer program, characterized in that, when the data visualization computer program is executed, the steps of the group data visualization method according to any one of claims 1-11 are implemented.