CN114547383A

CN114547383A - Case serial-parallel map generation method, device, equipment and medium

Info

Publication number: CN114547383A
Application number: CN202210173650.0A
Authority: CN
Inventors: 韩龙琴; 常宁; 王方圆; 尚程; 傅强; 梁彧; 蔡琳; 杨满智; 王杰; 田野; 金红; 陈晓光
Original assignee: Eversec Beijing Technology Co Ltd
Current assignee: Eversec Beijing Technology Co Ltd
Priority date: 2022-02-24
Filing date: 2022-02-24
Publication date: 2022-05-27

Abstract

The embodiment of the invention discloses a method, a device, equipment and a medium for generating a case serial-parallel map. The case string-parallel atlas generation method comprises the following steps: acquiring case element data of a plurality of cases to be processed; carrying out linear serial connection processing on a plurality of cases to be processed according to case element data to obtain initial case serial-parallel maps which are linearly connected in series; determining at least one annular serial connection line in the initial case serial-parallel map according to case element data; and connecting different cases to be processed in the initial case string parallel-connection map in series according to the annular serial-connection connecting line to obtain a target case string parallel-connection map. The technical scheme of the embodiment of the invention can improve the generation efficiency of the case serial-parallel map and discover the serial-parallel relation of the cases in time, thereby accurately and effectively analyzing illegal behaviors.

Description

Case serial-parallel map generation method, device, equipment and medium

Technical Field

The embodiment of the invention relates to the technical field of data processing, in particular to a case serial-parallel graph generation method, device, equipment and medium.

Background

At present, case concatenation generally means that more than two cases are analyzed and compared from aspects of material evidence, manipulation characteristics, time, place, selection targets and the like, because behaviors in case concatenation often have many common points, case concatenation can be carried out by using the common points, and whether cases are the same person or the same member can be judged.

However, the traditional case string and parallel analysis mainly depends on manual drawing of case string and parallel patterns by workers to display case string and parallel relationships, but the traditional case string and parallel patterns have the problem of low drawing efficiency, so that the workers cannot timely and effectively find the case string and parallel relationships with the continuous increase of cases and criminals, and the cases excessively split the string and parallel relationships, so that illegal behaviors cannot be accurately analyzed.

Disclosure of Invention

The embodiment of the invention provides a case string-parallel map generation method, a case string-parallel map generation device, case string-parallel map generation equipment and a case string-parallel map generation medium, which can improve case string-parallel map generation efficiency and discover case string-parallel relations in time, so that illegal behaviors are accurately and effectively analyzed.

In a first aspect, an embodiment of the present invention provides a case string parallel graph generation method, including:

acquiring case element data of a plurality of cases to be processed;

carrying out linear serial connection processing on a plurality of cases to be processed according to case element data to obtain initial case serial-parallel maps which are linearly connected in series;

determining at least one annular serial connection line in the initial case serial-parallel map according to case element data;

and connecting different cases to be processed in the initial case string parallel-connection map in series according to the annular serial-connection connecting line to obtain a target case string parallel-connection map.

In a second aspect, an embodiment of the present invention further provides a device for generating a case string-parallel graph, including:

the case element acquisition module is used for acquiring case element data of a plurality of cases to be processed;

the initial case string-parallel map generation module is used for carrying out linear serial connection processing on a plurality of cases to be processed according to case element data to obtain initial case string-parallel maps which are linearly connected in series;

the annular connecting line determining module is used for determining at least one annular connecting line in the initial case string parallel graph according to the case element data;

and the target case serial-parallel map generation module is used for serially connecting different cases to be processed in the initial case serial-parallel map according to the annular serial connecting line to obtain a target case serial-parallel map.

In a third aspect, an embodiment of the present invention further provides an electronic device, where the electronic device includes:

one or more processors;

storage means for storing one or more programs;

when the one or more programs are executed by the one or more processors, the one or more processors implement the method for generating the case string parallel graph provided by any embodiment of the present invention.

In a fourth aspect, an embodiment of the present invention further provides a computer storage medium, on which a computer program is stored, where the computer program, when executed by a processor, implements the case string parallel graph generating method provided in any embodiment of the present invention.

According to the technical scheme of the embodiment, the case element data of a plurality of cases to be processed are obtained, then the cases to be processed are subjected to linear serial connection processing according to the case element data, initial case serial-parallel maps which are in linear serial connection are obtained, at least one annular serial connection line in the initial case serial-parallel maps is further determined according to the case element data, so that different cases to be processed in the initial case serial-parallel maps are serially connected according to the annular serial connection line, and the target case serial-parallel maps are obtained. According to the scheme, the linear series connection processing can be performed on a plurality of cases to be processed according to case element data, the initial case string-parallel atlas is automatically generated without manual drawing, the initial case string-parallel atlas can be further processed based on the case element data, different cases to be processed in the initial case string-parallel atlas are connected in series through the annular series connection connecting line, the case string-parallel relation is displayed through the target case string-parallel atlas, the problems that the drawing efficiency of the traditional case string-parallel atlas is low, and the case string-parallel relation cannot be timely and effectively found are solved, the generation efficiency of the case string-parallel atlas can be improved, the case string-parallel relation can be timely found, and illegal behaviors can be accurately and effectively analyzed.

Drawings

Fig. 1 is a flowchart of a case string parallel graph generation method according to an embodiment of the present invention;

fig. 2 is a flowchart of a case string parallel graph generation method according to a second embodiment of the present invention;

FIG. 3 is a schematic diagram of an initial case string-to-parallel atlas provided by a second embodiment of the present invention;

FIG. 4 is a schematic diagram of a parallel-connected graph of a target case string with a part of linear shape and a part of circular shape according to a second embodiment of the present invention;

FIG. 5 is a schematic diagram of a parallel-connected graph of a plurality of non-intersecting circular target cases according to a second embodiment of the present invention;

FIG. 6 is a schematic diagram of a parallel graph of a plurality of intersecting circular target cases according to a second embodiment of the present invention;

FIG. 7 is a schematic diagram of a target case string-parallel map with a large loop containing a small loop according to the second embodiment of the present invention;

FIG. 8 is a schematic view of a crash case string-parallel map of case crashes according to a second embodiment of the present invention;

fig. 9 is a schematic diagram of a case string parallel map generation apparatus according to a third embodiment of the present invention;

fig. 10 is a schematic structural diagram of an electronic device according to a fourth embodiment of the present invention.

Detailed Description

The present invention will be described in further detail with reference to the accompanying drawings and examples. It is to be understood that the specific embodiments described herein are merely illustrative of the invention and are not limiting of the invention.

It should be further noted that, for the convenience of description, only some but not all of the relevant aspects of the present invention are shown in the drawings. Before discussing exemplary embodiments in more detail, it should be noted that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although a flowchart may describe the operations (or steps) as a sequential process, many of the operations can be performed in parallel, concurrently or simultaneously. In addition, the order of the operations may be re-arranged. The process may be terminated when its operations are completed, but may have additional steps not included in the figure. The processes may correspond to methods, functions, procedures, subroutines, and the like.

Example one

Fig. 1 is a flowchart of a case string parallel graph generation method according to an embodiment of the present invention, where the embodiment is applicable to a case string parallel graph generation apparatus for efficiently generating a case string parallel graph, and the method may be executed by the case string parallel graph generation apparatus, and the apparatus may be implemented by software and/or hardware, and may be generally integrated in an electronic device. The electronic device may be a terminal device, a server device, or the like, and the embodiment of the present invention does not limit the type of the electronic device that executes the case string parallel-to-parallel atlas generating method. Accordingly, as shown in fig. 1, the method comprises the following operations:

s110, obtaining case element data of a plurality of cases to be processed.

The case to be processed can be a case needing case serial-parallel analysis. The case element data may be data reflecting the characteristics of the case, and is used for performing serial-parallel processing on the case. Case element data may include a plurality of types of case characteristics.

In the embodiment of the invention, a plurality of cases to be processed, which need to be subjected to case serial-parallel connection, can be obtained first, so that case information matched with each case to be processed is obtained, and the case information matched with each case to be processed is further analyzed, so that case element data of each case to be processed is obtained.

And S120, performing linear serial connection processing on a plurality of cases to be processed according to case element data to obtain an initial case serial-parallel map in linear serial connection.

The linear concatenation processing may be an operation of serially connecting cases to be processed in sequence by a plurality of line segments. The initial case string parallel graph can be a case string parallel graph in which cases to be treated are serially connected in sequence.

In the embodiment of the invention, the case element data with the same or similar values can be used as the basis for the linear serial connection processing of the cases to be processed, so that the cases to be processed are subjected to the linear serial connection processing according to the basis of the linear serial connection processing, and the initial case serial-parallel map in which the cases to be processed are sequentially and linearly connected in series by using line segments is obtained. It should be noted that the case element data portions between the cases to be processed are the same, and it can be considered that the case element data portions between the cases to be processed have similar data.

For example, a case to be processed may be selected from a plurality of cases to be processed as a start point of linear concatenation processing, a second case to be processed having the same or similar case element data as the selected first case to be processed (the case to be processed as the start point of the linear concatenation processing) is determined, the first case to be processed and the second case to be processed are linearly concatenated, a third case to be processed having the same or similar case element data as the second case to be processed is further determined, the second case to be processed and the third case to be processed are linearly concatenated, and so on, the plurality of cases to be processed are linearly concatenated until a next case to be processed having the same or similar case element data as the current case to be processed cannot be obtained, the current case to be processed is used as an end point of the linear concatenation processing, and obtaining an initial case string-parallel map of linear series connection. It should be noted that the cases to be processed, which constitute the initial case string-parallel map, are different.

S130, determining at least one annular serial connecting line in the initial case serial-parallel map according to the case element data.

The ring-shaped serial connection line can be determined according to case element data, and different cases to be processed are connected in an initial case serial-parallel map to form a connection line of a ring-shaped structure.

In the embodiment of the present invention, the third case to be processed, which is sequentially connected in the initial case string parallel-parallel map, may be used as the starting point, the case to be processed, which is finally connected in series in the initial case string parallel-parallel map, may be used as the end point, and the case element data of the case to be processed within the starting point and the end point may be further compared with the case element data of the case to be processed, which is linearly connected in series before the case to be processed. If the case element data of at least one case to be processed, which is linearly connected in series before the case to be processed, is the same as or similar to the case element data of the case to be processed, it can be determined that the at least one case to be processed, which is linearly connected in series before the case to be processed, has the same or similar case element data as the case to be processed, and an annular series connection line needs to be established between the case to be processed and the case to be processed.

For example, if a fourth to-be-processed case in the initial case serial-parallel map has the same or similar case element data as the to-be-processed case in the third linear serial map and has the same or similar case element data as the to-be-processed case in the second linear serial map, an annular serial connection line needs to be established between the fourth to-be-processed case in the fourth linear serial map and the third to-be-processed case in the third linear serial map, and an annular serial connection line needs to be established between the fourth to-be-processed case in the fourth linear serial map and the second to-be-processed case in the second linear serial map.

And S140, connecting different cases to be processed in the initial case serial-parallel map in series according to the annular serial connection line to obtain a target case serial-parallel map.

The target case string-parallel graph can be obtained by connecting different cases to be processed in the initial case string-parallel graph in series by using an annular series connection line, and the case string-parallel graph comprising at least one annular structure is obtained.

In the embodiment of the invention, the cases to be processed matched with the annular serial connection line can be determined firstly, and then different cases to be processed matched with the annular serial connection line are connected in series based on the annular serial connection line, namely, the cases to be processed which are not directly and linearly connected in series and have the same or similar case element data are connected by using the annular serial connection line, so that a case string parallel graph comprising at least one annular structure is obtained.

Example two

Fig. 2 is a flowchart of a case string parallel graph generation method according to a second embodiment of the present invention. The embodiment of the invention is embodied on the basis of the above embodiment, and in the embodiment of the invention, a specific optional implementation mode for determining at least one annular serial connection line in an initial case string parallel graph according to case element data is provided.

As shown in fig. 2, the method of the embodiment of the present invention specifically includes:

s210, case element data of a plurality of cases to be processed are obtained.

In an optional embodiment of the present invention, the obtaining of case element data of a plurality of cases to be processed may include: acquiring initial target attention data and attention data to be judged of a case to be processed; and determining data to be judged and extracted according to the data to be judged and concerned, and taking the initial target data to be concerned and the data to be judged and extracted as case element data.

The initial target attention data can be determined according to case information of a case to be processed, and data can be obtained without discriminant analysis. For example, the initial target attention data may include at least one of a phone number of the first type of person of interest, a bank card of the first type of person of interest, a social account number of the first type of person of interest, a phone number of the second type of person of interest, a web address associated with the first type of person of interest, an application associated with the first type of person of interest, and the like. The first type of interested person may be a person performing an illegal act, etc. The second type of attendees may be victims of illegal actions performed by the first type of attendees. The data of interest to be judged can be data related to the case to be processed, which is obtained by analyzing and judging part of data in the initial target data of interest. For example, the data to be researched may include a website associated with the first type of attention person, and/or an application associated with the first type of attention person, and the like. The extracted data to be judged can be partial data in the data concerned to be judged. For example, the extraction data to be judged can comprise a whois mailbox, a whois registrant, a whois registration telephone, an IP address and the like. The embodiment of the invention does not limit the specific data content of the initial target attention data, the data to be judged and concerned and the data to be judged and extracted.

In the embodiment of the invention, the case information and/or the brief case situation matched with the case to be processed can be firstly obtained, then the case information and/or the brief case situation matched with the case to be processed is subjected to data extraction processing to obtain initial target attention data, and further the data related to the internet in the initial target attention data is analyzed and judged to obtain the attention data to be judged. After the attention data to be judged is obtained, data extraction is carried out on the attention data to be judged to obtain extraction data to be judged, and then the initial target attention data and the extraction data to be judged are used as case element data.

Illustratively, five elements (initial target attention data) of a suspect phone, a suspect bank card, a suspect social account number, a victim phone, a suspect website/suspect APP can be extracted from the report information and the plan information of the novel illegal criminal case (case to be processed) of the telecommunication network, and then four elements (data to be extracted by study and judgment) of a whois mailbox, a whois registrar, a whois registry phone and an IP address are researched and extracted from the suspect website/suspect APP, so that 9 parallel elements of the novel illegal criminal case series and parallel of the telecommunication network are formed through two sources. Each novel network illegal criminal case is a map entity, and the extracted 9 large series-parallel elements are used as case series-parallel nodes for case series-parallel. When the novel illegal criminal cases of the telecommunication network are connected in series and in parallel, the series and parallel analysis is generally based on cases with 3 or more cases.

S220, carrying out linear series connection processing on a plurality of cases to be processed according to case element data to obtain initial case series-parallel maps in linear series connection.

Fig. 3 is a schematic diagram of an initial case string-parallel map provided by the second embodiment of the present invention, and as shown in fig. 3, there are now 4 cases to be treated which are A, B, C, D respectively. The suspect bank card of A and B is the same, then case A and case B are concatenated and succeeded, the suspect social account number of B and C is the same, B and C are concatenated and succeeded, C and D are the same, and C and D are concatenated and succeeded.

For example, if the serial-parallel elements in the initial case serial-parallel map are all IP addresses, it may be determined that one pit person crimes, which indicates that in each case to be processed, a criminal uses the same server to build different illegal websites or APPs to crime on the network, and may use the IP addresses as important clues to detect cases. If the serial-parallel elements in the initial case serial-parallel map are whois mailboxes, whois telephones, bank cards and the like, at least preliminarily judging that a black chain exists, the suspect may be a specially registered website or a purchased bank card to crime, preliminarily judging that the suspect is a convict, and analyzing and judging whether the suspect is a crime of the same pit person or not according to specific real names of related persons.

And S230, determining at least one annular serial connection line in the initial case serial-parallel map according to the case element data.

In an optional embodiment of the present invention, S230 may specifically include:

s231, determining the current annular end case in the initial case string parallel-connection map.

Wherein, the current ring-shaped end case can be a case to be processed which needs to be connected with another case to be processed in series through a ring-shaped serial connection line. The linear concatenation sequence of the current annular end case in the initial case serial-parallel map is later than that of another case to be processed connected by the same annular concatenation connection line.

In the embodiment of the present invention, any case to be processed whose linear concatenation processing order in the initial case string-parallel graph is greater than or equal to two may be used as the current ring-shaped end case.

S232, determining the current annular starting point case according to case element data of the current annular ending point case and the initial case string parallel map.

The current ring-shaped starting case can be a case to be processed connected with the current ring-shaped end case through a ring-shaped serial connection line.

In the embodiment of the present invention, after the current annular end case is determined, case element data of the current annular end case may be further obtained, and a case to be processed that is concatenated into the initial case string parallel-mapped prior to the current annular end case is determined, and further, the current annular start case is determined according to case element data of the case to be processed that is concatenated into the initial case string parallel-mapped prior to the current annular end case and case element data of the current annular end case.

In an alternative embodiment of the present invention, determining the current circular start case from the case element data of the current circular end case and the initial case string parallel-to-parallel map may include: determining a case to be traced in linear series connection before the current annular end point case according to the initial case series-parallel map and the current annular end point case; and determining at least one current annular starting point case according to the case element data for tracing the case to be processed and the case element data of the current annular end point case.

Wherein, the case to be processed is traced back, which is a case to be processed that is linearly connected in series into the parallel-connected pattern of the initial case before the current annular end case.

In the embodiment of the invention, after the current annular end point case is determined, the cases to be processed which are linearly connected in series before the current annular end point case in the initial case series-parallel map can be determined, the cases to be processed which are linearly connected in series before the current annular end point case are further taken as the cases to be traced back, the case element data tracing back each case to be processed in the cases to be processed are further obtained, the case element data tracing back each case to be processed in the cases to be processed are further compared with the case element data of the current annular end point case, and the cases to be processed which are traced back and have the case element data which are the same as or similar to the current annular end point case in the cases to be processed are taken as the current annular start point case.

For example, when three or more cases to be processed are in parallel, and the nth case to be processed is taken as the current circular end case, the case to be processed having the same parallel-serial elements as the nth case to be processed may be determined to be the current circular start case matched with the nth case to be processed by being in parallel with the 1 st, 2, 3, …, and N-2 th case to be processed.

And S233, determining a ring-shaped serial connection line according to the current ring-shaped end point case and the current ring-shaped start point case.

In the embodiment of the present invention, after the current ring-shaped end point case and the current ring-shaped start point case are determined, it may be determined that a ring-shaped serial connection line needs to be established between the current ring-shaped end point case and the current ring-shaped start point case, so as to connect the current ring-shaped end point case and the current ring-shaped start point case through the ring-shaped serial connection line.

In an alternative embodiment of the present invention, determining a ring-shaped concatenation connection line according to the current ring-shaped end case and the current ring-shaped start case may include: determining case element matching data according to case element data of the current annular end point case and case element data of the current annular starting point case; and determining the annular serial connection line for marking the case element matching data according to the case element matching data.

Wherein, the case element matching data may be the same or similar case element data in the current circular end case and the current circular start case.

In the embodiment of the present invention, the case element data of the current ring-shaped end point case and the case element data of the current ring-shaped start point case may be subjected to data matching processing, and then the same or similar data of the current ring-shaped end point case and the current ring-shaped start point case may be used as the case element matching data, so that the case element matching data may be identified on the ring-shaped serial connection line matched with the current ring-shaped end point case and the current ring-shaped start point case.

S240, different cases to be processed in the initial case string-parallel atlas are connected in series according to the annular serial connection line, and a target case string-parallel atlas is obtained.

Illustratively, the target case tandem-parallel pattern may include partial linear and partial circular, multiple non-intersecting circular, multiple intersecting circular, and large loop-containing annuli, among others.

Illustratively, when a first case to be processed and a second case to be processed are connected in series and in parallel, 9 large series-parallel elements of the two cases to be processed can be compared, if the same series-parallel elements appear, the series-parallel is successful, and further when the second case to be processed is connected in series and in parallel to a third case to be processed, the 9 large series-parallel elements of the third case to be processed need to be compared and analyzed with the 9 large series-parallel elements of the first case to be processed, if the series-parallel elements are the same, the series-parallel elements are described to be connected in a ring shape; if the serial-parallel elements are different, the third case to be processed continues to be connected in series with the fourth case to be processed, and the fraud-related elements of the fourth case to be processed need to be compared with the 9 large serial-parallel elements of the first case to be processed and the second case to be processed simultaneously to be connected in series and parallel, so as to determine whether the cases are strip-shaped or ring-shaped.

Fig. 4 is a schematic diagram of a string-parallel map of target cases with partial linear shapes and partial circular shapes according to the second embodiment of the present invention, as shown in fig. 4, there are now 4 cases to be processed, which are A, B, C, D respectively. And if the bank cards of the suspect persons A and B are the same, the case A and the case B are successfully connected in series and in parallel. And the suspects social account numbers of the B and the C are the same, and the B and the C are successfully connected in series and in parallel. The suspicion APP of C and D is the same, and C and D are in serial-parallel connection successfully. And the same serial-parallel elements do not exist between A and C, so that a circular serial connection line does not exist between A and C. D and a do not have the same serial-parallel element, so there is no circular serial connection line between D and a. And if the suspect bank cards of B and D are the same, the case B and the case D are successfully connected in series and parallel, and are connected through a ring-shaped series connection line. The serial-parallel elements may be identified on the connection line at the same time as the serial-parallel element.

The construction principle of the target case string parallel graph is the same, the construction process of the target case string parallel graph in different forms is not described any more, a plurality of non-crossed annular target case string parallel graphs can refer to fig. 5, a plurality of crossed annular target case string parallel graphs can refer to fig. 6, and a large ring containing small ring target case string parallel graph can refer to fig. 7.

In an optional embodiment of the present invention, the linear concatenation processing of the plurality of cases to be processed according to the case element data to obtain the initial case string-parallel map of the linear concatenation may include: when it is determined that the two cases to be processed do not have a series-parallel association relationship, performing linear series connection processing on the cases to be processed respectively once to obtain a series-parallel atlas of the cases to be collided; different cases to be processed in the initial case string-parallel atlas are connected in series according to the annular serial connection line, and the method also comprises the following steps of when the target case string-parallel atlas is obtained: determining a series-parallel association relation included in the case series-parallel map to be collided according to the case element data of the case series-parallel map to be collided; and when the serial-parallel association relation included in the case serial-parallel atlas to be collided is determined to be null, returning to execute the operation of respectively carrying out linear serial processing on the cases to be processed to obtain the case serial-parallel atlas to be collided until the number of linear serial processing reaches the threshold of the number of serial processing.

The serial-parallel association relationship can be used for representing that two cases to be processed can be subjected to serial processing, that is, when the two cases to be processed have the same or similar case element data, the two cases to be processed can be considered to have the serial-parallel association relationship. The case string-parallel atlas to be collided can be a case string-parallel atlas obtained by respectively carrying out linear series connection processing on two cases to be processed which do not have a string-parallel incidence relation. The threshold value of the number of the serial connection times can be preset, and the maximum number of the cases to be processed is linearly connected in series with each initial case string parallel map in the case string parallel map to be collided.

In the embodiment of the invention, when the two cases to be processed do not have the same or similar case element data, the two cases to be processed without the same or similar case element data can be respectively subjected to linear series connection processing once to obtain two initial case string parallel maps, the obtained two initial case string parallel maps are used as case string parallel maps to be collided, and then the string parallel association relationship of the cases to be processed in the two initial case string parallel maps is determined according to the case element data of the cases to be processed in the two initial case string parallel maps included in the case string parallel maps to be collided. And if the serial-parallel association relationship does not exist in the cases to be processed in the two initial case serial-parallel maps, namely the serial-parallel association relationship included in the case serial-parallel map to be collided is empty, respectively performing linear serial connection processing on the cases to be processed in the two initial case serial-parallel maps once again, updating the case serial-parallel maps to be collided until the number of linear serial connection processing reaches the threshold value of the number of serial connection processing, and not performing linear serial connection processing on the cases to be processed any more. And if the cases to be processed in the two initial case string-parallel maps have a string-parallel incidence relation, namely the case string-parallel incidence relation included in the case string-parallel map to be collided is not empty, the cases to be processed in the two initial case string-parallel maps with the same or similar case elements are connected in series by using the line segments.

Illustratively, case collision can be carried out on cases A and B to be processed to determine whether the cases A and B are the same group, if the cases A and B have no direct relation according to 8 serial-parallel elements (suspect phone, suspect bank card, suspect social account number, victim phone, suspect APP, whois mailbox, whois registrar and whois registration phone), two-layer case serial-parallel operation is continued according to respective case serial-parallel dimensions, if two-layer case serial-parallel relation is not carried out, case serial-parallel operation is carried out again, and if the automatic serial-parallel depth is 6 layers (serial-parallel times threshold), if two cases can not be carried out continuously, the two cases have no direct serial-parallel relation. If the parallel-serial elements of cases in parallel connection with one another in a certain layer of A or B are the same, the fact that the A and B have the related relation is shown, all case elements passing through can be collected to conduct investigation and analysis, and if the fact that the E (cases in parallel-serial connection with the A in the 3 rd layer) and the F (cases in parallel-serial connection with the B in the 3 rd layer) are determined to have the same parallel-serial elements in parallel depth when the A and B cases collide with each other, the parallel-serial map of the collision case strings shown in the figure 8 can be obtained. And automatically carrying out serial-parallel operation in the case serial-parallel atlas to be collided, wherein the number of the cases cannot exceed 6 layers at most, and if the parallel operation depth of the cases reaches 6 layers but the deep serial-parallel operation needs to be carried out again, clicking the corresponding case to be processed in a manual mode to carry out serial-parallel operation again to obtain information.

In an optional embodiment of the present invention, after concatenating different cases to be processed in the initial case string parallel-parallel map according to the circular concatenation connection line to obtain the target case string parallel-parallel map, the method may further include: acquiring a current annular atlas in a target case serial-parallel atlas, and acquiring case element data matched with an annular serial connection line of the current annular atlas; when the fact that the serial case element data of the current annular map are unique is determined, determining that a first target attention behavior exists in the case to be processed in the current annular map; when determining that the first case element data of the serial case element data of the current annular map is matched with the second case element data, determining that the case to be processed in the current annular map has a second target attention behavior.

Wherein, the current ring-shaped pattern can be a ring-shaped pattern consisting of at least three cases to be treated and connecting lines among the cases to be treated. The serial case element data can be case element data which can enable the cases to be processed to be connected in series in the current ring-shaped graph. The first target act of interest may be a criminal act determined from the current ring map. The first case element data may be part of the initial target interest data of the current endless end case that matches the endless serial link. The second case element data may be partial data in the initial target attention data of the current loop start case matched with the loop concatenation line. The first case element data and the second case element data are of the same data type. The second target attention behavior may be a criminal behavior different from the first target attention behavior determined from the first case element data and the second case element data. Illustratively, the second target attention behavior may be a conviction behavior.

In the embodiment of the invention, the annular atlas in the target case serial-parallel atlas can be selected as the current annular atlas, and then the case element data of the case to be processed, which is matched with the annular serial-connection connecting line of the current annular atlas, can be obtained. When the serial case element data of each case to be processed in the current annular map are unique, that is, the case element data of each case to be processed having the serial-parallel association relation are the same, it can be determined that the case to be processed in the current annular map has the first target attention behavior. Analyzing the serial case element data of the current annular map, determining whether the first case element data and the second case element data in each case to be processed are the same, if the first case element data and the second case element data in at least one case to be processed are the same, indicating that the first case element data and the second case element data of the serial case element data of the current annular map are matched, and further determining that the case to be processed in the current annular map has a second target attention behavior.

For example, if the serial-parallel elements of the ring map are different, all the serial-parallel elements of the ring map may be integrated as a thread element of one nest point, and a thread for case investigation is added, so that the IP addresses extracted from all the related cases may be used as a first investigation element, which indicates that different servers are applied to deploy illegal websites, APPs, and the like in the same nest point. If the number of the victim is the same as the payee account number of the suspect, the fact that the victim has the possible action of conviction help is shown. If the suspect collection account number cannot correspond to the suspect real name system, the suspect collection account number is an intermediate account number, and the account number is suspected to be convicted. If the whois mailbox, whois registrant or whois registration telephone of the ring-shaped map are the same, the credit-helping behavior of the website or the APP registrant can be preferentially determined.

According to the technical scheme of the embodiment, the case element data of a plurality of cases to be processed are obtained, then the plurality of cases to be processed are subjected to linear series connection processing according to the case element data, initial case series-parallel maps which are in linear series connection are obtained, the current annular end point case in the initial case series-parallel maps is further determined, the current annular starting point case is determined according to the case element data of the current annular end point case and the initial case series-parallel maps, the annular series connection line is determined according to the current annular end point case and the current annular starting point case, then different cases to be processed in the initial case series-parallel maps are connected in series according to the annular series connection line, and the target case series-parallel maps are obtained. The scheme can carry out linear series connection processing on a plurality of cases to be processed according to case element data, automatically generate an initial case series-parallel map, the initial case string parallel atlas can be further processed based on case element data without manual drawing, so as to connect the different cases to be processed in the initial case serial-parallel map in series through the annular serial connection line, and the ring-shaped serial connection line is connected with the current ring-shaped end case and the current ring-shaped end case, a ring-shaped structure other than the linear serial connection structure can be formed, the parallel relation of the case strings is shown by rich parallel atlas of the target case strings, the problem that the drawing efficiency of the traditional parallel atlas of the case strings is lower is solved, and the problem that the case series-parallel relation cannot be found timely and effectively can be solved, the case series-parallel atlas generation efficiency can be improved, the case series-parallel relation can be found timely, and therefore illegal behaviors can be analyzed accurately and effectively.

It should be noted that any permutation and combination between the technical features in the above embodiments also belong to the scope of the present invention.

EXAMPLE III

Fig. 9 is a schematic diagram of an apparatus for generating a case string-parallel graph according to a third embodiment of the present invention, as shown in fig. 9, the apparatus includes: a case element acquisition module 310, an initial case string parallel-graph generation module 320, a circular connecting line determination module 330 and a target case string parallel-graph generation module 340, wherein:

a case element obtaining module 310, configured to obtain case element data of a plurality of cases to be processed;

the initial case string-parallel map generation module 320 is configured to perform linear concatenation processing on a plurality of cases to be processed according to case element data to obtain a linear-concatenated initial case string-parallel map;

a circular connecting line determining module 330, configured to determine at least one circular connecting line in the initial case string parallel-to-parallel map according to the case element data;

and the target case string-parallel map generating module 340 is configured to serially connect different cases to be processed in the initial case string-parallel map according to the annular serial connection line, so as to obtain a target case string-parallel map.

Optionally, the case element obtaining module 310 is specifically configured to obtain initial target attention data and attention data to be researched of the case to be processed; and determining data to be judged and extracted according to the data to be judged and concerned, and taking the initial target data to be concerned and the data to be judged and extracted as case element data.

Optionally, the circular connecting line determining module 330 is specifically configured to determine a current circular end case in the initial case string parallel map; determining a current annular starting point case according to case element data of the current annular end point case and the initial case string parallel map; and determining the annular serial connection line according to the current annular end point case and the current annular start point case.

Optionally, the circular connecting line determining module 330 is specifically configured to determine, according to the initial case string-parallel map and the current circular end case, a case to be traced back that is linearly connected in series before the current circular end case; and determining at least one current annular starting point case according to the case element data for tracing the case to be processed and the case element data of the current annular end point case.

Optionally, the circular connecting line determining module 330 is specifically configured to determine case element matching data according to the case element data of the current circular end point case and the case element data of the current circular start point case; and determining a circular serial connection line for marking the case element matching data according to the case element matching data.

Optionally, the initial case string-parallel map generating module 320 is specifically configured to, when it is determined that there is no string-parallel association relationship between two cases to be processed, perform linear series processing on the cases to be processed respectively once to obtain a case string-parallel map to be collided.

Optionally, the case string-parallel atlas generating device further includes a case collision module, configured to determine, according to the case element data of the case string-parallel atlas to be collided, a string-parallel association relation included in the case string-parallel atlas to be collided; and when the serial-parallel association relation included in the case serial-parallel atlas to be collided is determined to be null, returning to execute the linear serial processing of the cases to be processed respectively once to obtain the operation of the case serial-parallel atlas to be collided until the number of the linear serial processing reaches the threshold of the number of the serial processing.

Optionally, the case string-parallel map generation device further includes a behavior determination module, configured to obtain a current ring-shaped map in the target case string-parallel map, and obtain case element data matched with a ring-shaped serial connection line of the current ring-shaped map;

when determining that the serial case element data of the current annular map is unique, determining that a case to be processed in the current annular map has a first target attention behavior; and when determining that the first case element data of the serial case element data of the current annular map is matched with the second case element data, determining that the case to be processed in the current annular map has a second target attention behavior.

The case string parallel graph generation device can execute the case string parallel graph generation method provided by any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method. For details of the case string-parallel graph generation method provided in any embodiment of the present invention, reference may be made to the technical details not described in detail in this embodiment.

Since the case string parallel-graph generation device described above is a device that can execute the case string parallel-graph generation method in the embodiment of the present invention, based on the case string parallel-graph generation method described in the embodiment of the present invention, a person skilled in the art can understand the specific implementation of the case string parallel-graph generation device in the embodiment and various variations thereof, and therefore, how the case string parallel-graph generation device implements the case string parallel-graph generation method in the embodiment of the present invention is not described in detail herein. The device used by those skilled in the art to implement the method for generating a case serial-parallel map in the embodiment of the present invention is within the scope of the present application.

Example four

Fig. 10 is a schematic structural diagram of an electronic device according to a fourth embodiment of the present invention. FIG. 10 illustrates a block diagram of an electronic device 412 that is suitable for use in implementing embodiments of the present invention. The electronic device 412 shown in fig. 10 is only an example and should not bring any limitations to the function and scope of use of the embodiments of the present invention.

As shown in fig. 10, the electronic device 412 is in the form of a general purpose computing device. The components of the electronic device 412 may include, but are not limited to: one or more processors 416, a storage device 428, and a bus 418 that couples the various system components including the storage device 428 and the processors 416.

Bus 418 represents one or more of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example, such architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

Electronic device 412 typically includes a variety of computer system readable media. Such media may be any available media that is accessible by electronic device 412 and includes both volatile and nonvolatile media, removable and non-removable media.

Storage 428 may include computer system readable media in the form of volatile Memory, such as RAM (Random Access Memory) 430 and/or cache Memory 432. The electronic device 412 may further include other removable/non-removable, volatile/nonvolatile computer system storage media. By way of example only, storage system 434 may be used to read from and write to non-removable, nonvolatile magnetic media (not shown in FIG. 10, commonly referred to as a "hard drive"). Although not shown in FIG. 10, a magnetic disk drive for reading from and writing to a removable, nonvolatile magnetic disk (e.g., a "floppy disk") and an optical disk drive for reading from or writing to a removable, nonvolatile optical disk (e.g., a Compact disk-Read Only Memory (CD-ROM), a Digital Video disk (DVD-ROM), or other optical media) may be provided. In these cases, each drive may be connected to bus 418 by one or more data media interfaces. Storage 428 may include at least one program product having a set (e.g., at least one) of program modules that are configured to carry out the functions of embodiments of the invention.

Program 436 having a set (at least one) of program modules 426 may be stored, for example, in storage 428, such program modules 426 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination of which may comprise an implementation of a network environment. Program modules 426 generally perform the functions and/or methodologies of embodiments of the invention as described herein.

The electronic device 412 may also communicate with one or more external devices 414 (e.g., keyboard, pointing device, camera, display 424, etc.), with one or more devices that enable a user to interact with the electronic device 412, and/or with any devices (e.g., network card, modem, etc.) that enable the electronic device 412 to communicate with one or more other computing devices. Such communication may occur via I/O interface 422. Also, the electronic device 412 may communicate with one or more networks (e.g., a Local Area Network (LAN), Wide Area Network (WAN), etc.) and/or a public Network, such as the internet, via the Network adapter 420. As shown, network adapter 420 communicates with the other modules of electronic device 412 over bus 418. It should be appreciated that although not shown in the figures, other hardware and/or software modules may be used in conjunction with the electronic device 412, including but not limited to: microcode, device drivers, Redundant processing units, external disk drive Arrays, disk array (RAID) systems, tape drives, and data backup storage systems, to name a few.

The processor 416 executes various functional applications and data processing by running programs stored in the storage device 428, for example, implementing the case string parallel graph generation method provided by the above-described embodiment of the present invention: acquiring case element data of a plurality of cases to be processed; carrying out linear serial connection processing on a plurality of cases to be processed according to case element data to obtain initial case serial-parallel maps which are linearly connected in series; determining at least one annular serial connection line in the initial case serial-parallel map according to case element data; and connecting different cases to be processed in the initial case string parallel-connection map in series according to the annular serial-connection connecting line to obtain a target case string parallel-connection map.

EXAMPLE five

An embodiment five of the present invention further provides a computer storage medium storing a computer program, where the computer program is used to execute the case parallel-serial map generation method according to any one of the above embodiments of the present invention when executed by a computer processor: acquiring case element data of a plurality of cases to be processed; carrying out linear serial connection processing on a plurality of cases to be processed according to case element data to obtain initial case serial-parallel maps which are linearly connected in series; determining at least one annular serial connection line in the initial case serial-parallel map according to case element data; and connecting different cases to be processed in the initial case string parallel-connection map in series according to the annular serial-connection connecting line to obtain a target case string parallel-connection map.

Computer storage media for embodiments of the invention may employ any combination of one or more computer-readable media. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a Read-Only Memory (ROM), an Erasable Programmable Read-Only Memory (EPROM) or flash Memory), an optical fiber, a portable compact disc Read-Only Memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.

A computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, Radio Frequency (RF), etc., or any suitable combination of the foregoing.

Computer program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C + + or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet service provider).

It is to be noted that the foregoing is only illustrative of the preferred embodiments of the present invention and the technical principles employed. It will be understood by those skilled in the art that the present invention is not limited to the particular embodiments described herein, but is capable of various obvious changes, rearrangements and substitutions as will now become apparent to those skilled in the art without departing from the scope of the invention. Therefore, although the present invention has been described in greater detail by the above embodiments, the present invention is not limited to the above embodiments, and may include other equivalent embodiments without departing from the spirit of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A case serial-parallel map generation method is characterized by comprising the following steps:

acquiring case element data of a plurality of cases to be processed;

carrying out linear series connection processing on a plurality of cases to be processed according to the case element data to obtain initial case series-parallel maps which are linearly connected in series;

determining at least one annular serial connection line in the initial case serial-parallel map according to the case element data;

and connecting different cases to be processed in the initial case serial-parallel map in series according to the annular serial connection connecting line to obtain a target case serial-parallel map.

2. The method according to claim 1, wherein said obtaining case element data of a plurality of cases to be processed comprises:

acquiring initial target attention data and to-be-judged attention data of the case to be processed;

and determining data to be judged and extracted according to the data to be judged and concerned, and taking the initial target data to be concerned and the data to be judged and extracted as case element data.

3. The method according to claim 1, wherein said determining at least one circumferential concatenation connection in said initial case string-parallel graph from said case element data comprises:

determining a current annular end point case in the initial case string parallel map;

determining a current annular starting point case according to case element data of the current annular end point case and the initial case string parallel map;

and determining the annular serial connection line according to the current annular end point case and the current annular start point case.

4. The method according to claim 3, wherein said determining a current circular start case from case element data of said current circular end case and said initial case string-parallel map comprises:

determining a case to be traced back which is linearly connected in series before the current annular end point case according to the initial case series-parallel map and the current annular end point case;

and determining at least one current annular starting point case according to the case element data for tracing the case to be processed and the case element data of the current annular end point case.

5. The method of claim 3, wherein said determining the circular concatenation connection line according to the current circular end case and the current circular start case comprises:

determining case element matching data according to the case element data of the current annular end point case and the case element data of the current annular starting point case;

and determining a circular serial connection line for marking the case element matching data according to the case element matching data.

6. The method according to claim 1, wherein said linear concatenation processing of a plurality of cases to be processed according to said case element data to obtain an initial case serial-parallel map of linear concatenation, comprises:

when it is determined that the two cases to be processed do not have a series-parallel association relationship, performing linear series connection processing on the cases to be processed respectively once to obtain a series-parallel atlas of the cases to be collided;

the method for serially connecting the different cases to be processed in the initial case serial-parallel map according to the annular serial connection connecting line to obtain a target case serial-parallel map further comprises the following steps:

determining a serial-parallel association relation included in the case string-parallel map to be collided according to the case element data of the case string-parallel map to be collided;

and when the serial-parallel association relation included in the case serial-parallel atlas to be collided is determined to be null, returning to execute the linear serial processing of the cases to be processed respectively once to obtain the operation of the case serial-parallel atlas to be collided until the number of the linear serial processing reaches the threshold of the number of the serial processing.

7. The method according to claim 1, wherein after said concatenating different cases to be processed in said initial case string parallel-parallel pattern according to said circular concatenation connection line to obtain a target case string parallel-parallel pattern, further comprising:

acquiring a current annular atlas in the target case serial-parallel atlas, and acquiring case element data matched with an annular serial connection line of the current annular atlas;

when determining that the serial case element data of the current annular map is unique, determining that a case to be processed in the current annular map has a first target attention behavior;

and when determining that the first case element data of the serial case element data of the current annular map is matched with the second case element data, determining that the case to be processed in the current annular map has a second target attention behavior.

8. A case serial-parallel map generation device is characterized by comprising:

the initial case string-parallel map generation module is used for performing linear serial connection processing on a plurality of cases to be processed according to the case element data to obtain initial case string-parallel maps which are linearly connected in series;

the annular connecting line determining module is used for determining at least one annular connecting line in the initial case serial-parallel map according to the case element data;

and the target case series-parallel map generation module is used for serially connecting different cases to be processed in the initial case series-parallel map according to the annular series connection line to obtain a target case series-parallel map.

9. An electronic device, characterized in that the electronic device comprises:

one or more processors;

storage means for storing one or more programs;

when executed by the one or more processors, cause the one or more processors to implement a method of case string parallel graph generation as claimed in any one of claims 1-7.

10. A computer storage medium having stored thereon a computer program, characterized in that the program, when executed by a processor, implements the case string parallel graph generation method according to any one of claims 1 to 7.