A method and device for identifying abnormal accounts

Abstract

The present application is applicable to the field of artificial intelligence technology, and provides a method and device for identifying abnormal accounts, the identification method comprising: obtaining account information of an account to be tested; the account information includes characteristic parameters of the account to be tested in multiple preset account dimensions; selecting a pre-selected account from all the accounts to be tested according to the characteristic parameters; importing the account information of each of the pre-selected accounts into a first model, and outputting a first abnormal indicator of the pre-selected account with respect to all the characteristic parameters; importing the account information of each of the pre-selected accounts into a second model, and outputting a second abnormal indicator of the pre-selected account; determining the abnormal score of the pre-selected account based on the first abnormal indicator and the second abnormal indicator; and identifying abnormal accounts from all the pre-selected accounts based on the abnormal scores of each of the pre-selected accounts. The identification method provided by the present application can take into account both recognition accuracy and recognition efficiency in abnormal account identification.

Description

Technical Field

[0001] The present application belongs to the field of data processing technology, and in particular, relates to a method and device for identifying abnormal accounts. Background Art

[0002] With the development of the times, a large number of accounts have been registered on many platforms, and more and more users are using these accounts to conduct various activities on the Internet. However, there are criminals who use some accounts to conduct illegal activities. It is necessary to take effective measures to identify the abnormal accounts used by these criminals to conduct illegal activities among the large number of accounts, so as to purify the environment of the platforms where these accounts are located.

[0003] Currently, these abnormal accounts can only be identified manually. This method is time-consuming and labor-intensive, overly dependent on manual subjectivity, and cannot meet the actual needs of identifying abnormal accounts among a large number of accounts. Summary of the invention

[0004] The embodiments of the present application provide a method and device for identifying abnormal accounts, which jointly identify abnormal accounts based on a model obtained by supervised training and a model obtained by unsupervised training. New types of abnormal accounts that may appear in the future can be identified, while ensuring recognition accuracy and improving recognition efficiency, thereby solving the problems of low efficiency and high cost in identifying abnormal accounts in the prior art.

[0005] In a first aspect, an embodiment of the present application provides a method for identifying abnormal accounts, comprising: obtaining account information of an account to be tested; the account information includes characteristic parameters of the account to be tested in multiple preset account dimensions; selecting a pre-selected account from all the accounts to be tested based on the characteristic parameters; importing the account information of each of the pre-selected accounts into a first model, and outputting a first abnormality indicator of the pre-selected account with respect to all the characteristic parameters; the first model is obtained by performing unsupervised deep learning on the characteristic parameters of all the accounts to be tested; importing the account information of each of the pre-selected accounts into a second model, and outputting a second abnormality indicator of the pre-selected account; the second model is obtained by training a preset neural network with training information of multiple training accounts; determining the abnormality score of the pre-selected account based on the first abnormality indicator and the second abnormality indicator; and identifying abnormal accounts from all the pre-selected accounts based on the abnormality score of each of the pre-selected accounts.

[0006] In a possible implementation of the first aspect, after determining the abnormality scores of the pre-selected accounts, the pre-selected accounts are sorted in descending order based on the sizes of the abnormality scores of the pre-selected accounts to obtain an abnormal account priority table, the pre-selected accounts are manually verified according to the sorting of the abnormality priority table, and abnormal accounts are identified from the abnormal account priority table based on the results of the manual verification.

[0007] Exemplarily, the above-mentioned abnormality score refers to the probability score that the pre-selected account is an abnormal account. Whether the pre-selected account is an abnormal account can be directly identified based on the abnormality score, or it can be further determined by manual verification.

[0008] It should be understood that even through manual verification, whether each pre-selected account is an abnormal account is confirmed based on the order of the abnormal account priority table. Although some recognition efficiency is sacrificed to ensure recognition accuracy, compared with the existing technology, it can also reduce the workload of identifying abnormal accounts and improve the recognition hit rate of abnormal accounts during manual verification.

[0009] In a second aspect, an embodiment of the present application provides a device, including: a module for acquiring an account to be tested, for acquiring account information of an account to be tested; the account information includes characteristic parameters of the account to be tested in multiple preset account dimensions; a pre-selected account selection module, for selecting a pre-selected account from all the accounts to be tested according to the characteristic parameters; a first abnormal module, for importing the account information of each of the pre-selected accounts into a first model, and outputting a first abnormal indicator of the pre-selected account with respect to all the characteristic parameters; the first model is obtained by performing unsupervised deep learning on the characteristic parameters of all the accounts to be tested; a second abnormal module, for importing the account information of each of the pre-selected accounts into a second model, and outputting a second abnormal indicator of the pre-selected account; the second model is obtained by training a preset neural network with training information of multiple training accounts; an abnormal score calculation module, for determining the abnormal score of the pre-selected account based on the first abnormal indicator and the second abnormal indicator; an abnormal account identification module, for identifying abnormal accounts from all the pre-selected accounts based on the abnormal scores of each of the pre-selected accounts.

[0010] In a third aspect, an embodiment of the present application provides a terminal device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the identification method described in any one of the first aspects above when executing the computer program.

[0011] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, including: the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it implements the identification method described in any one of the first aspects above.

[0012] In a fifth aspect, an embodiment of the present application provides a computer program product, which, when executed on a terminal device, enables the terminal device to execute any one of the identification methods described in the first aspect above.

[0013] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here.

[0014] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0015] Compared with the existing technology, the first model obtained based on unsupervised training can identify abnormal accounts that are obviously different from most other normal accounts. The second model obtained based on supervised training can improve the recognition efficiency when identifying abnormal accounts. Identifying abnormal accounts together according to the first model and the second model can improve the recognition accuracy and solve the problems of low efficiency and high cost in identifying abnormal accounts in the existing technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1 is a flowchart of the implementation of the identification method provided in the first embodiment of the present application;

[0018] Figure 2 This is a schematic diagram of an application scenario of the identification method provided by an embodiment of the present application;

[0019] Figure 3 is a flowchart of the implementation of the identification method provided in the second embodiment of the present application;

[0020] Figure 4 is a flowchart of the implementation of the identification method provided in the third embodiment of the present application;

[0021] Figure 5 is a flowchart of the implementation of the identification method provided in the fourth embodiment of the present application;

[0022] Figure 6 is a schematic diagram of the first model structure provided in the fourth embodiment of the present application;

[0023] Figure 7 is a flowchart of an implementation of the identification method provided in the fifth embodiment of the present application;

[0024] Figure 8 This is a schematic diagram of a second model structure provided by another embodiment of the present application

[0025] Fig. 9 is a schematic diagram of the structure of the device provided in the embodiment of the present application;

[0026] Fig.10 It is a schematic diagram of the structure of the terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0028] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0029] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0030] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to identifying", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is identified" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is identified" or "in response to identifying [described condition or event]", depending on the context.

[0031] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0032] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0033] In the embodiment of the present application, the execution subject of the process is a terminal device, which includes but is not limited to: a server, a computer, a smart phone, a tablet computer, and other devices that can execute the abnormal account identification method provided in the present application. Figure 1 The following is a flowchart of the implementation of the identification method provided in the first embodiment of the present application, which is described in detail as follows:

[0034] In S101, the account information of the account to be tested is obtained.

[0035] In this embodiment, the account information includes characteristic parameters of the account to be tested in multiple preset account dimensions. For example, the account to be tested is a virtual bank account number, and the multiple preset account dimensions include account dimensions such as balance, number of transfers, total transfer amount, and average transfer amount. The account information also includes a unique identification parameter. For example, the unique identification parameter is composed of one or more combinations of parameters such as the account name, user name, and ID number of the account to be tested. For example, in addition to the unique identification parameter, the account information also includes candidate parameters, which include the above-mentioned characteristic parameters and other parameters.

[0036] It should be understood that the characteristic parameter can be preset and specified in the candidate parameters, or selected from the candidate parameters based on other methods (refer to the detailed description in the third embodiment below). Exemplarily, the variance of all the candidate parameters of the account to be tested is calculated, and the first R candidate parameters in the candidate parameter list generated by sorting the variances of each candidate parameter in descending order are selected as the characteristic parameter, where R is the number of characteristics.

[0037] In this embodiment, illustratively, the account information of the account to be tested may be directly obtained from the database, or the account information of the account to be tested collected by other terminal devices may be received.

[0038] In S102, a pre-selected account is selected from all the accounts to be tested according to the characteristic parameters.

[0039] In this embodiment, exemplarily, a threshold is preset for each characteristic parameter, and a pre-selected account is selected from all the accounts to be tested according to the preset threshold. The selection method may be: the pre-selected account has a characteristic parameter greater than the corresponding preset threshold, and the preset threshold is obtained based on the account information marked as a normal account. Exemplarily, a pre-selected ratio is preset for all the accounts to be tested, and the pre-selected number is determined based on the pre-selected ratio and the number of all accounts to be tested; the values ​​of each characteristic parameter are arranged in descending order to obtain multiple account queues corresponding to each characteristic parameter; the first X accounts to be tested in each account queue are selected as the pre-selected accounts; the value of X is the pre-selected number.

[0040] In S103, the account information of each of the pre-selected accounts is imported into the first model, and the first abnormality index of the pre-selected account with respect to all the characteristic parameters is output.

[0041] In this embodiment, the first model is obtained by performing unsupervised deep learning on the characteristic parameters of all the accounts to be tested.

[0042] Preferably, all the accounts to be tested are subjected to unsupervised clustering with each characteristic parameter as the attribute dimension, and the characteristic parameters of all the accounts to be tested are subjected to cluster analysis to obtain clustering results about the characteristic parameters. Based on the clustering results, the majority cluster centroid and minority cluster centroid corresponding to each characteristic parameter can be determined. The majority cluster centroid refers to the mass center (i.e., the point corresponding to the average value) of the cluster where the majority of the accounts to be tested are clustered after unsupervised cluster analysis (unsupervised cluster analysis in one-dimensional space) with the characteristic parameter as the attribute dimension is performed. The heterogeneous scores corresponding to the various characteristic parameters of the pre-selected account are obtained based on the differences between the various characteristic parameters of the pre-selected account and the majority cluster centroid corresponding to the various characteristic parameters, and the first abnormal indicator of the pre-selected account is determined based on the heterogeneous scores corresponding to all the characteristic parameters of the pre-selected account.

[0043] Exemplarily, the difference between each characteristic parameter of the pre-selected account and the centroid of the majority clusters corresponding to each characteristic parameter is normalized to obtain the heterogeneous score corresponding to each characteristic parameter of the pre-selected account, and the weighted average of the heterogeneous scores corresponding to all characteristic parameters of the pre-selected account is performed to obtain the first abnormal indicator of the pre-selected account.

[0044] It should be understood that the first abnormality indicator in this embodiment represents the degree of difference between the pre-selected account and most other accounts to be tested in various characteristic parameters, that is, the degree of outlier of the pre-selected account among all the accounts to be tested. The first abnormality indicator is used as an indicator to identify whether the pre-selected account is an abnormal account, which is based on the premise that most accounts to be tested are non-abnormal accounts. Therefore, the centroid of the majority cluster is selected as the calculation reference point for the above-mentioned heterogeneous score. If the value of the characteristic parameter is larger, the pre-selected account is more likely to be an abnormal account. Then, the centroid of the two clusters where the accounts to be tested are clustered (i.e., the point corresponding to the average value) with a smaller median value can be selected as the calculation reference point for the above-mentioned heterogeneous score after unsupervised clustering is performed with the characteristic parameter as the attribute value.

[0045] In another implementation of this embodiment, illustratively, a multidimensional space is established with each characteristic parameter as a dimension, all the accounts to be tested are mapped to corresponding points in the multidimensional space, and an optimal hypersphere is set so that the ratio of the volume of the optimal hypersphere to the number of the corresponding points contained in the optimal hypersphere is the smallest among all hyperspheres containing the corresponding points. The center of the optimal hypersphere is used as a calculation reference point, and the distance between the corresponding point mapped to the multidimensional space by the pre-selected account and the center is calculated, and the ratio of the distance to the radius of the optimal hypersphere is used as the first abnormality indicator.

[0046] In S104, the account information of each of the pre-selected accounts is imported into the second model, and the second abnormality indicator of the pre-selected account is output.

[0047] In this embodiment, the second model is obtained by training a preset neural network through the training information of multiple training accounts. The multiple training accounts include abnormal accounts that have been identified as abnormal and normal accounts that have been identified as non-abnormal. The training information includes an abnormal label, which is used to mark whether the training account is an abnormal account that has been identified as abnormal or a normal account that has been identified as non-abnormal. Exemplarily, the training account with a value of 1 for the abnormal label is an abnormal account that has been identified as abnormal, and the training account with a value of 0 for the abnormal label is a normal account that has been identified as non-abnormal. That is to say, according to the training information of the multiple training accounts containing the abnormal label, the preset neural network is trained with a supervised deep learning algorithm. Exemplarily, the preset neural network is a feedforward fully connected neural network, including L hidden layers, where L is the number of hidden layers of the preset neural network, and optionally, the value of L is 1. The second abnormality index refers to the similarity between the pre-selected account and the abnormal account that has been identified as abnormal and marked by the abnormal label, and the value of the second abnormality index is a floating point number. In the above training process, the model parameters of the second model are adjusted by setting loss regression so that the value of the second abnormality indicator output by the second model is close to the value of the abnormality label of the pre-selected account.

[0048] In S105, based on the first abnormality indicator and the second abnormality indicator, the abnormality score of the pre-selected account is determined.

[0049] In this embodiment, a first weight is configured for the first abnormal indicator, and a second weight is configured for the second abnormal indicator. According to the value of the first abnormal indicator and the corresponding first weight, and the value of the second abnormal indicator and the corresponding second weight, the abnormal score of the pre-selected account is calculated. Exemplarily, the product of the value of the first abnormal indicator and the corresponding first weight and the product of the value of the second abnormal indicator and the corresponding second weight are summed to obtain the abnormal score of the pre-selected account. Exemplarily, the first abnormal indicator and the second abnormal indicator are weighted and summed to obtain the abnormal score of the pre-selected account.

[0050] It should be understood that the above-mentioned abnormality score refers to the probability score that the pre-selected account is an abnormal account. Subsequently, whether the pre-selected account is an abnormal account can be directly identified based on the abnormality score, or it can be further determined by manual verification.

[0051] In S106 , based on the abnormal scores of the pre-selected accounts, abnormal accounts are identified from all the pre-selected accounts.

[0052] In this embodiment, the abnormal account is identified according to the abnormal score. Exemplarily, an abnormal threshold is preset, and all the pre-selected accounts whose abnormal scores are greater than or equal to the abnormal threshold are identified as abnormal accounts.

[0053] Exemplarily, based on the size of the abnormal scores of the pre-selected accounts, all the pre-selected accounts are sorted in descending order to obtain an abnormal account priority table; the number of abnormal users is determined based on the number of pre-selected accounts and a preset abnormal ratio; the first N pre-selected accounts are selected from the abnormal account priority table as the abnormal accounts; the value of N is the number of abnormal users.

[0054] Exemplarily, based on the size of the abnormal scores of the pre-selected accounts, all the pre-selected accounts are sorted in descending order to obtain an abnormal account priority table; the pre-selected accounts are manually verified according to the sorting of the abnormal priority table, and abnormal accounts are identified from the abnormal account priority table based on the results of the manual verification.

[0055] It should be understood that even through manual verification, whether each pre-selected account is an abnormal account is confirmed based on the order of the abnormal account priority table. Although some recognition efficiency is sacrificed to ensure recognition accuracy, compared with the existing technology, it can also reduce the workload of identifying abnormal accounts and improve the recognition hit rate of abnormal accounts during manual verification.

[0056] In this embodiment, the first model obtained based on unsupervised training can identify abnormal accounts that are obviously different from most other normal accounts. The second model obtained based on supervised training can improve the recognition efficiency when identifying abnormal accounts. The abnormal accounts are jointly identified according to the above-mentioned first model and the second model, which can improve the recognition accuracy and solve the problems of low efficiency and high cost in identifying abnormal accounts in the prior art.

[0057] Figure 2 A schematic diagram of an application scenario of the identification method provided by an embodiment of the present application is shown, and the details are as follows:

[0058] There is an abnormal account that sends a large number of data requests to the server, that is, it uses all the functions assigned to a single ordinary account by the server as much as possible at the same time, and tries to launch a DOS attack on the server, attempting to stop the server from providing normal services. The account information of the account to be tested is obtained from the server, and the abnormal account is identified based on the identification method provided in this application, and an identification result is generated to facilitate the subsequent server administrator to handle the account identified as an abnormal account. When the above-mentioned abnormal user launches a DOS attack, the above-mentioned request to initiate the attack has the same behavioral commonality, and the above-mentioned behavioral commonality is different from the behavioral characteristics when the normal account initiates the request operation. Therefore, the first abnormal indicator between the behavioral characteristics of most users can be identified through the first model, and the second abnormal indicator used to characterize the similarity between the identified abnormal behavior and the second model can also be calculated. The abnormal account with abnormal behavior is identified based on the above two abnormal indicators.

[0059] For example, there is an abnormal account in the securities market. These abnormal accounts are used to carry out illegal fund allocation activities. When carrying out illegal fund allocation activities, these abnormal accounts have the same common abnormal behaviors, such as conducting a large number of transactions within a limited time and covering positions once a small loss occurs. The above abnormal behavior commonalities are different from the behavioral characteristics of normal accounts. Therefore, the first abnormal indicator that is different from the behavioral characteristics of most users can be identified through the first model, and the second abnormal indicator used to characterize the similarity with the identified abnormal behavior can be calculated according to the second model. The abnormal accounts with abnormal behavior are identified based on the above two abnormal indicators. Specifically, the account information of the account to be tested is obtained, including candidate parameters of multiple preset account dimensions such as "peak value of securities held", "number of stocks traded", "number of transactions", "total transaction amount", "number of stocks held", "turnover rate" and "transfer frequency"; illustratively, "peak value of securities held", "number of stocks traded", "number of transactions" and "total transaction amount" are selected as feature parameters, and a pre-selected account is selected from all the accounts to be tested according to the feature parameters; a first abnormal indicator of the pre-selected account is identified through a first model, a second abnormal indicator of the pre-selected account is calculated according to a second model, and an abnormal score of the pre-selected account is determined according to the above two abnormal indicators; if the abnormal score is greater than or equal to a preset abnormal threshold, the pre-selected account is identified as an abnormal account; if the abnormal score is less than the abnormal threshold, the pre-selected account is identified as a normal account.

[0060] Figure 3 FIG. 2 shows a flowchart of the implementation of the identification method provided in the second embodiment of the present application. Figure 3 , relative to Figure 1 In the embodiment, the identification method provided in this embodiment further includes S301 before S103, which is described in detail as follows:

[0061] Furthermore, before the account information of each of the pre-selected accounts is imported into the first model and the first abnormality indicator of the pre-selected account with respect to all the characteristic parameters is output, the method further includes:

[0062] In S301, training information of multiple training accounts is obtained.

[0063] In this embodiment, the training information includes an abnormal label and candidate parameters; the abnormal label is used to mark whether the training account is an abnormal account. For a detailed description, please refer to S104 and will not be repeated here; the training information also includes a unique identification parameter. For example, the unique identification parameter is composed of one or more combinations of parameters such as the account name, user name and ID number of the training account; the candidate parameters include preset attribute parameters that may exist in the training account. For example, the training account is a virtual bank account, and the candidate parameters include attribute parameters such as balance, number of transfers, total transfer amount and average transfer amount.

[0064] In this embodiment, training information of multiple training accounts containing the above-mentioned abnormal labels is obtained to facilitate subsequent supervised training of the preset neural network.

[0065] Figure 4 FIG. 4 shows a flowchart of the implementation of the identification method provided in the third embodiment of the present application. Figure 4 , relative to Figure 3 In the embodiment, the identification method provided in this embodiment further includes S401 to S402 before S102, which are described in detail as follows:

[0066] Furthermore, before selecting a pre-selected account from all the accounts to be tested according to the characteristic parameters, the method further includes:

[0067] In S401, the weight of each of the candidate parameters of the training account is determined based on the training information of the multiple training accounts.

[0068] In this embodiment, the weight of each of the candidate parameters of the training account is determined based on the training information of the multiple training accounts and a feature weight algorithm. Preferably, the weight of each candidate parameter of the training account is determined based on the training information of the multiple training accounts and the Relief algorithm. Specifically, based on the above-mentioned abnormal labels, the multiple training accounts are divided into two categories, one of which is an abnormal account with the abnormal label of 1 that has been identified as abnormal, and the other is a normal account with the abnormal label of 0 that has been identified as non-abnormal; a training account is randomly selected, and then the nearest neighbor similar account of the same type as the training account is selected, and the nearest neighbor heterogeneous account of a different type from the training account is selected, wherein the nearest neighbor similar account is: an account of the same type as the training account and with the smallest distance from the training account determined based on all the candidate parameters, and the nearest neighbor heterogeneous account is: an account of a different type from the training account and with the smallest distance from the training account determined based on all the candidate parameters; if the distance between the training account and the nearest neighbor similar account on a certain candidate feature is smaller than that between the training account and the nearest neighbor heterogeneous account, the weight of the candidate feature is increased; if the distance between the training account and the nearest neighbor similar account on a certain candidate feature is larger than that between the training account and the nearest neighbor heterogeneous account, the weight of the candidate feature is reduced.

[0069] It should be understood that the Relife algorithm is a feature weight algorithm in the prior art. The specific implementation process can refer to the Relife algorithm in the prior art, which will not be repeated here. It should be understood that the feature weight algorithm in the prior art can be used in this embodiment. For example, based on the above-mentioned abnormal labels, multiple training accounts are divided into two categories, one is the abnormal account with the abnormal label of 1 that has been identified as abnormal, and the other is the normal account with the abnormal label of 0 that has been identified as non-abnormal; the training mean of all the training accounts corresponding to each of the candidate parameters, the abnormal mean of all the abnormal accounts, and the normal mean of all the normal accounts are calculated; the variance of the data group composed of the training mean, abnormal mean, and normal mean corresponding to each of the candidate parameters is calculated, and the candidate parameters in the first R positions in the candidate parameter list generated by descending sorting based on the variance of each of the candidate parameters are selected as the feature parameters, where R is the number of features.

[0070] In S402, the first R candidate parameters in the weight sequence obtained by sorting the weights in descending order are selected as the feature parameters, where R is a preset number of features.

[0071] In this embodiment, based on the weight sequence obtained by sorting the weights of each candidate parameter in descending order, the first R corresponding candidate parameters in the weight list are selected as the above-mentioned feature parameters, and the weight of the feature parameter is greater than or equal to any of the above-mentioned candidate parameters except the feature parameter.

[0072] It should be understood that the characteristic parameters of the training account selected in this embodiment and the characteristic parameters of the account to be tested in S102 belong to the same parameter type; the characteristic parameters in S102 may be preset in addition to being determined in this embodiment.

[0073] In this embodiment, the selected feature parameter refers to an attribute parameter that has a certain influence on the abnormal label of each training account. The feature parameter can be used to select a pre-selected account in S102 to pre-process the test account, reduce the amount of data processing, and improve recognition efficiency.

[0074] Figure 5 FIG. 4 shows a flowchart of the implementation of the identification method provided in the fourth embodiment of the present application. Figure 5 , relative to Figure 4 In the embodiment, the identification method provided in this embodiment further includes S501 to S502 before S103, which are described in detail as follows:

[0075] Furthermore, before the account information of each of the pre-selected accounts is imported into the first model and the first abnormality indicator of the pre-selected account with respect to all the characteristic parameters is output, the method further includes:

[0076] In S501, based on the characteristic parameters of all the accounts to be tested and an unsupervised clustering algorithm, two classifications are performed on each of the characteristic parameters to determine the centroid of the majority cluster corresponding to each of the characteristic parameters.

[0077] In this embodiment, preferably, according to the characteristic parameters of all the accounts to be tested and the K-means clustering algorithm, each of the characteristic parameters is classified into two categories, and the centroid of the majority cluster corresponding to each characteristic parameter is determined. Specifically, each characteristic parameter is selected, and the characteristic parameter is used as the attribute value, and two accounts to be tested are randomly selected as the centroids of the two clusters, and all the accounts to be tested are divided into each cluster according to the distance between the characteristic parameter and the centroid of each cluster, and then the centroid of each cluster is updated (i.e., the average of the characteristic parameter of all accounts to be tested in the cluster), and the centroids of each cluster are compared before and after the update. If the centroids of each cluster are different before and after the update, then the above step of dividing all the accounts to be tested into each cluster according to the distance between the characteristic parameter and the centroid of each cluster is returned to execute; if the centroids of each cluster are the same before and after the update, then the number of accounts to be tested contained in each cluster is compared, and the centroid of the majority cluster corresponding to the characteristic parameter is determined, and then the centroid of the majority cluster corresponding to each characteristic parameter is determined. The specific implementation steps can be referred to S105, which will not be repeated here.

[0078] In S502, a first model is generated based on the weights of the respective feature parameters and the majority cluster centroids corresponding to the respective feature parameters.

[0079] In this embodiment, the weights of the characteristic parameters determined in S401 and the centroids of the majority clusters corresponding to the characteristic parameters are used as model parameters to generate the first model. Figure 6 , Figure 6 The schematic diagram of the structure of the first model in this embodiment is shown. The first model takes the above-mentioned characteristic parameters of the pre-selected account as input and the first abnormality index as output. Specifically, based on the difference between each characteristic parameter of the pre-selected account and the centroid of the majority cluster corresponding to the characteristic parameter, and the weight of the characteristic parameter, the heterogeneous score corresponding to each characteristic parameter of the pre-selected account is calculated; based on the heterogeneous score corresponding to each characteristic parameter of the pre-selected account, the first abnormality index of the pre-selected account with respect to all the characteristic parameters is calculated.

[0080] See also Figure 6 , the account information of each of the pre-selected accounts is imported into the first model, and the first abnormality index of the pre-selected account with respect to all the characteristic parameters is output. Specifically, the difference between each of the characteristic parameters of the pre-selected account and the centroid of the majority cluster corresponding to the characteristic parameters is calculated to obtain the deviation value of each characteristic parameter; the deviation value of each characteristic parameter is multiplied by the weight corresponding to the characteristic parameter to calculate the above-mentioned heterogeneous score corresponding to each characteristic parameter; the heterogeneous scores corresponding to each characteristic parameter are summed to calculate the above-mentioned first abnormality index of the pre-selected account.

[0081] Exemplarily, when calculating the difference between each characteristic parameter of the pre-selected account and the centroid of the majority clusters corresponding to the characteristic parameters to obtain the deviation value of each characteristic parameter, the process is normalized to obtain a normalized result, and the normalized result is used instead of the deviation value to perform subsequent steps, so that the normalized result more accurately reflects the degree of deviation between each characteristic parameter and the centroid of the majority clusters corresponding to the characteristic parameter than the deviation value. Optionally, the ratio of the deviation value corresponding to each characteristic parameter to the centroid of the majority clusters corresponding to the characteristic parameter is used as the normalized result.

[0082] It should be understood that the K-means clustering algorithm is an unsupervised clustering algorithm in the prior art, which is used to divide sample data into K categories. In this embodiment, the value of K is set to 2, and the K-means clustering algorithm is only used to divide the above-mentioned accounts to be tested into majority clusters and minority clusters based on each of the above-mentioned feature parameters, and then determine the centroid of the majority cluster of each of the above-mentioned feature parameters, so as to generate the first model. The specific implementation of the K-means clustering algorithm in this embodiment can refer to the prior art, and will not be repeated here.

[0083] In this embodiment, the first model is determined based on an unsupervised clustering algorithm, so that the first abnormality indicator of the pre-selected account is subsequently determined based on the first model, that is, the degree to which the pre-selected account is different from the majority of all pre-selected accounts is quantified. Therefore, based on the identification method of this embodiment, abnormal accounts that may appear in the future and are different from most other normal accounts can be identified.

[0084] Figure 7 FIG. 5 shows a flowchart of the implementation of the identification method provided in the fifth embodiment of the present application. Figure 7 , relative to Figure 3 In the embodiment, the identification method provided in this embodiment also includes S701 to S702 before S104, which are described in detail as follows:

[0085] Furthermore, before the account information of each of the pre-selected accounts is imported into the second model and the second abnormality indicator of the pre-selected accounts is output, the method further includes:

[0086] In S701, data preprocessing is performed on the training information of the multiple training accounts to obtain a training matrix.

[0087] In this embodiment, preferably, an original matrix is ​​generated according to the candidate parameters of the multiple training accounts; the original matrix is ​​reduced in dimension based on a dimensionality reduction algorithm to generate a reduced-dimension matrix; and data is normalized on the reduced-dimension matrix to generate the training matrix.

[0088] Preferably, the value of a row in the original matrix represents all the candidate parameters of one of the training accounts, and the value of a column in the original matrix represents one of the candidate parameters of all the training accounts. Specifically, each of the candidate parameters of each of the training accounts is converted into floating-point data, that is, the candidate parameter is converted into floating-point data, and then the original matrix is ​​generated based on all the floating-point data corresponding to each of the candidate parameters of each of the training accounts, so as to facilitate the subsequent generation of the second model.

[0089] It should be understood that after the candidate parameter is converted into data of a floating-point type, the possible empty data is assigned a value based on the collaborative filtering (CF) algorithm. If empty data still exists after the possible empty data is assigned a value based on the collaborative filtering algorithm, a row of data of the original matrix corresponding to the empty data is deleted to avoid errors caused by the empty data.

[0090] Preferably, the PCA dimensionality reduction algorithm is used to reduce the dimension of the original matrix M to generate a reduced dimension matrix. Specifically, each column of the original matrix M is zero-meaned to obtain a zero-mean matrix, that is, the value of each column of M is subtracted from the mean of the column; the covariance matrix C of M is determined; the eigenvalue E1 and eigenvector E2 of the covariance matrix C are determined, and the eigenvalues ​​E1 and E2 satisfy C*E1=E2*E1 and E2!=C; the eigenvector corresponding to the first k eigenvalues ​​of the eigenvalue list sorted in descending order based on the size of the eigenvalue is selected, and the k eigenvectors are used as column vectors to form an eigenvector matrix M k ; M and M k The reduced-dimensional matrix is ​​obtained by multiplication, and the number of columns of the reduced-dimensional matrix is ​​reduced compared with the original matrix.

[0091] It should be understood that the PCA dimensionality reduction algorithm is a dimensionality reduction algorithm in the prior art. The optional dimensionality reduction algorithm in this embodiment also includes the T-distribution neighborhood embedding algorithm in the prior art. The specific implementation of the dimensionality reduction method in this embodiment can refer to the prior art and will not be repeated here.

[0092] Preferably, the dimension reduction matrix is ​​normalized to generate the above training matrix. Specifically, each column of the dimension reduction matrix is ​​selected for maximum-minimum normalization, that is, the maximum value of the column and the minimum value of the column are determined, and the pre-normalization interval corresponding to the column is determined. [0,1] is used as the post-normalization interval, and the value of the column is normalized to the maximum-minimum value to generate the training matrix. The specific implementation can refer to the maximum-minimum normalization in the prior art, which will not be repeated here.

[0093] It should be understood that, optionally, in the above data normalization process, subsequent operations can be performed with (0, 1) as the normalized interval to prevent calculation errors caused by data being 0.

[0094] It should be understood that in the process of performing data preprocessing on the training information of the multiple training accounts to obtain the training matrices corresponding to the multiple training accounts, the original matrix can be directly determined as the training matrix.

[0095] In S702, each row of data of the training matrix is ​​used as input and the abnormal label corresponding to each row of data is used as output, and the preset neural network is trained to generate a second model.

[0096] In this embodiment, each row of data of the training matrix is ​​imported into the preset neural network, and a predicted abnormality index is output; based on the predicted abnormality index and the abnormal labels of all the training accounts, the network loss is determined; based on the network loss, the preset neural network is trained to generate a second model. The preset neural network is a feedforward fully connected neural network, including L hidden layers, where L is the number of hidden layers of the preset neural network.

[0097] Specifically, each row of data of the training matrix is ​​imported into the neural network, and the predicted abnormal index of the above training account corresponding to each row of data is output; the abnormal label of the training account is used as the true value of the predicted abnormal index of the training account, the network loss of the neural network is determined, and the neural network is trained (i.e., the network parameters of the neural network are adjusted) based on the network loss and the loss regression training method. The specific implementation of the neural network training method in this embodiment can refer to the neural network training method in the prior art, which will not be repeated here.

[0098] Preferably, after the second model is generated, the second model is verified. Specifically, before all the training matrices are imported into the preset neural network and the predicted abnormality index is output, the training matrix is ​​reconstructed to obtain a training matrix and a verification matrix (A row of data in the training matrix is ​​randomly selected to form the training matrix, and the remaining B rows of data in the training matrix are used to form the verification matrix. The sum of the number of rows A of the training matrix and the number of rows B of the verification matrix is ​​the number of rows of the training matrix. Preferably, the ratio of A to B is equal to 3), the training matrix is ​​used to replace the training matrix for subsequent operations, and the verification matrix is ​​used to verify the second model. The second model is verified based on the verification matrix. Specifically, each row of data of the verification matrix is ​​imported into the neural network, and the verification anomaly index corresponding to each row of data is output. The verification label of the training account corresponding to the row of data is calculated based on each of the verification anomaly indexes (if the verification anomaly index is greater than or equal to a preset critical value, the value of the verification label corresponding to the training account is 1; if the verification anomaly index is less than a preset critical value, the value of the verification label corresponding to the training account is 0; preferably, the critical value is 0.5), and the verification value of the second model is calculated based on the verification label and the abnormal label corresponding to the training account. The verification value includes one or more of the accuracy (Precision), recall rate (Recall) and F1 value (F1-Score) of the second model. The accuracy, recall rate and F1 value are commonly used parameters of neural networks in the prior art, which are used to identify the output accuracy of a neural network. The specific implementation of calculating the verification value can refer to the prior art and will not be repeated here. If the verification value is greater than or equal to the preset verification pass value, it means that the second model has passed the verification; if the verification value is less than the verification pass value, the process returns to execute the above-mentioned acquisition of training information of multiple training accounts.

[0099] Optionally, when the preset neural network is trained based on the training matrix, the neural network after each training stage is used as a temporary model, thereby determining Y temporary models, where Y is the number of training times. The Y temporary models are verified, and the specific implementation refers to the relevant steps of this embodiment, which will not be repeated here, to obtain the temporary verification values ​​corresponding to each of the temporary models, and select the temporary model with the largest temporary verification value and the temporary verification value greater than or equal to the preset temporary verification qualified value as the second model.

[0100] Optionally, after returning to execute the above-mentioned acquisition of training information of multiple training accounts, before importing the training matrix into the preset neural network, the number of hidden layers L of the preset neural network is increased.

[0101] It should be understood that in this embodiment, if the preferred dimensionality reduction operation in S701 has been performed, the second model also includes a preprocessing layer before the input layer, and the preprocessing layer is used to convert each row of data of the above-mentioned original matrix into the corresponding row data of the above-mentioned training matrix. The specific implementation can refer to the above-mentioned dimensionality reduction and data standardization steps of this embodiment. The parameters of the preprocessing layer are obtained in the above-mentioned dimensionality reduction and data standardization steps of this embodiment. At this time, the input of the second model is each row of data of the original matrix.

[0102] In this embodiment, the above-mentioned training information is preprocessed to facilitate the subsequent training of the above-mentioned neural network and reduce the training time; in particular, the original matrix is ​​reduced in dimension based on the dimensionality reduction algorithm to improve the output efficiency of the second model; the second model is verified to improve the accuracy of the above-mentioned second abnormal indicator subsequently output by the second model, thereby improving the recognition accuracy of abnormal accounts.

[0103] Figure 8 A schematic diagram of a second model structure provided by another embodiment of the present application is shown, and the details are as follows:

[0104] Furthermore, before the account information of each of the pre-selected accounts is imported into the second model and the second abnormality indicator of the pre-selected account is output, it also includes: performing floating-point digitization on each of the candidate parameters in the account information of the pre-selected account to generate a floating-point value of the candidate parameter. The floating-point value of each of the candidate parameters of the pre-selected account is used as input (exemplarily, the floating-point values ​​of the j candidate parameters of the pre-selected account are used as input), and the second abnormality indicator of the pre-selected account is used as output. The second model includes an input layer, an output layer and L hidden layers, and the second model is a feedforward fully connected neural network. Preferably, the second model also includes a preprocessing layer before the input layer, and the preprocessing layer is used to perform dimensionality reduction and data standardization on the floating-point values ​​of each of the candidate parameters of the pre-selected account. Specifically, after the floating-point values ​​of each of the candidate parameters are reduced in dimension and the data is standardized, m parameters after dimensionality reduction are generated, and the m parameters after dimensionality reduction can represent all the j candidate parameters, and satisfy m>j. For a detailed implementation, see Figure 7 The fifth embodiment of the present invention will not be described in detail here.

[0105] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0106] Corresponding to the identification method described in the above embodiment, Fig. 9 A schematic diagram of the structure of the device provided in an embodiment of the present application is shown. For the convenience of explanation, only the parts related to the embodiment of the present application are shown.

[0107] Reference Fig. 9 The identification device includes: a test account acquisition module, used to acquire account information of the test account; the account information includes characteristic parameters of the test account in multiple preset account dimensions; a pre-selected account selection module, used to select a pre-selected account from all the test accounts according to the characteristic parameters; a first abnormal module, used to import the account information of each of the pre-selected accounts into a first model, and output a first abnormal indicator of the pre-selected account with respect to all the characteristic parameters; the first model is obtained by performing unsupervised deep learning on the characteristic parameters of all the test accounts; a second abnormal module, used to import the account information of each of the pre-selected accounts into a second model, and output a second abnormal indicator of the pre-selected account; the second model is obtained by training a preset neural network with training information of multiple training accounts; an abnormal score calculation module, used to determine the abnormal score of the pre-selected account based on the first abnormal indicator and the second abnormal indicator; an abnormal account identification module, used to identify abnormal accounts from all the pre-selected accounts based on the abnormal scores of each of the pre-selected accounts.

[0108] Optionally, the identification device further includes: a training information acquisition module, used to acquire training information of multiple training accounts, wherein the training information includes an abnormal label and candidate parameters; the abnormal label is used to mark whether the training account is an abnormal account.

[0109] Optionally, the identification device also includes: a feature weight determination module, used to determine the weight of each of the candidate parameters of the training account based on the training information of the multiple training accounts; a feature parameter selection module, used to select the first R candidate parameters in the weight sequence obtained by sorting the weights in descending order as the feature parameters, where R is a preset number of features.

[0110] Optionally, the identification device also includes: an unsupervised clustering module, used to classify each of the characteristic parameters into two categories according to the characteristic parameters of all the accounts to be tested and an unsupervised clustering algorithm, and determine the centroid of the majority cluster corresponding to each of the characteristic parameters; a first model generation module, used to generate a first model based on the weights of each of the characteristic parameters and the centroid of the majority cluster corresponding to each of the characteristic parameters.

[0111] Optionally, the first anomaly module includes a heterogeneous score module, which is used to calculate the heterogeneous score corresponding to each characteristic parameter of the pre-selected account based on the difference between each characteristic parameter of the pre-selected account and the centroid of the majority cluster corresponding to the characteristic parameter, and the weight of the characteristic parameter; and a first anomaly indicator module, which is used to calculate the first anomaly indicator of the pre-selected account with respect to all the characteristic parameters based on the heterogeneous score corresponding to each characteristic parameter of the pre-selected account.

[0112] Optionally, the identification device also includes: a training matrix module, used to perform data preprocessing on the training information of the multiple training accounts to obtain a training matrix; a second model generation module, used to take each row of data of the training matrix as input and the abnormal label corresponding to each row of data as output, to train a preset neural network and generate a second model.

[0113] Optionally, the training matrix generation module includes: an original matrix generation module, used to generate an original matrix according to the candidate parameters of the multiple training accounts; a dimensionality reduction module, used to reduce the dimension of the original matrix based on a dimensionality reduction algorithm to generate a reduced dimension matrix; and a data standardization module, used to perform data standardization on the reduced dimension matrix to generate the training matrix.

[0114] Optionally, the second model generation module includes: a predicted anomaly index module, used to import each row of data of the training matrix into the preset neural network and output a predicted anomaly index; a network loss determination module, used to determine the network loss based on the predicted anomaly index and the abnormal labels of all the training accounts; and a supervised training module, used to train the preset neural network based on the network loss to generate a second model.

[0115] Optionally, the abnormal account identification module includes: an abnormal account priority table generation module, which is used to sort all the pre-selected accounts in descending order based on the size of the abnormal scores of the pre-selected accounts to generate an abnormal account priority table; an abnormal account number determination module, which is used to determine the number of abnormal accounts based on the number of pre-selected accounts shown and a preset abnormal ratio; an abnormal account selection module, which is used to select the first N pre-selected accounts from the abnormal account priority table as the abnormal accounts; the value of N is the number of abnormal users.

[0116] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0117] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0118] Fig.10 FIG. 1 shows a schematic diagram of the structure of a terminal device provided by an embodiment of the present application. Fig.10 As shown, the terminal device 10 of this embodiment includes: at least one processor 100 ( Fig.10 Only one is shown in the figure) a processor, a memory 101, and a computer program 102 stored in the memory 101 and executable on the at least one processor 100, and when the processor 100 executes the computer program 102, the steps in any of the above-mentioned embodiments of the method for determining a shared service indicator based on a communication credential sharing service are implemented.

[0119] The terminal device 10 may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The terminal device may include, but is not limited to, a processor 100 and a memory 101. Those skilled in the art will appreciate that Fig.10 It is only an example of the terminal device 10 and does not constitute a limitation on the terminal device 10. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, it may also include input and output devices, network access devices, etc.

[0120] The processor 100 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0121] In some embodiments, the memory 101 may be an internal storage unit of the terminal device 10, such as a hard disk or memory of the terminal device 10. In other embodiments, the memory 101 may also be an external storage device of the terminal device 10, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the terminal device 10. Further, the memory 101 may also include both an internal storage unit of the terminal device 10 and an external storage device. The memory 101 is used to store an operating system, an application, a boot loader (BootLoader), data and other programs, such as the program code of the computer program. The memory 101 may also be used to temporarily store data that has been output or is to be output. The embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the steps in the above-mentioned various method embodiments.

[0122] An embodiment of the present application provides a computer program product. When the computer program product runs on a mobile terminal, the mobile terminal can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0123] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can at least include: any entity or device that can carry the computer program code to the camera / terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), electric carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0124] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0125] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0126] In the embodiments provided in the present application, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0127] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0128] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A method for identifying abnormal accounts, characterized in that: include: Get the account information of the account to be tested; The account information includes characteristic parameters of the account to be tested in multiple preset account dimensions; According to the characteristic parameters, a pre-selected account is selected from all the accounts to be tested; Importing the account information of each of the pre-selected accounts into a first model, and outputting a first abnormality indicator of the pre-selected account with respect to all the characteristic parameters; the first model is obtained by performing unsupervised deep learning on the characteristic parameters of all the accounts to be tested; Importing the account information of each of the pre-selected accounts into a second model, and outputting a second abnormality indicator of the pre-selected account; the second model is obtained by training a preset neural network with training information of a plurality of training accounts, the plurality of training accounts include abnormal accounts that have been identified as abnormal and normal accounts that have been identified as non-abnormal, and the training information includes an abnormality label, the abnormality label is used to mark whether the training account is an abnormal account that has been identified as abnormal or a normal account that has been identified as non-abnormal; Determining an abnormality score of the pre-selected account based on the first abnormality indicator and the second abnormality indicator; Based on the anomaly scores of the respective pre-selected accounts, abnormal accounts are identified from all the pre-selected accounts.

2. The identification method according to claim 1, characterized in that: Before importing the account information of each of the pre-selected accounts into the first model, the method further includes: Training information of multiple training accounts is obtained, where the training information includes an abnormal label and candidate parameters; the abnormal label is used to mark whether the training account is an abnormal account.

3. The identification method according to claim 2, characterized in that: Before selecting a pre-selected account from all the accounts to be tested according to the characteristic parameters, the method further includes: Determining a weight of each of the candidate parameters of the training account based on the training information of the multiple training accounts; The first R candidate parameters in the weight sequence obtained by sorting the weights in descending order are selected as the feature parameters, where R is a preset number of features.

4. The identification method according to claim 3, characterized in that: Before importing the account information of each of the pre-selected accounts into the first model and outputting the first abnormality indicator of the pre-selected accounts with respect to all the characteristic parameters, the method includes: According to the characteristic parameters of all the accounts to be tested and the unsupervised clustering algorithm, each characteristic parameter is classified into two categories, and the centroid of the majority cluster corresponding to each characteristic parameter is determined; A first model is generated based on the weights of the respective feature parameters and the centroids of the majority clusters corresponding to the respective feature parameters.

5. The identification method according to claim 4, characterized in that: The step of importing the account information of each of the pre-selected accounts into the first model and outputting the first abnormality indicator of the pre-selected accounts with respect to all the characteristic parameters includes: Calculate the heterogeneous score corresponding to each of the feature parameters of the pre-selected account based on the difference between each of the feature parameters of the pre-selected account and the centroid of the majority cluster corresponding to the feature parameter, and the weight of the feature parameter; Based on the heterogeneous scores corresponding to the respective characteristic parameters of the pre-selected accounts, a first abnormality index of the pre-selected accounts with respect to all the characteristic parameters is calculated.

6. The identification method according to claim 2, characterized in that: Before importing the account information of each of the pre-selected accounts into the second model and outputting the second abnormal indicator of the pre-selected accounts, the method includes: Performing data preprocessing on the training information of the multiple training accounts to obtain a training matrix; Each row of data in the training matrix is ​​used as input and the abnormal label corresponding to each row of data is used as output, and the preset neural network is trained to generate a second model.

7. The identification method according to claim 6, characterized in that: The step of performing data preprocessing on the training information of the plurality of training accounts to obtain the training matrix includes: generating an original matrix according to the candidate parameters of the plurality of training accounts; Reduce the dimension of the original matrix based on the dimension reduction algorithm to generate a reduced dimension matrix; Perform data normalization processing on the dimension reduction matrix to generate the training matrix.

8. The identification method according to claim 6 or 7, characterized in that: The method of taking each row of data of the training matrix as input and the training abnormality indicator corresponding to each row of data as output, training the preset neural network and generating the second model comprises: Importing each row of data of the training matrix into the preset neural network, and outputting a predicted abnormality indicator; Determining a network loss based on the predicted anomaly indicator and the anomaly labels of all the training accounts; The preset neural network is trained based on the network loss to generate a second model.

9. The identification method according to any one of claims 1 to 6, characterized in that: The determining the abnormal account among the pre-selected accounts based on the abnormal scores of the pre-selected accounts includes: Based on the abnormal scores of the pre-selected accounts, all the pre-selected accounts are sorted in descending order to generate an abnormal account priority table; Determine the number of abnormal accounts based on the number of pre-selected accounts and the preset abnormal ratio; The first N pre-selected accounts are selected from the abnormal account priority table as the abnormal accounts; the value of N is the number of the abnormal accounts.

10. A device for identifying abnormal accounts, characterized in that: include: A test account acquisition module is used to acquire account information of the test account; the account information includes characteristic parameters of the test account in multiple preset account dimensions; A pre-selected account selection module, used to select a pre-selected account from all the accounts to be tested according to the characteristic parameters; A first abnormality module, used to import the account information of each of the pre-selected accounts into a first model, and output a first abnormality indicator of the pre-selected account with respect to all the characteristic parameters; the first model is obtained by performing unsupervised deep learning on the characteristic parameters of all the accounts to be tested; A second abnormality module, used to import the account information of each of the pre-selected accounts into a second model, and output a second abnormality indicator of the pre-selected account; the second model is obtained by training a preset neural network with training information of multiple training accounts, the multiple training accounts include abnormal accounts that have been identified as abnormal and normal accounts that have been identified as non-abnormal, and the training information includes an abnormality label, and the abnormality label is used to mark whether the training account is an abnormal account that has been identified as abnormal or a normal account that has been identified as non-abnormal; an abnormality score calculation module, used to determine the abnormality score of the pre-selected account based on the first abnormality indicator and the second abnormality indicator; The abnormal account identification module is used to identify abnormal accounts from all the pre-selected accounts based on the abnormal scores of the pre-selected accounts.

11. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 9 is implemented.

12. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images