Target user account identification methods, computer equipment and storage media

Abstract

This application relates to a method, computer device, and storage medium for identifying target user accounts, and pertains to the field of network security technology. The method includes: classifying user accounts into communities based on different types of behavioral attributes; scoring each community based on the behavioral attributes of user accounts within each community; scoring the user account based on the community scores; and identifying target user accounts based on these scores. Since community classifications of user accounts may differ under different behavioral attributes, the above-described solution comprehensively determines the account score by considering the community classifications of user accounts under different behavioral attributes. This approach takes into account the possibility of similarities between non-target user accounts and target user accounts in a few behavioral attributes, thereby improving the accuracy of target user account identification.

Description

Technical Field

[0001] This application relates to the field of network security, and in particular to a method for identifying target user accounts, a computer device, and a storage medium. Background Technology

[0002] Currently, with the increasingly rich functions of online social platforms, a large amount of user privacy and wealth are gathered on these platforms. Criminals use these platforms to create a large number of fake social network accounts to achieve illegal purposes, making the maintenance of network security increasingly important.

[0003] In related technologies, the platform uses tools to generate behavioral sequences from user behavior, constructs a behavioral similarity graph between user accounts through sequence analysis, identifies user accounts that have a specified similarity to malicious user account samples through graph theory analysis, and identifies the user accounts found as malicious user accounts.

[0004] In related technologies, malicious user accounts are identified by comparing the similarity between individual user accounts and malicious user account samples. However, this may result in some user accounts being incorrectly classified as either malicious or non-malicious, thus affecting the accuracy of malicious user account detection. Summary of the Invention

[0005] This application provides a method, computer device, and storage medium for identifying target user accounts, which can improve the accuracy of target user account identification. The technical solution is as follows:

[0006] On the one hand, a method for identifying target user accounts is provided, the method including:

[0007] Obtain the behavior record information of each user account, wherein the behavior record information is used to indicate various behavioral attributes of the operation behavior;

[0008] Based on the behavioral record information of each user account, a weighted undirected graph corresponding to each behavioral attribute is generated; the weighted undirected graph is used to indicate the similarity of each user account under the corresponding behavioral attribute.

[0009] Community discovery processing is performed on the weighted undirected graphs corresponding to each of the aforementioned behavioral attributes to obtain the community set for each of the aforementioned behavioral attributes. The community set contains the user account communities divided according to the corresponding behavioral attributes.

[0010] Based on the behavioral attributes of user accounts in each user account community, obtain the community score for each user account community;

[0011] Based on the community ratings of each user account, obtain the account ratings of each user account;

[0012] Based on the account ratings of each user account, the target user account is identified from among the user accounts.

[0013] On the one hand, a target user account identification device is provided, the device comprising:

[0014] The information acquisition module is used to acquire the behavior record information of each user account, and the behavior record information is used to indicate various behavioral attributes of the operation behavior;

[0015] An undirected graph generation module is used to generate weighted undirected graphs corresponding to each of the behavioral attributes based on the behavioral record information of each user account; the weighted undirected graphs are used to indicate the similarity of each user account under the corresponding behavioral attributes.

[0016] The community set acquisition module is used to perform community discovery processing on the weighted undirected graphs corresponding to each of the behavioral attributes to obtain the community set for each of the behavioral attributes. The community set contains each user account community divided according to the corresponding behavioral attribute.

[0017] The community rating acquisition module is used to acquire the community rating of each user account community based on the behavioral attributes of the user accounts in each user account community;

[0018] The account rating acquisition module is used to obtain the account rating of each user account based on the community rating of each user account community.

[0019] The target identification module is used to identify the target user account from the user accounts based on the account rating of each user account.

[0020] In one possible implementation, the community rating acquisition module includes:

[0021] The quantity acquisition submodule is used to acquire the quantity of target attribute values ​​for each user account in the target community; the target community is any one of the user account communities; the quantity of target attribute values ​​is the quantity of attribute values ​​corresponding to the first behavioral attribute; the first behavioral attribute is the behavioral attribute corresponding to the target community;

[0022] The standard deviation acquisition submodule is used to acquire the standard deviation of the number of attribute values ​​in the target community. The standard deviation of the number of attribute values ​​is the standard deviation of the number of target attribute values ​​of each user account in the target community.

[0023] The community rating acquisition submodule is used to obtain the community rating of the target community based on the standard deviation of the number of attribute values ​​of the target community.

[0024] In one possible implementation, the community rating acquisition submodule includes:

[0025] The quantity processing unit is used to normalize the standard deviation of the quantity of attribute values ​​of each user account community corresponding to the first behavioral attribute.

[0026] The community scoring unit is used to take the normalized result of the standard deviation of the number of attribute values ​​of the target community as the community score of the target community.

[0027] In one possible implementation, the account rating acquisition module includes:

[0028] The target community rating acquisition submodule is used to obtain the community rating of the community where the target user account is located; the target user account is any one of the user accounts.

[0029] The vector construction submodule is used to construct a high-dimensional space vector of the target user account based on the community rating of the community to which the target user account belongs;

[0030] The account rating acquisition submodule is used to obtain the account rating of the target user account based on the high-dimensional space vector of the target user account.

[0031] In one possible implementation, the account rating acquisition submodule includes:

[0032] The account rating determination unit is used to take the normalized length of the high-dimensional space vector of the target user account as the account rating of the target user account.

[0033] In one possible implementation, the undirected graph generation module includes:

[0034] The bipartite graph generation submodule is used to generate an account attribute bipartite graph corresponding to the second behavior attribute based on the attribute values ​​of the second behavior attribute in the behavior record information of each user account. The second behavior attribute is any one of the various behavior attributes. The account attribute bipartite graph corresponding to the second behavior attribute includes account vertices corresponding to each user account, attribute value vertices corresponding to various attribute values ​​of the second behavior attribute, and edges between the account vertices and the attribute value vertices. The edges between the account vertices and the attribute value vertices are used to indicate that the corresponding user account has the corresponding attribute value.

[0035] The undirected graph generation submodule is used to generate a weighted undirected graph corresponding to the second behavioral attribute based on the bipartite graph of the account attribute corresponding to the second behavioral attribute.

[0036] In one possible implementation, the undirected graph generation submodule includes:

[0037] The transition probability matrix generation unit is used to generate a first transition probability matrix and a second transition probability matrix based on the bipartite graph of the account attributes corresponding to the second behavioral attribute; the first transition probability matrix is ​​used to indicate the probability of each account vertex transitioning to each attribute value vertex; the second transition probability matrix is ​​used to indicate the probability of each attribute value vertex transitioning to each account vertex.

[0038] An undirected graph generation unit is used to generate a weighted undirected graph corresponding to the second behavioral attribute by means of a random walk with restart, based on the first transition probability matrix and the second transition probability matrix.

[0039] In one possible implementation, the transition probability matrix generating unit is used for,

[0040] The weight of each attribute value vertex is obtained based on the number of its neighboring vertices; the neighboring vertices of each attribute value vertex are account vertices connected to the attribute value vertex by an edge.

[0041] The weight of each account vertex is obtained based on the weight of its neighboring vertices; the neighboring vertices of each account vertex are attribute value vertices connected to the account vertex by edges.

[0042] The first transition probability matrix is ​​generated based on the weights of each attribute value vertex and the weights of each account vertex.

[0043] The second transition probability matrix is ​​generated based on the number of neighboring vertices of each vertex with said attribute value.

[0044] In one possible implementation, the undirected graph generation unit is used for,

[0045] Multiplying the first transition probability matrix by the second transition probability matrix yields a third transition probability matrix, which is used to indicate the transition probability between each of the account vertices;

[0046] Based on the third transition probability matrix, a random walk with restart is performed between each of the account vertices to obtain the probability distribution between each of the account vertices;

[0047] The probability distributions between the account vertices are superimposed onto the weights of the edges between the account vertices to obtain the weighted undirected graph corresponding to the second behavioral attribute.

[0048] In one possible implementation, the device further includes:

[0049] The first attribute value merging module is used to merge the vertices of each attribute value using an adaptive segmentation method before generating the weighted undirected graph corresponding to the second behavior attribute based on the bipartite graph of the account attribute corresponding to the second behavior attribute, in response to the second behavior attribute being a first type of attribute; the first type of attribute is an attribute whose corresponding attribute value is correlated within the value range;

[0050] or,

[0051] The second attribute value merging module is used to merge the attribute value vertices by means of an exponential growth segmentation method in response to the second behavior attribute being a second type attribute. The second type attribute is the attribute whose corresponding attribute value exhibits a logarithmic growth trend in the value space.

[0052] In one possible implementation, the target recognition module includes:

[0053] The first target identification submodule is used to identify user accounts with a corresponding account score greater than a preset threshold as the target user accounts.

[0054] or,

[0055] The second target identification submodule is used to identify the user accounts whose corresponding account scores are greater than the average score among the user accounts as the target user accounts; the average score is the average of the account scores of the user accounts.

[0056] On the other hand, a computer device is provided, the computer device including a processor and a memory, the memory storing at least one instruction, at least one program, code set or instruction set, the at least one instruction, the at least one program, the code set or instruction set being loaded and executed by the processor to implement the above-described target user account identification method.

[0057] In another aspect, a computer-readable storage medium is provided, wherein at least one instruction, at least one program, code set, or instruction set is stored therein, wherein the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by a processor to implement the above-described target user account identification method.

[0058] This application categorizes user accounts into communities based on different behavioral attributes, scores each community based on the behavioral attributes of user accounts within each community, and then scores the user account based on the community scores. This scoring is then used to identify target user accounts. Since community categorization may differ under different behavioral attributes, the above-mentioned solution comprehensively determines the account score by considering the community categorization of user accounts under different behavioral attributes. This approach also takes into account the possibility of similarities between non-target user accounts and target user accounts in a few behavioral attributes, thus improving the accuracy of target user account identification.

[0059] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0060] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0061] Figure 1 This is a schematic diagram of a target user account identification system provided in an exemplary embodiment of this application;

[0062] Figure 2 This is a flowchart illustrating a target user account identification method provided in an exemplary embodiment of this application;

[0063] Figure 3 This is a schematic diagram of a target user account identification method provided in an exemplary embodiment of this application;

[0064] Figure 4 yes Figure 3 The illustrated embodiment is a schematic diagram of merging attribute values ​​using an adaptive segmentation method;

[0065] Figure 5 yes Figure 3 The illustrated embodiment is a schematic diagram of obtaining a set of attribute values;

[0066] Figure 6 yes Figure 3 The illustrated embodiment is a schematic diagram of a binary graph constituting account attributes;

[0067] Figure 7 This is a flowchart illustrating a target user account identification method provided in an exemplary embodiment of this application;

[0068] Figure 8 This is a structural block diagram of a target user account identification device provided in an exemplary embodiment of this application;

[0069] Figure 9 This is a structural block diagram of a computer device provided in an exemplary embodiment of this application. Detailed Implementation

[0070] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0071] It should be noted that the collection and processing of relevant data (e.g., behavioral record information) in this application should strictly comply with the requirements of relevant national laws and regulations, obtain the informed consent or separate consent of the personal information subject, and carry out subsequent data use and processing within the scope of laws and regulations and the authorization of the personal information subject.

[0072] First, the terms used in the embodiments of this application will be introduced:

[0073] 1) Cloud security

[0074] Cloud security refers to the collective term for security software, hardware, users, organizations, and security cloud platforms based on cloud computing business models. Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and the identification of unknown virus behavior. Through a large network of clients, it monitors abnormal software behavior on the network, obtains the latest information on Trojans and malware on the internet, sends it to the server for automatic analysis and processing, and then distributes solutions for viruses and Trojans to each client.

[0075] The main research directions in cloud security include: 1. Cloud computing security, which mainly studies how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, secure storage and isolation of user data, user access authentication, information transmission security, network attack protection, and compliance auditing; 2. Cloudification of security infrastructure, which mainly studies how to use cloud computing to build and integrate security infrastructure resources and optimize security protection mechanisms, including building a large-scale security event and information collection and processing platform through cloud computing technology to achieve the collection and correlation analysis of massive amounts of information and improve the ability to control network-wide security events and risks; 3. Cloud security services, which mainly studies various security services provided to users based on cloud computing platforms, such as antivirus services.

[0076] 2) Random Walk with Restart (RWR)

[0077] The basic idea of ​​the random walk algorithm is to traverse a graph starting from one or a series of vertices. At any vertex, the traverser will move to its neighboring vertices with probability 1-a, and will randomly jump to any vertex in the graph with probability a, where a is the jump probability. After each walk, a probability distribution is obtained, which describes the probability of each vertex being visited. This probability distribution is used as the input for the next walk, and this process is iterated repeatedly. When certain preconditions are met, this probability distribution will tend to converge. After convergence, a stationary probability distribution is obtained. The random walk model can be widely used in data mining and the Internet field.

[0078] The Restart Random Walk algorithm is an improvement upon the standard random walk algorithm. Starting from a node in the graph, each step presents two choices: randomly select an adjacent node or return to the starting node. The algorithm includes a parameter 'a' as the restart probability, where 1-a represents the probability of moving to an adjacent node. After iterations, it reaches a stationary state, and the resulting probability distribution can be considered as a distribution influenced by the starting node. The Restart Random Walk can capture various relationships between two nodes and capture the overall structural information of the graph.

[0079] 3) Community Detection Algorithm

[0080] Most community detection algorithms are based on iterative bisection, the basic idea of ​​which is to divide the graph into two subgraphs, then iterate, and finally obtain the required number of subgraphs. Classic algorithms include the Kernighan-Lin algorithm and the spectral bisection algorithm.

[0081] The KL (Kernighan-Lin) algorithm is a binary search method that divides a known network into two communities of a known size. It is a greedy algorithm. Its main idea is to define a gain function Q for the network partitioning, where Q represents the difference between the number of edges within a community and the number of edges between communities. The algorithm then finds the partitioning method that maximizes the gain function Q. Specifically, the strategy involves moving nodes from one community to another or swapping nodes between different community structures. The search starts from the initial solution and continues until no better candidate solution is found from the current solution, at which point the search stops.

[0082] When two community structures exist in a network, nodes can be partitioned based on the element values ​​in the eigenvectors corresponding to non-zero eigenvalues. Nodes corresponding to all positive elements are grouped into one community structure, while nodes corresponding to all negative elements are grouped into another community structure.

[0083] The spectral bisection algorithm utilizes the properties of the eigenvalues ​​and eigenvectors of the Laplace matrix to partition communities. The smaller the value of the second smallest eigenvalue λ² of the Laplace matrix, the better the partitioning effect. Therefore, the spectral bisection method uses the second smallest eigenvalue of the Laplace matrix to partition communities.

[0084] Figure 1 This is a schematic diagram illustrating a target user account identification system according to an exemplary embodiment. The target user account identification system includes a terminal 110 and a platform server 120.

[0085] Users can access the platform scenario corresponding to the platform server 120 on terminal 110, and users can perform business within the platform scenario.

[0086] After a user enters the platform scenario, the platform server 120 can record the user's static attributes and behavioral attributes within the platform scenario.

[0087] Among them, behavioral attributes can include user account behavior data in the platform scenario, and static attributes can include the user's basic attributes.

[0088] The platform server 120 may include a memory that can be used to store various behavioral attributes.

[0089] Terminal 110 can transmit data with platform server 120 via wired or wireless network.

[0090] Platform server 120 can be a single server, a server cluster consisting of several servers, or it can contain one or more virtualization platforms, or it can be a cloud computing service center.

[0091] The platform server 120 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, etc., but is not limited to these. The terminal and server can be directly or indirectly connected via wired or wireless communication, which is not limited herein.

[0092] Optionally, the wired or wireless networks described above use standard communication technologies and / or protocols. The network is typically the Internet, but can also be any network, including but not limited to any combination of Local Area Networks (LANs), Metropolitan Area Networks (MANs), Wide Area Networks (WANs), mobile wireless networks, private networks, or Virtual Private Networks. In some embodiments, technologies and / or formats including Hyper Text Markup Language (HTML), Extensible Markup Language (XML), etc., are used to represent data exchanged over the network. Furthermore, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Networks (VPNs), and Internet Protocol Security (IPsec) can be used to encrypt all or some links. In other embodiments, custom and / or dedicated data communication technologies can be used to replace or supplement the aforementioned data communication technologies.

[0093] Figure 2 This is a flowchart illustrating a target user account identification method according to an exemplary embodiment. The target user account identification method can be executed by a computer device. The computer device can be the one described above. Figure 1 The system shown includes platform server 120. (For example...) Figure 2 As shown, the target user account identification method includes the following steps:

[0094] In step 201, the behavior record information of each user account is obtained. The behavior record information is used to indicate the various behavioral attributes of the operation behavior.

[0095] In step 202, a weighted undirected graph corresponding to each behavioral attribute is generated based on the behavioral record information of each user account; the weighted undirected graph is used to indicate the similarity of each user account under the corresponding behavioral attribute.

[0096] Optionally, the aforementioned weighted undirected graph consists of account vertices corresponding to each user account and edges between these account vertices. Each edge in the weighted undirected graph corresponds to two account vertices, and the weight of the edge represents the similarity between the user accounts corresponding to these two account vertices under the corresponding behavioral attributes.

[0097] In the embodiments of this application, each behavioral attribute corresponds to a weighted undirected graph. In the weighted undirected graphs corresponding to different behavioral attributes, the weights of the edges between the same two account vertices may be the same or different.

[0098] In step 203, community discovery processing is performed on the weighted undirected graphs corresponding to each behavioral attribute to obtain the community set for each behavioral attribute. The community set contains the user account communities divided according to the corresponding behavioral attribute.

[0099] In this embodiment of the application, each user account community contains at least two user accounts, indicating that the user accounts in the user account community are similar under the corresponding behavioral attributes.

[0100] In step 204, a community score is obtained for each user account community based on the behavioral attributes of the user accounts in each user account community.

[0101] Optionally, the community score of the user account community indicates the probability that a user account in the user account community is the target user account.

[0102] In step 205, the account rating of each user account is obtained based on the community rating of each user account community.

[0103] In step 206, the target user account is identified from the user accounts based on the account rating of each user account.

[0104] In summary, by classifying user accounts into communities based on different behavioral attributes, and then scoring each community based on the behavioral attributes of user accounts within each community, and further scoring the user account based on the community scores, target user accounts can be identified. Since the community classification of user accounts may differ under different behavioral attributes, the above-mentioned solution comprehensively determines the account score of user accounts based on the community classification of user accounts under different behavioral attributes, taking into account the possibility that non-target user accounts and target user accounts may have similarities in a few behavioral attributes, thus improving the accuracy of target user account identification.

[0105] Figure 3 This is a schematic diagram illustrating a target user account identification method according to an exemplary embodiment. The method can be executed by a computer device; for example, the computer device may be... Figure 1 The platform server of the system shown. For example... Figure 3 As shown, the target user account identification method includes the following steps:

[0106] In step 301, the behavior record information of each user account is obtained.

[0107] In this embodiment of the disclosure, the computer device can obtain the behaviors of each user account on the social network platform and the various attribute information associated with the behaviors, as behavior record information.

[0108] Among them, behavior record information can be used to indicate various behavioral attributes of operational behaviors.

[0109] In one possible implementation, the behavioral attribute may include at least one of the first type of attribute and the second type of attribute.

[0110] The first type of attribute is an attribute whose corresponding value is correlated within the range of values.

[0111] For example, the first type of attribute may include at least one of the following: user identity attribute, user behavior type attribute, user behavior time attribute, user Internet Protocol (IP) address attribute, and version number attribute.

[0112] The second type of attribute is one whose value increases logarithmically in the value space.

[0113] For example, the second type of attribute can include user behavior count attributes.

[0114] For example, a user identification attribute can be the identity document (ID) of the user who generates an event on the platform. For instance, if user A's ID is A, when user A performs a certain operation on the platform, the user ID in user A's behavior record information can be recorded as A.

[0115] The user behavior type attribute can be the type of event generated by a user's operation on the platform. For example, if user A logs in to an account on the platform, the corresponding user behavior type attribute in the user A behavior record information can be recorded as "account login".

[0116] User behavior time attributes can be at least one of the start time, end time, and duration of an event generated by a user's operation on the platform. For example, the start time of user A's account login operation on the platform can be recorded as the user behavior time attribute in user A's behavior record information.

[0117] In one possible implementation, the user's behavior record information is obtained by the platform from the terminal side of each user, or the user's behavior record information is obtained by the platform from a real-time updated database.

[0118] The behavioral record information of each user can be stored in a database on the platform server, which can be updated in real time. Alternatively, the behavioral record information of each user can be stored in the storage of the platform server, which can be updated in real time and then stored in the storage.

[0119] In step 302, based on the attribute value of the second behavior attribute in the behavior record information of each user account, a bipartite graph of account attributes corresponding to the second behavior attribute is generated.

[0120] The second behavioral attribute can be any one of the behavioral attributes; the bipartite graph of the account attribute corresponding to the second behavioral attribute includes the account vertices corresponding to each user account, the attribute value vertices corresponding to the various attribute values ​​of the second behavioral attribute, and the edges between the account vertices and the attribute value vertices.

[0121] The edge between the account vertex and the attribute value vertex can be used to indicate that the corresponding user account has the corresponding attribute value.

[0122] In one possible implementation, before generating the bipartite graph of the account attributes corresponding to the second-row attribute, if the second-row attribute is a first-class attribute, the vertices of each attribute value can be merged using an adaptive segmentation method.

[0123] The adaptive segmentation method may include: first, converting the attribute value corresponding to the second row to a number system; then, dividing the attribute value into at least one category according to the value of the highest digit of the attribute value; next, obtaining the number of users in at least one category; comparing the number of users in at least one category with a first threshold to obtain the comparison result; and finally, merging the attribute values ​​according to the comparison result.

[0124] Each attribute value can be converted into a binary representation.

[0125] For example, when the second row is an IP address attribute, the corresponding IP address values ​​are converted into binary representations. Starting from the highest bit, each attribute value is divided into two categories: one with the highest bit being 0 and the other with the highest bit being 1. The number of users with the corresponding attribute values ​​in these two categories is determined. If the number of users is less than the first threshold, the attribute values ​​of that category are merged. If the number of users is greater than or equal to the first threshold, the highest bit of the attribute value of that category is removed, and recursive processing is performed.

[0126] For example, such as Figure 4As shown, the second row represents IP address attributes. The user account vertices are u0, u1, u2, and u3. The attribute value corresponding to u1 is 11.2.3.4, the attribute value corresponding to u2 is 34.5.6.7, the attribute values ​​corresponding to u3 are 124.7.7.7 and 124.7.8.9, and the attribute values ​​corresponding to u0 are 164.0.1.2 and 164.0.1.9. Each IP address is converted into a binary representation, and the first threshold is set to 4. Based on whether the highest bit of the attribute value is 0 or 1, the attribute values ​​are divided into two categories. If the number of users with the corresponding attribute value is less than 4, the attribute values ​​corresponding to u1, u2, and u3 can be merged. The attribute value corresponding to u0 can be merged again with the merged attribute value of u1, u2, and u3 to obtain a merged attribute value where the number of users equals the first threshold.

[0127] In another possible implementation, before generating the bipartite graph of account attributes corresponding to the second-row attribute, when the second-row attribute is a second-class attribute, the vertices of each attribute value are merged using the exponential growth segmentation method.

[0128] The exponential growth segmentation method may include dividing the interval length according to the obtained attribute values, and then merging the attribute values ​​according to the determined interval length.

[0129] For example, when counting the behavior type of login as the second behavior attribute, the vertices of each attribute value can be merged using an exponentially growing segmentation method. When the count value is less than 10, it can be divided using intervals of length 1, resulting in ten different attribute values ​​from 0 to 9 corresponding to the behavior type. When the count value is between 10 and 30, it can be divided using 10 intervals of length 2. Similarly, it can be divided into seven intervals: 30 to 60, 60 to 100, 100 to 150, 150 to 300, 300 to 500, 500 to 1000, and above 1000. Each interval can be further divided into 10 intervals using lengths of 3, 4, 5, 10, 20, 50, and infinitely long.

[0130] In one possible implementation, in the process of generating the bipartite graph of the account attribute corresponding to the second behavior attribute based on the behavior record information, it is first necessary to obtain the account vertex corresponding to each user account, the attribute value vertex corresponding to the various attribute values ​​of the second behavior attribute, the edge between the account vertex and the attribute value vertex, and the edge weight between the account vertex and the corresponding attribute value.

[0131] In one possible implementation, the account vertices corresponding to each user account can form a user account set U, and the attribute value vertices corresponding to the various attribute values ​​of the second behavior attribute can form an attribute value set V. The user account set U and the attribute value set V are obtained by reading behavior record information.

[0132] Among them, the user account set is a set containing each user vertex, the attribute value can be the attribute value corresponding to a certain type of attribute information, the attribute value set can be obtained according to the type of attribute information, and the attribute value set corresponding to each type of attribute information can include each attribute value of the corresponding type of attribute information.

[0133] In one possible implementation, for different types of behavioral attributes, a user can correspond to one or more attribute values, and the edge weights of the user and the corresponding attribute values ​​are all set to 1. The set of each edge weight can form an edge set E.

[0134] For example, when the type of attribute information is IP address, and any user can correspond to one or more attribute values, we can obtain a user set composed of each user, and obtain a set of attribute values ​​for each IP address composed of several IP addresses corresponding to each user.

[0135] For example, such as Figure 5 As shown, based on the behavior records of users A, B, C, and D, we can obtain the user vertices as users A, B, C, and D. The attribute values ​​of the IP addresses corresponding to these users are 164.0.1.2, 164.0.1.9, 11.2.3.4, 34.5.6.7, 124.7.7.7, and 124.7.8.9, which are six different IP addresses. These six IP addresses can be combined into an attribute value set.

[0136] In one possible implementation, merging attribute values ​​through two methods can create a bipartite graph of account attributes, such as... Figure 6 As shown, B = (U, V, E) is used. At least one of the attribute values ​​a, b, and c is included, and these values ​​represent the merged attribute values.

[0137] In step 303, a first transition probability matrix and a second transition probability matrix are generated based on the bipartite graph of account attributes corresponding to the second behavioral attribute.

[0138] In this embodiment of the disclosure, in the process of transforming the bipartite graph of account attributes into a weighted undirected graph from user to user, it is necessary to determine the transition probability matrix.

[0139] The first transition probability matrix can be used to indicate the probability of each account vertex transitioning to each attribute value vertex; the second transition probability matrix can be used to indicate the probability of each attribute value vertex transitioning to each account vertex.

[0140] In one possible implementation, the method for generating the first transition probability matrix can be to obtain the weight of each attribute value vertex based on the number of its neighboring vertices, where the neighboring vertices of each attribute value vertex are account vertices connected to the attribute value vertex by edges. Then, based on the weights of the neighboring vertices of each account vertex, the weight of each account vertex can be obtained, where the neighboring vertices of each account vertex are attribute value vertices connected to the account vertex by edges. Finally, based on the weights of each attribute value vertex and the weights of each account vertex, the first transition probability matrix can be generated.

[0141] In one possible implementation, the second transition probability matrix can be generated based on the number of neighboring vertices of each attribute value vertex.

[0142] The method for calculating the weight of attribute values ​​can be as follows:

[0143] H v =log2|Γ v |

[0144] Among them, H v Γ represents the weight of the attribute value. v The number of neighboring attribute values.

[0145] The first transition probability matrix can be calculated as follows.

[0146]

[0147] Where, N u Γ is the sum of the weights of all neighboring vertices of the account vertex. v N is the set of neighboring vertices for a specific attribute value. u The calculation can be performed using the method shown below.

[0148]

[0149] For example, since the user's malicious intent is not preset, the weight of the user account can be preset to 1, and the second transition probability matrix can be calculated as follows.

[0150]

[0151] In step 304, based on the first transition probability matrix and the second transition probability matrix, a weighted undirected graph corresponding to the second row attribute is generated by a random walk with restart.

[0152] In this embodiment of the disclosure, the probability of each account vertex moving to each attribute value vertex and the probability of each attribute value vertex moving to each account vertex can be determined. Based on the probability of each account vertex moving to each account vertex, a weighted undirected graph corresponding to the second row attribute is generated by performing a random walk algorithm with restart, starting from each account vertex.

[0153] In one possible implementation, the first transition probability matrix is ​​multiplied by the second transition probability matrix to obtain the third transition probability matrix.

[0154] The third transition probability matrix can be used to indicate the transition probability between each account vertex.

[0155] In one possible implementation, a random walk with restart is performed between each account vertex based on the third transition probability matrix to obtain the probability distribution between each account vertex. Then, the probability distribution between each account vertex is superimposed on the weight of the edge between each account vertex to obtain the weighted undirected graph corresponding to the second row attribute.

[0156] The third transition probability matrix can be represented by A, the first transition probability matrix by S, and the second transition probability matrix by T. Multiplying the first and second transition probability matrices yields the third transition probability matrix, i.e., A = S * T.

[0157] For example, the calculation method for performing a random walk with restart starting from each account vertex can be as follows:

[0158]

[0159] in, It is the probability distribution of a random walk with restarts starting from account u on the user vertex set, 1 u It is a unit probability distribution vector where only account vertex u is 1 and all other account vertices are zero, and α is the restart probability of the random walk algorithm with restart.

[0160] The calculated probability distribution is then added to the weights of the edges connecting the starting point and all other account vertices. This can be calculated using the formula described below.

[0161]

[0162] Among them, w u1,u2 and w u2,u1 Let u1 be the edge weight between account vertex u1 and account vertex u2.

[0163] In one possible implementation, the above calculations can be used to construct a weighted undirected graph from user account to user account, represented by G = (U, W).

[0164] In step 305, community detection is performed on the weighted undirected graphs corresponding to each behavioral attribute to obtain the community set for each behavioral attribute.

[0165] In this embodiment of the disclosure, the weighted undirected graphs corresponding to each behavioral attribute are processed according to the community detection algorithm to obtain a community set composed of communities corresponding to each behavioral attribute.

[0166] The community set can include various user account communities categorized according to their corresponding behavioral attributes.

[0167] In one possible implementation, a clustering algorithm is used to process the weighted undirected graphs corresponding to each behavioral attribute, resulting in a set of communities composed of communities corresponding to each behavioral attribute.

[0168] For example, the user accounts being detected include user accounts A, B, C, and D. Based on the user behavior type attribute, user accounts A and B can be divided into community 1, and user accounts C and D into community 2. Community 1 and community 2 can be combined to form the community set corresponding to the user behavior type attribute. Based on the user behavior time attribute, user accounts A and D can be divided into community 3, and user accounts B and C into community 4. Community 3 and community 4 can be combined to form the community set corresponding to the user behavior time attribute.

[0169] In step 306, the number of target attribute values ​​for each user account in the target community is obtained.

[0170] The target community can be any community among the user account communities, and the number of target attribute values ​​can be the number of attribute values ​​corresponding to the first row of attributes.

[0171] The first behavioral attribute can be the behavioral attribute corresponding to the target community.

[0172] For example, if the detected user accounts include user accounts A, B, C, and D, based on the version number attribute, user accounts A and B can be divided into Community 1, and user accounts C and D into Community 2. Among them, user account A has three version numbers: x, y, and z, and user account B has two version numbers: x and d. If Community 1 is taken as the target community, the platform obtains the number of version numbers that user accounts A and B each have in Community 1. It can be found that the number of target attribute values ​​for user account A is 3, and the number of target attribute values ​​for user account B is 2.

[0173] In step 307, the standard deviation of the number of attribute values ​​of the target community is obtained.

[0174] In this embodiment of the disclosure, the standard deviation of the number of target attribute values ​​corresponding to each user account in the target community is calculated.

[0175] Among them, the standard deviation of the number of attribute values ​​is the standard deviation of the number of target attribute values ​​for each user account in the target community.

[0176] For example, if the target community contains user accounts A, B, C, and D, and the number of target attribute values ​​obtained for user accounts A, B, C, and D are 5, 5, 6, and 8 respectively, the standard deviations corresponding to user accounts A, B, C, and D can be calculated using the standard deviation calculation formula.

[0177] In step 308, the standard deviation of the number of attribute values ​​for each user account community corresponding to the first row attribute is normalized.

[0178] In this embodiment of the disclosure, by obtaining the standard deviation of the number of attribute values ​​of each user account community corresponding to the first row attribute, comparing the standard deviation of the number of attribute values ​​of each user account community, determining the maximum and minimum standard deviation, and normalizing the standard deviation of each community and the maximum standard deviation of that community.

[0179] In one possible implementation, the maximum standard deviation σ in the community corresponding to the first row attribute is calculated. max and the minimum standard deviation σ ,on The standard deviation is normalized using the formula shown below.

[0180]

[0181] Here, s(c) can be used as the normalization result, σ is the standard deviation parameter, and σ(c) is the standard deviation parameter of a specific community.

[0182] In one possible implementation, s(c) can be used to represent the community rating, which can be used to measure the community rating of each community, thereby reflecting the degree of malice of each community.

[0183] In step 309, the normalized result of the standard deviation of the number of attribute values ​​of the target community is used as the community score of the target community.

[0184] In one possible implementation example, the platform server maps the standard deviation normalization result corresponding to the target community to the community score of the target community.

[0185] The larger the value corresponding to the standard deviation normalization result, the higher the homogeneity of the user accounts' behavior attribute in the community, and the higher the degree of malice in the community.

[0186] In step 310, the community rating of the community where the target user account is located is obtained.

[0187] The target user account can be any one of the various user accounts.

[0188] In one possible implementation, the target user account has a community rating in at least one community, where each community rating represents the degree of malice of the target user account's behavioral attributes in that community.

[0189] For example, it is possible to obtain the community rating of target user account A in a community based on IP address attributes, or it is possible to obtain the community rating of target user account A in a community based on version number attributes.

[0190] In step 311, a high-dimensional space vector of the target user account is constructed based on the community score of the community where the target user account is located.

[0191] In this embodiment of the disclosure, the community ratings of each community to which the target user account belongs, and the weights of the behavioral attributes corresponding to each community in calculating the ratings, can together constitute a high-dimensional space vector of the target user account.

[0192] In step 312, the account score of the target user account is obtained based on the high-dimensional space vector of the target user account.

[0193] In one possible implementation, the normalized length of the high-dimensional vector of the target user account is used as the account score of the target user account.

[0194] The account score can be represented by the normalized length of the high-dimensional vector of the target user's account. The normalized length of the high-dimensional vector of the target user's account can be calculated using the formula described below.

[0195]

[0196] Where s(u) is the account rating of the target user account, and Φ is the set of behavioral attributes. It refers to a specific behavioral attribute.

[0197] In step 313, the target user account is identified from the user accounts based on the account rating of each user account.

[0198] In this embodiment of the disclosure, malicious accounts can be identified from each user account by comparing the account ratings of each user account.

[0199] In one possible implementation, user accounts whose corresponding account scores are greater than a preset threshold are identified as target user accounts.

[0200] In another possible implementation, user accounts whose corresponding account rating is greater than the average rating are identified as target user accounts.

[0201] The average rating is the average of the ratings for each user account.

[0202] In summary, by classifying user accounts into communities based on different behavioral attributes, and then scoring each community based on the behavioral attributes of user accounts within each community, and further scoring the user account based on the community scores, target user accounts can be identified. Since the community classification of user accounts may differ under different behavioral attributes, the above-mentioned solution comprehensively determines the account score of user accounts based on the community classification of user accounts under different behavioral attributes, taking into account the possibility that non-target user accounts and target user accounts may have similarities in a few behavioral attributes, thus improving the accuracy of target user account identification.

[0203] Figure 7 This is a flowchart illustrating a target user account identification method according to an exemplary embodiment. In online social networking platforms, to protect users' assets and privacy, the platform server can identify malicious user accounts through the flowchart of this target user account identification method. Figure 7 As shown, the platform server can obtain behavior record information containing the behavior attributes of user accounts based on the user account behavior information (S71). Based on the obtained behavior record information of each user account, a bipartite graph of account attributes corresponding to each user's behavior attributes is constructed. This bipartite graph of account attributes can intuitively observe the relationship between user accounts and attribute values. The attribute values ​​corresponding to each behavior attribute can be merged according to the adaptive segmentation method and the exponential growth segmentation method respectively (S72). Then, through a random walk algorithm with restart, a weighted undirected graph from user to user can be generated (S73). Through a clustering algorithm, such as a community detection algorithm, the user accounts in the weighted undirected graph can be divided into several communities (S74). Based on the standard deviation of the distribution of each attribute value in the community, several communities can be scored to judge the degree of malice of the community (S75). Then, based on the community scores of each account in each community, a high-dimensional space vector is constructed, and the length of the high-dimensional space vector is calculated as the account score of the user account. This account score is used to represent the degree of malice of the user account (S76). Finally, based on the account ratings of each user account, the malicious accounts (S77) among each user account are identified to facilitate subsequent network security maintenance.

[0204] Figure 8 This is a structural block diagram of a target user account identification device according to an exemplary embodiment. The target user account identification device can be implemented in whole or in part as part of a computer device through hardware or a combination of hardware and software, to perform... Figure 3 or Figure 4 The corresponding steps of the method shown in the embodiments. The target user account identification device may include:

[0205] The information acquisition module 810 is used to acquire the behavior record information of each user account, and the behavior record information is used to indicate various behavioral attributes of the operation behavior;

[0206] The undirected graph generation module 820 is used to generate a weighted undirected graph corresponding to each of the behavioral attributes based on the behavioral record information of each user account; the weighted undirected graph is used to indicate the similarity of each user account under the corresponding behavioral attributes.

[0207] The community set acquisition module 830 is used to perform community discovery processing on the weighted undirected graphs corresponding to each of the behavioral attributes to obtain the community set for each of the behavioral attributes. The community set contains each user account community divided according to the corresponding behavioral attribute.

[0208] The community rating acquisition module 840 is used to acquire the community rating of each user account community based on the behavioral attributes of the user accounts in each user account community;

[0209] The account rating acquisition module 850 is used to acquire the account rating of each user account based on the community rating of each user account community.

[0210] The target identification module 860 is used to identify the target user account from the user accounts based on the account rating of each user account.

[0211] In one possible implementation, the community rating acquisition module 840 includes:

[0212] The quantity acquisition submodule is used to acquire the quantity of target attribute values ​​for each user account in the target community; the target community is any one of the user account communities; the quantity of target attribute values ​​is the quantity of attribute values ​​corresponding to the first behavioral attribute; the first behavioral attribute is the behavioral attribute corresponding to the target community;

[0213] The standard deviation acquisition submodule is used to acquire the standard deviation of the number of attribute values ​​in the target community. The standard deviation of the number of attribute values ​​is the standard deviation of the number of target attribute values ​​of each user account in the target community.

[0214] The community rating acquisition submodule is used to obtain the community rating of the target community based on the standard deviation of the number of attribute values ​​of the target community.

[0215] In one possible implementation, the community rating acquisition submodule includes:

[0216] The quantity processing unit is used to normalize the standard deviation of the quantity of attribute values ​​of each user account community corresponding to the first behavioral attribute.

[0217] The community scoring unit is used to take the normalized result of the standard deviation of the number of attribute values ​​of the target community as the community score of the target community.

[0218] In one possible implementation, the account rating acquisition module 850 includes:

[0219] The target community rating acquisition submodule is used to obtain the community rating of the community where the target user account is located; the target user account is any one of the user accounts.

[0220] The vector construction submodule is used to construct a high-dimensional space vector of the target user account based on the community rating of the community to which the target user account belongs;

[0221] The account rating acquisition submodule is used to obtain the account rating of the target user account based on the high-dimensional space vector of the target user account.

[0222] In one possible implementation, the account rating acquisition submodule includes:

[0223] The account rating determination unit is used to take the normalized length of the high-dimensional space vector of the target user account as the account rating of the target user account.

[0224] In one possible implementation, the undirected graph generation module 820 includes:

[0225] The bipartite graph generation submodule is used to generate an account attribute bipartite graph corresponding to the second behavior attribute based on the attribute values ​​of the second behavior attribute in the behavior record information of each user account. The second behavior attribute is any one of the various behavior attributes. The account attribute bipartite graph corresponding to the second behavior attribute includes account vertices corresponding to each user account, attribute value vertices corresponding to various attribute values ​​of the second behavior attribute, and edges between the account vertices and the attribute value vertices. The edges between the account vertices and the attribute value vertices are used to indicate that the corresponding user account has the corresponding attribute value.

[0226] The undirected graph generation submodule is used to generate a weighted undirected graph corresponding to the second behavioral attribute based on the bipartite graph of the account attribute corresponding to the second behavioral attribute.

[0227] In one possible implementation, the undirected graph generation submodule includes:

[0228] The transition probability matrix generation unit is used to generate a first transition probability matrix and a second transition probability matrix based on the bipartite graph of the account attributes corresponding to the second behavioral attribute; the first transition probability matrix is ​​used to indicate the probability of each account vertex transitioning to each attribute value vertex; the second transition probability matrix is ​​used to indicate the probability of each attribute value vertex transitioning to each account vertex.

[0229] An undirected graph generation unit is used to generate a weighted undirected graph corresponding to the second behavioral attribute by means of a random walk with restart, based on the first transition probability matrix and the second transition probability matrix.

[0230] In one possible implementation, the transition probability matrix generating unit is used for,

[0231] The weight of each attribute value vertex is obtained based on the number of its neighboring vertices; the neighboring vertices of each attribute value vertex are account vertices connected to the attribute value vertex by an edge.

[0232] The weight of each account vertex is obtained based on the weight of its neighboring vertices; the neighboring vertices of each account vertex are attribute value vertices connected to the account vertex by edges.

[0233] The first transition probability matrix is ​​generated based on the weights of each attribute value vertex and the weights of each account vertex.

[0234] The second transition probability matrix is ​​generated based on the number of neighboring vertices of each vertex with said attribute value.

[0235] In one possible implementation, the undirected graph generation unit is used for,

[0236] Multiplying the first transition probability matrix by the second transition probability matrix yields a third transition probability matrix, which is used to indicate the transition probability between each of the account vertices;

[0237] Based on the third transition probability matrix, a random walk with restart is performed between each of the account vertices to obtain the probability distribution between each of the account vertices;

[0238] The probability distributions between the account vertices are superimposed onto the weights of the edges between the account vertices to obtain the weighted undirected graph corresponding to the second behavioral attribute.

[0239] In one possible implementation, the device further includes:

[0240] The first attribute value merging module is used to merge the vertices of each attribute value using an adaptive segmentation method before generating the weighted undirected graph corresponding to the second behavior attribute based on the bipartite graph of the account attribute corresponding to the second behavior attribute, in response to the second behavior attribute being a first type of attribute; the first type of attribute is an attribute whose corresponding attribute value is correlated within the value range;

[0241] or,

[0242] The second attribute value merging module is used to merge the attribute value vertices by means of an exponential growth segmentation method in response to the second behavior attribute being a second type attribute. The second type attribute is the attribute whose corresponding attribute value exhibits a logarithmic growth trend in the value space.

[0243] In one possible implementation, the target recognition module 860 includes:

[0244] The first target identification submodule is used to identify user accounts with a corresponding account score greater than a preset threshold as the target user accounts.

[0245] or,

[0246] The second target identification submodule is used to identify the user accounts whose corresponding account scores are greater than the average score among the user accounts as the target user accounts; the average score is the average of the account scores of the user accounts.

[0247] In summary, by classifying user accounts into communities based on different behavioral attributes, and then scoring each community based on the behavioral attributes of user accounts within each community, and further scoring the user account based on the community scores, target user accounts can be identified. Since the community classification of user accounts may differ under different behavioral attributes, the above-mentioned solution comprehensively determines the account score of user accounts based on the community classification of user accounts under different behavioral attributes, taking into account the possibility that non-target user accounts and target user accounts may have similarities in a few behavioral attributes, thus improving the accuracy of target user account identification.

[0248] Figure 9This is a schematic diagram illustrating the structure of a computer device according to an exemplary embodiment. The computer device 900 includes a Central Processing Unit (CPU) 901, a system memory 904 including Random Access Memory (RAM) 902 and Read-Only Memory (ROM) 903, and a system bus 905 connecting the system memory 904 and the CPU 901. The computer device 900 also includes a basic input / output system (I / O system) 906 that facilitates information transfer between various components within the computer device, and a mass storage device 907 for storing an operating system 913, application programs 914, and other program modules 915.

[0249] The basic input / output system 906 includes a display 908 for displaying information and an input device 909 for user input, such as a mouse or keyboard. Both the display 908 and the input device 909 are connected to the central processing unit 901 via an input / output controller 910 connected to the system bus 905. The basic input / output system 906 may also include the input / output controller 910 for receiving and processing input from multiple other devices such as a keyboard, mouse, or electronic stylus. Similarly, the input / output controller 910 also provides output to a display screen, printer, or other types of output devices.

[0250] The mass storage device 907 is connected to the central processing unit 901 via a mass storage controller (not shown) connected to the system bus 905. The mass storage device 907 and its associated computer device-readable media provide non-volatile storage for the computer device 900. That is, the mass storage device 907 may include computer device-readable media (not shown), such as a hard disk or a compact disc read-only memory (CD-ROM) drive.

[0251] Without loss of generality, the computer device readable medium may include computer device storage media and communication media. Computer device storage media include volatile and non-volatile, removable and non-removable media implemented using any method or technology for storing information such as computer device readable instructions, data structures, program modules, or other data. Computer device storage media include RAM, ROM, erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), CD-ROM, digital video disc (DVD) or other optical storage, magnetic tape cassettes, magnetic tape, disk storage, or other magnetic storage devices. Of course, those skilled in the art will recognize that the computer device storage media are not limited to the above-mentioned types. The system memory 904 and mass storage device 907 described above can be collectively referred to as memory.

[0252] According to various embodiments of this disclosure, the computer device 900 can also be connected to a remote computer device on a network, such as the Internet. That is, the computer device 900 can be connected to a network 912 via a network interface unit 911 connected to the system bus 905, or it can use the network interface unit 911 to connect to other types of networks or remote computer device systems (not shown).

[0253] The memory also includes one or more programs, which are stored in the memory, and the central processing unit 901 implements these programs by executing them. Figure 3 or Figure 4 All or part of the steps of the method shown.

[0254] Those skilled in the art will recognize that the functions described in the embodiments of this disclosure in one or more of the foregoing examples can be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions can be stored in a computer device-readable medium or transmitted as one or more instructions or code on a computer device-readable medium. A computer device-readable medium includes computer device storage media and communication media, wherein a communication medium includes any medium that facilitates the transmission of a computer device program from one location to another. A storage medium can be any available medium accessible by a general-purpose or special-purpose computer device.

[0255] This disclosure also provides a computer device storage medium for storing computer device software instructions used by the above-described testing apparatus, which includes a program designed to execute the above-described target user account identification method.

[0256] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the following claims.

[0257] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A method for identifying target user accounts, characterized in that, The method is performed by a computer device, and the method includes: Obtain the behavior record information of each user account. The behavior record information is used to indicate various behavior attributes of the operation behavior. The behavior attributes include at least one of the following: user identity attribute, user behavior type attribute, user behavior time attribute, user Internet protocol address attribute, version number attribute, and user behavior count attribute. Based on the attribute values ​​of the second behavior attribute in the behavior record information of each user account, a bipartite graph of account attributes corresponding to the second behavior attribute is generated. The second behavior attribute is any one of the various behavior attributes. The bipartite graph of account attributes corresponding to the second behavior attribute includes account vertices corresponding to each user account, attribute value vertices corresponding to various attribute values ​​of the second behavior attribute, and edges between the account vertices and the attribute value vertices. The edges between the account vertices and the attribute value vertices are used to indicate that the corresponding user account has the corresponding attribute value. Based on the bipartite graph of account attributes corresponding to the second behavioral attribute, a first transition probability matrix and a second transition probability matrix are generated. The first transition probability matrix indicates the probability of each account vertex transitioning to each attribute value vertex. The first transition probability matrix is ​​generated based on the weights of the attribute value vertices in the bipartite graph of account attributes, where the weight of each attribute value vertex includes the logarithm of the number of neighboring attribute values ​​of the attribute value vertex. The second transition probability matrix indicates the probability of each attribute value vertex transitioning to each account vertex. The second transition probability matrix is ​​generated based on the weights of the account vertices in the bipartite graph of account attributes, where different account vertices use the same weights. Based on the first transition probability matrix and the second transition probability matrix, a weighted undirected graph corresponding to the second behavioral attribute is generated by a random walk with restart; the weighted undirected graph is used to indicate the similarity of each user account under the corresponding behavioral attribute. Community discovery processing is performed on the weighted undirected graphs corresponding to each of the aforementioned behavioral attributes to obtain the community set for each of the aforementioned behavioral attributes. The community set contains the user account communities divided according to the corresponding behavioral attributes. Based on the behavioral attributes of user accounts in each user account community, a community score is obtained for each user account community. The community score of the user account community is used to indicate the degree of malice of the user account community. Based on the community rating of each user account, the account rating of each user account is obtained, and the account rating of each user account is used to indicate the degree of malice of each user account. Based on the account ratings of each user account, malicious user accounts are identified from among the user accounts.

2. The method according to claim 1, characterized in that, The process of obtaining community scores for each user account community based on the behavioral attributes of user accounts in each user account community includes: Obtain the number of target attribute values ​​for each user account in the target community; the target community is any one of the user account communities; the number of target attribute values ​​is the number of attribute values ​​corresponding to the first behavioral attribute; the first behavioral attribute is the behavioral attribute corresponding to the target community; Obtain the standard deviation of the number of attribute values ​​in the target community, where the standard deviation of the number of target attribute values ​​for each user account in the target community is the standard deviation of the number of target attribute values. The community score of the target community is obtained based on the standard deviation of the number of attribute values ​​of the target community.

3. The method according to claim 2, characterized in that, The step of obtaining the community score of the target community based on the standard deviation of the number of attribute values ​​of the target community includes: The standard deviation of the number of attribute values ​​for each user account community corresponding to the first behavioral attribute is normalized. The normalized result of the standard deviation of the number of attribute values ​​of the target community is used as the community score of the target community.

4. The method according to any one of claims 1 to 3, characterized in that, The process of obtaining the account rating for each user account based on the community rating of each user account community includes: Obtain the community rating of the community where the target user account is located; the target user account is any one of the user accounts. Based on the community rating of the community where the target user account is located, a high-dimensional space vector of the target user account is constructed; The account score of the target user account is obtained based on the high-dimensional space vector of the target user account.

5. The method according to claim 4, characterized in that, The step of obtaining the account score of the target user account based on the high-dimensional space vector of the target user account includes: The normalized length of the high-dimensional space vector of the target user account is used as the account score of the target user account.

6. The method according to any one of claims 1 to 3, characterized in that, The step of generating a first transition probability matrix and a second transition probability matrix based on the bipartite graph of account attributes corresponding to the second behavioral attribute includes: The weight of each attribute value vertex is obtained based on the number of its neighboring vertices; the neighboring vertices of each attribute value vertex are account vertices connected to the attribute value vertex by an edge. The weight of each account vertex is obtained based on the weight of its neighboring vertices; the neighboring vertices of each account vertex are attribute value vertices connected to the account vertex by edges. The first transition probability matrix is ​​generated based on the weights of each attribute value vertex and the weights of each account vertex. The second transition probability matrix is ​​generated based on the number of neighboring vertices of each vertex with said attribute value.

7. The method according to any one of claims 1 to 3, characterized in that, The step of generating a weighted undirected graph corresponding to the second behavioral attribute based on the first transition probability matrix and the second transition probability matrix, through a random walk with restart, includes: Multiplying the first transition probability matrix by the second transition probability matrix yields a third transition probability matrix, which is used to indicate the transition probability between each of the account vertices; Based on the third transition probability matrix, a random walk with restart is performed between each of the account vertices to obtain the probability distribution between each of the account vertices; The probability distributions between the account vertices are superimposed onto the weights of the edges between the account vertices to obtain the weighted undirected graph corresponding to the second behavioral attribute.

8. The method according to any one of claims 1 to 3, characterized in that, Before generating the weighted undirected graph corresponding to the second behavioral attribute based on the bipartite graph of the account attribute corresponding to the second behavioral attribute, the process also includes: In response to the second behavioral attribute being a first type of attribute, the vertices of each attribute value are merged using an adaptive segmentation method; the first type of attribute is an attribute whose corresponding attribute values ​​are correlated within the value range. or, In response to the second behavior attribute being a second type of attribute, the vertices of each attribute value are merged using an exponential growth segmentation method. The second type of attribute is an attribute whose corresponding attribute value exhibits a logarithmic growth trend in the value space.

9. The method according to any one of claims 1 to 3, characterized in that, The step of identifying malicious user accounts from among the user accounts based on their account ratings includes: Among the various user accounts, user accounts with a corresponding account score greater than a preset threshold are identified as malicious user accounts; or, Among the various user accounts, those with an account rating greater than the average rating are identified as malicious user accounts; the average rating is the average of the account ratings of all user accounts.

10. A target user account identification device, characterized in that, The device includes: The information acquisition module is used to acquire the behavior record information of each user account. The behavior record information is used to indicate various behavior attributes of the operation behavior. The behavior attributes include at least one of the following: user identity attribute, user behavior type attribute, user behavior time attribute, user Internet protocol address attribute, version number attribute, and user behavior count attribute. The bipartite graph generation submodule is used to generate an account attribute bipartite graph corresponding to the second behavior attribute based on the attribute values ​​of the second behavior attribute in the behavior record information of each user account. The second behavior attribute is any one of the various behavior attributes. The account attribute bipartite graph corresponding to the second behavior attribute includes account vertices corresponding to each user account, attribute value vertices corresponding to various attribute values ​​of the second behavior attribute, and edges between the account vertices and the attribute value vertices. The edges between the account vertices and the attribute value vertices are used to indicate that the corresponding user account has the corresponding attribute value. A transition probability matrix generation unit is used to generate a first transition probability matrix and a second transition probability matrix based on the bipartite graph of account attributes corresponding to the second behavioral attribute. The first transition probability matrix indicates the probability of each account vertex transitioning to each attribute value vertex. The first transition probability matrix is ​​generated based on the weights of the attribute value vertices in the bipartite graph of account attributes, where the weights of the attribute value vertices include the logarithm of the number of neighboring attribute values ​​of the attribute value vertex. The second transition probability matrix indicates the probability of each attribute value vertex transitioning to each account vertex. The second transition probability matrix is ​​generated based on the weights of the account vertices in the bipartite graph of account attributes, where different account vertices use the same weights. An undirected graph generation unit is used to generate a weighted undirected graph corresponding to the second behavioral attribute based on the first transition probability matrix and the second transition probability matrix, through a random walk with restart; the weighted undirected graph is used to indicate the similarity of each user account under the corresponding behavioral attribute. The community set acquisition module is used to perform community discovery processing on the weighted undirected graphs corresponding to each of the behavioral attributes to obtain the community set for each of the behavioral attributes. The community set contains each user account community divided according to the corresponding behavioral attribute. The community rating acquisition module is used to acquire the community rating of each user account community based on the behavioral attributes of the user accounts in each user account community. The community rating of the user account community is used to indicate the degree of malice of the user account community. The account rating acquisition module is used to obtain the account rating of each user account based on the community rating of each user account community. The target identification module is used to identify malicious user accounts from among the user accounts based on the account rating of each user account.

11. The apparatus according to claim 10, characterized in that, The community rating acquisition module includes: The quantity acquisition submodule is used to acquire the quantity of target attribute values ​​for each user account in the target community; the target community is any one of the user account communities; the quantity of target attribute values ​​is the quantity of attribute values ​​corresponding to the first behavioral attribute; the first behavioral attribute is the behavioral attribute corresponding to the target community; The standard deviation acquisition submodule is used to acquire the standard deviation of the number of attribute values ​​in the target community. The standard deviation of the number of attribute values ​​is the standard deviation of the number of target attribute values ​​of each user account in the target community. The community rating acquisition submodule is used to obtain the community rating of the target community based on the standard deviation of the number of attribute values ​​of the target community.

12. The apparatus according to claim 11, characterized in that, The community rating acquisition submodule includes: The quantity processing unit is used to normalize the standard deviation of the quantity of attribute values ​​of each user account community corresponding to the first behavioral attribute. The community scoring unit is used to take the normalized result of the standard deviation of the number of attribute values ​​of the target community as the community score of the target community.

13. The apparatus according to claim 11, characterized in that, The account rating acquisition module includes: The target community rating acquisition submodule is used to obtain the community rating of the community where the target user account is located; the target user account is any one of the user accounts. The vector construction submodule is used to construct a high-dimensional space vector of the target user account based on the community rating of the community to which the target user account belongs; The account rating acquisition submodule is used to obtain the account rating of the target user account based on the high-dimensional space vector of the target user account.

14. A computer device, characterized in that, The computer device includes a processor and a memory, the memory storing at least one instruction, at least one program, a code set, or an instruction set, the at least one instruction, the at least one program, the code set, or the instruction set being loaded and executed by the processor to implement the target user account identification method as described in any one of claims 1 to 9.

15. A computer-readable storage medium, characterized in that, The storage medium stores at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, the at least one program, the code set, or instruction set is loaded and executed by a processor to implement the target user account identification method as described in any one of claims 1 to 9.

Images