Abnormal user prediction method and device

Abstract

The embodiments of the present application disclose an abnormal user prediction method and device. A specific implementation of the abnormal user prediction method includes: obtaining a set of behavioral data of a user and the user's associated users on social software; extracting features from the behavioral data set to generate a set of behavioral features; generating a set of directed graph triples based on the behavioral feature set; sorting the behavioral features of users with directed graph triples in the behavioral feature set in time sequence to generate time series features; inputting the time series features into a pre-trained abnormal user prediction model to predict whether the user is an abnormal user. This implementation predicts whether a user is an abnormal user based on the behavioral context of the user and its associated users using social software, thereby reducing the missed detection rate of abnormal users.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to a method and device for predicting abnormal users. Background Art

[0002] Social interaction refers to social interactions. The software that achieves this goal through the Internet is social software. With the rapid development of mobile Internet, various social software have emerged one after another. The phenomenon of spreading illegal information through social software is becoming more and more serious. At present, abnormal users are detected based on their behavioral data on social software. Only users who directly spread illegal information on social software will be detected as abnormal users. As for the case of gangs spreading illegal information, the gang members cannot be detected because they only participate in auxiliary activities and do not directly spread illegal information. Summary of the invention

[0003] The embodiments of the present application provide a method and device for predicting abnormal users.

[0004] In the first aspect, the embodiment of the present application provides an abnormal user prediction method, comprising: obtaining a behavior data set of a user and the user's associated users on a social software; extracting features from the behavior data set to generate a behavior feature set; generating a directed Figure 3 Tuple set; the behavior feature set contains directed Figure 3 The behavioral features of the users in the tuple are sorted in time series to generate time series features; the time series features are input into a pre-trained abnormal user prediction model to predict whether the user is an abnormal user.

[0005] In some embodiments, the behavior data in the behavior data set includes operation-related behavior data; and feature extraction is performed on the behavior data set, including: Multi-Hot encoding the operation-related behavior data in the behavior data set to generate operation-related behavior features.

[0006] In some embodiments, the behavior data in the behavior data set also includes content-type behavior data, and the content-type behavior data includes image content-type behavior data; and feature extraction of the behavior data set also includes: using an image classification network to extract features from the image content-type behavior data in the behavior data set to generate image content-type behavior features.

[0007] In some embodiments, an image classification network is used to extract features of image content-related behavior data in a behavior data set to generate image content-related behavior features, including: inputting the image content-related behavior data into the image classification network, and outputting the image content-related behavior features from the fully connected layer of the image classification network.

[0008] In some embodiments, an image classification network is used to extract features of image content-type behavior data in a behavior data set to generate image content-type behavior features, including: inputting the image content-type behavior data into the image classification network, outputting an image content-type behavior feature map from the feature layer of the image classification network; and expanding the content-type behavior feature map to generate image content-type behavior features.

[0009] In some embodiments, the image classification network is a ResNet or VGG model.

[0010] In some embodiments, the content-type behavior data also includes text content-type behavior data; and feature extraction of the behavior data set also includes: inputting the text content-type behavior data in the behavior data set into a pre-trained model, and outputting text content-type behavior features.

[0011] In some embodiments, the pre-trained model is a BERT semantic network.

[0012] In some embodiments, content-related behavior data also includes voice content-related behavior data; and feature extraction of the behavior data set also includes: performing voice recognition on the voice content-related behavior data in the behavior data set to generate text content-related behavior data; and performing text encoding on the text content-related behavior data to generate voice content-related behavior features.

[0013] In some embodiments, based on the set of behavioral features, a directed Figure 3 Tuple set, including: based on the entity association relationship of the operation class behavior data in the behavior data set, generate a directed Figure 3 A set of tuples, where there is a directed Figure 3 Directed in a collection of tuples Figure 3 The tuple includes the entities and associations of the operational behavior data.

[0014] In some embodiments, the abnormal user prediction model is trained through the following steps: obtaining a positive sample behavior data set of abnormal users and their associated users on social software, and a negative sample behavior data set of normal users and their associated users on social software; generating positive sample time series features and negative sample time series features based on the positive sample behavior data set and the negative sample behavior data set, respectively; and training the time series network using the positive sample time series features and the negative sample time series features to obtain the abnormal user prediction model.

[0015] In some embodiments, the temporal network is a recurrent neural network.

[0016] In some embodiments, obtaining a set of behavioral data of a user and the user's associated users on social software includes: identifying the social software installed on the user's terminal device, and obtaining the user's address book on the social software; obtaining operation data and content data of various operations performed by the user and the associated users in the address book on the social software to generate a set of behavioral data, wherein the operation data includes operation data of performing at least one of adding friends, establishing a group chat session, inviting to join a group chat session, browsing a social space, or replying to comment information on a social space, and the content data includes content data of performing at least one of posting a chat message in a chat session, posting shared information on a social space, and modifying a personal profile; and generating a directed Figure 3 The tuple set includes: generating a directed Figure 3 A collection of tuples.

[0017] In a second aspect, the embodiment of the present application provides an abnormal user prediction device, including: an acquisition module, configured to acquire a set of behavior data of a user and the user's associated users on social software; an extraction module, configured to perform feature extraction on the behavior data set to generate a behavior feature set; a generation module, configured to generate a directed Figure 3 tuple set; a sorting module, configured to sort the behavior feature set into directed Figure 3 The behavior features of the users in the tuple are sorted in time sequence to generate time series features; the prediction module is configured to input the time series features into a pre-trained abnormal user prediction model to predict whether the user is an abnormal user.

[0018] In some embodiments, the behavior data in the behavior data set includes operation-related behavior data; and the extraction module includes: an encoding submodule configured to perform Multi-Hot encoding on the operation-related behavior data in the behavior data set to generate operation-related behavior features.

[0019] In some embodiments, the behavior data in the behavior data set also includes content-type behavior data, and the content-type behavior data includes image content-type behavior data; and the extraction module also includes: an extraction sub-module, which is configured to use an image classification network to perform feature extraction on the image content-type behavior data in the behavior data set to generate image content-type behavior features.

[0020] In some embodiments, the extraction submodule includes: a first output unit configured to input image content class behavior data into an image classification network, and output image content class behavior features from a fully connected layer of the image classification network.

[0021] In some embodiments, the extraction submodule includes: a second output unit, configured to input the image content class behavior data into the image classification network, and output the image content class behavior feature map from the feature layer of the image classification network; an expansion unit, configured to expand the content class behavior feature map to generate image content class behavior features.

[0022] In some embodiments, the image classification network is a ResNet or VGG model.

[0023] In some embodiments, the content-type behavior data also includes text content-type behavior data; and the extraction module also includes: an output submodule, configured to input the text content-type behavior data in the behavior data set into the pre-trained model and output text content-type behavior features.

[0024] In some embodiments, the pre-trained model is a BERT semantic network.

[0025] In some embodiments, the content-type behavior data also includes voice content-type behavior data; and the extraction module also includes: a recognition submodule, configured to perform voice recognition on the voice content-type behavior data in the behavior data set to generate text content-type behavior data; an encoding submodule, configured to perform text encoding on the text content-type behavior data to generate voice content-type behavior features.

[0026] In some embodiments, the generation module is further configured to: generate a directed Figure 3 A set of tuples, where there is a directed Figure 3 Directed in a collection of tuples Figure 3 The tuple includes the entities and associations of the operational behavior data.

[0027] In some embodiments, the abnormal user prediction model is trained through the following steps: obtaining a positive sample behavior data set of abnormal users and their associated users on social software, and a negative sample behavior data set of normal users and their associated users on social software; generating positive sample time series features and negative sample time series features based on the positive sample behavior data set and the negative sample behavior data set, respectively; and training the time series network using the positive sample time series features and the negative sample time series features to obtain the abnormal user prediction model.

[0028] In some embodiments, the temporal network is a recurrent neural network.

[0029] In some embodiments, the acquisition module is further configured to: identify the social software installed on the user's terminal device, and obtain the user's address book on the social software; obtain the operation data and content data of the user and the associated users in the address book performing various operations on the social software, and generate a set of behavior data, wherein the operation data includes operation data of performing at least one operation of adding friends, establishing a group chat session, inviting to join a group chat session, browsing a social space, or replying to comment information on a social space, and the content data includes content data of performing at least one operation of posting a chat message in a chat session, posting shared information on a social space, and modifying a personal profile; and the generation module is further configured to: generate a directed action data set based on the behavior characteristics of at least one operation of adding friends, inviting to join a group chat session, and replying to comment information on a social space. Figure 3 A collection of tuples.

[0030] In a third aspect, an embodiment of the present application provides a computer device, comprising: one or more processors; a storage device on which one or more programs are stored; when the one or more programs are executed by one or more processors, the one or more processors implement the method described in any implementation method in the first aspect.

[0031] In a fourth aspect, an embodiment of the present application provides a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the method described in any implementation manner in the first aspect.

[0032] The abnormal user prediction method and device provided in the embodiment of the present application first obtains the behavior data set of the user and the user's associated users on the social software; then extracts features from the behavior data set to generate a behavior feature set; then generates a directed Figure 3 Tuple set; then there is a directed Figure 3 The behavior features of the users in the tuple are sorted in time sequence to generate time series features. Finally, the time series features are input into the pre-trained abnormal user prediction model to predict whether the user is an abnormal user. The user is predicted to be an abnormal user based on the behavioral context of the user and his / her associated users using social software, thereby reducing the missed detection rate of abnormal users. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0034] Figure 1 is an exemplary system architecture in which the present application may be applied;

[0035] Figure 2is a flowchart of an embodiment of an abnormal user prediction method according to the present application;

[0036] Figure 3 is a flowchart of another embodiment of the abnormal user prediction method according to the present application;

[0037] Figure 4 is a flowchart of an embodiment of an abnormal user prediction model training method according to the present application;

[0038] Figure 5 It is a structural diagram of a computer system suitable for implementing a computer device of an embodiment of the present application. DETAILED DESCRIPTION

[0039] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It should also be noted that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings.

[0040] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0041] Figure 1 An exemplary system architecture 100 is shown to which an embodiment of the abnormal user prediction method of the present application can be applied.

[0042] like Figure 1 As shown, the system architecture 100 may include devices 101, 102, 103, 104 and a network 105. The network 105 is used to provide a medium for communication links between the devices 101, 102, 103, 104. The network 105 may include various connection types, such as wired, wireless communication links or optical fiber cables.

[0043] Devices 101, 102, 103, and 104 can be hardware devices or software that support network connection to provide various network services. When the device is hardware, it can be various electronic devices, including but not limited to smart phones, tablet computers, laptops, desktop computers, servers, etc. At this time, as a hardware device, it can be implemented as a distributed device group consisting of multiple devices, or it can be implemented as a single device. When the device is software, it can be installed in the electronic devices listed above. At this time, as software, it can be implemented as multiple software or software modules for providing distributed services, for example, or it can be implemented as a single software or software module. No specific limitation is made here.

[0044] In practice, a device can provide corresponding network services by installing corresponding client applications or server applications. After the client application is installed, the device can be embodied as a client in network communication. Correspondingly, after the server application is installed, it can be embodied as a server in network communication.

[0045] As an example, in Figure 1 In the embodiment, devices 101, 102, and 103 are embodied as clients, and device 104 is embodied as a server. For example, devices 101, 102, and 103 may be clients of social software, and device 104 may be a server of the social software.

[0046] It should be noted that the abnormal user prediction method provided in the embodiment of the present application can be executed by the device 104.

[0047] It should be understood that Figure 1 The number of networks and devices in the embodiment is only for illustration. Any number of networks and devices may be provided according to implementation requirements.

[0048] Continue to refer Figure 2 , which shows a process 200 of an embodiment of an abnormal user prediction method according to the present application. The abnormal user prediction method comprises the following steps:

[0049] Step 201: Obtain a set of behavior data of a user and his / her associated users on social software.

[0050] In this embodiment, the execution subject of the abnormal user prediction method (for example Figure 1 The device 104 shown can obtain a set of behavioral data of the user and its associated users on the social software.

[0051] In practice, users and their associated users are users who register for social software. There is a direct or indirect association between users and their associated users on social software. For example, there is a direct association between users who are friends or belong to the same group of chat sessions on social software. There is an indirect association between users who have common friends on social software.

[0052] Among them, the behavior data set may include behavior data generated by the user and its associated users performing various behaviors on the social software. The behavior data may be operation data and content data for performing various operations on the social software. The operation data may be used to record the operation process of performing operations on the social software, such as the operation process of adding friends, the operation process of establishing a group chat session, the operation process of inviting to join a group chat session, the operation process of browsing the social space, the operation process of posting chat messages in a chat session, and the operation process of posting shared information on the social space, etc. In addition, the operation data may also include statistical data, such as the frequency of users logging into the social software, the frequency of users sending chat messages, the frequency of users establishing group chat sessions, the frequency of users refreshing social spaces, etc. The content data may be used to record the content generated by performing operations on the social software, such as chat messages posted in a chat session, shared information posted on the social space, and modified personal data, etc.

[0053] Usually, the execution subject is the background server of the social software, which stores the behavior data of all users who have registered the social software. Moreover, the behavior data of different users correspond to different user identifiers. Therefore, the execution subject can locally search for the behavior data set of the user and its associated users on the social software. In addition, the terminal device of the user who has registered the social software can also store the behavior data of the user who has registered the social software. Therefore, the execution subject can also obtain the behavior data from the user's terminal device (for example, Figure 1 The user's behavior data is obtained from the device 101 shown in the figure, and the user's terminal device (such as Figure 1 The device 102, 103 shown in the figure obtains the behavior data of the associated user to obtain a behavior data set.

[0054] In actual application scenarios, the behavior data included in the behavior data set is usually generated in the recent period, such as the behavior data generated by the user and its associated users performing various behaviors on the social software in the past three days.

[0055] Step 202: extract features from the behavior data set to generate a behavior feature set.

[0056] In this embodiment, for the behavior data in the behavior data set, the execution subject may extract features from the behavior data to generate corresponding behavior features, wherein the behavior features may be used to describe the characteristics of the behavior in the behavior data, and are usually expressed in vector form.

[0057] Step 203: Generate a directed Figure 3 A collection of tuples.

[0058] In this embodiment, for a behavior feature in the behavior feature set, the execution subject may generate a corresponding directed Figure 3 Tuple.

[0059] It should be noted that only the behavior characteristics that can describe the relationship between two entities and the relationship between the two entities can generate the corresponding directed Figure 3 Tuple. Among them, there are Figure 3 A tuple includes two entities and the relationship between the two entities. The two entities are subject and object, and the direction is from subject to object. For example, the behavior of user A adding user B as a friend corresponds to the triple (user A, add friend, user B), and the direction is from entity "user A" to entity "user B". For another example, the behavior of user A changing the occupation in his profile to engineer corresponds to the triple (user A, occupation, engineer), and the direction is from entity "user A" to entity "engineer".

[0060] Step 204: Figure 3 The user behavior features of the tuple are sorted in time sequence to generate time series features.

[0061] In this embodiment, the execution subject can select a directed Figure 3 The behavior features of the users in the tuple are sorted and combined in time sequence to obtain the time series features. Figure 3 The user behavior characteristics of the tuple are sorted from front to back.

[0062] Among them, there are Figure 3 Users of tuples can be directed Figure 3 The user to which the entity in the tuple corresponds. For example, for a directed Figure 3 Tuple (user A, add friend, user B), there is this directed Figure 3 The users of the tuple are user A and user B, so all the behavior features of user A and user B are selected from the behavior feature set. Figure 3 Tuple (user A, occupation, engineer), there is this directed Figure 3 The user of the tuple is user A, so all behavior features of user A are selected from the behavior feature set.

[0063] Step 205: input the time series features into a pre-trained abnormal user prediction model to predict whether the user is an abnormal user.

[0064] In this embodiment, the execution entity may input the time series features into a pre-trained abnormal user prediction model to predict whether the user is an abnormal user.

[0065] Among them, the abnormal user prediction model can be used to predict whether the user is an abnormal user. Generally, when analyzing the behavior features in the time series features, the abnormal user prediction model can analyze the context behavior features and output the probability that the user is an abnormal user.

[0066] Among them, abnormal users can be users who perform abnormal behaviors on social software, including users who directly perform abnormal behaviors and users who indirectly perform abnormal behaviors. Abnormal behaviors performed directly can be, for example, users who directly post illegal information on social software. Abnormal behaviors performed indirectly can be abnormal behaviors performed directly on social software by users associated with abnormal users, such as closely related users who directly post illegal information on social software. In this case, users associated with abnormal users are also abnormal users.

[0067] For example, user A established a group chat session on a social software and posted a QR code of the group chat session on the social space; then user A added user B as a friend, and user B joined the group chat session through the QR code of the group chat session posted by user A; then user C joined the group chat session through the invitation of user B; finally, user C posted illegal information in the group chat session. Among them, user C is the user who directly performed abnormal behavior and is an abnormal user. User A and user B are users who indirectly performed abnormal behavior and may also be abnormal users.

[0068] In addition, when the abnormal user prediction model predicts that the user is an abnormal user, it means that the user is very likely to be an abnormal user, and the user cannot be directly identified as an abnormal user. In order to reduce the false positive rate, the abnormal user prediction model can also mark the abnormal behavior features in the time series features and send the context-related information to manual review, which can also improve the review efficiency. Among them, the way to mark the abnormal behavior features can be, for example, highlighting.

[0069] For ease of understanding, the following provides practical application scenarios that can implement the abnormal user prediction method of the embodiment of the present application, which are as follows:

[0070] First, identify the social software installed on the user's terminal device, obtain the user's address book on the social software, and obtain the operation data and content data of various operations performed by the user and the associated users in the address book on the social software to generate a behavior data set.

[0071] The operation data may include operation data for performing at least one of the operations of adding friends, establishing a group chat session, inviting to join a group chat session, browsing a social space, or replying to a comment message on a social space. The content data may include content data for performing at least one of the operations of publishing a chat message in a chat session, publishing shared information on a social space, and modifying a personal profile.

[0072] Afterwards, feature extraction is performed on the behavior data set to generate a behavior feature set, and a directed action is generated based on the behavior feature of at least one of the operations of adding a friend, inviting to join a group chat session, and replying to a comment message on a social space. Figure 3 A collection of tuples.

[0073] Then, there will be a directed Figure 3 The user behavior features of the tuple are sorted in time sequence to generate time series features.

[0074] Finally, the time series features are input into the pre-trained abnormal user prediction model to predict whether the user is an abnormal user. If the abnormal user prediction model predicts that the user is an abnormal user, the highlight mark is sent for manual review, indicating high risk, and the context-related information is also sent for review. The abnormal user prediction method provided in the embodiment of the present application first obtains the behavior data set of the user and the user's associated users on the social software; then, the behavior data set is extracted to generate a behavior feature set; then, based on the behavior feature set, a directed Figure 3 Tuple set; then there is a directed Figure 3 The behavior features of the users in the tuple are sorted in time sequence to generate time series features. Finally, the time series features are input into the pre-trained abnormal user prediction model to predict whether the user is an abnormal user. The user is predicted to be an abnormal user based on the behavioral context of the user and his / her associated users using social software, thereby reducing the missed detection rate of abnormal users.

[0075] Further references Figure 3 , which shows a process 300 of another embodiment of the abnormal user prediction method according to the present application. The abnormal user prediction method includes the following steps:

[0076] Step 301: Obtain a set of behavioral data of a user and his / her associated users on social software.

[0077] In this embodiment, the execution subject of the abnormal user prediction method (for example Figure 1 The device 104 shown can obtain a set of behavioral data of the user and its associated users on the social software.

[0078] Here, the behavior data set may include behavior data generated by the user and its associated users performing various behaviors on the social software. Due to the different recorded information, the behavior data can be divided into operation behavior data and content behavior data. Among them, the operation behavior data can be used to record the operation process of performing operations on social software. Content behavior data can be used to record the content generated by performing operations on social software. Due to the different content formats recorded by content behavior data, it can be divided into image content behavior data, text content behavior data and voice content behavior data. Different types of behavior data use different feature extraction methods. Specifically, if there is operation behavior data in the behavior data set, the above-mentioned execution subject can execute step 302a; if there is image content behavior data in the behavior data set, the above-mentioned execution subject can execute step 302b; if there is text content behavior data in the behavior data set, the above-mentioned execution subject can execute step 302c; if there is voice content behavior data in the behavior data set, the above-mentioned execution subject can execute step 302b.

[0079] Step 302a, Multi-Hot encoding is performed on the operation-related behavior data in the behavior data set to generate operation-related behavior features.

[0080] In this embodiment, if there is operation-related behavior data in the behavior data set, the execution subject may perform Multi-Hot encoding on the operation-related behavior data to generate corresponding operation-related behavior features.

[0081] Usually, there are multiple values ​​under the classification features corresponding to the operation-type behavior data, so Multi-Hot encoding is required. Specifically, for the classification features corresponding to a certain operation-type behavior data, each value under it is converted into the form of One-Hot encoding to construct a dictionary matrix, where the key is the coordinate and the value is 1 or 0, indicating whether there is a value. For example, the operation-type behavior data is used to describe whether the user uses the shake function, whether the user refreshes the circle of friends, whether the user sends a chat message, whether the user publishes shared information, and whether the user adds a friend, so each operation needs to be encoded separately. The encoded operation-type behavior features can be, for example, [1,1,0,0,1], indicating that the user used the shake function, refreshed the circle of friends, and added a friend, but did not send a chat message or publish shared information.

[0082] Step 302b: Use the image classification network to extract features from the image content behavior data in the behavior data set to generate image content behavior features.

[0083] In this embodiment, if there is image content behavior data in the behavior data set, the execution subject can use the image classification network to extract features of the image content behavior data to generate corresponding image content behavior features.

[0084] Generally, image classification networks can be used to classify images, and here the intermediate data generated during the image classification process is used as the image content class behavior feature. In actual application scenarios, the image classification network can be, for example, a ResNet (Residual Network) or a VGG (Visual Geometry Group) model. Among them, ResNet is characterized by being easy to optimize and being able to improve accuracy by increasing the depth. Its internal residual blocks use skip connections to alleviate the gradient vanishing problem caused by increasing the depth in deep neural networks. The VGG model performs well in multiple transfer learning tasks, and its main features are: small convolution kernels, small pooling kernels, deeper layers, wider feature maps, and fully connected convolutions, etc.

[0085] In some embodiments, the execution subject may input the image content behavior data into the image classification network, and output the image content behavior features from the fully connected layer of the image classification network. During the image classification process, the fully connected layer of the image classification network outputs the classification result of the image. The classification result is used as the image content behavior feature, and the image detail features are lost.

[0086] In some embodiments, the above-mentioned execution subject may first input the image content class behavior data into the image classification network, and output the image content class behavior feature map from the feature layer of the image classification network; then expand the content class behavior feature map to generate the image content class behavior feature. In the image classification process, the intermediate feature layer of the image classification network outputs a feature map, which retains the image detail features. Usually, the feature map exists in the form of a matrix, and here the feature map can be expanded and spliced ​​into a multi-dimensional vector. For example, for an 8*8 feature map, it can be expanded into a 64-dimensional vector.

[0087] Step 302c: input the text content-related behavior data in the behavior data set into the pre-training model, and output text content-related behavior features.

[0088] In this embodiment, if there is text content-related behavior data in the behavior data set, the above-mentioned execution subject can input the text content-related behavior data into the pre-training model to output text content-related behavior features.

[0089] Among them, the pre-trained model can learn the knowledge representation of each word according to the contextual relationship of each word in the text. Since the learned knowledge representation of each word can be combined with its contextual information, it can better express the meaning of each word. In actual application scenarios, the pre-trained model can be, for example, a BERT (Bidirectional Encoder Representation from Transformers) semantic network. BERT is a deep bidirectional representation pre-trained model that can extract the semantic information of the text at a deeper level.

[0090] Step 302d: Perform speech recognition on the speech content behavior data in the behavior data set to generate text content behavior data.

[0091] In this embodiment, if there is voice content behavior data in the behavior data set, the execution subject can perform speech recognition on the voice content behavior data to generate corresponding text content behavior data. Among them, speech recognition is a technology that converts speech into corresponding text.

[0092] Step 303d, text encoding is performed on the text content behavior data to generate voice content behavior features.

[0093] In this embodiment, the execution subject may perform text encoding on the text content behavior data to generate corresponding voice content behavior features.

[0094] The method of text encoding the text content behavior data may refer to step 302c, which will not be described in detail here.

[0095] Step 304: Generate a directed Figure 3 A collection of tuples.

[0096] In this embodiment, the execution subject can generate a directed Figure 3 A set of tuples. Figure 3 Directed in a collection of tuples Figure 3 A tuple may include entities and associations of operational behavior data.

[0097] The operation behavior data is usually used to describe two entities and the relationship between the two entities. Therefore, the execution subject can generate the corresponding directed Figure 3 Tuple.

[0098] Step 305: Figure 3The user behavior features of the tuple are sorted in time sequence to generate time series features.

[0099] Step 306: input the time series features into a pre-trained abnormal user prediction model to predict whether the user is an abnormal user.

[0100] In this embodiment, the specific operations of steps 305-306 are already described in Figure 2 In the illustrated embodiment, steps 204-205 are described in detail and will not be repeated here.

[0101] from Figure 3 It can be seen that Figure 2 Compared with the corresponding embodiment, the process 300 of the abnormal user prediction method in this embodiment highlights the step of extracting behavioral features. Therefore, the solution described in this embodiment adopts different feature extraction methods for different types of behavioral data, realizes targeted extraction of behavioral features, and can be applied in various practical application scenarios.

[0102] Continue to refer Figure 4 , which shows a process 400 of an embodiment of an abnormal user prediction model training method according to the present application. The abnormal user prediction model training method comprises the following steps:

[0103] Step 401: Obtain a positive sample behavior data set of abnormal users and their associated users on social software, and a negative sample behavior data set of normal users and their associated users on social software.

[0104] In this embodiment, the execution subject of the abnormal user prediction model training method (for example Figure 1 The device 104 shown can obtain a positive sample behavior data set of abnormal users and their associated users on social software, and a negative sample behavior data set of normal users and their associated users on social software.

[0105] The abnormal users here can be abnormal users identified by other means, such as abnormal users identified by manual analysis, abnormal users predicted by other models, abnormal users reported by other users, etc. The abnormal users and their associated users’ behavior data sets on social software contain abnormal behavior data, which is a positive sample behavior data set. Similarly, the behavior data sets of normal users and their associated users on social software include normal behavior data, which is a negative sample behavior data set.

[0106] Step 402: Generate positive sample time series features and negative sample time series features based on the positive sample behavior data set and the negative sample behavior data set, respectively.

[0107] In this embodiment, the execution subject can generate positive sample time series features based on the positive sample behavior data set, and generate negative sample time series features based on the negative sample behavior data set. The generation method of positive sample time series features and negative sample time series features can refer to Figure 2 and Figure 3 The method of generating the time series features in will not be described in detail here.

[0108] Step 403: train the time series network using the positive sample time series features and the negative sample time series features to obtain an abnormal user prediction model.

[0109] In this embodiment, the above-mentioned execution entity can use the positive sample time series features and the negative sample time series features to train the time series network to obtain an abnormal user prediction model.

[0110] Among them, the positive sample time series feature can be marked with a positive sample label (the label value can be, for example, 1), and the negative sample time series feature can be marked with a negative sample label (the label value can be, for example, 0). The above-mentioned execution subject can use the positive sample time series feature and the negative sample time series feature as input, respectively, and use the positive sample label and the negative sample label as supervision, respectively, to perform supervised training on the time series network, and then obtain an abnormal user prediction model. Usually, the number of negative samples is much larger than the number of positive samples, so as to simulate the mathematical distribution in which normal social behaviors occupy the majority in actual application scenarios.

[0111] Among them, the time series network is used to process time series features. You can use various types of RNN (Recurrent Neural Networks), including but not limited to LSTM (Long Short-Term Memory) or BERT semantic network. The behavioral features of each time node in the time series feature can be used as a word vector. Since the length of word vectors of different behavioral features is different, the length of the longest word vector among all samples is usually used as the benchmark, and if it is insufficient, it will be supplemented (such as zero padding).

[0112] The abnormal user prediction model training method provided in the embodiment of the present application first obtains a positive sample behavior data set of abnormal users and their associated users on social software, as well as a negative sample behavior data set of normal users and their associated users on social software; then, based on the positive sample behavior data set and the negative sample behavior data set, positive sample time series features and negative sample time series features are generated respectively; finally, the positive sample time series features and the negative sample time series features are used to train the time series network to obtain an abnormal user prediction model, thereby training an abnormal user prediction model that can predict whether a user is an abnormal user.

[0113] Reference below Figure 5, which shows a computer device (for example, Figure 1 A schematic diagram of the structure of a computer system 500 of the device 104 shown. Figure 5 The computer device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0114] like Figure 5 As shown, the computer system 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the system 500 are also stored. The CPU 501, the ROM 502, and the RAM 503 are connected to each other through a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0115] The following components are connected to the I / O interface 505: an input section 506 including a keyboard, a mouse, etc.; an output section 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, a modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage section 508 as needed.

[0116] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication part 509, and / or installed from a removable medium 511. When the computer program is executed by a central processing unit (CPU) 501, the above-mentioned functions defined in the method of the present application are executed.

[0117] It should be noted that the computer-readable medium described in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0118] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or electronic device. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0119] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0120] The units involved in the embodiments described in the present application may be implemented by software or by hardware. The described units may also be set in a processor. For example, they may be described as: a processor includes an acquisition module, an extraction module, a generation module, a sorting module, and a prediction module. The names of these units do not constitute a limitation on the unit itself in this case. For example, the acquisition module may also be described as "a unit for obtaining a set of behavioral data of a user and the user's associated users on social software."

[0121] As another aspect, the present application also provides a computer-readable medium, which may be included in the computer device described in the above embodiment; or it may exist independently without being assembled into the computer device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by the computer device, the computer device: obtains a behavioral data set of the user and the user's associated users on the social software; extracts features from the behavioral data set to generate a behavioral feature set; and generates a directed Figure 3 Tuple set; the behavior feature set contains directed Figure 3 The behavioral features of the users in the tuple are sorted in time series to generate time series features; the time series features are input into a pre-trained abnormal user prediction model to predict whether the user is an abnormal user.

[0122] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above invention concept. For example, the above features are replaced with the technical features with similar functions disclosed in this application (but not limited to) by each other to form a technical solution.

Claims

1. An abnormal user prediction method, comprising: Obtaining a collection of behavioral data of a user and the user's associated users on social software; Extracting features from the behavior data set to generate a behavior feature set; Based on the set of behavioral features, a directed graph triple set is generated, wherein a directed graph triple in the directed graph triple set includes two entities and an association relationship between the two entities, the two entities are a subject and an object, and the direction is from the subject to the object; Sorting the behavior features of users having directed graph triples in the behavior feature set in time sequence to generate time sequence features; Input the time series features into a pre-trained abnormal user prediction model to predict whether the user is an abnormal user, wherein the abnormal user includes a user who directly performs abnormal behavior and a user who indirectly performs abnormal behavior. The directly performed abnormal behavior is directly posting illegal information on the social software, and the indirectly performed abnormal behavior is that the associated users of the abnormal user directly perform abnormal behavior on the social software; The behavior data set includes operation behavior data, image content behavior data, text content behavior data and voice content behavior data; and The step of obtaining a set of behavior data of the user and the user's associated users on the social software includes: Identify that the social software is installed on the terminal device of the user, and obtain the contact list of the user on the social software; Acquire operation data and content data of various operations performed by the user and associated users in the address book on the social software to generate the behavior data set, wherein the operation data includes operation data of performing at least one of adding friends, inviting to join a group chat session, or replying to comment information on a social space, and the content data includes content data of performing at least one of posting a chat message in a chat session, posting shared information on a social space, and modifying a personal profile; The abnormal user prediction model is trained through the following steps: Acquire a positive sample behavior data set of an abnormal user and the abnormal user's associated users on the social software, and a negative sample behavior data set of a normal user and the normal user's associated users on the social software; Based on the positive sample behavior data set and the negative sample behavior data set, respectively generate positive sample time series features and negative sample time series features; The time series network is trained using the positive sample time series features and the negative sample time series features to obtain the abnormal user prediction model.

2. The method according to claim 1, wherein: The extracting features from the behavior data set includes: Multi-Hot encoding is performed on the operation-related behavior data in the behavior data set to generate operation-related behavior features.

3. The method according to claim 2, wherein the feature extraction of the behavior data set further comprises: An image classification network is used to extract features of the image content behavior data in the behavior data set to generate image content behavior features.

4. The method according to claim 3, wherein: The step of extracting features of the image content behavior data in the behavior data set by using an image classification network to generate image content behavior features includes: The image content class behavior data is input into the image classification network, and the image content class behavior features are output from the fully connected layer of the image classification network.

5. The method according to claim 3, wherein: The step of extracting features of the image content behavior data in the behavior data set by using an image classification network to generate image content behavior features includes: Inputting the image content class behavior data into the image classification network, and outputting an image content class behavior feature map from the feature layer of the image classification network; The content-related behavior feature graph is expanded to generate image content-related behavior features.

6. The method according to claim 3, wherein: The image classification network is a ResNet or VGG model.

7. The method according to claim 3, wherein: The feature extraction of the behavior data set further includes: The text content class behavior data in the behavior data set is input into the pre-training model, and the text content class behavior features are output.

8. The method according to claim 7, wherein: The pre-trained model is the BERT semantic network.

9. The method according to claim 7, wherein: The feature extraction of the behavior data set further includes: Performing speech recognition on the speech content behavior data in the behavior data set to generate text content behavior data; The text content-related behavior data is text-encoded to generate the voice content-related behavior features.

10. The method according to claim 2, wherein: The generating a directed graph triple set based on the behavior feature set includes: Based on the entity association relationships of the operation-type behavior data in the behavior data set, the directed graph triple set is generated, wherein the directed graph triples in the directed graph triple set include the entities and association relationships of the operation-type behavior data.

11. The method according to claim 1, wherein: The temporal network is a recurrent neural network.

12. A computer device comprising: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 11.

13. A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method according to any one of claims 1 to 11.

Images