Abnormal account identification method and device, storage medium, and electronic device

Abstract

The embodiment of the present invention relates to an abnormal account identification method and device, storage medium, and electronic device, and relates to the field of machine learning technology. The method includes: preprocessing the comment data to be identified to obtain text data to be identified, and performing drainage text entity identification on the text data to be identified to obtain drainage entities; evaluating the quality of the text data to be identified according to the comment scores of the comment data to be identified to obtain a quality evaluation result, and obtaining an account portrait of the user account corresponding to the comment data to be identified according to the evaluation result; identifying whether the user account is an abnormal account according to the drainage entity and the account portrait. The embodiment of the present invention improves the accuracy of the identification results of abnormal accounts.

Description

Background Art

[0002] With the development of machine learning and deep learning technologies, algorithms are increasingly being used in the e-commerce field. User comments on products are already very important data in the e-commerce field. At the same time, comments will largely affect consumers' purchasing preferences and choices. Therefore, many black industry chains have set their sights on the commercial value of comments. Some users may be more likely to be black industry chains that introduce illegal content such as public accounts, QQ groups, and traffic diversion links in the product comment area, which greatly affects the normal process of product purchases and affects users' judgment and purchasing behavior. Therefore, how to identify and block these illegal traffic diversion texts and crack down on the black industry chain and its related accounts to ensure that user comment content is clean and effective is a matter of great concern to every company.

[0003] The existing solution to the above problem is to use simple rules to identify illegal traffic diversion, that is, prepare a batch of user comment samples offline, the comments contain illegal traffic diversion content, summarize the characteristics of illegal traffic diversion texts, and formulate relevant rules to identify illegal traffic diversion content. When a new comment appears online, the completed identification rules can be used to identify and block the comment text.

[0004] However, the above scheme has the following defects: on the one hand, due to the limitations of the formulated rules, rules can only be formulated for the characteristics of the discovered illegal diversion texts. When new illegal diversion texts appear, the current rules cannot be identified, which leads to a low accuracy rate in the identification results of the diversion entity; on the other hand, the current identification situation only identifies illegal diversion texts, and does not profile the risk accounts in various dimensions in the black industry chain, which leads to a low accuracy rate in the identification results of risk accounts; on the other hand, many comments not only expose the diversion links, but also add many special characters and rules, which will make the recognition results of the diversion entity less accurate.

[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present invention, and therefore may include information that does not constitute prior art known to ordinary technicians in the field. Summary of the invention

[0006] The purpose of the present invention is to provide an abnormal account identification method, an abnormal account identification device, a computer-readable storage medium and an electronic device, thereby at least to a certain extent overcoming the problems of low accuracy of identification results of diversion entities and low accuracy of identification results of risky accounts caused by limitations and defects of related technologies.

[0007] According to one aspect of the present disclosure, a method for identifying an abnormal account is provided, comprising:

[0008] Preprocessing the comment data to be identified to obtain text data to be identified, and performing flow-inducing text entity recognition on the text data to be identified to obtain flow-inducing entities;

[0009] Evaluating the quality of the text data to be identified according to the review scores of the review data to be identified to obtain a quality evaluation result, and obtaining an account portrait of a user account corresponding to the review data to be identified according to the evaluation result;

[0010] Whether the user account is an abnormal account is identified based on the diversion entity and the account portrait.

[0011] In an exemplary embodiment of the present disclosure, preprocessing the comment data to be identified to obtain the text data to be identified includes:

[0012] The special symbols and / or emoticons included in the comment data to be identified are cleaned to obtain the text data to be identified.

[0013] In an exemplary embodiment of the present disclosure, the text data to be identified is subjected to flow-inducing text entity recognition, and the flow-inducing entity is obtained, including:

[0014] Segmenting the text data to be identified to obtain a plurality of segmented words, and inputting each of the segmented words into an illegal diversion model to obtain the diversion entity;

[0015] The traffic diversion entity includes a start byte, a middle byte and other entities.

[0016] In an exemplary embodiment of the present disclosure, the illegal traffic diversion model includes a bidirectional long short-term memory network layer, a fully connected layer, and a conditional random field layer;

[0017] Wherein, inputting each of the segmentation words into the illegal diversion model to obtain the diversion entity includes:

[0018] Input each of the segmented words into the bidirectional long short-term memory network to obtain positive context information and reverse context information;

[0019] Performing feature splicing on the forward context information and the reverse context information through the fully connected layer to obtain spliced ​​context information;

[0020] The concatenated context information is identified through the conditional random field to obtain the drainage entity.

[0021] In an exemplary embodiment of the present disclosure, the abnormal account identification method further includes:

[0022] Acquire historical comment data and preprocess the historical comment data to obtain standard input data;

[0023] The standard input data is used to train an initial network model including a bidirectional long short-term memory network layer, a fully connected layer, and a conditional random field layer to obtain the illegal diversion model.

[0024] In an exemplary embodiment of the present disclosure, evaluating the quality of the text data to be identified according to the comment scores of the comment data to be identified to obtain a quality evaluation result includes:

[0025] Scoring the review data to be identified using a preset scoring model to obtain the review score;

[0026] According to the preset score range to which the comment score belongs, the quality of the text data to be identified is evaluated to obtain a quality evaluation result; wherein the quality evaluation result includes malicious comments, low-quality comments, general-quality comments, and high-quality comments.

[0027] In an exemplary embodiment of the present disclosure, obtaining an account portrait of a user account corresponding to the comment data to be identified according to the evaluation result includes:

[0028] Acquire all comment data of the user account corresponding to the comment data to be identified, and input all the comment data into the illegal traffic diversion model to obtain the traffic diversion entity corresponding to all the comment data;

[0029] Dividing all the comment data into a first set having illegal traffic diversion comments and a second set having no illegal traffic diversion comments according to the traffic diversion entities corresponding to all the comment data;

[0030] If the proportion of the number of illegal comments included in the first set in the total amount of all comment data is greater than a first preset threshold and the quality assessment result is a malicious comment, then the account portrait of the user account is a suspected black industry chain account.

[0031] In an exemplary embodiment of the present disclosure, the abnormal account identification method further includes:

[0032] If the proportion of the number of comments with illegal traffic diversion included in the first set to the total amount of all the comment data is not greater than the first preset threshold, then determining whether the proportion of the number of comments without illegal traffic diversion included in the second set to the total amount of all the comment data is greater than the second preset threshold;

[0033] If the proportion of the number of non-illegal traffic diversion comments included in the second set to the total amount of all comment data is greater than a second preset threshold, then the number of non-illegal traffic diversion comments corresponding to the low-quality comments in the second set is calculated;

[0034] If the proportion of the number of comments without illegal traffic diversion corresponding to the low-quality comments in the number of comments without illegal traffic diversion in the second set is greater than a third preset threshold, and the quality assessment result is a malicious comment, then the account portrait of the user account is a suspected black industry chain account.

[0035] In an exemplary embodiment of the present disclosure, identifying whether the user account is an abnormal account according to the traffic diversion entity and the account portrait includes:

[0036] If the traffic diversion entity is an illegal traffic diversion entity, and the account profile is a suspected black industry chain account, then the user account is an abnormal account.

[0037] According to one aspect of the present disclosure, there is provided an abnormal account identification device, comprising:

[0038] An entity recognition module is used to pre-process the comment data to be recognized to obtain text data to be recognized, and to perform drainage text entity recognition on the text data to be recognized to obtain drainage entities;

[0039] A quality assessment module, used to assess the quality of the text data to be identified according to the review scores of the review data to be identified to obtain a quality assessment result, and to obtain an account portrait of a user account corresponding to the review data to be identified according to the assessment result;

[0040] An account identification module is used to identify whether the user account is an abnormal account based on the diversion entity and the account portrait.

[0041] According to one aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the abnormal account identification method described in any one of the above is implemented.

[0042] According to one aspect of the present disclosure, there is provided an electronic device, including:

[0043] Processor; and

[0044] A memory, configured to store executable instructions of the processor;

[0045] Wherein, the processor is configured to execute any one of the above-mentioned abnormal account identification methods by executing the executable instructions.

[0046] An abnormal account identification method and device provided by an embodiment of the present invention, on the one hand, obtains text data to be identified by preprocessing comment data to be identified, and performs drainage text entity identification on the text data to be identified to obtain drainage entities; then, the quality of the text data to be identified is evaluated according to the comment scores of the comment data to be identified to obtain a quality evaluation result, and an account portrait of the user account corresponding to the comment data to be identified is obtained according to the evaluation result; finally, whether the user account is an abnormal account is identified according to the drainage entity and the account portrait, which solves the problem in the prior art that the current identification situation only identifies illegal drainage texts, and does not profile the risk accounts in various dimensions on the black industry chain, thereby leading to On the other hand, it solves the problem of low accuracy of identification results of risky accounts and improves the accuracy of identification results of abnormal accounts. On the other hand, it solves the problem that due to the limitations of the formulated rules in the prior art, only rules can be formulated for the characteristics of the discovered illegal diversion texts, and when new illegal diversion texts appear, the current rules cannot be used to identify them, which leads to low accuracy of identification results of diversion entities and improves the accuracy of identification results of diversion entities. On the other hand, it solves the problem that in the prior art, since many comments add many special characters and rules while exposing the diversion links, the accuracy of identification results of diversion entities is low and further improves the accuracy of identification results of diversion entities.

[0047] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The accompanying drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present invention, and together with the specification are used to explain the principles of the present invention. Obviously, the accompanying drawings described below are only some embodiments of the present invention, and for those of ordinary skill in the art, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0049] Figure 1 A flowchart of an abnormal account identification method according to an example embodiment of the present invention is schematically shown.

[0050] Figure 2 A flowchart of a method for inputting each segmented word into an illegal diversion model to obtain the diversion entity according to an exemplary embodiment of the present invention is schematically shown.

[0051] Figure 3 A schematic diagram of an exemplary structure of an illegal traffic diversion model according to an exemplary embodiment of the present invention is shown.

[0052] Figure 4An example diagram of an application scenario of an illegal traffic diversion model according to an example embodiment of the present invention is schematically shown.

[0053] Figure 5 A flowchart schematically illustrates a method for obtaining an account portrait of a user account corresponding to the comment data to be identified based on an evaluation result according to an example embodiment of the present invention.

[0054] Figure 6 A flowchart schematically illustrates another abnormal account identification method according to an exemplary embodiment of the present invention.

[0055] Figure 7 A flowchart schematically illustrates another abnormal account identification method according to an exemplary embodiment of the present invention.

[0056] Figure 8 A block diagram schematically shows an abnormal account identification device according to an exemplary embodiment of the present invention.

[0057] Fig. 9 An electronic device for implementing the above abnormal account identification method according to an exemplary embodiment of the present invention is schematically shown. DETAILED DESCRIPTION

[0058] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present invention will be more comprehensive and complete, and the concept of the example embodiments will be fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present invention. However, those skilled in the art will appreciate that the technical solutions of the present invention may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present invention.

[0059] In addition, the accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0060] This exemplary embodiment first provides an abnormal account identification method, which can be run on a server, server cluster or cloud server, etc., or on a terminal device; of course, those skilled in the art can also run the method of the present invention on other platforms as required, and this exemplary embodiment does not specifically limit this. Figure 1 As shown, the abnormal account identification method may include the following steps:

[0061] Step S110: pre-process the comment data to be identified to obtain text data to be identified, and perform drainage text entity recognition on the text data to be identified to obtain drainage entities.

[0062] Step S120. Evaluate the quality of the text data to be identified according to the comment scores of the comment data to be identified to obtain a quality evaluation result, and obtain an account portrait of the user account corresponding to the comment data to be identified according to the evaluation result.

[0063] Step S130. Identify whether the user account is an abnormal account based on the traffic diversion entity and the account portrait.

[0064] In the above abnormal account identification method, on the one hand, the text data to be identified is obtained by preprocessing the comment data to be identified, and the drainage text entity identification is performed on the text data to be identified to obtain the drainage entity; then the quality of the text data to be identified is evaluated according to the comment scores of the comment data to be identified to obtain the quality evaluation result, and the account portrait of the user account corresponding to the comment data to be identified is obtained according to the evaluation result; finally, whether the user account is an abnormal account is identified according to the drainage entity and the account portrait, which solves the problem that the existing technology only identifies illegal drainage texts, and does not profile the risk accounts in various dimensions in the black industrial chain, which leads to risk accounts. The problem of low accuracy of recognition results is solved, and the accuracy of recognition results of abnormal accounts is improved; on the other hand, the problem that the existing technology has limitations in the formulated rules, so that only rules can be formulated for the characteristics of the discovered illegal diversion texts, and when new illegal diversion texts appear, the current rules cannot be used to identify them, which leads to low accuracy of recognition results of diversion entities, and the accuracy of recognition results of diversion entities is improved; on the other hand, the problem that many comments in the existing technology add many special characters and rules while exposing the diversion links, which makes the accuracy of recognition results of diversion entities low is solved, and the accuracy of recognition results of diversion entities is further improved.

[0065] Hereinafter, each step involved in the abnormal account identification method according to an exemplary embodiment of the present invention will be explained and illustrated in detail with reference to the accompanying drawings.

[0066] First, the purpose of the invention and the professional terms involved in the exemplary embodiments of the present invention are explained.

[0067] Machine learning: Machine learning refers to the process of using certain algorithms to guide computers to use known data to derive appropriate models and use this model to make judgments on new situations.

[0068] Illegal traffic diversion: Introducing illegal traffic diversion content such as public accounts, QQ groups, and diversion links in the comment area.

[0069] Bi-LSTM (Bidirectional Long Short-Term Memory Network): It is composed of two LSTMs, one of which obtains sequence information from the forward direction, and the other LSTM obtains sequence information from the reverse direction. In this way, the complete information of the entire sequence and the order of each position in the sequence can be integrated.

[0070] CRF (Conditional Random Field): is a discriminant model and a type of random field, often used to label or analyze sequence data, such as natural language text or biological sequences.

[0071] Furthermore, the exemplary embodiment of the present invention identifies illegal traffic-generating comment texts posted by risky accounts on the black industry chain, and profiles these risky accounts in various dimensions, considering the use of recommendation weights to identify and punish related accounts. This solution is applied in the actual environment. First, it is necessary to obtain online comment data, analyze the characteristics of illegal traffic-generating texts, formulate preliminary rules for cleaning, and manually annotate different types of illegal texts for model training; use the illegal traffic identification model, and use the comment text Jingdou score logic to evaluate the quality of comment texts posted by different accounts to identify black industry chain accounts;

[0072] In step S110, the comment data to be identified is preprocessed to obtain text data to be identified, and the text data to be identified is subjected to flow-inducing text entity recognition to obtain flow-inducing entities.

[0073] In this example embodiment, first, the special symbols and / or emoticons included in the comment data to be identified are cleaned to obtain the text data to be identified. Specifically, a large number of user comment samples can be obtained online, and the preset rules and ASCII code ranges can be used to filter and remove redundant symbols in the comments, including special symbols, emoticons, etc., to obtain a relatively clean comment sequence data set. In addition, since there are many types of illegal drainage texts in the comments, it is necessary to cover as many types of illegal drainage as possible based on the actual distribution of the comment samples. It should be noted here that the above-mentioned preset rules can, for example, be a database of special symbols and emoticons. When a symbol is identified, it can be determined whether the symbol exists in the database. If it exists, it is directly filtered; in addition, it can also be directly filtered by the ASCII code range corresponding to each special symbol or emoticon, and this example does not impose special restrictions on this.

[0074] Secondly, after obtaining the above-mentioned text data to be identified, the text data to be identified can be subjected to drainage text entity recognition to obtain drainage entities. Specifically, it can include segmenting the text data to be identified to obtain multiple segmentation words, and inputting each segmentation word into the illegal drainage model to obtain the drainage entity; wherein, the drainage entity includes the start byte, the middle byte and other entities.

[0075] refer to Figure 2 As shown, inputting each of the segmented words into the illegal diversion model to obtain the diversion entity may include steps S210 to S230, which are described in detail below.

[0076] In step S210, each of the segmented words is input into the bidirectional long short-term memory network to obtain positive context information and reverse context information.

[0077] In step S220, feature concatenation is performed on the forward context information and the reverse context information through the fully connected layer to obtain concatenated context information.

[0078] In step S230, the splicing context information is identified by using the conditional random field to obtain the drainage entity.

[0079] The following, combined Figure 3 as well as Figure 4 Steps S210 to S230 are explained and illustrated.

[0080] First, in order to obtain the drainage entity, the initial network model needs to be trained to obtain the illegal drainage model. Specifically, it may include, first, obtaining historical comment data and preprocessing the historical comment data to obtain standard input data; secondly, using the standard input data to train the initial network model including the bidirectional long short-term memory network layer, the fully connected layer and the conditional random field layer to obtain the illegal drainage model.

[0081] refer to Figure 3 As shown, the initial network model may include BI-LSTM (bidirectional long short-term memory network) 301, Fully-connected (fully connected layer) 302 and CRF (conditional random field) 303. Among them, Bi-LSTM contains forward and backward LSTM, which can obtain the context information of the positive and reverse order of the complete sequence; thereby more accurately determining the location of the public account, WeChat account and other information related to the illegal diversion text. The fully connected layer can be used to perform feature splicing on the context information of the positive and reverse order of the complete sequence. CRF can be used to realize the recognition of illegal diversion text, because by training the Bi-LSTM network model, the comment text sequence in the text is mapped to the specified sample tag space vector, which contains the context information of the complete sequence, and the vector is input into the CRF to identify the location of the illegal diversion text public account and other information in the text.

[0082] Furthermore, a comment dataset (historical dataset) containing illegal traffic diversion text can be extracted, and then the comment dataset can be preprocessed, and annotation rules can be formulated to perform sequence annotation of illegal traffic diversion text on the preprocessed comment dataset, for example, sequence annotation of public accounts that illegally divert traffic, such as "XX Home", "XX Assistant", and "XX People", etc., and the annotation results can be used to train the LSTM+CRF model, and then the trained model can be used as the above-mentioned illegal traffic diversion model.

[0083] For further reference, Figure 4As shown, after obtaining the illegal drainage model, first, each segmentation word is input into the bidirectional long short-term memory network to obtain the forward context information and the reverse context information; for example, the segmented public account XX is input into the bidirectional long short-term memory network to obtain the forward context value: the public account XX is purchased at half price; the reverse context value is: enjoy half price to purchase XX public account; then, the forward context information and the reverse context information are feature spliced ​​through the fully connected layer to obtain the spliced ​​context information, and finally the spliced ​​context information is identified through the conditional random field to obtain the drainage entity, wherein the drainage entity can include the starting byte (B), the middle byte (I) and other entities (O). Specifically, the identifiers of illegal drainage entities such as public accounts, coupons, QQ groups, etc. can be B-pub, I-pub, B-coupon, I-coupon, B-qq, I-qq, O, etc. For example, there is a comment like this: "Search for the official account XX family and buy it at half price, you know, this Gong Zonghao is half price", it can be seen that the comment belongs to the official account diversion, where the diversion entity is "XX family", and the comment text sequence is input into the Bi-LSTM network to obtain the spatial vector A, and then the vector B is obtained through the fully connected layer, and finally the vector B is input into the CRF to realize the identification of illegal diversion of the official account of the "XX family" entity.

[0084] In step S120, the quality of the text data to be identified is evaluated according to the comment scores of the comment data to be identified to obtain a quality evaluation result, and the account portrait of the user account corresponding to the comment data to be identified is obtained according to the evaluation result.

[0085] In this example embodiment, first, the quality of the text data to be identified is evaluated according to the comment score of the comment data to be identified to obtain a quality evaluation result, which may specifically include: first, the comment data to be identified is scored using a preset scoring model to obtain the comment score; second, the quality of the text data to be identified is evaluated according to the preset score interval to which the comment score belongs to obtain a quality evaluation result; wherein the quality evaluation result includes malicious comments, low-quality comments, general quality comments, and high-quality comments. For example, the preset scoring model can be used to configure the corresponding comment Jingdou for the comment data to be identified according to the comment content, number of characters, and comment dimension (for example, from the practicality, quality, service attitude, etc. of the product) of each comment data to be identified, and then the above comment score is obtained according to the number of comment Jingdou; then the above quality evaluation result is obtained according to the preset score interval to which the comment score belongs. For example, 0-30 points correspond to malicious comments, 30-60 points correspond to low-quality comments, 60-80 points correspond to general quality comments, 80-100 points correspond to high-quality comments, and so on.

[0086] Secondly, the account portrait of the user account corresponding to the comment data to be identified is obtained according to the evaluation result. Figure 5 As shown, obtaining an account portrait of a user account corresponding to the comment data to be identified according to the evaluation results may include steps S510 to S530, which are described in detail below.

[0087] In step S510, all comment data of the user account corresponding to the comment data to be identified are obtained, and all the comment data are input into the illegal diversion model to obtain the diversion entities corresponding to all the comment data.

[0088] In step S520, all the comment data are divided into a first set having illegal traffic diversion comments and a second set having no illegal traffic diversion comments according to the traffic diversion entities corresponding to the all the comment data.

[0089] In step S530, if the proportion of the number of comments with illegal traffic diversion included in the first set in the total amount of all comment data is greater than a first preset threshold and the quality assessment result is a malicious comment, then the account portrait of the user account is a suspected black industry chain account.

[0090] For further reference, Figure 6 As shown, the abnormal account identification method may further include steps S610 to S630, which are described in detail below.

[0091] In step S610, if the proportion of the number of comments with illegal traffic diversion included in the first set to the total amount of all comment data is not greater than the first preset threshold, then it is determined whether the proportion of the number of comments without illegal traffic diversion included in the second set to the total amount of all comment data is greater than the second preset threshold.

[0092] In step S620, if the proportion of the number of comments without illegal traffic diversion included in the second set in the total amount of all comment data is greater than a second preset threshold, the number of comments without illegal traffic diversion corresponding to the low-quality comments in the second set is calculated.

[0093] In step S630, if the proportion of the number of comments without illegal traffic diversion corresponding to the low-quality comments in the number of comments without illegal traffic diversion in the second set is greater than the third preset threshold, and the quality assessment result is a malicious comment, then the account portrait of the user account is a suspected black industry chain account.

[0094] The following will be combined Figure 7 right Figure 5 as well as Figure 6The steps involved are explained and illustrated. Specifically:

[0095] In step S710, all comments of a single user are obtained, and all comments of the single user are input into the illegal traffic diversion model to obtain the traffic diversion entity corresponding to each comment;

[0096] In step S720, it is determined whether each traffic diversion entity is an illegal traffic diversion entity. If yes, the process jumps to step S730; if no, the process jumps to step S740;

[0097] In step S730, a first set A is constructed based on the comments corresponding to the illegal traffic diversion entities, and the number of illegal comments in the first set A is calculated;

[0098] In step S740, a second set B is constructed based on the comments corresponding to the non-illegal traffic diversion entities, and the number of non-illegal comments in the second set B is calculated;

[0099] In step S750, it is determined whether the proportion of the number of illegal comments in the first set A to the number of all comments is greater than the first preset threshold α; if so, and the above-mentioned quality assessment result is a malicious comment, the account profile of the user account is a suspected black industry chain account; if not, jump to step S760;

[0100] In step S760, it is determined whether the proportion of the number of non-violation comments in the second set B to the number of all comments is greater than a second preset threshold value θ; if yes, the process jumps to step S770; if no, the account profile of the user account is a normal account;

[0101] Step S770, using the Jingdou score model to calculate the number of non-illegal traffic diversion comments corresponding to the low-quality comments in the second set B;

[0102] Step S780, determine whether the proportion of the number of comments without illegal traffic diversion corresponding to low-quality comments in the number of comments without illegal traffic diversion in the second set B is greater than the third preset threshold P; if so, and the above quality assessment result is a malicious comment, then the account portrait of the user account is a suspected black industry chain account; if not, then the account portrait of the user account is a normal account.

[0103] Through this method, we can extract comment texts posted under different accounts, use the trained illegal traffic diversion identification model to identify illegal traffic diversion texts, and use the comment Jingdou of the comment texts to evaluate the quality of user comment texts in different dimensions. Based on the evaluation results of each dimension, user account profiles are created, and the profiles are used to screen and identify accounts in the black industry chain; thus improving the accuracy of the identification results of abnormal accounts.

[0104] In step S130, whether the user account is an abnormal account is identified based on the traffic diversion entity and the account portrait.

[0105] In an exemplary embodiment of the present disclosure, if the traffic diversion entity is an illegal traffic diversion entity, and the account profile is a suspected black industry chain account, then the user account is an abnormal account. Through this method, the accuracy of the abnormal account identification result can be further improved, avoiding the problem of poor user experience caused by the normal account being mistaken.

[0106] The exemplary embodiment of the present invention also provides a device for identifying abnormal accounts. Figure 8 As shown, the abnormal account identification device may include an entity identification module 810, a quality assessment module 820 and an account identification module 830. Among them:

[0107] The entity recognition module 810 may be used to pre-process the comment data to be recognized to obtain text data to be recognized, and perform drainage text entity recognition on the text data to be recognized to obtain drainage entities.

[0108] The quality assessment module 820 can be used to assess the quality of the text data to be identified based on the comment scores of the comment data to be identified to obtain a quality assessment result, and to obtain an account portrait of the user account corresponding to the comment data to be identified based on the assessment result.

[0109] The account identification module 830 can be used to identify whether the user account is an abnormal account based on the diversion entity and the account portrait.

[0110] In an exemplary embodiment of the present disclosure, preprocessing the comment data to be identified to obtain the text data to be identified includes:

[0111] The special symbols and / or emoticons included in the comment data to be identified are cleaned to obtain the text data to be identified.

[0112] In an exemplary embodiment of the present disclosure, performing flow-inducing text entity recognition on the text data to be recognized, and obtaining the flow-inducing entity includes:

[0113] Segmenting the text data to be identified to obtain a plurality of segmented words, and inputting each of the segmented words into an illegal diversion model to obtain the diversion entity;

[0114] The traffic diversion entity includes a start byte, a middle byte and other entities.

[0115] In an exemplary embodiment of the present disclosure, the illegal traffic diversion model includes a bidirectional long short-term memory network layer, a fully connected layer, and a conditional random field layer;

[0116] Wherein, inputting each of the segmentation words into the illegal diversion model to obtain the diversion entity includes:

[0117] Input each of the segmented words into the bidirectional long short-term memory network to obtain positive context information and reverse context information;

[0118] Performing feature splicing on the forward context information and the reverse context information through the fully connected layer to obtain spliced ​​context information;

[0119] The concatenated context information is identified through the conditional random field to obtain the drainage entity.

[0120] In an exemplary embodiment of the present disclosure, the abnormal account identification method further includes:

[0121] Acquire historical comment data and preprocess the historical comment data to obtain standard input data;

[0122] The standard input data is used to train an initial network model including a bidirectional long short-term memory network layer, a fully connected layer, and a conditional random field layer to obtain the illegal diversion model.

[0123] In an exemplary embodiment of the present disclosure, evaluating the quality of the text data to be recognized according to the comment scores of the comment data to be recognized to obtain a quality evaluation result includes:

[0124] Scoring the review data to be identified using a preset scoring model to obtain the review score;

[0125] According to the preset score range to which the comment score belongs, the quality of the text data to be identified is evaluated to obtain a quality evaluation result; wherein the quality evaluation result includes malicious comments, low-quality comments, general-quality comments, and high-quality comments.

[0126] In an exemplary embodiment of the present disclosure, obtaining an account portrait of a user account corresponding to the comment data to be identified according to the evaluation result includes:

[0127] Acquire all comment data of the user account corresponding to the comment data to be identified, and input all the comment data into the illegal traffic diversion model to obtain the traffic diversion entity corresponding to all the comment data;

[0128] Dividing all the comment data into a first set having illegal traffic diversion comments and a second set having no illegal traffic diversion comments according to the traffic diversion entities corresponding to all the comment data;

[0129] If the proportion of the number of illegal comments included in the first set in the total amount of all comment data is greater than a first preset threshold and the quality assessment result is a malicious comment, then the account portrait of the user account is a suspected black industry chain account.

[0130] In an exemplary embodiment of the present disclosure, the abnormal account identification device further includes:

[0131] The first judgment module can be used to judge whether the proportion of the number of comments without illegal traffic diversion included in the second set in the total amount of all comment data is greater than a second preset threshold if the proportion of the number of comments with illegal traffic diversion included in the first set in the total amount of all comment data is not greater than a first preset threshold.

[0132] The comment quantity calculation module can be used to calculate the number of comments without illegal traffic diversion corresponding to the low-quality comments in the second set if the proportion of the number of comments without illegal traffic diversion included in the second set to the total amount of all comment data is greater than a second preset threshold.

[0133] The suspected black industry chain account determination module can be used to determine the account profile of the user account as a suspected black industry chain account if the proportion of the number of comments without illegal traffic diversion corresponding to the low-quality comments in the number of comments without illegal traffic diversion in the second set is greater than a third preset threshold, and the quality assessment result is a malicious comment.

[0134] In an exemplary embodiment of the present disclosure, identifying whether the user account is an abnormal account according to the traffic diversion entity and the account portrait includes:

[0135] If the traffic diversion entity is an illegal traffic diversion entity, and the account profile is a suspected black industry chain account, then the user account is an abnormal account.

[0136] The specific details of each module in the above-mentioned abnormal account identification device have been described in detail in the corresponding abnormal account identification method, so they will not be repeated here.

[0137] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0138] In addition, although the steps of the method of the present invention are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0139] In an exemplary embodiment of the present invention, an electronic device capable of implementing the above method is also provided.

[0140] It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as a "circuit", "module" or "system".

[0141] Refer to the following Fig. 9 An electronic device 900 according to this embodiment of the present invention will be described. Fig. 9 The electronic device 900 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0142] like Fig. 9 As shown, the electronic device 900 is in the form of a general computing device. The components of the electronic device 900 may include, but are not limited to: the at least one processing unit 910, the at least one storage unit 920, a bus 930 connecting different system components (including the storage unit 920 and the processing unit 910), and a display unit 940.

[0143] The storage unit stores program codes, which can be executed by the processing unit 910, so that the processing unit 910 performs the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification. For example, the processing unit 910 can perform the following steps: Figure 1 The step S110 shown in the figure is as follows: preprocessing the comment data to be identified to obtain the text data to be identified, and performing drainage text entity recognition on the text data to be identified to obtain the drainage entity; S120: evaluating the quality of the text data to be identified according to the comment scores of the comment data to be identified to obtain a quality evaluation result, and obtaining an account portrait of the user account corresponding to the comment data to be identified according to the evaluation result; step S130: identifying whether the user account is an abnormal account according to the drainage entity and the account portrait.

[0144] The storage unit 920 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 9201 and / or a cache storage unit 9202 , and may further include a read-only storage unit (ROM) 9203 .

[0145] The storage unit 920 may also include a program / utility 9204 having a set (at least one) of program modules 9205, such program modules 9205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0146] Bus 930 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0147] The electronic device 900 may also communicate with one or more external devices 1000 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 900, and / or communicate with any device that enables the electronic device 900 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 950. Furthermore, the electronic device 900 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 960. As shown, the network adapter 960 communicates with other modules of the electronic device 900 via a bus 930. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 900, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0148] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present invention.

[0149] In an exemplary embodiment of the present invention, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of this specification is stored. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to perform the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of this specification.

[0150] The program product for implementing the above method according to an embodiment of the present invention may adopt a portable compact disk read-only memory (CD-ROM) and include program code, and may be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, apparatus, or device.

[0151] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0152] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0153] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0154] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0155] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0156] Other embodiments of the invention will readily occur to those skilled in the art after considering the specification and practicing the invention invented herein. This application is intended to cover any variations, uses or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art that are not invented by the present invention. The specification and examples are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the claims.

Claims

1. A method for identifying abnormal accounts, characterized in that: include: Preprocessing the comment data to be identified to obtain text data to be identified, and performing flow-inducing text entity recognition on the text data to be identified to obtain flow-inducing entities; The quality of the text data to be identified is evaluated according to the comment scores of the comment data to be identified to obtain a quality evaluation result, and the account portrait of the user account corresponding to the comment data to be identified is obtained according to the evaluation result, including: obtaining all comment data of the user account corresponding to the comment data to be identified, and inputting all the comment data into the illegal diversion model to obtain the diversion entities corresponding to the all comment data; dividing all the comment data into a first set with illegal diversion comments and a second set without illegal diversion comments according to the diversion entities corresponding to the all comment data; if the proportion of the number of illegal diversion comments included in the first set in the total amount of all the comment data is greater than a first preset threshold and the quality evaluation result is a malicious comment, then the account portrait of the user account is a suspected black industry chain account; Whether the user account is an abnormal account is identified based on the diversion entity and the account portrait.

2. The abnormal account identification method according to claim 1, characterized in that: The text data to be identified by preprocessing the comment data to be identified includes: The special symbols and / or emoticons included in the comment data to be identified are cleaned to obtain the text data to be identified.

3. The abnormal account identification method according to claim 1, characterized in that: The text data to be identified is subjected to flow-inducing text entity recognition, and the obtained flow-inducing entities include: Segmenting the text data to be identified to obtain a plurality of segmented words, and inputting each of the segmented words into an illegal diversion model to obtain the diversion entity; The traffic diversion entity includes a start byte, a middle byte and other entities.

4. The abnormal account identification method according to claim 3, characterized in that: The illegal traffic diversion model includes a bidirectional long short-term memory network layer, a fully connected layer, and a conditional random field layer; Wherein, inputting each of the segmentation words into the illegal diversion model to obtain the diversion entity includes: Input each of the segmented words into the bidirectional long short-term memory network to obtain positive context information and reverse context information; Performing feature splicing on the forward context information and the reverse context information through the fully connected layer to obtain spliced ​​context information; The concatenated context information is identified through the conditional random field to obtain the drainage entity.

5. The abnormal account identification method according to claim 4, characterized in that: The abnormal account identification method further includes: Acquire historical comment data and preprocess the historical comment data to obtain standard input data; The standard input data is used to train an initial network model including a bidirectional long short-term memory network layer, a fully connected layer, and a conditional random field layer to obtain the illegal diversion model.

6. The abnormal account identification method according to claim 3, characterized in that: The quality of the text data to be identified is evaluated according to the comment scores of the comment data to be identified to obtain a quality evaluation result including: Scoring the review data to be identified using a preset scoring model to obtain the review score; According to the preset score range to which the comment score belongs, the quality of the text data to be identified is evaluated to obtain a quality evaluation result; wherein the quality evaluation result includes malicious comments, low-quality comments, general-quality comments, and high-quality comments.

7. The abnormal account identification method according to claim 1, characterized in that: The abnormal account identification method further includes: If the proportion of the number of comments with illegal traffic diversion included in the first set to the total amount of all the comment data is not greater than the first preset threshold, then determining whether the proportion of the number of comments without illegal traffic diversion included in the second set to the total amount of all the comment data is greater than the second preset threshold; If the proportion of the number of comments without illegal traffic diversion included in the second set to the total amount of all comment data is greater than a second preset threshold, then the number of comments without illegal traffic diversion corresponding to the low-quality comments in the second set is calculated; If the proportion of the number of comments without illegal traffic diversion corresponding to the low-quality comments in the number of comments without illegal traffic diversion in the second set is greater than a third preset threshold, and the quality assessment result is a malicious comment, then the account portrait of the user account is a suspected black industry chain account.

8. The abnormal account identification method according to claim 7, characterized in that: Identifying whether the user account is an abnormal account according to the traffic diversion entity and the account portrait includes: If the traffic diversion entity is an illegal traffic diversion entity, and the account profile is a suspected black industry chain account, then the user account is an abnormal account.

9. An abnormal account identification device, characterized in that: include: An entity recognition module is used to pre-process the comment data to be recognized to obtain text data to be recognized, and to perform drainage text entity recognition on the text data to be recognized to obtain drainage entities; A quality assessment module, for assessing the quality of the text data to be identified according to the comment scores of the comment data to be identified to obtain a quality assessment result, and obtaining an account portrait of the user account corresponding to the comment data to be identified according to the assessment result, including: obtaining all comment data of the user account corresponding to the comment data to be identified, and inputting all comment data into an illegal traffic diversion model to obtain traffic diversion entities corresponding to all comment data; dividing all comment data into a first set with illegal traffic diversion comments and a second set without illegal traffic diversion comments according to the traffic diversion entities corresponding to all comment data; if the proportion of the number of illegal traffic diversion comments included in the first set in the total amount of all comment data is greater than a first preset threshold and the quality assessment result is a malicious comment, then the account portrait of the user account is a suspected black industry chain account; An account identification module is used to identify whether the user account is an abnormal account based on the diversion entity and the account portrait.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the abnormal account identification method according to any one of claims 1 to 8 is implemented.

11. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; Wherein, the processor is configured to execute the abnormal account identification method described in any one of claims 1-8 by executing the executable instructions.

Images