Method, device, electronic device and storage medium for identifying abnormal object set

Abstract

The present disclosure relates to a method, device, electronic device and storage medium for identifying a set of abnormal objects. The method includes: obtaining operation structure information corresponding to a preset number of abnormal objects, wherein the operation structure information is a graph with a preset number of abnormal objects as nodes and the same target operation numbers executed between two abnormal objects in the preset number of abnormal objects as edges. Based on the operation structure information, the preset number of abnormal objects are divided into sets to obtain at least one set of abnormal objects. The method obtains the connection relationship between the abnormal objects based on the operation structure information, and then identifies the abnormal object set corresponding to the abnormal object based on the connection relationship between the abnormal objects, thereby improving the efficiency and effectiveness of identifying abnormal objects. Not only can the abnormal object set of "fake people and fake machines" be discovered, but also the abnormal object set of "real people and real machines" can be discovered, thereby improving the accuracy of identifying the abnormal object set.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing technology, and in particular to a method, device, electronic device and storage medium for identifying a set of abnormal objects. Background Art

[0002] In recent years, the number of short video users has increased significantly, and the short video market has become increasingly large. At the same time, the illusion of traffic has also emerged, such as malicious clicks and inflated volumes and followers.

[0003] At present, the ability to identify abnormal objects is mostly focused on the determination of a single object. In the related technology, the features of normal objects are compared with the features of abnormal users to identify a single abnormal object. The efficiency of identifying abnormal objects is low, and there is only a black or white judgment for a single abnormal object, which results in the abnormal object being converted into a normal object by re-registering an account, resulting in the problem of low effectiveness of abnormal object identification. Summary of the invention

[0004] The present disclosure provides a method, device, electronic device and storage medium for identifying a set of abnormal objects, so as to at least solve the problem of low efficiency and low effectiveness in identifying abnormal objects in the related art. The technical solution of the present disclosure is as follows:

[0005] According to a first aspect of an embodiment of the present disclosure, a method for identifying an abnormal object set is provided, the method comprising:

[0006] Obtaining operation structure information corresponding to a preset number of abnormal objects, wherein the operation structure information is a graph with the preset number of abnormal objects as nodes and the same target operations performed jointly between any two of the preset number of abnormal objects as edges, wherein the target operands corresponding to each of the preset number of abnormal objects are greater than or equal to the preset number of operands, and the same target operands corresponding to any two of the abnormal objects are greater than or equal to the preset number of common operands;

[0007] Based on the operation structure information, the preset number of abnormal objects are divided into sets to obtain at least one abnormal object set.

[0008] As an optional embodiment, after dividing the preset number of abnormal objects into sets based on the operation structure information to obtain at least one abnormal object set, the method further includes:

[0009] Based on the operation structure information, a core exception object in each exception object set is determined, wherein the core exception object is a core object in each exception object set that abnormally executes the target operation, and the core exception object is used to identify a corresponding exception object set.

[0010] As an optional embodiment, determining the core abnormal object in each abnormal object set based on the operation structure information includes:

[0011] Based on the operation structure information, determining association information between each abnormal object in each abnormal object set and a corresponding associated abnormal object, wherein the association information is used to measure the closeness of the association between each abnormal object and the corresponding associated abnormal object, wherein the associated abnormal object is an abnormal object connected to each current abnormal object in the operation structure information;

[0012] Based on the association information, determine the abnormal indicator data corresponding to each abnormal object in each abnormal object set;

[0013] The abnormal objects whose abnormal indicator data meet the preset threshold are taken as the core abnormal objects.

[0014] As an optional embodiment, the association information includes the total number of associated objects and the target association weight, and the determining, based on the operation structure information, the association information between each abnormal object in each abnormal object set and the corresponding associated abnormal object includes:

[0015] Based on the operation structure information, the total number of associated objects of the associated abnormal objects corresponding to each abnormal object and the target association weight corresponding to each abnormal object are obtained, where the target association weight is the sum of the association weights between each abnormal object and the corresponding associated abnormal object;

[0016] The determining, based on the association information, the abnormal indicator data corresponding to each abnormal object in the abnormal object set comprises:

[0017] Based on the total number of associated objects, the target association weight, the total number of abnormal objects and the cumulative association weight, the abnormal indicator data corresponding to each abnormal object is determined, the total number of abnormal objects is the number value of abnormal objects in each abnormal object set, and the cumulative association weight represents the sum of the association weights between each abnormal object in each abnormal object set.

[0018] As an optional embodiment, the method further includes:

[0019] Acquire multiple initial operation data sets divided based on preset grouping information, wherein the initial operation data sets represent a set of common operation data corresponding to the initial objects, wherein the common operation data corresponding to the initial objects are the same target operation numbers executed between two initial objects and two initial objects, and the initial objects are objects whose corresponding target operation numbers are greater than or equal to the preset operation numbers;

[0020] Performing filtering processing on each initial operation data set respectively to obtain a filtered operation data set, wherein the filtered operation data set represents a set of common operation data corresponding to the objects to be identified, wherein the common operation data corresponding to the objects to be identified are the same target operation numbers commonly performed between the objects to be identified and between the objects to be identified, and the objects to be identified are initial objects whose same target operation numbers are greater than or equal to the preset common operation numbers;

[0021] Merging the filtered operation data sets to obtain a target operation data set;

[0022] The operation structure information is generated based on the target operation data set.

[0023] As an optional embodiment, the filtering operation data set is a plurality of filtering operation data sets arranged in sequence, and merging the plurality of filtering operation data sets to obtain the target operation data set includes:

[0024] The first filter operation data set and the second filter operation data set of the plurality of filter operation data sets arranged in sequence are merged, and the filter operation data sets after the second filter operation data set are merged in sequence until the last filter operation data set is merged to obtain the target operation data set.

[0025] As an optional embodiment, the set division of the preset number of abnormal objects based on the operation structure information to obtain at least one abnormal object set includes:

[0026] Based on the connection relationship between each node in the operation structure information, determine the connected graph structure corresponding to each abnormal object;

[0027] The abnormal objects corresponding to the nodes in the connected graph structure whose number of nodes meets a preset number threshold are divided into the same abnormal object set.

[0028] As an optional embodiment, it is characterized in that the method further comprises:

[0029] Based on the update exception object, the operation structure information is updated to obtain updated operation structure information;

[0030] Based on the connected graph structure in the update operation structure information, the abnormal object set corresponding to the connected graph structure in the operation structure information is updated to obtain an updated abnormal object set;

[0031] Based on the core exception object, operation data monitoring is performed on the update exception object set.

[0032] According to a second aspect of an embodiment of the present disclosure, a device for identifying an abnormal object set is provided, the device comprising:

[0033] An operation structure information acquisition module is configured to execute and acquire operation structure information corresponding to a preset number of abnormal objects, wherein the operation structure information is a graph with the preset number of abnormal objects as nodes and the same target operations performed jointly between two of the preset number of abnormal objects as edges, the target number of operations corresponding to each of the preset number of abnormal objects is greater than or equal to the preset number of operations, and the number of the same target operations corresponding to the two abnormal objects is greater than or equal to the preset number of common operations;

[0034] The abnormal object set acquisition module is configured to perform set division on the preset number of abnormal objects based on the operation structure information to obtain at least one abnormal object set.

[0035] As an optional embodiment, it is characterized in that the device further comprises:

[0036] The core abnormal object determination module is configured to determine the core abnormal object in each abnormal object set based on the operation structure information, wherein the core abnormal object is a core object that abnormally executes the target operation in each abnormal object set, and the core abnormal object is used to identify the corresponding abnormal object set.

[0037] As an optional embodiment, the core abnormal object determination module includes:

[0038] a correlation information determining unit, configured to determine, based on the operation structure information, correlation information between each abnormal object in each abnormal object set and a corresponding associated abnormal object, wherein the correlation information is used to measure the degree of correlation between each abnormal object and the corresponding associated abnormal object, and the associated abnormal object is an abnormal object connected to each current abnormal object in the operation structure information;

[0039] an abnormal indicator data determining unit, configured to determine the abnormal indicator data corresponding to each abnormal object in each abnormal object set based on the association information;

[0040] The core abnormal object determination unit is configured to execute the abnormal object whose abnormal indicator data meets a preset threshold as the core abnormal object.

[0041] As an optional embodiment, the association information includes the total number of association objects and the target association weight, and the association information determination unit includes:

[0042] an associated information acquisition unit, configured to acquire, based on the operation structure information, a total number of associated objects of associated abnormal objects corresponding to each abnormal object and a target associated weight corresponding to each abnormal object, wherein the target associated weight is a sum of the associated weights between each abnormal object and the corresponding associated abnormal object;

[0043] The abnormal indicator data determination unit includes:

[0044] The abnormal indicator calculation unit is configured to determine the abnormal indicator data corresponding to each abnormal object based on the total number of associated objects, the target association weight, the total number of abnormal objects and the cumulative association weight, wherein the total number of abnormal objects is the number value of abnormal objects in each abnormal object set, and the cumulative association weight represents the sum of the association weights between each abnormal object in each abnormal object set.

[0045] As an optional embodiment, the device further includes:

[0046] An initial operation data set acquisition module is configured to execute acquisition of a plurality of initial operation data sets divided based on preset grouping information, wherein the initial operation data sets represent a set of common operation data corresponding to the initial objects, wherein the common operation data corresponding to the initial objects are the same target operation numbers commonly executed between the initial objects and the pairwise initial objects, and the initial objects are objects whose corresponding target operation numbers are greater than or equal to the preset operation numbers;

[0047] A filtering processing module is configured to perform filtering processing on each initial operation data set to obtain a filtered operation data set, wherein the filtered operation data set represents a set of common operation data corresponding to the objects to be identified, wherein the common operation data corresponding to the objects to be identified are the same target operation numbers commonly performed between the objects to be identified and between the objects to be identified, and the objects to be identified are initial objects whose same target operation numbers are greater than or equal to the preset common operation numbers;

[0048] a target operation data set generation module, configured to merge the filtered operation data sets to obtain a target operation data set;

[0049] The operation structure information generating module is configured to generate the operation structure information based on the target operation data set.

[0050] As an optional embodiment, the filtering operation data set is a plurality of filtering operation data sets arranged in sequence, and the target operation data set generating module includes:

[0051] The data set merging unit is configured to merge the first filter operation data set and the second filter operation data set in the plurality of filter operation data sets arranged in order, and to merge the filter operation data sets after the second filter operation data set in sequence until the last filter operation data set is merged to obtain the target operation data set.

[0052] As an optional embodiment, the abnormal object set acquisition module includes:

[0053] A connected graph structure acquisition unit is configured to determine a connected graph structure corresponding to each abnormal object based on a connection relationship between nodes in the operation structure information;

[0054] The set filtering unit is configured to divide the abnormal objects corresponding to the nodes in the connected graph structure whose number of nodes meets a preset number threshold into the same abnormal object set.

[0055] As an optional embodiment, it is characterized in that the device further comprises:

[0056] An operation structure information updating module is configured to update the operation structure information based on the update exception object to obtain updated operation structure information;

[0057] An abnormal object set updating module is configured to update the abnormal object set corresponding to the connected graph structure in the operation structure information based on the connected graph structure in the update operation structure information to obtain an updated abnormal object set;

[0058] The operation data monitoring module is configured to perform operation data monitoring on the update exception object set based on the core exception object.

[0059] According to a third aspect of an embodiment of the present disclosure, there is provided an electronic device, including:

[0060] processor;

[0061] a memory for storing instructions executable by the processor;

[0062] The processor is configured to execute the instructions to implement the method for identifying a set of abnormal objects as described above.

[0063] According to a fourth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided. When instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the method for identifying a set of abnormal objects as described above.

[0064] According to a fifth aspect of an embodiment of the present disclosure, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the method for identifying a set of abnormal objects described above is implemented.

[0065] The technical solution provided by the embodiments of the present disclosure brings at least the following beneficial effects:

[0066] The operation structure information corresponding to a preset number of abnormal objects is obtained, and the operation structure information is a graph with a preset number of abnormal objects as nodes and the same target operation number executed between two abnormal objects in the preset number of abnormal objects as edges. Based on the edges in the operation structure information, the preset number of abnormal objects are divided into sets to obtain at least one abnormal object set. The method can obtain the connection relationship between the abnormal objects according to the operation structure information, thereby identifying the abnormal object set corresponding to the abnormal object based on the connection relationship between the abnormal objects, improving the efficiency of identifying the abnormal object, and the target operation corresponding to each abnormal object in the abnormal object set is high in similarity. Through the overall similar target operation, the abnormal object set is identified, which can play the role of finding one and leading to a hundred, thereby improving the effectiveness of identifying the abnormal object set, and in the subsequent steps, the abnormal object set with overall similar operations is monitored, which can improve the effectiveness of monitoring the abnormal object set. The method can not only discover the abnormal object set of "fake people and fake machines", but also discover the abnormal object set of "real people and real machines", thereby improving the accuracy of identifying the abnormal object set.

[0067] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute improper limitations on the present disclosure.

[0069] Figure 1 The figure is a schematic diagram of an application scenario of a method for identifying a set of abnormal objects according to an exemplary embodiment.

[0070] Figure 2 The present invention is a flowchart of a method for identifying a set of abnormal objects according to an exemplary embodiment.

[0071] Figure 3 The present invention is a flowchart of generating operation structure information in a method for identifying an abnormal object set according to an exemplary embodiment.

[0072] Figure 4The diagram is a schematic diagram of generating an initial operation data set in a method for identifying an abnormal object set according to an exemplary embodiment.

[0073] Figure 5 The diagram is a schematic diagram of merging a filtering operation data set in a method for identifying an abnormal object set according to an exemplary embodiment.

[0074] Figure 6 The present invention is a flowchart of obtaining an abnormal object set in a method for identifying an abnormal object set according to an exemplary embodiment.

[0075] Figure 7 The present invention is a schematic diagram of a connected graph structure in a method for identifying an abnormal object set according to an exemplary embodiment.

[0076] Figure 8 The present invention is a flowchart of determining a core abnormal object in a method for identifying an abnormal object set according to an exemplary embodiment.

[0077] Fig. 9 The present invention is a flowchart of determining associated information in a method for identifying a set of abnormal objects according to an exemplary embodiment.

[0078] Fig.10 The present invention is a flowchart of monitoring an abnormal object set in a method for identifying an abnormal object set according to an exemplary embodiment.

[0079] Fig.11 It is a schematic diagram showing an application scenario of a method for identifying a set of abnormal objects in a likes-boosting application according to an exemplary embodiment.

[0080] Fig.12 The present invention is a block diagram of a device for identifying an abnormal object set according to an exemplary embodiment.

[0081] Fig.13 It is a block diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0082] In order to enable ordinary persons in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings.

[0083] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0084] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties.

[0085] Figure 1 is a schematic diagram of an application scenario of a method for identifying a set of abnormal objects according to an exemplary embodiment. Figure 1 As shown, the application scenario includes a server 110 and a client 120. The server 110 obtains operation structure information corresponding to a preset number of abnormal objects, and the abnormal objects correspond to the client 120. The server 110 divides the abnormal objects based on the operation structure information to obtain at least one abnormal object set, and determines the core abnormal object in each abnormal object set. The server 110 can monitor the operation data of the abnormal object set based on the core abnormal object.

[0086] In the disclosed embodiment, the server 110 may include an independently operated server, or a distributed server, or a server cluster composed of a plurality of servers. The server 110 may include a network communication unit, a processor, a memory, and the like. Specifically, the server 110 may divide the abnormal objects based on the operation structure information corresponding to the abnormal objects, obtain at least one abnormal object set, and determine the core abnormal object in each abnormal object set. The server 110 may also monitor the operation data of the abnormal object set based on the core abnormal object.

[0087] In the embodiments of the present disclosure, the client 120 includes physical devices such as smart phones, desktop computers, tablet computers, laptops, digital assistants, smart wearable devices, etc., and may also include software running in the physical devices, such as applications, etc. The operating system running on the physical device in the embodiments of the present application may include but is not limited to Android system, IOS system, Linux, Unix, Windows, etc.

[0088] Figure 2is a flowchart of a method for identifying an abnormal object set according to an exemplary embodiment. Figure 2 As shown, the method is used in a server and includes the following steps.

[0089] S210. Obtain operation structure information corresponding to a preset number of abnormal objects, the operation structure information is a graph with a preset number of abnormal objects as nodes, and the same target operations performed jointly between two abnormal objects in the preset number of abnormal objects as edges, the target operation number corresponding to each of the preset number of abnormal objects is greater than or equal to the preset operation number, and the same target operation number corresponding to two abnormal objects is greater than or equal to the preset common operation number;

[0090] As an optional embodiment, the operation structure information is composed of the abnormal objects obtained within a preset time period and the same target operations between the abnormal objects. The weight of the edge in the operation structure information is the number of the same target operations between the abnormal objects, such as the abnormal objects obtained within a day and the common operations between the abnormal objects. The operation structure information can be continuously updated.

[0091] As an alternative embodiment, see Figure 3 , the method further comprises:

[0092] S310. Acquire multiple initial operation data sets divided based on preset grouping information, the initial operation data sets represent a set of common operation data corresponding to the initial objects, the common operation data corresponding to the initial objects are the same target operation numbers executed between the initial objects and the initial objects, and the initial objects are objects whose corresponding target operation numbers are greater than or equal to the preset operation numbers;

[0093] S320. Filter each initial operation data set to obtain a filtered operation data set, wherein the filtered operation data set represents a set of common operation data corresponding to the object to be identified, wherein the common operation data corresponding to the object to be identified is the same target operation number performed between two objects to be identified and between two objects to be identified, and the object to be identified is an initial object whose same target operation number is greater than or equal to a preset common operation number;

[0094] S330. Merge the filtered operation data sets to obtain a target operation data set;

[0095] S340. Generate operation structure information based on the target operation data set.

[0096] As an optional embodiment, the initial object and the target operation corresponding to the initial object can be obtained from the object operation log, and the object whose target operation number is greater than or equal to the preset operation number is screened out from the object operation log as the initial object. The target operation can be the operation information that the server needs to detect whether there is an abnormal operation, such as a like operation. There may be an abnormal operation of brushing the number of likes, so it is necessary to identify the user who brushes the number of likes, that is, the abnormal object. The initial object is an object that may have abnormal operations. When identifying the abnormal object, data processing and filtering processing based on the initial object are required to obtain the abnormal object.

[0097] As an optional embodiment, Figure 4 As shown, based on the initial objects and the target operations corresponding to the initial objects, the number of the same target operations performed jointly between the two initial objects is determined, and multiple initial operation data sets corresponding to the initial objects are obtained. The common operation data corresponding to the initial objects in the initial operation data sets include the initial combination pairs composed of the two initial objects, and the number of the same target operations corresponding to the initial combination pairs. The preset grouping information can be multiple time partitions corresponding to the preset time period, and the multiple initial operation data sets can be the initial operation data sets corresponding to each time partition. The time partition is the time interval obtained by equally dividing the preset time period, for example, a day is divided into 6 time partitions, and each time partition corresponds to 4 hours of operation data. Corresponding to the initial objects and the target operations corresponding to the initial objects in each time partition, the number of the same target operations performed jointly between the two initial objects is determined, and the initial operation data set corresponding to the time partition is obtained. The preset grouping information can also be multiple geographical partitions corresponding to the preset area. The geographical partition can be determined by the IP address, and the multiple initial operation data sets can be the initial operation data sets corresponding to each geographical partition.

[0098] Based on the initial operation data set, the same target operands corresponding to the two initial objects are determined, the initial objects whose same target operands are greater than or equal to the preset common operands are obtained, and the initial objects whose same target operands are less than the preset common operands are deleted to obtain a filtering operation data set. Among them, the initial objects whose same target operands are greater than or equal to the preset common operands are abnormal objects, so the common operation data corresponding to the objects to be identified in the filtering operation data set include target combination pairs composed of two abnormal objects, and the same target operands corresponding to the target combination pairs. Each initial operation data set corresponds to a filtering operation data set, so there are also multiple filtering operation data sets. In the case where the initial operation data set corresponds to a time partition, the filtering operation data set also corresponds to the same time partition.

[0099] By merging multiple filtering operation data sets, a target operation data set of a preset number of abnormal objects can be obtained. The target operation data set is a collection of common operation data corresponding to abnormal objects within a preset time period. The abnormal objects in the target operation data set have not yet been collectively screened. Therefore, the number of abnormal objects in the target operation data set at this time is not the number corresponding to the preset number of abnormal objects. The number of abnormal objects in the target operation data set is generally greater than the number corresponding to the preset number of abnormal objects. Determine the common operations between the two abnormal objects based on the target operation data set. Take the preset number of abnormal objects as nodes, connect the two abnormal objects according to the same target operations performed jointly between the two abnormal objects, and set the same target operation number as the weight of the edge between the two abnormal objects, so as to generate operation structure information.

[0100] As an optional embodiment, the target operation data set is processed based on a preset graph structure generation algorithm to generate operation structure information. Based on the preset graph structure generation algorithm, the common operation data corresponding to the abnormal objects in the target operation data set can be represented as three fields, namely user_1_id, user_2_id and count, wherein user_1_id and user_2_id represent the identifiers of the abnormal objects in pairs, and count is the number of identical target operations between the abnormal objects in pairs. According to these three fields, a triple of the graph corresponding to the operation structure information can be generated, i.e., [node 1, node 2, weight (edge)]. In this way, each group of data in the target operation data set is processed to obtain a series of triples consisting of nodes and edges, and the obtained triples are stored, and then based on the graph structure generation algorithm, the stored triples are called to generate the corresponding graph objects to obtain the operation structure information.

[0101] The graph structure generation algorithm may be a Graphx algorithm, and the three fields corresponding to the abnormal object and the same target operand may be Dataframe objects. DataFrame is a tabular data structure that contains a set of ordered columns, each of which may have different values. When storing triples, Resilient Distributed Datasets (RDD) may be used for storage. In addition, based on the Graphx algorithm, nodes and edges may be stored in different RDD partitions, respectively, and based on the routing data corresponding to the operation structure information, different nodes and edges may be sequentially obtained from different RDD partitions to generate the operation structure information.

[0102] First, the initial object whose target operation is greater than the preset number of operations is obtained, which can reduce the amount of calculation of the common operation data corresponding to the initial object. Then, based on the preset number of common operations, the initial object is screened to filter out normal users and avoid accidental injury to normal users. Based on time partitions, multiple initial operation data sets are obtained, and then multiple filtered operation data sets are obtained, which can reduce the operation data set to reduce the amount of calculation in each time partition, thereby improving the efficiency of obtaining the filtered operation data set.

[0103] As an optional embodiment, the filtering operation data set is a plurality of filtering operation data sets arranged in sequence, and the filtering operation data sets are merged to obtain the target operation data set including:

[0104] The first filter operation data set and the second filter operation data set in the plurality of filter operation data sets arranged in sequence are merged, and the filter operation data sets after the second filter operation data set are merged in sequence until the last filter operation data set is merged to obtain a target operation data set.

[0105] As an optional embodiment, the filtering operation data set corresponds to the time partition corresponding to the initial operation data set, so the multiple filtering operation data sets arranged in sequence can be sorted in the order of the time partitions. When the current filtering operation data set is the first filtering operation data set, the first filtering operation data set and the second filtering operation data set are merged to obtain the first merged operation data set. When the current filtering operation data set is not the first filtering operation data set, and the current filtering operation data set is not the second filtering operation data set, the current filtering operation data set and the previous merged operation data set corresponding to the current filtering operation data set are merged to obtain the merged operation data set corresponding to the current filtering operation data set. When the merged operation data set corresponding to the last filtering operation data set is obtained, the merged operation data set corresponding to the last filtering operation data set is used as the target operation data set.

[0106] In the case where the current filtering operation data set is the first filtering operation data set, the first filtering operation data set and the second filtering operation data set are merged to determine the intersection between the first filtering operation data set and the second filtering operation data set, and to determine the difference between the intersection and the first filtering operation data set, and the difference between the intersection and the second filtering operation data set, and the intersection and the two differences are merged to obtain the first merged operation data set. For example, Figure 5As shown, the filtering operation data set A and the filtering operation data set B are merged, and the intersection AB between the filtering operation data set A and the filtering operation data set B is obtained through set operation, and the difference set A1 between the intersection AB and the filtering operation data set A, and the difference set B1 between the intersection AB and the filtering operation data set AB are obtained. The intersection AB, the difference set A1 and the difference set B1 are merged to obtain the merged operation data set.

[0107] After obtaining the first merge operation data set, the third filter operation data set is used as the current filter operation data set, and the first merge operation data set is the previous merge operation data set corresponding to the current filter operation data set. The first merge operation data set and the third filter operation data set are merged, the intersection between the first merge operation data set and the third filter operation data set is determined, and the difference between the intersection and the first merge operation data set and the difference between the intersection and the third filter operation data set are determined, and the intersection and the two differences are merged to obtain the second merge operation data set. The second merge operation data set is the merge operation data set corresponding to the third filter operation data set. By analogy, the fourth filter operation data set and the second merge operation data set are merged, and so on, until the last filter operation data set and the second-to-last merge operation data set are merged to obtain the merge operation data set corresponding to the last filter operation data set, that is, to obtain the last merge operation data set, and the last merge operation data set is used as the target operation data set.

[0108] Wherein, when merging the filtering operation data set, the data in the intersection is the sum of the same target operands between the same identifiable objects in the operation data set currently being merged. When the operation data set currently being merged is the first filtering operation data set and the second filtering operation data set, the intersection is the sum of the same target operands between the same identifiable objects in the first filtering operation data set and the second filtering operation data set. Similarly, when the operation data set currently being merged is the last merging operation data set and the current filtering operation data set, the data in the intersection is the sum of the same target operands between the same identifiable objects in the last merging operation data set and the current filtering operation data set. For example, filtering operation data set A includes identifiable objects 1 and identifiable objects 2, and the same target operands between identifiable objects 1 and identifiable objects 2, and the same target operands between identifiable objects 1 and identifiable objects 2 are 50, filtering operation data set B also includes identifiable objects 1 and identifiable objects 2, and the same target operands between identifiable objects 1 and identifiable objects 2 are 30, then in the merged intersection, the same target operands between identifiable objects 1 and identifiable objects 2 are 80.

[0109] By calculating an intersection and two complements between the current filtering operation data set and the last merged operation data set, and merging the filtering operation data sets in order to obtain the target operation data set, it is possible to avoid obtaining duplicate data, thereby improving the accuracy of the target operation data set and simplifying the steps of generating operation structure information.

[0110] S220. Based on the operation structure information, a preset number of abnormal objects are divided into sets to obtain at least one abnormal object set;

[0111] As an optional embodiment, each node in the operation structure information is connected by an edge, and the node corresponds to an abnormal object. Based on the edge in the operation structure information, the similarity between the abnormal objects can be determined, and the connected abnormal objects are classified and divided to obtain at least one abnormal object set. The operation data corresponding to the abnormal objects in each abnormal object set are similar, and the operation data corresponding to the abnormal objects in different abnormal object sets are weakly correlated and non-aggregate, and the non-aggregate means that the operation row data corresponding to the abnormal objects in different abnormal object sets are not classified into the same category.

[0112] As an alternative embodiment, see Figure 6 , based on the edge of the operation structure information, the abnormal objects are divided into sets, and at least one abnormal object set is obtained, including:

[0113] S610. Based on the connection relationship between each node in the operation structure information, determine the connected graph structure corresponding to each abnormal object;

[0114] S620. Divide the abnormal objects corresponding to the nodes in the connected graph structure whose number of nodes meets a preset number threshold into the same abnormal object set.

[0115] As an optional embodiment, the connected graph structure is a graph structure in which there is a path between any two nodes, and the path may include direct connections and indirect connections, such as Figure 7 As shown, for example, node 2 is connected to node 3 and node 4, node 5 is connected to node 3 and node 4, and node 2 is connected to node 5, wherein there is no direct connection between node 3 and node 4, but node 3 and node 4 can be indirectly connected through node 2 or node 5, so there is also a path between node 3 and node 4, and node 6 is connected to node 7, and node 6 is not connected to node 2, node 3, node 4 and node 5, and node 7 is not connected to node 2, node 3, node 4 and node 5, therefore, node 6 and node 7 form a connected graph structure, and node 2, node 3, node 4 and node 5 form a connected graph structure.

[0116] Based on the connection relationship between each node in the operation structure information, the paths between two nodes are determined, thereby obtaining multiple connected graph structures. The nodes in each connected graph structure correspond to abnormal objects, so there is a corresponding relationship between these abnormal objects and the connected graph structure. For example, connected graph structure 1 includes node x, node y and node z, so the connected graph structure corresponding to the abnormal object corresponding to node x, the connected graph structure corresponding to the abnormal object corresponding to node y, and the connected graph structure corresponding to the abnormal object corresponding to node z are all connected graph structure 1.

[0117] As an optional embodiment, there is a corresponding relationship between the connected graph structure and the abnormal object set, and each connected graph structure corresponds to an abnormal object set. The connected graph structure can be screened first to obtain the number of nodes corresponding to the connected graph structure, and the connected graph structures with a number of nodes less than a preset number threshold are filtered out, and the abnormal objects corresponding to each node in the connected graph structure with a number of nodes greater than or equal to the preset number threshold are divided into the same abnormal object set.

[0118] Based on a preset algorithm, the nodes in the connected graph structure are numbered. The target identification node used to identify each connected graph structure can be the node with the smallest serial number in the connected graph structure, and the identity document (id) corresponding to the node is the identifier of the connected graph structure. The id identifier can be used as a set classification identifier for the set of abnormal objects corresponding to the connected graph structure, and the abnormal objects with the same set classification identifier can be divided into the same set of abnormal objects. The preset algorithm can be a graph object calling algorithm, such as the ConnectedComponents algorithm, etc., which classifies the nodes in the operation structure information into different connected graph structures. The final output of the ConnectedComponents algorithm is a Graph[vertexId, Long] object, where vertexId is the node identifier and Long is the target node identifier. For example, in the Figure 7 When the two connected graph structures shown are classified and divided, (2, 2), (3, 2), (4, 2), (5, 2), (6, 6) (7, 6) can be obtained. According to the output result, it can be determined that nodes 2, 3, 4 and 5 belong to the connected graph structure marked by node 2, and nodes 6 and 7 belong to the connected graph structure marked by node 6. The Graph[vertexId, Long] object can be converted to a Dataframe object.

[0119] By determining the abnormal object set through the connected graph structure, it can be made that there is an association between each two abnormal objects in the abnormal object set, and the abnormal objects in different abnormal object sets are not associated, thereby improving the accuracy of the abnormal object set division. At the same time, after obtaining the initial abnormal object set, based on the preset number threshold, the initial abnormal object set is screened, and the initial abnormal object set with the number of abnormal objects less than the preset number threshold is removed, which can further filter normal users and initial abnormal object sets with a smaller magnitude to avoid accidental injury to normal users.

[0120] As an optional embodiment, after dividing a preset number of abnormal objects into sets based on the operation structure information to obtain at least one abnormal object set, the method further includes:

[0121] Based on the operation structure information, a core exception object in each exception object set is determined. The core exception object is a core object of an abnormal execution target operation in each exception object set. The core exception object is used to identify a corresponding exception object set.

[0122] As an optional embodiment, based on the operation structure information, the core abnormal object in each abnormal object set can be determined, the number of core abnormal objects is at least one, and can also be multiple, and the core abnormal object is closely connected to other abnormal objects in the corresponding abnormal object set, that is, the number of other abnormal objects connected to the core abnormal object in the corresponding abnormal object set is large, and the number of the same target operations with other abnormal objects is large, and the number of other abnormal objects connected and the same target operations can be judged by the preset threshold information, and the other abnormal objects are abnormal objects in the abnormal object set except the core abnormal object. Therefore, the abnormal object set can be identified based on the core abnormal object.

[0123] Based on the core abnormal object, the abnormal object set is identified, so that changes in the organizational structure and the number of members in the abnormal object set will not affect the identification of the abnormal object set, which facilitates long-term monitoring of the abnormal object set through the core abnormal object, thereby improving the stability and effectiveness of the abnormal object set identification.

[0124] As an alternative embodiment, see Figure 8 , based on the operation structure information, it is determined that the core abnormal objects in each abnormal object set include:

[0125] S810. Based on the operation structure information, determine the association information between each abnormal object in each abnormal object set and the corresponding associated abnormal object, the association information is used to measure the closeness of the association between each abnormal object and the corresponding associated abnormal object, and the associated abnormal object is the corresponding abnormal object connected to each current abnormal object in the operation structure information;

[0126] S820. Based on the association information, determine the abnormal indicator data corresponding to each abnormal object in each abnormal object set;

[0127] S830. Take the abnormal objects whose abnormal indicator data meet the preset threshold as core abnormal objects.

[0128] As an optional embodiment, based on the nodes and edges in the operation structure information, the association information between each abnormal object in each abnormal object set and the associated abnormal object corresponding to each abnormal object can be determined, and the association information is used to measure the closeness of the association between each abnormal object and the corresponding associated abnormal object, and the associated abnormal object is the corresponding abnormal object connected to each current abnormal object in the operation structure information. Based on the association information, the abnormal index data corresponding to each abnormal object in each abnormal object set can be calculated. And the abnormal objects whose abnormal index data is greater than or equal to the preset threshold are taken as core abnormal objects. The core abnormal object can represent the basic organizational structure of the abnormal object set and the characteristics of the abnormal execution operation, for example, the abnormal object in the abnormal object set that organizes the abnormal execution of the target operation can be determined, or it can be determined that the abnormal object set is biased towards which type of video abnormal execution of the target operation, so that the abnormal object set can be identified based on the core abnormal object.

[0129] Based on the operation structure information, the association information of each abnormal object is determined, so that the abnormal indicator data corresponding to each abnormal object can be obtained based on the association information, and the core abnormal object with the closest connection with other abnormal objects in the abnormal data set can be screened out, thereby improving the accuracy of core abnormal object screening.

[0130] As an alternative embodiment, see Fig. 9 , the association information includes the total number of associated objects and the target association weight. Based on the operation structure information, the association information between each abnormal object in each abnormal object set and the corresponding associated abnormal object is determined to include:

[0131] S910. Based on the operation structure information, the total number of associated objects of the associated abnormal objects corresponding to each abnormal object and the target association weight corresponding to each abnormal object are obtained, where the target association weight is the sum of the association weights between each abnormal object and the corresponding associated abnormal object;

[0132] Based on the association information, the abnormal indicator data corresponding to each abnormal object in each abnormal object set is determined to include:

[0133] S920. Based on the total number of associated objects, the target association weight, the total number of abnormal objects and the cumulative association weight, determine the abnormal indicator data corresponding to each abnormal object, the total number of abnormal objects is the number of abnormal objects in each abnormal object set, and the cumulative association weight represents the sum of the association weights between each abnormal object in each abnormal object set.

[0134] As an optional embodiment, based on the nodes and edges in the operation structure information, the total number of associated objects of the associated abnormal objects corresponding to each abnormal object in each abnormal object set and the target associated weight corresponding to each abnormal object can be obtained. The total number of associated objects is the total number of abnormal objects connected to the current abnormal object in each abnormal object set, which is the total number of nodes connected to the current node in the corresponding connected graph structure, and the current node is the node corresponding to the current abnormal object. The target associated weight is the association weight between each abnormal object and the corresponding associated abnormal object, that is, the sum of the edge weights connected to the nodes corresponding to each abnormal object in the connected graph structure corresponding to each abnormal object set.

[0135] As an optional embodiment, the total number of associated objects and the target associated weight can be preliminarily screened to obtain the abnormal objects whose total number of associated objects is greater than or equal to the preset node number threshold, and whose target associated weight is greater than or equal to the preset associated weight threshold. If the abnormal object satisfies the conditions corresponding to the above-mentioned node number threshold and the associated weight threshold at the same time, the abnormal data index corresponding to the abnormal object can be further calculated. If the abnormal object does not meet any one of the node number threshold and the associated weight threshold, for example, the total number of associated objects of the abnormal object is less than the node number threshold, but the target associated weight is greater than or equal to the associated weight threshold, or the total number of associated objects of the abnormal object is greater than or equal to the node number threshold, but the target associated weight is less than the associated weight threshold, then the abnormal object can be directly excluded. If the abnormal object neither meets the condition of the node number threshold nor the condition of the associated weight threshold, the abnormal object can also be excluded.

[0136] As an optional embodiment, the more total number of associated objects corresponding to an abnormal object, the closer the connection between the abnormal object and other abnormal objects other than the abnormal object in the abnormal object set. The abnormal objects are connected by common operations, wherein the weight of the edge is the same target operation number, so the larger the target association weight corresponding to the abnormal object, the more the same target operations between the abnormal objects, that is, the higher the operation similarity, thereby indicating that the abnormal object is more closely connected with other abnormal objects in the same abnormal object set. Through the total number of associated objects and the target association weight, the abnormal index data of each abnormal object can be calculated.

[0137] As an optional embodiment, since the total number of associated objects and the target associated weight are data representing different information, the total number of associated objects and the target associated weight can be normalized to convert the total number of associated objects and the target associated weight into data representing the same information. For example, the ratio of the total number of associated objects to the total number of abnormal objects in the abnormal object set is calculated, and the ratio between the target associated weight and the cumulative associated weight is calculated, so as to perform normalization.

[0138] Based on the nodes and edges in the operation structure information, the total number of abnormal objects in each abnormal object set and the cumulative association weights between the abnormal objects can be obtained. The total number of abnormal objects is the total number of nodes in the connected graph structure corresponding to the abnormal object set in the operation structure information. The cumulative association weight represents the sum of the weights of the edges corresponding to the abnormal objects in each abnormal object set in the operation structure information.

[0139] Calculate the ratio between the total number of associated objects and the total number of abnormal objects, and calculate the ratio between the target association weight and the cumulative association weight. The sum of the ratios is used as the abnormal indicator data. As shown in the following formula, the abnormal indicator data corresponding to each abnormal object is:

[0140]

[0141] Among them, L is the abnormal indicator data, n is the total number of associated objects corresponding to the abnormal object, N is the total number of abnormal objects in the abnormal object set corresponding to the abnormal object, w is the target association weight corresponding to the abnormal object, and W is the cumulative association weight of the abnormal object set corresponding to the abnormal object.

[0142] As an optional embodiment, the abnormal objects in each abnormal object set may be sorted according to the size of the abnormal indicator data, and the abnormal objects in the sequence whose abnormal indicator data is greater than or equal to a preset threshold are taken as core abnormal objects. Alternatively, when sorting from large to small, the first preset number of abnormal objects are obtained as core abnormal objects. When sorting from small to large, the last preset number of abnormal objects are obtained as core abnormal objects.

[0143] By determining the closeness of the association between the abnormal object and other abnormal objects in the abnormal object set through the total number of associated objects and the target association weight, the core abnormal object in the abnormal object set is determined, which can improve the accuracy and effectiveness of determining the core abnormal object, so that the determined core abnormal object can accurately identify the corresponding abnormal object set.

[0144] As an alternative embodiment, see Fig.10 , the method further comprises:

[0145] S1010. Based on the update exception object, the operation structure information is updated to obtain the updated operation structure information;

[0146] S1020. Based on the connected graph structure in the updated operation structure information, the abnormal object set corresponding to the connected graph structure in the operation structure information is updated to obtain an updated abnormal object set;

[0147] S1030. Based on the core abnormal object, monitor the operation data of the abnormal object set.

[0148] As an optional embodiment, the updated abnormal object may be an abnormal object in a time period after the current preset time period. Some abnormal objects in the abnormal object set may not necessarily perform the target operation abnormally in each preset time period, so that there is a difference between the updated abnormal object and the preset number of abnormal objects. Based on the updated abnormal object, the operation structure information corresponding to the preset number of abnormal objects can be updated to obtain the updated operation structure information. The connected graph structure in the updated operation structure information will also change, and there may be a situation where some nodes in a certain connected graph structure are deleted or some nodes in a certain connected graph structure are added. Since the connected graph structure in the operation structure information has a corresponding relationship with the abnormal object set, the abnormal objects in the abnormal object set may change with the update of the operation structure information, that is, the abnormal object set may also add some abnormal objects or delete some abnormal objects. The core abnormal object can reflect the core organizational structure of the corresponding abnormal object set. Therefore, the changes in the scale and organizational structure of the abnormal object set can be monitored through the core abnormal objects in the abnormal object set. The core abnormal object can be one or more abnormal objects.

[0149] Based on the core abnormal objects, the operation data of the abnormal object set can be monitored for a long time, and the organizational structure changes and scale changes of the abnormal object set can also be monitored, thereby improving the stability of the identification of the abnormal object set and the effectiveness of monitoring the abnormal object set.

[0150] As an optional embodiment, the method for identifying the abnormal object set can be applied to the scenario of identifying abnormal users who increase the number of likes. Fig.11, before identifying the abnormal object set, the operation structure information can be generated. The preset time period is one day, the target operation is the like operation, and the object operation log is the like log. The initial objects whose like operation number is greater than or equal to the preset operation number in one day are screened from the like log, and the preset operation number can be 150 times. One day is divided into 6 time partitions, and the initial objects corresponding to each time partition and the same target operation number of each initial object are determined, and the common operation data corresponding to the initial objects in each time partition are obtained, and the initial operation data set corresponding to each time partition is generated. Based on the preset common operation number, the initial objects in the initial operation data set are filtered to obtain a filtered operation data set, and the filtered operation data sets corresponding to each time partition are merged to obtain a target operation data set. Based on the abnormal objects in the target operation data set and the same target operation number corresponding to each abnormal object, the operation structure information is constructed as nodes and edges respectively. The operation structure information can be updated based on the updated abnormal objects corresponding to the time period after the preset time period. For example, after obtaining the operation structure information according to the target operation data set corresponding to the first day, after obtaining a new target operation data set on the second day, the operation structure information corresponding to the first day can be updated based on the new target operation data set.

[0151] After the operation structure information is generated, the abnormal object set can be identified. Obtain the connected graph structure in the operation structure information, and obtain the target node identifier in the connected graph structure, that is, the ID of the vertex with the smallest serial number, and use the target node identifier as the set identification information. Based on the set identification information, the abnormal objects corresponding to the nodes in each connected graph structure are divided into the same initial abnormal object set. Obtain the number of abnormal objects in each initial abnormal object set, and use the initial abnormal object set with a number of abnormal objects greater than or equal to a preset number threshold as the abnormal object set. In the application scenario of brushing the volume of likes, this method can not only discover the abnormal object set that is brushed by "fake people and fake machines", but also discover the abnormal object set that is brushed by "real people and real machines".

[0152] Calculate the association information between each abnormal object and other abnormal objects in each abnormal object set, determine the abnormal index data of each abnormal object in each abnormal object set based on the association information, obtain abnormal objects whose abnormal index data is greater than or equal to a preset threshold, and use these abnormal objects as core abnormal objects. Based on the core abnormal objects, the operations of brushing the likes of each abnormal object set can be monitored.

[0153] This embodiment proposes a method for identifying an abnormal object set, the method comprising: obtaining operation structure information corresponding to a preset number of abnormal objects, the operation structure information being a graph with a preset number of abnormal objects as nodes and the same target operation number executed between two abnormal objects in the preset number of abnormal objects as edges. Based on the operation structure information, the preset number of abnormal objects are divided into sets to obtain at least one abnormal object set. The method can obtain the connection relationship between the abnormal objects according to the operation structure information, thereby identifying the abnormal object set corresponding to the abnormal object based on the connection relationship between the abnormal objects, improving the efficiency of identifying the abnormal object, and the target operation corresponding to each abnormal object in the abnormal object set is high in similarity. Through the overall similar target operation, the abnormal object set is identified, which can play the role of finding one and leading to a hundred, thereby improving the effectiveness of identifying the abnormal object set, and monitoring the abnormal object set with overall similar operations in the subsequent steps, which can improve the effectiveness of monitoring the abnormal object set. The method can not only discover the abnormal object set of "fake people and fake machines", but also discover the abnormal object set of "real people and real machines", thereby improving the accuracy of identifying the abnormal object set.

[0154] The method can also identify the abnormal object set through the core abnormal object, so that the identification of the abnormal object set will not change due to the structure and members in the abnormal object set, thereby improving the stability of the identification of the abnormal object set and the effectiveness of monitoring the abnormal object set.

[0155] Fig.12 1 is a block diagram of a device for identifying an abnormal object set according to an exemplary embodiment. Fig.12 , the device comprises:

[0156] The operation structure information acquisition module 1210 is configured to execute and acquire the operation structure information corresponding to a preset number of abnormal objects, wherein the operation structure information is a graph with the preset number of abnormal objects as nodes and the same target operations performed between two abnormal objects in the preset number of abnormal objects as edges, the target operation number corresponding to each of the preset number of abnormal objects is greater than or equal to the preset operation number, and the same target operation number corresponding to two abnormal objects is greater than or equal to the preset common operation number;

[0157] The abnormal object set acquisition module 1220 is configured to perform set division on a preset number of abnormal objects based on the operation structure information to obtain at least one abnormal object set.

[0158] As an optional embodiment, it is characterized in that the device further comprises:

[0159] The core abnormal object determination module is configured to determine the core abnormal object in each abnormal object set based on the operation structure information. The core abnormal object is the core object of the abnormal execution target operation in each abnormal object set. The core abnormal object is used to identify the corresponding abnormal object set.

[0160] As an optional embodiment, the core abnormal object determination module includes:

[0161] A correlation information determination unit is configured to determine, based on the operation structure information, correlation information between each abnormal object in each abnormal object set and a corresponding associated abnormal object, wherein the correlation information is used to measure the degree of correlation between each abnormal object and the corresponding associated abnormal object, and the associated abnormal object is an abnormal object connected to each current abnormal object in the operation structure information;

[0162] An abnormal indicator data determination unit is configured to determine the abnormal indicator data corresponding to each abnormal object in each abnormal object set based on the association information;

[0163] The core abnormal object determination unit is configured to execute abnormal objects whose abnormal indicator data meets a preset threshold as core abnormal objects.

[0164] As an optional embodiment, the association information includes the total number of association objects and the target association weight, and the association information determination unit includes:

[0165] The associated information acquisition unit is configured to acquire, based on the operation structure information, a total number of associated objects of associated abnormal objects corresponding to each abnormal object and a target associated weight corresponding to each abnormal object, wherein the target associated weight is a sum of the associated weights between each abnormal object and the corresponding associated abnormal object;

[0166] The abnormal indicator data determination unit includes:

[0167] The abnormal indicator calculation unit is configured to determine the abnormal indicator data corresponding to each abnormal object based on the total number of associated objects, the target association weight, the total number of abnormal objects and the cumulative association weight, wherein the total number of abnormal objects is the number of abnormal objects in each abnormal object set, and the cumulative association weight represents the sum of the association weights between each abnormal object in each abnormal object set.

[0168] As an optional embodiment, the device further includes:

[0169] An initial operation data set acquisition module is configured to execute acquisition of a plurality of initial operation data sets divided based on preset grouping information, wherein the initial operation data sets represent a set of common operation data corresponding to the initial objects, wherein the common operation data corresponding to the initial objects are the same target operation numbers commonly executed between two initial objects and between two initial objects, and the initial objects are objects whose corresponding target operation numbers are greater than or equal to the preset operation numbers;

[0170] A filtering processing module is configured to perform filtering processing on each initial operation data set to obtain a filtered operation data set, wherein the filtered operation data set represents a set of common operation data corresponding to the objects to be identified, wherein the common operation data corresponding to the objects to be identified are the same target operation numbers commonly performed between two objects to be identified and between two objects to be identified, and the objects to be identified are initial objects whose same target operation numbers are greater than or equal to a preset common operation number;

[0171] A target operation data set generation module is configured to merge the filtered operation data sets to obtain a target operation data set;

[0172] The operation structure information generating module is configured to generate operation structure information based on the target operation data set.

[0173] As an optional embodiment, the filtering operation data set is a plurality of filtering operation data sets arranged in sequence, and the target operation data set generation module includes:

[0174] The data set merging unit is configured to merge the first filter operation data set and the second filter operation data set in the plurality of filter operation data sets arranged in sequence, and to merge the filter operation data sets after the second filter operation data set in sequence until the last filter operation data set is merged to obtain the target operation data set.

[0175] As an optional embodiment, the abnormal object set acquisition module includes:

[0176] A connected graph structure acquisition unit is configured to determine a connected graph structure corresponding to each abnormal object based on a connection relationship between nodes in the operation structure information;

[0177] The set filtering unit is configured to divide the abnormal objects corresponding to the nodes in the connected graph structure whose number of nodes meets a preset number threshold into the same abnormal object set.

[0178] As an optional embodiment, it is characterized in that the device further comprises:

[0179] The operation structure information updating module is configured to update the operation structure information based on the update exception object to obtain the updated operation structure information;

[0180] The abnormal object set updating module is configured to update the abnormal object set corresponding to the connected graph structure in the operation structure information based on the updated connected graph structure in the operation structure information to obtain an updated abnormal object set;

[0181] The operation data monitoring module is configured to perform operation data monitoring on the update exception object set based on the core exception object.

[0182] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0183] Fig.13 is a block diagram of an electronic device for identifying an abnormal object set according to an exemplary embodiment. The electronic device may be a server, and its internal structure diagram may be as shown in FIG. Fig.13 As shown. The electronic device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the electronic device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for identifying a set of abnormal objects is implemented.

[0184] Those skilled in the art will understand that Fig.13 The structure shown in the figure is merely a block diagram of a partial structure related to the scheme of the present disclosure, and does not constitute a limitation on the electronic device to which the scheme of the present disclosure is applied. The specific electronic device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0185] In an exemplary embodiment, a computer-readable storage medium including instructions is also provided, such as a memory 1304 including instructions, and the instructions can be executed by a processor 1320 of the electronic device 1300 to complete the above method. Alternatively, the computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0186] In an exemplary embodiment, a computer program product is also provided, including a computer program, and when the computer program is executed by a processor, the above-mentioned method for identifying a set of abnormal objects is implemented.

[0187] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0188] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A method for identifying a set of abnormal objects, It is characterized in that The method comprises: Obtaining operation structure information corresponding to a preset number of abnormal objects, wherein the operation structure information is a graph with the preset number of abnormal objects as nodes and the same target operations performed jointly between any two of the preset number of abnormal objects as edges, wherein the target operands corresponding to each of the preset number of abnormal objects are greater than or equal to the preset number of operands, and the same target operands corresponding to any two of the abnormal objects are greater than or equal to the preset number of common operands; Based on the operation structure information, the preset number of abnormal objects are divided into sets to obtain at least one abnormal object set; Based on the operation structure information, determine a core exception object in each exception object set, the core exception object being a core object for each exception object set that abnormally executes the target operation, and the core exception object being used to identify a corresponding exception object set; Based on the update exception object, the operation structure information is updated to obtain updated operation structure information; Based on the connected graph structure in the update operation structure information, the abnormal object set corresponding to the connected graph structure in the operation structure information is updated to obtain an updated abnormal object set; Based on the core exception object, operation data monitoring is performed on the update exception object set.

2. The method for identifying an abnormal object set according to claim 1, It is characterized in that The determining, based on the operation structure information, a core abnormal object in each abnormal object set comprises: Based on the operation structure information, determining association information between each abnormal object in each abnormal object set and a corresponding associated abnormal object, wherein the association information is used to measure the closeness of the association between each abnormal object and the corresponding associated abnormal object, wherein the associated abnormal object is an abnormal object connected to each current abnormal object in the operation structure information; Based on the association information, determine the abnormal indicator data corresponding to each abnormal object in each abnormal object set; The abnormal objects whose abnormal indicator data meet the preset threshold are taken as the core abnormal objects.

3. The method for identifying an abnormal object set according to claim 2, It is characterized in that The association information includes the total number of associated objects and the target association weight, and the determining, based on the operation structure information, the association information between each abnormal object in each abnormal object set and the corresponding associated abnormal object includes: Based on the operation structure information, the total number of associated objects of the associated abnormal objects corresponding to each abnormal object and the target association weight corresponding to each abnormal object are obtained, where the target association weight is the sum of the association weights between each abnormal object and the corresponding associated abnormal object; The determining, based on the association information, the abnormal indicator data corresponding to each abnormal object in the abnormal object set comprises: Based on the total number of associated objects, the target association weight, the total number of abnormal objects and the cumulative association weight, the abnormal indicator data corresponding to each abnormal object is determined, the total number of abnormal objects is the number value of abnormal objects in each abnormal object set, and the cumulative association weight represents the sum of the association weights between each abnormal object in each abnormal object set.

4. The method for identifying an abnormal object set according to claim 1, It is characterized in that The method further comprises: Acquire multiple initial operation data sets divided based on preset grouping information, wherein the initial operation data sets represent a set of common operation data corresponding to the initial objects, wherein the common operation data corresponding to the initial objects are the same target operation numbers executed between two initial objects and two initial objects, and the initial objects are objects whose corresponding target operation numbers are greater than or equal to the preset operation numbers; Performing filtering processing on each initial operation data set respectively to obtain a filtered operation data set, wherein the filtered operation data set represents a set of common operation data corresponding to the objects to be identified, wherein the common operation data corresponding to the objects to be identified are the same target operation numbers commonly performed between the objects to be identified and between the objects to be identified, and the objects to be identified are initial objects whose same target operation numbers are greater than or equal to the preset common operation numbers; Merging the filtered operation data sets to obtain a target operation data set; The operation structure information is generated based on the target operation data set.

5. The method for identifying an abnormal object set according to claim 4, It is characterized in that The filtering operation data set is a plurality of filtering operation data sets arranged in sequence, and merging the plurality of filtering operation data sets to obtain a target operation data set includes: The first filter operation data set and the second filter operation data set of the plurality of filter operation data sets arranged in sequence are merged, and the filter operation data sets after the second filter operation data set are merged in sequence until the last filter operation data set is merged to obtain the target operation data set.

6. The method for identifying an abnormal object set according to claim 1, It is characterized in that The step of dividing the preset number of abnormal objects into sets based on the operation structure information to obtain at least one abnormal object set includes: Based on the connection relationship between each node in the operation structure information, determine the connected graph structure corresponding to each abnormal object; The abnormal objects corresponding to the nodes in the connected graph structure whose number of nodes meets a preset number threshold are divided into the same abnormal object set.

7. A device for identifying a set of abnormal objects, It is characterized in that The device comprises: An operation structure information acquisition module is configured to execute and acquire operation structure information corresponding to a preset number of abnormal objects, wherein the operation structure information is a graph with the preset number of abnormal objects as nodes and the same target operations performed jointly between two of the preset number of abnormal objects as edges, the target number of operations corresponding to each of the preset number of abnormal objects is greater than or equal to the preset number of operations, and the number of the same target operations corresponding to the two abnormal objects is greater than or equal to the preset number of common operations; an abnormal object set acquisition module, configured to perform set division on the preset number of abnormal objects based on the operation structure information to obtain at least one abnormal object set; A core abnormal object determination module is configured to determine a core abnormal object in each abnormal object set based on the operation structure information, wherein the core abnormal object is a core object that abnormally performs the target operation in each abnormal object set, and the core abnormal object is used to identify a corresponding abnormal object set; An operation structure information updating module is configured to update the operation structure information based on the update exception object to obtain updated operation structure information; An abnormal object set updating module is configured to update the abnormal object set corresponding to the connected graph structure in the operation structure information based on the connected graph structure in the update operation structure information to obtain an updated abnormal object set; The operation data monitoring module is configured to perform operation data monitoring on the update exception object set based on the core exception object.

8. The device for identifying an abnormal object set according to claim 7, It is characterized in that The core abnormal object determination module includes: a correlation information determining unit, configured to determine, based on the operation structure information, correlation information between each abnormal object in each abnormal object set and a corresponding associated abnormal object, wherein the correlation information is used to measure the degree of correlation between each abnormal object and the corresponding associated abnormal object, and the associated abnormal object is an abnormal object connected to each current abnormal object in the operation structure information; an abnormal indicator data determining unit, configured to determine the abnormal indicator data corresponding to each abnormal object in each abnormal object set based on the association information; The core abnormal object determination unit is configured to execute the abnormal object whose abnormal indicator data meets a preset threshold as the core abnormal object.

9. The device for identifying an abnormal object set according to claim 8, It is characterized in that The association information includes the total number of association objects and the target association weight, and the association information determination unit includes: an associated information acquisition unit, configured to acquire, based on the operation structure information, a total number of associated objects of associated abnormal objects corresponding to each abnormal object and a target associated weight corresponding to each abnormal object, wherein the target associated weight is a sum of the associated weights between each abnormal object and the corresponding associated abnormal object; The abnormal indicator data determination unit includes: The abnormal indicator calculation unit is configured to determine the abnormal indicator data corresponding to each abnormal object based on the total number of associated objects, the target association weight, the total number of abnormal objects and the cumulative association weight, wherein the total number of abnormal objects is the number value of abnormal objects in each abnormal object set, and the cumulative association weight represents the sum of the association weights between each abnormal object in each abnormal object set.

10. The device for identifying an abnormal object set according to claim 7, It is characterized in that The device also includes: An initial operation data set acquisition module is configured to execute acquisition of a plurality of initial operation data sets divided based on preset grouping information, wherein the initial operation data sets represent a set of common operation data corresponding to the initial objects, wherein the common operation data corresponding to the initial objects are the same target operation numbers commonly executed between the initial objects and the pairwise initial objects, and the initial objects are objects whose corresponding target operation numbers are greater than or equal to the preset operation numbers; A filtering processing module is configured to perform filtering processing on each initial operation data set to obtain a filtered operation data set, wherein the filtered operation data set represents a set of common operation data corresponding to the objects to be identified, wherein the common operation data corresponding to the objects to be identified are the same target operation numbers commonly performed between the objects to be identified and between the objects to be identified, and the objects to be identified are initial objects whose same target operation numbers are greater than or equal to the preset common operation numbers; a target operation data set generation module, configured to merge the filtered operation data sets to obtain a target operation data set; The operation structure information generating module is configured to generate the operation structure information based on the target operation data set.

11. The device for identifying an abnormal object set according to claim 10, It is characterized in that The filtering operation data set is a plurality of filtering operation data sets arranged in sequence, and the target operation data set generation module includes: The data set merging unit is configured to merge the first filter operation data set and the second filter operation data set in the plurality of filter operation data sets arranged in order, and to merge the filter operation data sets after the second filter operation data set in sequence until the last filter operation data set is merged to obtain the target operation data set.

12. The device for identifying an abnormal object set according to claim 7, It is characterized in that The abnormal object set acquisition module includes: A connected graph structure acquisition unit is configured to determine a connected graph structure corresponding to each abnormal object based on a connection relationship between nodes in the operation structure information; The set filtering unit is configured to divide the abnormal objects corresponding to the nodes in the connected graph structure whose number of nodes meets a preset number threshold into the same abnormal object set.

13. An electronic device, It is characterized in that include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the method for identifying a set of abnormal objects as described in any one of claims 1 to 6.

14. A computer-readable storage medium, It is characterized in that When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the method for identifying a set of abnormal objects as described in any one of claims 1 to 6.

15. A computer program product comprising a computer program, It is characterized in that When the computer program is executed by a processor, the method for identifying a set of abnormal objects according to any one of claims 1 to 6 is implemented.

Images