An abnormal data processing method, device, equipment, and storage medium

Abstract

The present disclosure provides an abnormal data processing method, apparatus, device, and storage medium, which relate to the technical field of data processing, and particularly to the technical fields of big data, information flow, and artificial intelligence. The specific implementation solution is as follows: Obtain the search information to be recognized of at least two interaction platforms, and the access behaviors associated with the search information to be recognized in the at least two interaction platforms, where the search information to be recognized includes search term information and / or website address information triggered by the search term information; Determine the target access characteristics of the search information to be recognized according to the access behaviors; Identify the abnormal data in the search information to be recognized according to the target access characteristics. It can improve the accuracy of abnormal data recognition and provide a new solution for accurately identifying abnormal data in interaction platforms.

Description

Technical Field

[0001] The present disclosure relates to the technical field of data processing, in particular to the technical fields of big data, information flow, and artificial intelligence, and specifically relates to an abnormal data processing method, apparatus, device, and storage medium. Background Art

[0002] With the rapid development of Internet technology, more and more Internet interaction platforms have emerged as the times require. However, some lawbreakers use the Internet interaction platform as a platform for exposing their abnormal data, seriously affecting the normal operation of the interaction platform. Therefore, how to accurately identify abnormal data in the interaction platform is crucial. Summary of the Invention

[0003] The present disclosure provides an abnormal data processing method, apparatus, device, and storage medium.

[0004] According to one aspect of the present disclosure, there is provided an abnormal data processing method, including:

[0005] Obtaining the to-be-identified search information of at least two interaction platforms, and the access behaviors associated with the to-be-identified search information in the at least two interaction platforms, where the to-be-identified search information includes search term information and / or the website information triggered by the search term information;

[0006] Determining the target access characteristics of the to-be-identified search information according to the access behaviors;

[0007] Identifying the abnormal data in the to-be-identified search information according to the target access characteristics.

[0008] According to another aspect of the present disclosure, there is provided an electronic device, including:

[0009] At least one processor; and

[0010] A memory communicatively connected to the at least one processor; where

[0011] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the abnormal data processing method of any embodiment of the present disclosure.

[0012] According to another aspect of the present disclosure, there is provided a non-transitory computer-readable storage medium storing computer instructions, where the computer instructions are used to cause a computer to execute the abnormal data processing method of any embodiment of the present disclosure.

[0013] The solution of the embodiments of the present disclosure can identify abnormal data in the entire access process of search information, improve the accuracy of abnormal data identification, and provide a new solution for accurately identifying abnormal data in the interaction platform.

[0014] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it used to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The drawings are used to better understand the solution and do not constitute a limitation to the present disclosure. Among them:

[0016] Figure 1 is a flowchart of a method for processing abnormal data provided by an embodiment of the present disclosure;

[0017] Figure 2 is a flowchart of a method for processing abnormal data provided by an embodiment of the present disclosure;

[0018] Figure 3 is a flowchart of a method for processing abnormal data provided by an embodiment of the present disclosure;

[0019] Figure 4 is a flowchart of a method for processing abnormal data provided by an embodiment of the present disclosure;

[0020] Figure 5 is a flowchart of a method for processing abnormal data provided by an embodiment of the present disclosure;

[0021] Figure 6 is a flowchart of a method for processing abnormal data provided by an embodiment of the present disclosure;

[0022] Figure 7 is a system architecture diagram of abnormal data processing provided by an embodiment of the present disclosure;

[0023] Figure 8 is a schematic structural diagram of an apparatus for processing abnormal data provided by an embodiment of the present disclosure;

[0024] Figure 9 is a block diagram of an electronic device for implementing a method for processing abnormal data according to an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0025] The exemplary embodiments of the present disclosure will be described below with reference to the accompanying drawings. Various details of the embodiments of the present disclosure are included to facilitate understanding, and they should be considered merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, descriptions of well-known functions and structures are omitted in the following description for clarity and conciseness.

[0026] Figure 1 is a flowchart of an abnormal data processing method provided according to an embodiment of the present disclosure. The embodiments of the present disclosure are applicable to the situation of identifying abnormal data. In particular, it is applicable to the situation of providing abnormal data identification for enterprise-side (Business, B-side) users. For example, it can be to analyze the massive search information of multiple B-side interaction platforms and identify the abnormal data therein. This method can be executed by an abnormal data processing device, and the device can be implemented in a software and / or hardware manner. Specifically, it can be integrated into an electronic device. For example, the electronic device can be a computing device that provides data analysis services for multiple B-side interaction platforms. As Figure 1 shown, the abnormal data processing method provided in this embodiment may include:

[0027] S101, obtain the search information to be identified of at least two interaction platforms, and the access behaviors associated with the search information to be identified in the at least two interaction platforms.

[0028] Among them, the so-called interaction platform is a platform that can interact with users and provide search services to users. The interaction platform is preferably a B-side interaction platform. For example, it can be a website that provides search services on the B-side.

[0029] The so-called search information to be identified is the search information that needs to be identified for abnormal data. This search information can be the data information generated during the process of the interaction platform providing search services to users, and specifically can include search term information and / or website address information triggered by the search term information. Among them, the search term information can be the relevant information of the search term input by the user in the search engine of the interaction platform. For example, it can be the search term itself or the information obtained by parsing the search term. The website address information can be the relevant information of the access page website address (i.e., the access website address) triggered by the search term information on the interaction platform, that is, the relevant information of the access website address feedback by the interaction platform in response to the search term information input by the user. For example, it can be the access website address itself or the information obtained by parsing the access website address. It should be noted that the number of search information to be identified in this embodiment is preferably multiple.

[0030] The so-called access behavior associated with search information in the interaction platform can be the behavior generated during the entire access process from the start of accessing the interaction platform by the search information to the completion of the access. It can include, but is not limited to: the interaction platforms accessed by the search information, the specific pages accessed on the interaction platform, and the page view volume of the pages it accesses, etc.

[0031] Optionally, in this embodiment, the computing device providing data analysis services for multiple interaction platforms can interact with each interaction platform to obtain the search information to be identified on each interaction platform. Specifically, one implementable way is: the computing device can monitor the operation status of each interaction platform in real time, so as to obtain the online search terms generated by each interaction platform, and / or the page URLs triggered by the online search terms, and generate a set of search information to be identified according to the online search terms and / or page URLs obtained within a period of time (such as within one day).

[0032] Another implementable way is: the computing device can send a data acquisition request to each interaction platform every preset period (such as one day), and receive all the online search terms generated within the preset period and / or the access URLs triggered by the online search terms feedback by each interaction platform in response to the data acquisition request, and generate a set of search information to be identified according to all the received online search terms and / or access URLs.

[0033] Among them, when generating a set of search information to be identified according to the obtained online search terms and / or access URLs, the obtained online search terms and / or access URLs can be directly used as a set of search information to be identified; it can also be to perform information parsing on the online search terms and / or access URLs and use the parsing results as the search information to be identified; it can also be to use the online search terms and their parsing results, and / or the access URLs and their parsing results together as the search information to be identified, etc. This embodiment does not limit this.

[0034] Optionally, while obtaining the search information to be identified, the computing device also needs to further obtain the access behavior associated with the search information to be identified in each interaction platform. The specific acquisition method can be similar to the method of obtaining the search information to be identified. For example, one implementable way is: the computing device monitors the operation status of each interaction platform in real time, so as to obtain the access behavior associated with each search information to be identified in each interaction platform. Another implementable way is: when each interaction platform responds to the data acquisition request and feedbacks the online search terms and / or the access URLs triggered by the online search terms, it also feedbacks the access behavior associated with the online search terms and access URLs in this interaction platform. At this time, the computing device can summarize the access behaviors feedback by each interaction platform to obtain the access behavior associated with the search information to be identified in each interaction platform.

[0035] S102. Determine the target access features of the search information to be recognized according to the access behavior.

[0036] Among them, the target access features of the search information to be recognized can be the features that depict the access behavior associated with the search information to be recognized in each interaction platform. It can include but is not limited to: features such as the access scope and access distribution of each search information in each interaction platform. Specifically, the target access features can be depicted from the perspective of each search information; it can also be depicted from the perspective of the interaction platform.

[0037] Optionally, in this embodiment, the target access features of each search information to be recognized can be determined based on its access behavior associated with at least two interaction platforms. That is to say, based on each search information to be recognized, starting from its access behavior when accessing each interaction platform until the end of the access, focusing on the access details of the entire process to construct the target access features of the search information to be recognized. The target access features can represent the access framework of the search information to be recognized when accessing the interaction platform.

[0038] Among them, one implementable way to determine the target access features of the search information to be recognized according to the access behavior is: input the access behavior associated with each search information to be recognized in each interaction platform into a pre-trained feature extraction model, and the feature extraction model can parse and obtain the target access features of the search information to be recognized based on the input access behavior.

[0039] Another implementable way is: according to the preset statistical rules of the target access features, statistically analyze the access behavior associated with each search information to be recognized in each interaction platform, and abstract the target access features of the search information to be recognized according to the statistical results.

[0040] S103. Identify the abnormal data in the search information to be recognized according to the target access features.

[0041] Among them, the abnormal data can refer to the black and gray production data associated with abnormal behaviors (such as cybercrime behaviors or controversial behaviors). For example, it can be the advertisement data associated with the traffic advertisement attack behavior existing in the interaction platform.

[0042] Optionally, in this embodiment, the common access features associated with each type of abnormal data can be pre-statistically analyzed. At this time, the target access features of each search information to be recognized can be compared with the common access features associated with each type of abnormal data. If the feature similarity meets the requirements, the search information to be recognized is regarded as abnormal data. It can also be based on a pre-trained abnormal data recognition model to analyze the target access features of each search information to be recognized to determine whether the search information to be recognized is abnormal data, etc.

[0043] In the solution of the embodiment of the present disclosure, the to-be-identified search information of at least two interaction platforms and the access behaviors associated with each interaction platform are obtained, the target access characteristics of the to-be-identified search information are determined based on the access behaviors, and whether the to-be-identified search information is abnormal data is determined based on the target access characteristics. This embodiment starts from the behavioral characteristics of the entire access process of the search information on the interaction platform to identify the abnormal data therein, without relying on manual operations, improving the accuracy and efficiency of abnormal data identification, and providing a new solution for accurately identifying the abnormal data in the interaction platform.

[0044] Figure 2 It is a flowchart of an abnormal data processing method provided according to an embodiment of the present disclosure. On the basis of the above embodiment, the embodiment of the present disclosure further elaborates in detail how to determine the target access characteristics of the to-be-identified search information according to the access behaviors associated with the to-be-identified search information in at least two interaction platforms, as Figure 2 shown, the abnormal data processing method provided in this embodiment may include:

[0045] S201, obtain the to-be-identified search information of at least two interaction platforms, and the access behaviors associated with the to-be-identified search information in at least two interaction platforms.

[0046] Wherein, the to-be-identified search information includes search term information and / or website address information triggered by the search term information.

[0047] S202, according to the access behaviors, determine the interaction platforms associated with the to-be-identified search information, and the page view volume of the to-be-identified search information on the associated interaction platforms.

[0048] Wherein, the page view volume (PV) can be an important indicator for measuring the platform traffic of the interaction platform. Specifically, a web page interface request from the interaction platform is regarded as a page view volume, and through accumulation over a period of time, the total page view volume during this period can be obtained.

[0049] Optionally, in this embodiment, for each to-be-identified search information, based on the access behaviors associated with it in at least two interaction platforms, count which interaction platforms the to-be-identified search information specifically accesses, that is, count the interaction platforms associated with the to-be-identified search information. In addition, it is also necessary to count how many web page interface requests the to-be-identified search information triggers in each interaction platform, and then the page view volume associated with the to-be-identified search information in each interaction platform can be obtained.

[0050] S203, according to the interaction platforms associated with the to-be-identified search information, and the page view volume of the to-be-identified search information on the associated interaction platforms, determine the target access characteristics of the to-be-identified search information.

[0051] Optionally, there are many ways to determine the target access feature of the search information to be recognized according to the interaction platform associated with the search information to be recognized and its page view volume on the associated interaction platform, and this is not limited herein.

[0052] One implementable way is as follows: According to the interaction platform associated with the search information to be recognized, count the total number of interaction platforms associated with the search information to be recognized. Based on the page view volume of the interaction platform associated with the search information to be recognized, count the total page view volume associated with the search information to be recognized, and use the total number of interaction platforms and the total page view volume as the access range feature in the target access feature for measuring the search information to be recognized.

[0053] Another implementable way is as follows: According to the page view volume of the search information to be recognized on the associated interaction platform, characterize the distribution type of each interaction platform associated with the search information to be recognized as the access data distribution feature in the target access feature. Specifically, count the mean value, variance, coefficient of variation, etc. of the page view volume of the search information to be recognized on each interaction platform, and use the mean value, variance, coefficient of variation, etc. to characterize the access data distribution feature in the target access feature of the search information to be recognized.

[0054] Another implementable way is as follows: According to the interaction platform associated with the search information to be recognized and the page view volume of the search information to be recognized on the associated interaction platform, count the total page view volume associated with the search information to be recognized, how many interaction platforms these page view volumes are distributed on, and average to each interaction platform, the average page view volume received by each interaction platform, etc., as the access scale feature in the target access feature for measuring the search information to be recognized. That is, measure the impact brought by the access party to the accessed party (i.e., the interaction platform party) from the perspective of the access party. Optionally, it is also possible to sort each interaction platform in descending order according to the page view volume based on the page view volume of the search information to be recognized on the associated interaction platform, and calculate the slope of the change in the page view volume between adjacent interaction platforms after sorting as the access scale feature in the target access feature for measuring the search information to be recognized. That is, characterize the impact brought by the search data to be recognized to each interaction platform based on the slope of the change in the page view volume.

[0055] It should be noted that this embodiment can determine the target access feature of the search information to be recognized based on at least one of the above implementable ways. Preferably, the multi-dimensional target access feature of the search information to be recognized is determined based on the above three ways at the same time.

[0056] S204. Identify the abnormal data in the search information to be recognized according to the target access feature.

[0057] In the solution of the embodiments of the present disclosure, the to-be-identified search information of at least two interactive platforms and their associated access behaviors on each interactive platform are obtained. Based on the access behaviors, the interactive platforms associated with the to-be-identified search information and the page views on the associated interactive platforms are determined. Furthermore, based on the associated interactive platforms and the page views thereon, the target access characteristics of the to-be-identified search information are determined, and based on the target access characteristics, it is determined whether the to-be-identified search information is abnormal data. This solution characterizes the target access characteristics from multiple perspectives such as the access scope, access data distribution, and access party magnitude based on the interactive platforms associated with the to-be-identified search information and the page views on the interactive platforms, improving the richness and accuracy of the target access characteristics and providing a guarantee for accurately identifying abnormal data based on the target access characteristics subsequently.

[0058] Optionally, in addition to determining the target access characteristics of the to-be-identified search information in the manner described in the above embodiments, the embodiments of the present disclosure can also adopt the following method to determine the target access characteristics of the to-be-identified search information from the perspective of the interactive platforms. Specifically, the following steps are included:

[0059] (1) According to the access behaviors, determine the to-be-identified search information associated with each interactive platform and the page views corresponding to the to-be-identified search information associated with each interactive platform.

[0060] Specifically, for each interactive platform, the to-be-identified search information that appears in the interactive platform can be determined from all the obtained to-be-identified search information as the to-be-identified search information associated with the interactive platform. In addition, for each to-be-identified search information associated with the interactive platform, the page views corresponding to the to-be-identified search information on the interactive platform need to be counted.

[0061] (2) According to the to-be-identified search information associated with each interactive platform and the page views corresponding to the to-be-identified search information associated with each interactive platform, determine the target access characteristics of the to-be-identified search information.

[0062] Specifically, according to the to-be-identified search information associated with each interactive platform, count how many to-be-identified search information are associated with the interactive platform; according to the page views corresponding to the to-be-identified search information associated with each interactive platform, count the average page views corresponding to each associated to-be-identified search information on the interactive platform, etc., and use the statistical results as the accessed party magnitude characteristics in the target access characteristics for measuring the to-be-identified search information. That is, measure the relationship characteristics between it and the access party (i.e., the to-be-identified search information) from the perspective of the accessed party.

[0063] This embodiment depicts the target access characteristics of the search information to be recognized from the perspective of the interaction platform, further enriching the feature dimensions of the target access characteristics, making the depicted target access characteristics more comprehensive and accurate, and thus improving the accuracy of the abnormal data recognized based on the target access characteristics.

[0064] Optionally, in addition to determining the target access characteristics of the search information to be recognized in the manner described in the above embodiment, this embodiment of the present disclosure may further include: determining the evolution characteristics of the search information to be recognized according to the information content of the search information to be recognized, and adding the evolution characteristics to the target access characteristics of the search information to be recognized.

[0065] Specifically, the evolution characteristics of the search information to be recognized may be the characteristics that depict the difficulty level of the evolution process of the search information to be recognized itself, and can be analyzed from the content information of the search information to be recognized itself. For example, according to the information content of the search information to be recognized, it can be determined what the changed content is in its current evolution process compared with the previous one. If a random number or time is added, the evolution characteristic is simple; if multi-layer nested information is added, the evolution characteristic is complex, etc.

[0066] This embodiment analyzes the evolution characteristics of the information content of the search information to be recognized and adds them to the target access characteristics of the search information to be recognized, characterizing the target access characteristics from two dimensions of access behavior and content information, making the depicted target access characteristics more comprehensive and accurate, and thus improving the accuracy of the abnormal data recognized based on the target access characteristics.

[0067] Figure 3 It is a flowchart of an abnormal data processing method provided according to an embodiment of the present disclosure. Based on the above embodiment, this embodiment of the present disclosure further elaborates in detail on how to recognize abnormal data in the search information to be recognized according to the target access characteristics, as Figure 3 shown, the abnormal data processing method provided in this embodiment may include:

[0068] S301, obtain the search information to be recognized of at least two interaction platforms, and the access behaviors associated with the search information to be recognized in at least two interaction platforms.

[0069] Among them, the search information to be recognized includes search term information and / or website information triggered by the search term information.

[0070] S302, determine the target access characteristics of the search information to be recognized according to the access behavior.

[0071] S303, recognize the abnormal data in the search information to be recognized according to the target access characteristics through an abnormal data recognition model.

[0072] Among them, the abnormal data recognition model can be a pre-trained neural network model capable of performing the abnormal data recognition task. Optionally, in this embodiment, multiple abnormal data recognition models can be pre-trained based on different neural network models. For example, one abnormal data recognition model is trained based on the Logistic Regression (LR) model, and another abnormal data recognition model is trained based on the XGBOOST model. Optionally, the specific training process of the abnormal data recognition model will be introduced in detail in the subsequent embodiments.

[0073] Specifically, in this embodiment, the target access features of each search information to be recognized can be input into the abnormal data recognition model. The abnormal data recognition model can then analyze the input target access features based on the training algorithm to determine whether the search information associated with the target access features is abnormal data.

[0074] Optionally, when the abnormal data recognition model in this embodiment is composed of multiple neural network models capable of performing the abnormal data recognition task, each abnormal data recognition model can identify a part of the abnormal data from the search information to be recognized according to the target access features, and then fuse (such as merge or take the intersection, etc.) the recognition results of multiple models to obtain the final recognition result.

[0075] Optionally, another implementable manner for this embodiment to identify the abnormal data in the search information to be recognized according to the target access features can be: identifying the abnormal data in the search information to be recognized according to the target access features and the feature threshold.

[0076] Among them, the feature threshold can be a pre-set standard for measuring whether the target access features conform to the abnormal data features.

[0077] Optionally, this embodiment can pre-set the feature threshold corresponding to the abnormal data for the target access features, and then for the target access features of each search information to be recognized, determine whether the feature reaches the feature threshold. If it reaches, it means that the search information to be recognized is abnormal data. For example, if the target access feature is the access range feature and the feature threshold is to access 200,000 interaction platforms and 10 million page views, then when the target access feature of a certain search information to be recognized reaches 200,000 interaction platforms and 10 million page views, the search information to be recognized is abnormal data.

[0078] Optionally, when the dimension of the target access features of the search information to be recognized is multiple, this embodiment can judge whether each dimension reaches the feature threshold to improve the accuracy of the recognition result. It is also possible to select at least one relatively important target access feature from multiple dimensions and only judge whether the selected important target access features reach the feature threshold to improve the efficiency of abnormal data recognition.

[0079] Optionally, another implementable way to identify abnormal data in the search information to be identified according to the target access feature in this embodiment may be to combine the above two implementable ways, that is, first, through the abnormal data recognition model, according to the target access feature, identify a part of the abnormal data in the search information to be identified; then, according to the target access feature and the feature threshold, identify another part of the abnormal data in the search information to be identified; and then perform fusion (such as merging or taking the intersection, etc.) processing on the two parts of abnormal data identified by the two methods to obtain the final abnormal data.

[0080] The solution of the embodiment of the present disclosure obtains the search information to be identified of at least two interaction platforms and the access behaviors associated with each interaction platform, determines the target access feature of the search information to be identified based on the access behavior, and based on the abnormal data recognition model and / or the method of feature threshold judgment, identifies the abnormal data in the search information to be identified according to the target access feature. This solution introduces multiple different ways to identify abnormal data based on the target access feature, improving the flexibility and accuracy of the abnormal data recognition result.

[0081] Figure 4 It is a flowchart of an abnormal data processing method provided according to an embodiment of the present disclosure. On the basis of the above embodiment, the embodiment of the present disclosure further explains in detail the process of how to train the abnormal data recognition model, such as Figure 4 As shown, the abnormal data processing method provided in this embodiment may include:

[0082] S401, obtain sample search information and determine the supervised label information associated with the sample search information.

[0083] Among them, the sample search information is the training sample data required to train the abnormal data recognition model. It is similar to the search information to be identified and may include search term information and / or website information triggered by the search term information. Specifically, the sample search information may be the search information generated during the historical operation of at least two interaction platforms.

[0084] The so-called supervised label information is the sample search information marked as abnormal data. It is used to supervise the model training during the training of the abnormal data recognition model.

[0085] One implementable way in this embodiment is to determine the supervised label information associated with the sample search information based on the way of manual recognition; another implementable way is to automatically determine the associated supervised label information for each sample search information according to a preset rule. Specifically, the process of automatically determining the supervised label information associated with the sample search information may include the following steps:

[0086] (i) Determine initial label information based on feedback information from at least two interactive platforms on sample search information.

[0087] Specifically, when the interactive platform finds that there is abnormal data in its search information, it will send a notification message of the abnormal data to the computing device, for example, which search information is abnormal data. Therefore, this embodiment needs to obtain the feedback information of the interactive platform on the sample search information while obtaining the sample search information, and based on the abnormal search information pointed out in the feedback information, first mark a part of the sample search information that belongs to abnormal data from the sample search information as the initial label information.

[0088] It should be noted that since the interactive platform processes a large amount of search information every day and not all interactive platforms will feedback information, the initial label information determined by this step is only a small part of the abnormal data in the sample search information, that is, the initial label information determined by this step is not comprehensive enough.

[0089] (ii) updating the initial label information according to the similarity between the information content of the sample search information and the information content of the initial label information.

[0090] Specifically, after determining the initial label information, this embodiment can calculate the similarity between the information content of each sample search information and the information content of each initial label information (i.e., the sample search information that has been marked as abnormal data in the first step), and add the sample search information whose similarity reaches a preset threshold and does not belong to the initial label information to the initial label information to update the initial label information.

[0091] It should be noted that the updating operation of the initial label information in this step greatly improves the comprehensiveness of the initial label information.

[0092] (iii) determining the supervisory label information associated with the sample search information based on the similarity between the sample access features of the sample search information and the sample access features of the updated initial label information.

[0093] Among them, the so-called sample access features refer to the access features corresponding to some feature dimensions required for training the abnormal data recognition model. It should be noted that in this embodiment, the feature dimensions contained in the target access features include all feature dimensions as much as possible, and some feature dimensions corresponding to the sample access features can be relatively important feature dimensions in the interactive platform business. This solution selects sample access features of some feature dimensions to train the abnormal data recognition model. Compared with selecting access features of all feature dimensions to train the abnormal number recognition model, this avoids overfitting of the abnormal data model and improves the model training effect.

[0094] Specifically, in this embodiment, the sample access feature of the sample search information and the sample access feature of the updated initial label information can be determined according to the access behaviors associated with the sample search information on at least two interaction platforms. Furthermore, based on each sample search information, the similarity between its sample access feature and the sample access features of each initial label information is calculated. The sample search information with a similarity reaching a preset threshold and not belonging to the initial label information is added to the initial label information, and the initial label obtained after processing this step is used as the supervised label information associated with the sample search information.

[0095] After initially determining the label information through the feedback information of the interaction platform in this embodiment, the supervised label information representing abnormal data is continuously improved based on the similarity in two dimensions: the information content and the sample access feature of the search information, improving the accuracy and comprehensiveness of the determination of the supervised label information.

[0096] Optionally, in this embodiment, to ensure the accuracy of the determined supervised label information, the method of manual verification can also be used to verify the accuracy of the supervised label information determined by the above method.

[0097] S402. Based on the sample search information and the supervised label information, perform supervised training on the abnormal data recognition model.

[0098] Optionally, this embodiment can obtain the access behaviors associated with the sample search information on at least two interaction platforms, and based on this access behavior, determine the target access feature of the sample search information. The target access feature of the sample search information is used as the input of the abnormal data recognition model, and the supervised label information associated with the sample search information is used as the supervised data of the abnormal data recognition model to perform supervised training on the abnormal data recognition model. Specifically, the target access feature of the sample search information can be input into the abnormal data recognition model. The abnormal data recognition model parses and processes the input target access feature of the sample search information, predicts the abnormal data in the sample search information, calculates the loss function according to the predicted abnormal data and the supervised label information associated with this sample search information, and updates the model parameters of the abnormal data recognition model through backpropagation according to the loss function.

[0099] It should be noted that this embodiment needs to perform multiple iterative trainings on the abnormal data recognition model according to the above scheme based on multiple groups of sample search information and supervised label information until the preset training stop condition is reached, and then stop adjusting the parameters of the abnormal data recognition model to obtain the trained abnormal data recognition model. The training stop condition can include: the number of training times reaches the preset number, or the model loss converges, etc.

[0100] S403. Obtain the search information to be recognized on at least two interaction platforms, and the access behaviors associated with the search information to be recognized on at least two interaction platforms.

[0101] Among them, the search information to be recognized includes search term information and / or website information triggered by the search term information.

[0102] S404. Determine the target access characteristics of the search information to be recognized according to the access behavior.

[0103] S405. Identify the abnormal data in the search information to be recognized according to the target access characteristics through the abnormal data recognition model.

[0104] Preferably, the abnormal data in the search information to be recognized can also be identified according to the target access characteristics and the characteristic threshold, and the abnormal data determined based on the abnormal data recognition model is fused with the abnormal data determined based on the characteristic threshold to obtain the finally recognized abnormal data.

[0105] In the solution of the embodiment of the present disclosure, after obtaining the abnormal data recognition model by means of supervised training according to the sample search information and its corresponding supervised label information, the search information to be recognized of at least two interactive platforms and the access behaviors associated with each interactive platform are obtained, the target access characteristics of the search information to be recognized are determined based on the access behavior, and the abnormal data in the search information to be recognized is identified based on the abnormal data recognition model. This solution provides a method for automatically determining the supervised label information of the sample search information. In addition, the supervised training of the abnormal data recognition model based on the supervised label improves the accuracy of the recognition result of the abnormal data recognition model.

[0106] Figure 5 It is a flowchart of an abnormal data processing method provided according to an embodiment of the present disclosure. On the basis of the above embodiment, the embodiment of the present disclosure further explains in detail how to obtain the search information to be recognized of at least two interactive platforms, such as Figure 5 As shown, the abnormal data processing method provided in this embodiment may include:

[0107] S501. Obtain the search terms of at least two interactive platforms and the access website addresses triggered by the search terms.

[0108] Among them, the so-called search term may be a vocabulary entered by the user in the search engine of the interactive platform to represent its search needs. The page website address corresponding to the search result obtained by the search engine in response to the search term is the access website address triggered by the search term.

[0109] Optionally, in this embodiment, the computing device providing data analysis services for multiple interactive platforms may interact with each interactive platform to obtain the search terms of each interactive platform and the accessed URLs triggered by the search terms. Specifically, it may be that the computing device can monitor the operation status of each interactive platform in real time to obtain the search terms of each interactive platform and the accessed URLs triggered by the search terms. It may also be that once every preset period (such as one day), a data acquisition request is sent to each interactive platform, and all the search terms generated within the preset period and the accessed URLs triggered by the search terms feedback by each interactive platform in response to the data acquisition request are received, etc.

[0110] S502. Extract abnormal trigger words from the search terms, and use the search terms and the abnormal trigger words as the search term information of the search information to be recognized.

[0111] Among them, the so-called abnormal trigger words may refer to the words in the search terms that may trigger the appearance of abnormal data. Specifically, in this embodiment, the words in the search terms that represent contact information, such as the social accounts of instant messaging software, email addresses, or phone numbers, etc., may be used as abnormal words. For example, if the search term is "Platform promotion, high price for IP traffic acquisition (QQ: 1234567)", then the "QQ: 1234567" representing contact information in it is the abnormal trigger word in this search term.

[0112] Optionally, there are many ways to extract abnormal trigger words from the search terms in this embodiment, and this embodiment does not limit this.

[0113] One implementable way is: use a pre-trained trigger word extraction model to parse the search terms, so as to output the abnormal trigger words in the search terms.

[0114] Another implementable way is: pre-set matching rules (such as regular matching rules) based on various types of abnormal trigger words, and perform consistency matching between the obtained search terms and the matching rules corresponding to the abnormal trigger words, so as to obtain the words with high matching degree as the abnormal trigger words.

[0115] Another implementable way is: perform semantic parsing on each word in the search terms, and find the words with the semantics of representing contact information as the abnormal trigger words in the search terms.

[0116] Optionally, after performing the abnormal trigger word extraction operation on all the obtained search terms in this embodiment, the obtained search terms and the extracted abnormal trigger words are used together as the search term information in the search information to be recognized.

[0117] S503. Extract sub-URLs from the accessed URLs, and use the accessed URLs and the sub-URLs as the URL information of the search information to be recognized.

[0118] The so-called sub-URL can be a URL embedded in the access URL. For example, if the access URL is "http: / / www.799998.com?http: / / 我我要广告推广 / ?w2", it includes two sub-URLs, namely "http: / / www.799998.com" and "http: / / 我是我广告推广 / ".

[0119] Optionally, the method of extracting sub-URLs from visited URLs in this embodiment can be similar to the method of extracting abnormal trigger words from search terms. For example, it can be extracted through a pre-trained URL extraction model; it can also be extracted through pre-set matching rules; it can also be extracted based on a semantic parsing algorithm, etc., which is not limited to this embodiment.

[0120] Optionally, in this embodiment, after performing the sub-website extraction operation on the obtained accessed web sites, the obtained accessed web sites and the extracted sub-websites are used together as the web site information in the search term to be identified.

[0121] It should be noted that, in this embodiment, the search term information of the search information to be identified obtained in S502 and the website information of the search information to be identified obtained in S503 can be taken together as the search information to be identified.

[0122] S504: Obtain access behaviors associated with the search information to be identified in at least two interactive platforms.

[0123] S505: Determine target access features of the search information to be identified based on the access behavior.

[0124] S506: Identify abnormal data in the search information to be identified according to the target access feature.

[0125] The scheme of the disclosed embodiment extracts abnormal trigger words and sub-websites from the search words of at least two interactive platforms and the accessed web addresses triggered by them, respectively, and uses the search words, accessed web addresses, abnormal trigger words and sub-websites as search information to be identified, obtains the associated access behavior, determines the target access characteristics, and then determines the abnormal data in the search information to be identified based on the target access characteristics. This scheme uses the information of four dimensions, namely, search words, accessed web addresses, abnormal trigger words and sub-websites, as search information to be identified to identify abnormal data, solves the problem of invalid blocks of single-dimensional search information, and increases the stability and comprehensiveness of abnormal data identification.

[0126] Figure 6 is a flow chart of an abnormal data processing method provided according to an embodiment of the present disclosure. Based on the above embodiment, the embodiment of the present disclosure further provides a preferred example of how to apply the identified abnormal data, such as Figure 6 As shown, the abnormal data processing method provided in this embodiment may include:

[0127] S601. Obtain the search information to be recognized from at least two interactive platforms, as well as the access behaviors associated with the search information to be recognized in the at least two interactive platforms.

[0128] Among them, the search information to be recognized includes search term information and / or website URL information triggered by the search term information.

[0129] S602. Determine the target access characteristics of the search information to be recognized according to the access behaviors.

[0130] S603. Identify the abnormal data in the search information to be recognized according to the target access characteristics.

[0131] S604. If a blacklist update event is detected, update the online blacklist according to the co-occurrence situation of the online blacklist and the abnormal data.

[0132] Among them, the blacklist update event may refer to an event that triggers the update of the abnormal data blacklist (i.e., the online blacklist). In this embodiment, detecting a blacklist update event includes: detecting that the target access characteristics of the abnormal data reach the preset requirements; or, detecting that the current time reaches the blacklist update period.

[0133] Specifically, one implementable way is: preset update requirements for all or part of the target access characteristics. If the target access characteristics of the abnormal data meet the preset update requirements, that is, reach the preset requirements, it is considered that a blacklist update event is detected. Among them, if there are multiple preset requirements, meeting the preset requirements can be that all preset requirements are met, a certain number of preset requirements are met, etc. Another implementable way is: preset a blacklist update period (such as three days). If it is detected that the current time reaches the blacklist update period, it is considered that a blacklist update event is detected. Another implementable way is: the above two implementable ways can be combined, that is, under normal circumstances, update the abnormal data blacklist periodically according to the preset blacklist update period; when the newly recognized abnormal data has a greater impact on the operation of the interactive platform, that is, the target access characteristics of the abnormal data meet the preset requirements, temporarily trigger the update of the abnormal data blacklist. The method of this embodiment can flexibly trigger the update of the abnormal data blacklist in multiple ways, improving the timeliness and flexibility of the update of the abnormal data blacklist.

[0134] Optionally, after detecting a blacklist update event in this embodiment, the Apriori algorithm can be called to analyze whether the association rules for supplementing or deleting the blacklist are satisfied among the abnormal data based on the preset association rules, that is, according to whether the abnormal data belongs to the online blacklist and the co-occurrence situation among the abnormal data. If satisfied, the online blacklist is updated based on at least two abnormal data that meet the association rules. The specific implementation method is as follows: For abnormal data that both belong to the online blacklist, analyze whether there are multiple abnormal data that always appear simultaneously. If so, retain one of them in the online blacklist and delete the rest. For abnormal data that does not belong to the blacklist, analyze whether it always appears simultaneously with a certain blacklist abnormal data in the online blacklist. If not, supplement this abnormal data to the online blacklist.

[0135] Exemplarily, assume that two abnormal data are identified from the search term "platform promotion ip high price for traffic (QQ: 1234567, @ice000)", namely term A "QQ: 1234567" and term B "@ice000". If the function of the association rule is to supplement the blacklist, and term A is a vocabulary in the online blacklist while term B is not, at this time, it can be determined whether the confidence of term B relative to term A is less than a preset value (such as less than 1), that is, to determine whether term A and term B always exist simultaneously. If not, supplement term B to the online blacklist. If the association rule is to delete the blacklist, and both term A and term B are vocabulary in the online blacklist, at this time, it can be determined whether the confidence of term B relative to term A is less than a preset value (such as less than 1), that is, to determine whether term A and term B always exist simultaneously. If so, delete term B from the online blacklist and only retain term A.

[0136] It should be noted that in this embodiment, for at least two abnormal data that meet the blacklist deletion rules, when determining the abnormal data to be deleted from the online blacklist, it can be randomly selected or selected according to certain rules. This is not limited herein.

[0137] It should be noted that the search information in this embodiment can include information in multiple dimensions. For example, search term information and website address information. The search term information can further include the search term and the abnormal trigger term; the website address information can also include the accessed website address and the sub-website address. In this embodiment, an online blacklist can be maintained for each dimension. Specifically, for each type of online blacklist, the method described in this embodiment can be used to update the blacklist.

[0138] The solution of the embodiment of the present disclosure obtains the search information to be recognized of at least two interactive platforms and their access behaviors associated with each interactive platform, determines the target access characteristics of the search information to be recognized based on the access behaviors, and determines the abnormal data in the search information to be recognized based on the target access characteristics. After detecting a blacklist update event, the online blacklist is updated based on the co-occurrence of the online blacklist and the abnormal data. When updating the online blacklist in this solution, instead of simply adding the abnormal data to the online blacklist, the online blacklist is updated by considering the co-occurrence of the abnormal data and whether the abnormal data belongs to the blacklist, which ensures the timeliness of the online blacklist while reducing the redundancy of the online blacklist data.

[0139] Optionally, in this embodiment, the computing device can also monitor abnormal data in the online search information of at least two interactive platforms based on the online blacklist. Specifically, based on the updated online blacklist in the above embodiment, the computing device can monitor in real time the attack situation of each interactive platform by abnormal data, for example, the total number of interactive platforms attacked by abnormal data, and the page view volume attacked on each interactive platform, etc. It can also monitor in real time the shielding situation of each interactive platform for abnormal data, for example, the page view volume of the abnormal data shielded by each interactive platform. This solution improves the accuracy of abnormal data monitoring by establishing an accurate and comprehensive online blacklist to monitor abnormal data in the online search information of interactive platforms.

[0140] Figure 7 It is a system architecture diagram for abnormal data processing provided according to an embodiment of the present disclosure. Based on the above embodiment, the embodiment of the present disclosure gives a preferred example of an abnormal data processing method. This method is mainly applicable to the process of a computing device providing data analysis services for multiple B-side interactive platforms. Based on the search data of multiple B-side interactive platforms, abnormal data is identified, the online blacklist is updated, and abnormal data monitoring is performed on the online search information of multiple B-side interactive platforms based on the updated online blacklist. Among them, the B-side interactive platforms in this embodiment are preferably interactive platforms with a relatively small business scale and no professional data storage conditions and analysis teams themselves, and need to entrust a data analysis service provider to perform data analysis.

[0141] Such as Figure 7As shown in the figure, in the data preprocessing stage, the computing device obtains search terms of at least two B-side interaction platforms and the accessed URLs triggered by the search terms; extracts abnormal trigger words from the search terms, and uses the search terms and abnormal trigger words as the search term information of the search information to be recognized; extracts sub-URLs from the accessed URLs, and uses the accessed URLs and sub-URLs as the URL information of the search information to be recognized. After obtaining the search information to be recognized in four dimensions, it is also necessary to further obtain the access behavior of the search information to be recognized, and determine the target access characteristics of the search information to be recognized based on this access behavior.

[0142] In the abnormal data recognition stage, the computing device inputs the target access characteristics of the search information to be recognized into a pre-trained abnormal data recognition model to obtain a part of the abnormal data predicted by the model, that is, the first abnormal data; at the same time, according to the relationship between the target access characteristics and the feature threshold, another part of the abnormal data in the search information to be recognized is identified, that is, the second abnormal data, and the first abnormal data and the second abnormal data are merged as the abnormal data finally recognized in this stage. Among them, the abnormal data recognition model is trained by a supervised training method based on support and confidence through sample search information and its associated supervision labels. The supervision label information associated with the sample search information is obtained by expanding in two dimensions of semantic and behavioral characteristics, and this supervision label information is more accurate and comprehensive.

[0143] In the online blacklist update stage, an online blacklist can be constructed for each of the four types of abnormal data: search terms, abnormal trigger words of search terms, accessed URLs, and sub-URLs of accessed URLs. For each type of abnormal data, when it meets the blacklist update event, according to the association rule, that is, the co-occurrence situation of the online blacklist of this type and the abnormal data of this type, the data of the online blacklist of this type is supplemented or deleted. Preferably, in order to ensure the accuracy of the online blacklist data, manual verification of the supplement or deletion operation can also be performed, and after verification, the online blacklist data is updated. And based on the updated online blacklist, the online search information of multiple B-side interaction platforms is monitored for abnormal data to establish a perfect monitoring system.

[0144] This solution provides a preferred example of abnormal data processing, gives a new idea for accurately identifying abnormal data in search information and updating the online blacklist, and provides a guarantee for providing accurate monitoring services for the interaction platform based on the online blacklist.

[0145] Figure 8It is a schematic structural diagram of an abnormal data processing device provided according to an embodiment of the present disclosure. The embodiments of the present disclosure are applicable to the situation of identifying abnormal data. In particular, it is applicable to the situation of providing abnormal data identification for enterprise (Business, B-side) users. For example, it can be to parse the massive search information of multiple B-side interaction platforms and identify the abnormal data therein. This device can be implemented by software and / or hardware, and this device can implement the abnormal data processing method of any embodiment of the present disclosure. As Figure 8 shown, the abnormal data processing device 800 includes:

[0146] An information acquisition module 801, configured to acquire the search information to be identified of at least two interaction platforms, and the access behaviors associated with the search information to be identified in the at least two interaction platforms, where the search information to be identified includes search term information and / or the website information triggered by the search term information;

[0147] An access feature determination module 802, configured to determine the target access feature of the search information to be identified according to the access behaviors associated with the search information to be identified in the at least two interaction platforms;

[0148] An abnormal data identification module 803, configured to identify the abnormal data in the search information to be identified according to the target access feature.

[0149] The solution of the embodiment of the present disclosure acquires the search information to be identified of at least two interaction platforms and the access behaviors associated with each interaction platform, determines the target access feature of the search information to be identified based on this access behavior, and determines whether the search information to be identified is abnormal data based on this target access feature. This embodiment starts from the behavior characteristics of the entire access process of the search information in the interaction platform to identify the abnormal data therein, without relying on manual operations, improving the accuracy and efficiency of abnormal data identification, and providing a new solution for accurately identifying the abnormal data in the interaction platform.

[0150] Further, the access feature determination module 802 is specifically configured to:

[0151] Determine the interaction platforms associated with the search information to be identified according to the access behaviors associated with the search information to be identified in the at least two interaction platforms, and the page view volume of the search information to be identified in the associated interaction platforms;

[0152] Determine the target access feature of the search information to be identified according to the interaction platforms associated with the search information to be identified and the page view volume of the search information to be identified in the associated interaction platforms.

[0153] Further, the access feature determination module 802 is also specifically configured to:

[0154] Determine the search information to be recognized associated with each interaction platform and the page view volume corresponding to the search information to be recognized associated with each interaction platform according to the access behaviors associated with the search information to be recognized in the at least two interaction platforms;

[0155] Determine the target access features of the search information to be recognized according to the search information to be recognized associated with each interaction platform and the page view volume corresponding to the search information to be recognized associated with each interaction platform.

[0156] Further, the above device further includes:

[0157] An evolution feature determination module, configured to determine the evolution features of the search information to be recognized according to the information content of the search information to be recognized, and add the evolution features to the target access features of the search information to be recognized.

[0158] Further, the abnormal data recognition module 803 includes:

[0159] A first recognition unit, configured to recognize abnormal data in the search information to be recognized through an abnormal data recognition model according to the target access features; and / or,

[0160] A second recognition unit, configured to recognize abnormal data in the search information to be recognized according to the target access features and a feature threshold.

[0161] Further, the above device further includes:

[0162] A sample information acquisition module, configured to acquire sample search information;

[0163] A supervision label determination module, configured to determine the supervision label information associated with the sample search information;

[0164] A model training module, configured to perform supervised training on the abnormal data recognition model based on the sample search information and the supervision label information.

[0165] Further, the supervision label determination module is specifically configured to:

[0166] Determine initial label information according to the feedback information of the at least two interaction platforms on the sample search information;

[0167] Update the initial label information according to the similarity between the information content of the sample search information and the information content of the initial label information;

[0168] Determine the supervision label information associated with the sample search information according to the similarity between the sample access features of the sample search information and the sample access features of the updated initial label information.

[0169] Further, the information acquisition module 801 is specifically configured to:

[0170] Obtain search terms of at least two interaction platforms and the access URLs triggered by the search terms;

[0171] Extract abnormal trigger terms from the search terms, and use the search terms and the abnormal trigger terms as the search term information of the search information to be recognized;

[0172] Extract sub-URLs from the access URLs, and use the access URLs and the sub-URLs as the URL information of the search information to be recognized.

[0173] Further, the above device further includes:

[0174] A blacklist update module, configured to update the online blacklist according to the co-occurrence situation of the online blacklist and the abnormal data if a blacklist update event is detected.

[0175] Further, the above device further includes an update event detection module, specifically configured to:

[0176] Detect that the target access feature of the abnormal data reaches a preset requirement; or,

[0177] Detect that the current moment reaches the blacklist update period.

[0178] Further, the above device further includes:

[0179] An abnormal monitoring module, which monitors abnormal data of the online search information of the at least two interaction platforms based on the online blacklist.

[0180] The above product can execute the method provided in any embodiment of the present disclosure, and has corresponding functional modules and beneficial effects for executing the method.

[0181] In the technical solution of the present disclosure, the acquisition, storage, and application, etc. of any search information (such as search terms, abnormal trigger terms, access URLs, and sub-URLs, etc.) and access behaviors involved all comply with the provisions of relevant laws and regulations and do not violate public order and good customs.

[0182] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0183] Figure 9FIG. shows a schematic block diagram of an exemplary electronic device 900 that can be used to implement embodiments of the present disclosure. The electronic device is intended to represent various forms of digital computers, such as, laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as, personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely exemplary and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0184] As Figure 9 shown, the device 900 includes a computing unit 901 that can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 902 or a computer program loaded from a storage unit 908 into a random access memory (RAM) 903. In the RAM 903, various programs and data required for the operation of the device 900 can also be stored. The computing unit 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0185] Multiple components in the device 900 are connected to the I / O interface 905, including: an input unit 906, such as a keyboard, a mouse, etc.; an output unit 907, such as various types of displays, speakers, etc.; a storage unit 908, such as a magnetic disk, an optical disk, etc.; and a communication unit 909, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 909 allows the device 900 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0186] The computing unit 901 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 901 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 901 executes the various methods and processes described above, such as the abnormal data processing method. For example, in some embodiments, the abnormal data processing method can be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as the storage unit 908. In some embodiments, part or all of the computer program can be loaded and / or installed onto the device 900 via the ROM 902 and / or the communication unit 909. When the computer program is loaded into the RAM 903 and executed by the computing unit 901, one or more steps of the abnormal data processing method described above can be executed. Alternatively, in other embodiments, the computing unit 901 can be configured to execute the abnormal data processing method by any other suitable means (e.g., by means of firmware).

[0187] The various embodiments of the systems and techniques described above in this document can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGA), application-specific integrated circuits (ASIC), application-specific standard products (ASSP), system-on-a-chip systems (SOC), complex programmable logic devices (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include: being implemented in one or more computer programs, which can be executed and / or interpreted on a programmable system including at least one programmable processor, and the programmable processor can be a dedicated or general-purpose programmable processor, and can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit the data and instructions to the storage system, the at least one input device, and the at least one output device.

[0188] The program code for implementing the methods of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing devices, such that when the program codes are executed by the processor or controller, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The program codes can be executed entirely on the machine, partially on the machine, executed partially on the machine and partially on a remote machine as an independent software package, or executed entirely on a remote machine or server.

[0189] In the context of this disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0190] For purposes of providing an interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices can also be used to provide for interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic, speech, or tactile input).

[0191] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer having a graphical user interface or a web browser through which the user can interact with an implementation of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of a communication network include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0192] A computer system may include a client and a server. The client and the server are generally far from each other and usually interact via a communication network. The relationship between the client and the server is created by computer programs running on respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or a cloud host, which is a host product in the cloud computing service system, solving the defects of difficult management and weak business scalability existing in traditional physical hosts and VPS services. The server can also be a server of a distributed system or a server combined with blockchain.

[0193] Artificial intelligence is a discipline that studies how to make computers simulate certain thinking processes and intelligent behaviors of humans (such as learning, reasoning, thinking, planning, etc.), and it has technologies at both the hardware level and the software level. Artificial intelligence hardware technologies generally include technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, and big data processing; artificial intelligence software technologies mainly include several major directions such as computer vision technology, speech recognition technology, natural language processing technology, machine learning / deep learning technology, big data processing technology, and knowledge graph technology.

[0194] Cloud computing refers to a technical system that accesses an elastic and scalable shared physical or virtual resource pool through a network. The resources can include servers, operating systems, networks, software, applications, and storage devices, etc., and the resources can be deployed and managed in a demand-based and self-service manner. Through cloud computing technology, it can provide efficient and powerful data processing capabilities for the application and model training of technologies such as artificial intelligence and blockchain.

[0195] It should be understood that various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and no limitations are imposed herein.

[0196] The above specific implementation manners do not constitute a limitation on the protection scope of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure shall be included within the protection scope of this disclosure.

Claims

1. An abnormal data processing method, comprising: Obtaining search terms of at least two interactive platforms and the accessed URLs triggered by the search terms; Extracting abnormal trigger terms from the search terms, and using the search terms and the abnormal trigger terms as search term information of the search information to be recognized; Extracting sub-URLs from the accessed URLs, and using the accessed URLs and the sub-URLs as URL information of the search information to be recognized; and obtaining the access behaviors associated with the search information to be recognized in the at least two interactive platforms, wherein the search information to be recognized includes search term information and / or the URL information triggered by the search term information; Determining the target access characteristics of the search information to be recognized according to the access behaviors; Identifying abnormal data in the search information to be recognized according to the target access characteristics; Wherein, the determining the target access characteristics of the search information to be recognized according to the access behaviors includes: Determining the interactive platforms associated with the search information to be recognized according to the access behaviors, and the page view volume of the search information to be recognized on the associated interactive platforms; Determining the target access characteristics of the search information to be recognized according to the interactive platforms associated with the search information to be recognized and the page view volume of the search information to be recognized on the associated interactive platforms.

2. The method according to claim 1, wherein The determining the target access characteristics of the search information to be recognized according to the access behaviors further includes: Determining the search information to be recognized associated with each interactive platform according to the access behaviors, and the page view volume corresponding to the search information to be recognized associated with each interactive platform; Determining the target access characteristics of the search information to be recognized according to the search information to be recognized associated with each interactive platform and the page view volume corresponding to the search information to be recognized associated with each interactive platform.

3. The method according to any one of claims 1-2, further comprising: Determining the evolution characteristics of the search information to be recognized according to the information content of the search information to be recognized, and adding the evolution characteristics to the target access characteristics of the search information to be recognized.

4. The method according to claim 3, wherein The identifying abnormal data in the search information to be recognized according to the target access characteristics includes: Identifying abnormal data in the search information to be recognized through an abnormal data recognition model according to the target access characteristics; and / or, Identifying abnormal data in the search information to be recognized according to the target access characteristics and a characteristic threshold.

5. The method according to claim 4, further comprising: Obtaining sample search information, and determining the supervised label information associated with the sample search information; Performing supervised training on the abnormal data recognition model based on the sample search information and the supervised label information.

6. The method according to claim 5, wherein The determining the supervised label information associated with the sample search information includes: Determining initial label information according to the feedback information of the sample search information by the at least two interactive platforms; Updating the initial label information according to the similarity between the information content of the sample search information and the information content of the initial label information; Determine the supervised label information associated with the sample search information based on the similarity between the sample access characteristics of the sample search information and the sample access characteristics of the updated initial label information.

7. The method according to claim 1, further comprising: If a blacklist update event is detected, update the online blacklist according to the co-occurrence of the online blacklist and the abnormal data.

8. The method according to claim 7, wherein, Detecting a blacklist update event includes: Detecting that the target access characteristics of the abnormal data meet the preset requirements; or, Detecting that the current time reaches the blacklist update period.

9. The method according to claim 7, further comprising: Based on the online blacklist, monitor the online search information of the at least two interactive platforms for abnormal data.

10. An abnormal data processing device, comprising: An information acquisition module, configured to acquire search terms of at least two interactive platforms and the access URLs triggered by the search terms; Extract abnormal trigger words from the search terms, and use the search terms and the abnormal trigger words as the search term information of the search information to be recognized; Extract sub-URLs from the access URLs, and use the access URLs and the sub-URLs as the URL information of the search information to be recognized; and acquire the access behaviors associated with the search information to be recognized in the at least two interactive platforms, where the search information to be recognized includes search term information and / or the URL information triggered by the search term information; An access feature determination module, configured to determine the target access characteristics of the search information to be recognized according to the access behavior; An abnormal data recognition module, configured to recognize the abnormal data in the search information to be recognized according to the target access characteristics; Wherein, the access feature determination module is specifically configured to: Determine the interactive platform associated with the search information to be recognized according to the access behavior, and the page view volume of the search information to be recognized on the associated interactive platform; Determine the target access characteristics of the search information to be recognized according to the interactive platform associated with the search information to be recognized and the page view volume of the search information to be recognized on the associated interactive platform.

11. The device according to claim 10, wherein, The access feature determination module is further specifically configured to: Determine the search information to be recognized associated with each interactive platform according to the access behavior, and the page view volume corresponding to the search information to be recognized associated with each interactive platform; Determine the target access characteristics of the search information to be recognized according to the search information to be recognized associated with each interactive platform and the page view volume corresponding to the search information to be recognized associated with each interactive platform.

12. The device according to any one of claims 10-11, further comprising: An evolution feature determination module, configured to determine the evolution feature of the search information to be recognized according to the information content of the search information to be recognized, and add the evolution feature to the target access characteristics of the search information to be recognized.

13. The apparatus according to claim 12, wherein, The abnormal data recognition module includes: A first recognition unit, configured to recognize the abnormal data in the search information to be recognized through an abnormal data recognition model according to the target access characteristics; and / or, A second recognition unit, configured to recognize abnormal data in the search information to be recognized according to the target access feature and the feature threshold.

14. The apparatus according to claim 13, further comprising: A sample information acquisition module, configured to acquire sample search information; A supervision label determination module, configured to determine supervision label information associated with the sample search information; A model training module, configured to perform supervised training on the abnormal data recognition model based on the sample search information and the supervision label information.

15. The apparatus according to claim 14, wherein, The supervision label determination module is specifically configured to: Determine initial label information according to feedback information of the at least two interaction platforms on the sample search information; Update the initial label information according to the similarity between the information content of the sample search information and the information content of the initial label information; Determine the supervision label information associated with the sample search information according to the similarity between the sample access feature of the sample search information and the sample access feature of the updated initial label information.

16. The apparatus according to claim 10, further comprising: A blacklist update module, configured to update the online blacklist according to the co-occurrence situation of the online blacklist and the abnormal data if a blacklist update event is detected.

17. The apparatus according to claim 16, further comprising an update event detection module, specifically configured to: Detect that the target access feature of the abnormal data reaches a preset requirement; or Detect that the current moment reaches the blacklist update period.

18. The apparatus according to claim 16, further comprising: An abnormal monitoring module, configured to monitor abnormal data in the online search information of the at least two interaction platforms based on the online blacklist.

19. An electronic device, comprising: At least one processor; And A memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the abnormal data processing method according to any one of claims 1-9.

20. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to execute the abnormal data processing method according to any one of claims 1-9.

21. A computer program product, comprising a computer program, where the computer program implements the abnormal data processing method according to any one of claims 1-9 when executed by a processor.

Images