A method, device, equipment and storage medium for detecting traffic fraud objects

Abstract

The embodiments of the present application disclose a method, device, equipment and storage medium for detecting traffic cheating objects. The relevant embodiments can be applied to various scenarios such as cloud technology, artificial intelligence and smart transportation, and are used to reduce the cost of determining the cheating objects and improve the efficiency of detecting cheating objects. The method of the embodiment of the present application includes: obtaining a target heterogeneous graph between the set of objects to be detected and the set of entity objects, wherein the target heterogeneous graph includes a first node set and a second node set, generating a first vector corresponding to each first node and a second vector corresponding to each second node according to the target heterogeneous graph, calculating the vector similarity between each node pair according to the first vector and the second vector, determining the target node pair with cheating behavior according to the vector similarity, and taking the objects to be detected and the entity objects corresponding to the target node pair as traffic cheating objects.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data management technology, and in particular to a method, device, equipment and storage medium for detecting a traffic fraud object. Background Art

[0002] With the rapid development of information technology, advertising has vital value in the Internet world, and false advertising clicks have become a common behavior on the Internet. Many developers of information dissemination or trading platforms can apply to open advertising space and become traffic owners. When the basic objects are exposed and click on the ads on the information dissemination or trading platforms, the traffic owners can get some commissions.

[0003] Therefore, in some advertisements that charge per click, the more clicks the advertisement receives, the more revenue the traffic owner will earn. As a result, some traffic owners will cheat to create invalid exposures to increase advertising costs. However, such cheating will seriously affect the effectiveness of advertising and increase the advertising costs of advertisers, thus causing advertisers to stop or abandon advertising.

[0004] Currently, it is usually determined by analyzing the underlying code to determine whether malicious code has been implanted in the terminal device used by the basic object and thus controlled by the machine. It requires a lot of manpower to compile the underlying code into code that is easy for platform developers to understand, which increases the cost of manual detection of cheating behavior. Summary of the invention

[0005] The embodiments of the present application provide a method, apparatus, device and storage medium for detecting traffic fraud objects, which are used to quickly and accurately determine the objects to be detected and the entity objects that have cheating behavior by vectorizing a target heterogeneous graph between a set of objects to be detected and a set of entity objects to obtain the similarity between a first vector and a second vector. There is no need to analyze the underlying code to determine whether malicious code is implanted in the terminal device used by the basic object and thus controlled by the machine, and there is no need to compile the underlying code into a code that is easy for platform developers to understand, thereby reducing the cost of manual detection and improving detection efficiency.

[0006] The present application provides a method for detecting a traffic fraud object, including:

[0007] Acquire a target heterogeneous graph between the set of objects to be detected and the set of entity objects, wherein the target heterogeneous graph includes a first node set and a second node set, each first node in the first node set has a corresponding relationship with each object to be detected in the set of objects to be detected, and each second node in the second node set has a corresponding relationship with each entity object in the set of entity objects;

[0008] According to the target heterogeneous graph, generate a first vector corresponding to each first node and a second vector corresponding to each second node;

[0009] Calculate the vector similarity between each node pair according to the first vector and the second vector;

[0010] According to the vector similarity, the target node pair with cheating behavior is determined, and the object to be detected and the entity object corresponding to the target node pair are taken as the traffic cheating object.

[0011] On the other hand, the present application provides a detection device for a traffic fraud object, including:

[0012] An acquisition unit is used to acquire a target heterogeneous graph between the set of objects to be detected and the set of entity objects, wherein the target heterogeneous graph includes a first node set and a second node set, each first node in the first node set has a corresponding relationship with each object to be detected in the set of objects to be detected, and each second node in the second node set has a corresponding relationship with each entity object in the set of entity objects;

[0013] The processing unit is further used to generate a first vector corresponding to each first node and a second vector corresponding to each second node according to the target heterogeneous graph;

[0014] The processing unit is further used to calculate the vector similarity between each node pair based on the first vector and the second vector;

[0015] The determination unit is used to determine the target node pair with cheating behavior according to the vector similarity, and use the object to be detected and the entity object corresponding to the target node as the traffic cheating object.

[0016] In a possible design, in an implementation of another aspect of the embodiment of the present application, the acquisition unit may be specifically used to:

[0017] Acquire traffic propagation data, wherein the traffic propagation data respectively have corresponding relationships with the object set to be detected and the entity object set, and the traffic propagation data is used to generate a first node set and a second node set, the first node set has a corresponding relationship with the object set to be detected, and the second node set has a corresponding relationship with the traffic entity set;

[0018] Generate a target heterogeneous graph based on the traffic propagation data.

[0019] In a possible design, in an implementation of another aspect of the embodiment of the present application, the acquisition unit may be specifically used to:

[0020] Extracting a first node set, a second node set, and a heterogeneous relationship between the first node and the second node from the traffic propagation data;

[0021] According to the heterogeneous relationship, the first node and the second node are connected through node edges to obtain a target heterogeneous graph, wherein each node edge corresponds to a relationship or a scene information, and each node edge corresponds to an edge weight.

[0022] In a possible design, in an implementation of another aspect of the embodiment of the present application, the acquisition unit may be specifically used to:

[0023] According to the forwarding relationship between the first node and the second node, the jump relationship between the first node and the second node, the jump relationship between each second node and the scene information between the first node and the second node, the first node and the second node are connected through node edges to obtain a target heterogeneous graph.

[0024] In a possible design, in an implementation of another aspect of the embodiment of the present application, the processing unit may be specifically used for:

[0025] Perform node sequence sampling on the target heterogeneous graph to obtain a target heterogeneous node sequence corresponding to the target heterogeneous graph, wherein the target heterogeneous node sequence includes nodes and neighboring nodes of the nodes;

[0026] The target heterogeneous node sequence is converted into a first vector and a second vector.

[0027] In a possible design, in an implementation of another aspect of the embodiment of the present application, the processing unit may be specifically used for:

[0028] Generate a meta-path according to the target heterogeneous graph and the sampling length, wherein the meta-path includes a node type, a sampling order of the node type, and a sampling length;

[0029] The target heterogeneous graph is sampled according to the meta-path to obtain the target heterogeneous node sequence.

[0030] In a possible design, in an implementation of another aspect of the embodiment of the present application, the processing unit may be specifically used for:

[0031] Obtain the edge weights corresponding to the node edges connecting each node with its neighboring nodes from the target heterogeneous graph;

[0032] Calculate the sampling probability corresponding to each node's neighboring nodes according to the edge weight;

[0033] According to the size of sampling probability, node type, sampling order of node type and sampling length, it walks between each node and neighboring nodes of the target heterogeneous graph to generate a target heterogeneous node sequence.

[0034] In a possible design, in an implementation of another aspect of the embodiment of the present application,

[0035] The processing unit is also used to normalize the edge weights to obtain normalized weights;

[0036] The processing unit may be specifically configured to calculate the sampling probability corresponding to the neighboring nodes of each node according to the normalized weight.

[0037] In a possible design, in an implementation of another aspect of the embodiment of the present application, the processing unit may be specifically used for:

[0038] Divide the target heterogeneous node sequence into multiple node subsequences;

[0039] Perform vector mapping on each node in each node subsequence to obtain the corresponding predicted embedding vector of each node;

[0040] Obtain a first vector and a second vector according to the predicted embedding vector.

[0041] In a possible design, in an implementation of another aspect of the embodiment of the present application, the processing unit may be specifically used for:

[0042] Perform vector mapping on the central node of each node subsequence to obtain a first embedding vector;

[0043] Performing vector mapping processing on the neighboring nodes of the central node according to the first embedding vector to obtain a second embedding vector corresponding to the neighboring nodes;

[0044] Obtaining a first vector and a second vector according to the predicted embedding vector includes:

[0045] A first vector and a second vector are obtained according to the first embedding vector and the second embedding vector.

[0046] In a possible design, in an implementation of another aspect of the embodiment of the present application, the determining unit may be specifically used to:

[0047] Compare the vector similarity with the similarity threshold to obtain a comparison result;

[0048] If the comparison result is that the vector similarity is less than or equal to the similarity threshold, the node pair is determined to be a normal node pair;

[0049] If the comparison result is that the vector similarity is greater than the similarity threshold, the node pair is determined as the target node pair.

[0050] In a possible design, in an implementation of another aspect of the embodiment of the present application, the determining unit may be specifically used to:

[0051] According to the relationship between similarity and score, obtain the similarity score corresponding to the vector similarity;

[0052] The node pairs corresponding to the similarity scores greater than the score threshold are taken as the target node pairs.

[0053] On the other hand, the present application provides a computer device, including: a memory, a transceiver, a processor, and a bus system;

[0054] Wherein, the memory is used to store programs;

[0055] The processor is used to implement the above-mentioned methods when executing the program in the memory;

[0056] The bus system is used to connect the memory and the processor so that the memory and the processor can communicate with each other.

[0057] Another aspect of the present application provides a computer-readable storage medium, in which instructions are stored. When the computer-readable storage medium is run on a computer, the computer is enabled to execute the above-mentioned methods.

[0058] It can be seen from the above technical solutions that the embodiments of the present application have the following beneficial effects:

[0059] By obtaining a target heterogeneous graph between the set of objects to be detected and the set of entity objects, a first vector corresponding to each first node and a second vector corresponding to each second node can be generated according to the target heterogeneous graph, and the vector similarity between each node pair can be calculated according to the first vector and the second vector, and then the target node pair with cheating behavior is determined according to the vector similarity, and the objects to be detected and the entity objects corresponding to the target node pair are used as traffic cheating objects. In the above manner, by constructing a target heterogeneous graph between the set of objects to be detected and the set of entity objects, the target heterogeneous graph can be represented by a vector to accurately obtain the first vector corresponding to each object to be detected and the second vector corresponding to each entity object, and then the objects to be detected and the entity objects with cheating behavior can be quickly and accurately determined by calculating the similarity between the first vector and the second vector, without having to analyze the underlying code to determine whether the terminal device used by the basic object is implanted with malicious code and thus controlled by the machine, and without having to compile the underlying code into a code that is easy for platform developers to understand, thereby reducing the cost of manual detection and improving detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 This is a schematic diagram of the architecture of a data object control system in an embodiment of the present application;

[0061] Figure 2 This is a flow chart of an embodiment of a method for detecting a traffic fraud object in an embodiment of the present application;

[0062] Figure 3This is another embodiment flow chart of the method for detecting traffic fraud objects in the embodiment of the present application;

[0063] Figure 4 This is another embodiment flow chart of the method for detecting traffic fraud objects in the embodiment of the present application;

[0064] Figure 5 This is another embodiment flow chart of the method for detecting traffic fraud objects in the embodiment of the present application;

[0065] Figure 6 This is another embodiment flow chart of the method for detecting traffic fraud objects in the embodiment of the present application;

[0066] Figure 7 This is another embodiment flow chart of the method for detecting traffic fraud objects in the embodiment of the present application;

[0067] Figure 8 This is another embodiment flow chart of the method for detecting traffic fraud objects in the embodiment of the present application;

[0068] Fig. 9 This is another embodiment flow chart of the method for detecting traffic fraud objects in the embodiment of the present application;

[0069] Fig.10 This is another embodiment flow chart of the method for detecting traffic fraud objects in the embodiment of the present application;

[0070] Fig.11 This is another embodiment flow chart of the method for detecting traffic fraud objects in the embodiment of the present application;

[0071] Fig.12 This is another embodiment flow chart of the method for detecting traffic fraud objects in the embodiment of the present application;

[0072] Fig.13 It is a schematic diagram of a heterogeneous relationship of a method for detecting a traffic fraud object in an embodiment of the present application;

[0073] Fig.14 This is a schematic diagram of a vector acquisition principle of a method for detecting a traffic fraud object in an embodiment of the present application;

[0074] Fig.15 It is a vector similarity diagram of the method for detecting traffic fraud objects in an embodiment of the present application;

[0075] Fig.16 It is a schematic diagram of the detection effect of a traffic fraud object organization obtained in the method for detecting a traffic fraud object in an embodiment of the present application;

[0076] Fig.17This is a schematic diagram of a heterogeneous relationship of a traffic fraud object organization in a method for detecting a traffic fraud object in an embodiment of the present application;

[0077] Fig.18 It is a schematic diagram of an entity object of the method for detecting a traffic fraud object in an embodiment of the present application;

[0078] FIG. 19( a ) is a schematic diagram of a physical display position of a method for detecting a traffic fraud object in an embodiment of the present application;

[0079] FIG. 19( b ) is another schematic diagram of a physical display position of a method for detecting a traffic fraud object in an embodiment of the present application;

[0080] FIG. 19( c ) is another schematic diagram of a physical display position of a method for detecting a traffic fraud object in an embodiment of the present application;

[0081] Fig. 20 This is an object relationship diagram of the method for detecting traffic fraud objects in an embodiment of the present application;

[0082] Fig.21 This is a schematic diagram of an embodiment of a device for detecting a traffic fraud object in an embodiment of the present application;

[0083] Fig. 22 It is a schematic diagram of an embodiment of a computer device in an embodiment of the present application. DETAILED DESCRIPTION

[0084] The embodiments of the present application provide a method, apparatus, device and storage medium for detecting traffic fraud objects, which are used to quickly and accurately determine the objects to be detected and the entity objects that have cheating behavior by vectorizing a target heterogeneous graph between a set of objects to be detected and a set of entity objects to obtain the similarity between a first vector and a second vector. There is no need to analyze the underlying code to determine whether malicious code is implanted in the terminal device used by the basic object and thus controlled by the machine, and there is no need to compile the underlying code into a code that is easy for platform developers to understand, thereby reducing the cost of manual detection and improving detection efficiency.

[0085] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein, for example. In addition, the terms "including" and "corresponding to" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0086] To facilitate understanding, some terms or concepts involved in the embodiments of the present application are first explained.

[0087] 1. (Cost Per Click, CPC) Advertising

[0088] CPC is used to represent the cost of each ad click. In this model, advertisers only pay for the behavior of the base object clicking the target object (such as an ad), and no longer pay for the exposure of the ad. For advertisers, CPC advertising avoids the risk of exposure without clicks, and is currently one of the mainstream advertising charging methods.

[0089] 2. Advertisers

[0090] Advertisers refer to the objects or service providers that pay for advertising. Advertisers hope that every paid ad click is a valid click from a real user, rather than a cheating click.

[0091] 3. Traffic Master

[0092] Traffic source is the carrier that provides object traffic, usually refers to media, websites or software. Fig.18 As shown in the figure, on the advertising platform, traffic owners refer to public accounts with a certain number of fans. Traffic owners can participate in the profit sharing of advertisements. Under the same ad exposure, the higher the click-through rate, the higher the profit share. Therefore, traffic owners have a strong motivation to cheat to increase the click-through rate.

[0093] 4. Advertising fraud

[0094] In the process of advertising exposure, clicks, and effects, a target object may, for some malicious purpose, manipulate the advertising exposure, clicks, and effects. This malicious behavior that is not in line with the target object's true intention is called advertising fraud.

[0095] 5. Advertising anti-fraud

[0096] Check the advertising exposure, clicks, effects, etc. to determine whether the advertising exposure, clicks, effects, etc. are normal.

[0097] 6. Advertising

[0098] Advertisement placement refers to the process of advertising platforms displaying advertisements on the pages of traffic owners. Which advertisement is displayed on which page is usually determined by the platform's algorithm. Generally speaking, it is placed according to the interests of the basic objects. That is, what kind of advertisement will be displayed depends on the interests of the basic objects browsing the page.

[0099] 7. Advertising space

[0100] Ad slot refers to the media location identifier where the advertisement is placed, such as Figure 19(a) to Figure 19(c) As shown, for example, the ads on articles displayed on a platform are divided into top ad slots, mid-article ad slots, and bottom ad slots according to the positions where the ads appear in the articles. In addition, the ads on some mini-programs can be divided into banner ads, rewarded video ads, or interstitial ads according to the positions where they appear.

[0101] 8. Ad conversion rate

[0102] Ad conversion rate refers to the ratio of the number of conversions brought by an ad to the number of clicks on the ad during the advertising process. For different promotion goals, the corresponding conversion goals are different. Fig.16 As shown, for example, for e-commerce ads, the conversion goal refers to the orders brought by the ads, and the corresponding ad conversion rate is the ratio of the orders brought by the ads to the number of clicks; for Android / IOS download ads, conversion refers to the application activations brought by the ads, and the corresponding ad conversion rate is the ratio of the application activations brought by the ads to the number of clicks.

[0103] 9. Ad click-through rate

[0104] The click-through rate of an ad is the ratio of clicks to exposures. If the number of exposures of an ad is M and the number of clicks is N, then the click-through rate ctr = N / M.

[0105] 10. Heterogeneous Graphs

[0106] Heterogeneity refers to the property of containing different components. In the field of information technology, heterogeneity is usually used to describe entities containing multiple different types. A heterogeneous graph refers to a relationship graph containing different types of nodes.

[0107] It is understandable that the detection method of traffic cheating objects disclosed in this application specifically involves cloud technology (Cloud technology), and cloud technology is further introduced below. Cloud technology refers to a hosting technology that unifies a series of resources such as hardware, software, and network in a wide area network or a local area network to realize the calculation, storage, processing, and sharing of data. Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, application technology, etc. based on the cloud computing business model application, which can form a resource pool, which is used on demand and is flexible and convenient. Cloud computing technology will become an important support. The background service of the technical network system requires a large amount of computing and storage resources, such as video websites, picture websites, and more portal websites. With the high development and application of the Internet industry, each item may have its own identification mark in the future, and all need to be transmitted to the background system for logical processing. Data of different levels will be processed separately, and all kinds of industry data need strong system backing support, which can only be achieved through cloud computing.

[0108] Cloud computing is a computing model that distributes computing tasks across a resource pool consisting of a large number of computers, enabling various application systems to obtain computing power, storage space, and information services as needed. The network that provides resources is called a "cloud". From the user's perspective, the resources in the "cloud" are infinitely scalable and can be obtained at any time, used on demand, expanded at any time, and paid for by use.

[0109] As a provider of basic cloud computing capabilities, a cloud computing resource pool (referred to as a cloud platform, generally referred to as an IaaS (Infrastructure as a Service) platform) will be established, and various types of virtual resources will be deployed in the resource pool for external customers to choose to use. The cloud computing resource pool mainly includes: computing devices (virtualized machines, including operating systems), storage devices, and network devices.

[0110] According to the logical function division, the PaaS (Platform as a Service) layer can be deployed on the IaaS (Infrastructure as a Service) layer, and the SaaS (Software as a Service) layer can be deployed on the PaaS layer. SaaS can also be deployed directly on IaaS. PaaS is a platform for software operation, such as databases, web containers, etc. SaaS is a variety of transaction software, such as web portals, SMS mass senders, etc. Generally speaking, SaaS and PaaS are upper layers relative to IaaS.

[0111] Secondly, cloud storage is a new concept extended and developed from the concept of cloud computing. A distributed cloud storage system (hereinafter referred to as storage system) refers to a storage system that uses cluster applications, grid technology, and distributed storage file systems to bring together a large number of different types of storage devices (storage devices are also called storage nodes) in the network through application software or application interfaces to work together and provide external data storage and transaction access functions.

[0112] At present, the storage method of the storage system is: create a logical volume, and when creating a logical volume, allocate physical storage space for each logical volume. The physical storage space may be composed of disks of a storage device or several storage devices. The client stores data on a logical volume, that is, stores the data on the file system. The file system divides the data into many parts, each of which is an object. The object contains not only data but also additional information such as data identification (ID, ID entity). The file system writes each object into the physical storage space of the logical volume, and the file system records the storage location information of each object, so that when the client requests to access the data, the file system can allow the client to access the data according to the storage location information of each object.

[0113] The process of the storage system allocating physical storage space to a logical volume is as follows: based on the estimated capacity of the objects stored in the logical volume (this estimate often has a large margin relative to the actual capacity of the objects to be stored) and the grouping of independent redundant disk arrays (RAID, Redundant Array of Independent Disks), the physical storage space is pre-divided into stripes. A logical volume can be understood as a stripe, thereby allocating physical storage space to the logical volume.

[0114] Furthermore, blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the blockchain underlying platform, platform product service layer and application service layer.

[0115] The underlying blockchain platform can include processing modules such as user management, basic services, smart contracts, and operation monitoring, providing services such as identity information management, verification of the validity of transaction requests, transaction storage, contract registration and issuance, contract triggering, contract execution, and product operation for blockchain participants to use. The platform product service layer provides the basic capabilities and implementation framework of typical applications. Developers can build on these basic capabilities and superimpose transaction features to complete the blockchain implementation of transaction logic. The application service layer provides application services based on blockchain solutions for transaction participants to use.

[0116] It should be understood that the detection method of traffic cheating objects provided by the present application can be applied to the fields of cloud technology, artificial intelligence, smart transportation, etc., and is used to perform traffic or advertising management or maintenance by detecting whether there is cheating between basic objects and traffic masters, basic objects and IPs, or basic objects and devices. As an example, by detecting that there is cheating between a basic object and public account A or that it belongs to a cheating object, the traffic or advertisements placed by basic object A and public account A are restricted. As another example, by detecting that there is cheating between a basic object B and application B or that it belongs to a cheating object, the advertisements placed in application B are reduced. As another example, by detecting that there is cheating between a basic object C and IP address C or that it belongs to a cheating object, IP address C can be included in the cheating blacklist. In the above-mentioned various scenarios, in order to detect cheating, it is usually determined by analyzing the underlying code whether malicious code is implanted in the terminal device used by the basic object and thus controlled by the machine, and a large amount of manpower costs are required to compile the underlying code into a code that is easy for platform developers to understand, resulting in an increase in the cost of manually detecting cheating.

[0117] It can be understood that the intelligent traffic system (ITS) used in the field of smart transportation, also known as the intelligent transportation system (ITS), effectively integrates advanced science and technology (information technology, computer technology, data communication technology, sensor technology, electronic control technology, automatic control theory, operations research, artificial intelligence, etc.) into transportation, service control and vehicle manufacturing, strengthens the connection between vehicles, roads and users, and thus forms a comprehensive transportation system that ensures safety, improves efficiency, improves the environment and saves energy.

[0118] In order to solve the above problems, this application proposes a method for detecting traffic fraud objects. Figure 1 The digital watermark control system shown in Figure 1 , Figure 1 FIG. 1 is a schematic diagram of a digital watermark control system in an embodiment of the present application. Figure 1 As shown, the server can obtain the target heterogeneous graph between the set of objects to be detected and the set of entity objects provided by the terminal device, and can generate a first vector corresponding to each first node and a second vector corresponding to each second node according to the target heterogeneous graph, and calculate the vector similarity between each node pair according to the first vector and the second vector, and then determine the target node pair with cheating behavior according to the vector similarity, and use the objects to be detected and the entity objects corresponding to the target node pair as traffic cheating objects. In the above manner, by constructing the target heterogeneous graph between the set of objects to be detected and the set of entity objects, the target heterogeneous graph can be represented by vectors to accurately obtain the first vector corresponding to each object to be detected and the second vector corresponding to each entity object, and then the objects to be detected and the entity objects with cheating behavior can be quickly and accurately determined by calculating the similarity between the first vector and the second vector, without having to analyze the underlying code to determine whether the terminal device used by the basic object is implanted with malicious code and thus controlled by the machine, and without having to compile the underlying code into a code that is easy for platform developers to understand, thereby reducing the cost of manual detection and improving detection efficiency.

[0119] For ease of understanding, Figure 1 As shown, this embodiment takes the object to be detected (such as a user browsing a public account or using a mini program, etc.) clicking on a target entity (such as an advertisement on a public account) as an example for explanation. When the object to be detected is exposed or clicks on an advertisement, the client installed on the terminal device will report the current advertising behavior data generated by the object to be detected on the entity object, including but not limited to the current time, the id of the object to be detected, the scene (browsing the public account, using the mini program for searching, or using a mini game, etc.), the IP of the object to be detected, and the id of the entity object (such as a public account or mini program, etc.) to the access server, so that the access server first stores the exposure and click log of the object to be detected in a database (such as an advertisement exposure and click database), and then the access server can request the computing server in real time, so that the computing server can determine whether the advertisement click of the object to be detected and the entity object at that time is a machine or script-type cheating click on the advertisement by calculating the heterogeneous graph similarity between the object to be detected and the entity object, and return the result at the same time.

[0120] Understandably, Figure 1 Only one type of terminal device is shown in the figure. In actual scenarios, more types of terminal devices may participate in the data processing process. Terminal devices include but are not limited to mobile phones, computers, intelligent voice interaction devices, smart home appliances, car terminals, etc. The specific number and type depend on the actual scenario and are not limited here. Figure 1One server is shown in the figure, but in actual scenarios, multiple servers may also be involved, especially in the scenario of multi-model training interaction. The number of servers depends on the actual scenario and is not limited here.

[0121] It should be noted that in this embodiment, the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms. The terminal device and the server can be directly or indirectly connected through wired or wireless communication, and the terminal device and the server can be connected to form a blockchain network, which is not limited in this application.

[0122] The following is an introduction to the detection method of traffic fraud objects in this application. Figure 2 In one embodiment of the present application, a method for detecting a traffic fraud object includes:

[0123] In step S101, a target heterogeneous graph between the set of objects to be detected and the set of entity objects is obtained, wherein the target heterogeneous graph includes a first node set and a second node set, each first node in the first node set has a corresponding relationship with each object to be detected in the set of objects to be detected, and each second node in the second node set has a corresponding relationship with each entity object in the set of entity objects;

[0124] In this embodiment, since the normal detected object will only click on the target entity (such as an advertisement) that it is interested in, the behavioral differences between the normal detected object and the detected object with cheating behavior include the following points. It can be understood that cheating behavior can be specifically manifested as an automatic machine cheating to click on advertisements. Automatic machine cheating to click on advertisements is a cheating behavior that controls hundreds of terminal devices (such as mobile phones) to control abnormal objects to click on advertisements. However, the normal detection object's click on advertisements is not controlled by a unified script:

[0125] 1) The concentration of clicked entity objects (such as traffic hosts) is different: Since the target entities (such as advertisements) seen by each target object under each traffic host appear randomly, the traffic hosts clicked by normal targets are relatively scattered. However, targets with cheating behaviors will gather on these traffic hosts to increase the advertising revenue of specific traffic hosts, so the traffic hosts clicked by targets with cheating behaviors are relatively concentrated;

[0126] 2) The concentration of clicked entity objects (such as IP addresses) is different: Since normal objects to be detected will only click on the target entities of interest (such as ads), the IP addresses that click on ads are relatively dispersed, and there will not be a large number of concentrated clicks on ads by a certain IP address. However, when objects to be detected with cheating behavior click on ads in large numbers through scripts or automatons, IP addresses are clustered. Even if IP addresses are frequently switched through the second broadcast IP address, the total amount of the second broadcast IP address pool is limited. Therefore, objects to be detected with cheating behavior will cross-use the same IP address to click ads.

[0127] 3) Different click time distribution: Since the target entity (such as an advertisement) appears randomly and the subject to be detected only clicks on the advertisements that it is interested in, the time when the normal subject to be detected clicks on the advertisement is relatively scattered, while the abnormal subject to be detected is easily induced to click on the advertisement by the external task platform, or the advertisement cheating task is initiated by the automatic machine, resulting in an abnormal increase in the number of advertisement clicks within a certain period of time;

[0128] 4) The behavior scenarios of target entities (such as advertisements) are different: The behavior of each object to be detected will have a source scenario. For example, under the public account, there are subscription account entry, group chat entry, etc., and under the mini program, there are recent use opening, external app wake-up, scan code opening, etc.; the objects to be detected with cheating behavior usually enter through scenarios such as scan code opening and external app wake-up, while normal objects to be detected usually enter through subscription account entry, recent use, etc.

[0129] 5) The concentration of clicks on target entities (such as ads) is different: Normal subjects to be detected will only click on target entities (such as ads) that they are interested in, so they will not click on all exposed ads. The types of ads they click are relatively concentrated. However, subjects to be detected with cheating behavior will not distinguish between ad types in order to increase ad revenue, and will click indiscriminately. The types of ads they click are relatively scattered.

[0130] Therefore, in order to avoid or reduce cheating behaviors such as false advertising exposure, clicks or delivery effects by traffic objects in aspects such as advertising exposure, clicks or delivery effects, this embodiment can obtain a target heterogeneous graph between the object set to be detected and the entity object set.

[0131] The target heterogeneous graph includes a first node set and a second node set, each first node in the first node set has a corresponding relationship with each object to be detected in the object set to be detected, and each second node in the second node set has a corresponding relationship with each entity object in the entity object set.

[0132] The object to be detected can be specifically detected by clicking on an entity object (such as a traffic master or IP, etc.) or clicking on an object of a target entity (such as an advertisement, article or news, etc.) on a client such as a media, website or software through a terminal device.

[0133] The entity object can be specifically represented by a traffic owner, IP, target device or external link, etc., and can also be represented by other entity objects, which are not specifically limited here. Among them, the traffic owner can be used to provide a carrier for the basic object traffic, usually referring to media, websites or software, etc. For example, the traffic owner can be specifically represented by Fig.18 It refers to a public account, mini program or video account with a certain number of fans. Traffic owners can participate in the profit sharing of advertisements. It is understandable that under the same advertising exposure, the higher the advertising click-through rate, the higher the profit that the traffic owner can share.

[0134] Specifically, Fig.13 As shown, a target heterogeneous graph between the set of objects to be detected and the set of entity objects is obtained. Specifically, the traffic propagation data reported by the object to be detected through the terminal device can be obtained by receiving the server, and the first node set, the second node set and the heterogeneous relationship between the first node and the second node can be extracted from the traffic propagation data. The first node and the second node can be connected using the node edge according to the heterogeneous relationship to obtain the target heterogeneous graph. Alternatively, the obtained traffic propagation data can be input into the image generation model, and the heterogeneous feature relationship in the traffic propagation data can be extracted through the image generation model, wherein the heterogeneous relationship can be specifically manifested as one or more of the target entity (such as advertisement) click relationship between the object to be detected and the entity object (such as traffic master), the target entity (such as advertisement) click relationship between the object to be detected and the entity object (such as IP), the installation relationship between the object to be detected and the entity object (such as terminal device), the opening relationship between the object to be detected and the entity object (such as external link), etc., and can also be other heterogeneous relationship features, which are not specifically limited here. Then, the heterogeneous relationship features can be converted into the first node set and the second node set connected by the node edge set through the image generation model to obtain the target heterogeneous graph.

[0135] For example, the traffic propagation data obtained is the behavioral data record of the subject to be detected clicking on the advertising content in the past N days. The behavioral data record of clicking on the advertising content can be specifically expressed as the advertising content that is clicked and consumed, and the characteristic information associated with the content, such as the traffic master ID that generates the display advertising content, the IP address of the subject to be detected clicking on the advertisement, and the way to open the official account or mini program, etc. Then, based on these traffic propagation data, the following can be constructed: Fig.13 The target heterogeneous graph corresponding to the node set of “user-traffic master” is shown.

[0136] In step S102, a first vector corresponding to each first node and a second vector corresponding to each second node are generated according to the target heterogeneous graph;

[0137] In this embodiment, after obtaining the target heterogeneous graph between the object set to be detected and the entity object set, a first vector corresponding to each first node and a second vector corresponding to each second node can be generated according to the target heterogeneous graph. The first nodes and the second nodes in the target heterogeneous graph can be directly expressed in a digital form, that is, vector representation can be performed, and the first vector corresponding to the first node and the second vector corresponding to the second node that can be convenient for the computer device to identify and process can be obtained, thereby improving the efficiency of detecting traffic fraud objects to a certain extent.

[0138] Specifically, Fig.14 As shown, after obtaining the target heterogeneous graph between the set of objects to be detected and the set of entity objects, a first vector corresponding to each first node and a second vector corresponding to each second node can be generated according to the target heterogeneous graph. Specifically, the target heterogeneous graph can be used as the input of the graph embedding model, and the first embedding vector of any node can be obtained through the graph embedding model. Then, the second embedding vectors of other neighboring nodes can be predicted based on the first embedding vector of the node through the graph embedding model. The graph embedding model can be determined according to actual application requirements, and can be specifically expressed as a skip-gram model or a continuous bag-of-words model (CBOW) model in the word2vec algorithm, or other graph embedding models, such as the Hin2vec algorithm, which is not specifically limited here.

[0139] Alternatively, specifically, based on a Metapath algorithm, a metapath of appropriate length may be predefined, and then node sampling may be performed on the target heterogeneous graph according to the metapath to obtain a target heterogeneous node sequence, and each node in the target heterogeneous graph may be better mapped into the same latent vector space based on the target heterogeneous node sequence to obtain vectors corresponding to each node, i.e., a first vector corresponding to the first node and a second vector corresponding to the second node. The first vector and the second vector may also be obtained in other ways, which are not specifically limited here.

[0140] In step S103, the vector similarity between each node pair is calculated based on the first vector and the second vector;

[0141] In this embodiment, after obtaining the first vector and the second vector, the vector similarity between each node pair can be calculated based on the first vector and the second vector, so that the degree of willingness of the object to be detected to click on the entity object (such as the traffic master) can be reflected based on the vector similarity between each node pair. Therefore, the vector similarity can be used to accurately determine whether there is cheating behavior between the object to be detected and the entity object, thereby improving the accuracy and efficiency of detecting traffic cheating objects to a certain extent.

[0142] Each node pair includes a first node and a second node.

[0143] Specifically, after obtaining the first vector and the second vector, the vector similarity between each node pair can be calculated based on the first vector and the second vector. Specifically, the cosine similarity formula can be used to calculate the vector similarity. Other similarity algorithms can also be used, such as the Euclidean distance calculation formula, etc., which are not specifically limited here.

[0144] For example, Fig.15 As shown, assuming that the first vector generated by the target heterogeneous graph is u i , the entity object (such as traffic master) vector generated by the target heterogeneous graph is a, and the cosine similarity calculation formula shown in formula (1) can be used to calculate the vector similarity between all first vectors and any second vector, so as to obtain the similarity distribution of all objects to be detected on any entity object (such as traffic master):

[0145]

[0146] It can be understood that the similarity between the first vector and the second vector, that is, the vector similarity of a node pair, can be used to reflect the degree of willingness of the object to be detected to click on the entity object (such as the traffic master). That is, the higher the vector similarity, the higher the correlation between the first node and the second node. It can be understood that the object to be detected is more inclined to click on the target entity (such as an advertisement) on the entity object (such as the traffic master).

[0147] In step S104, according to the vector similarity, the target node pair with cheating behavior is determined, and the object to be detected and the entity object corresponding to the target node pair are taken as traffic cheating objects.

[0148] In this embodiment, since the similarity between the first vector and the second vector between each node pair, that is, the vector similarity of a node pair, can be used to reflect the degree of willingness of the object to be detected to click on the entity object (such as the traffic master), that is, the higher the vector similarity, the higher the correlation between the first node and the second node, which can be understood as the object to be detected is more inclined to click on the target entity (such as an advertisement) on the entity object (such as the traffic master). Therefore, after obtaining the vector similarity of each node pair, the target node pair with cheating behavior can be screened out from several node pairs according to the vector similarity, and the object to be detected and the entity object corresponding to the target node pair are used as traffic cheating objects. There is no need to analyze the underlying code to determine whether the terminal device used by the basic object is implanted with malicious code and thus controlled by the machine, and there is no need to compile the underlying code into a code that is easy for platform developers to understand, thereby reducing the cost of manual detection and improving detection efficiency.

[0149] Specifically, after obtaining the vector similarity of each node pair, the target node pairs with cheating behavior can be screened out from several node pairs according to the vector similarity. Specifically, the vector similarity can be compared with a certain threshold. When the vector similarity exceeds a certain threshold, it means that the object to be detected may be induced by certain external factors to passively or actively click on the target entity (such as an advertisement). Alternatively, the object to be detected and the traffic master with advertising cheating behavior can be identified based on the similarity score between the object to be detected and the entity object (such as the traffic master). Other identification methods can also be used, which are not specifically limited here.

[0150] It is understandable that if Fig.16 As shown, it has been verified that the coverage rate of the traffic cheating target organizations (such as Beijing A organization) identified by this embodiment with cheating behavior is above 96%. Fig.17 It is a target heterogeneous graph corresponding to the traffic fraud target organization.

[0151] In an embodiment of the present application, a method for detecting traffic cheating objects is provided. Through the above method, by constructing a target heterogeneous graph between a set of objects to be detected and a set of entity objects, the target heterogeneous graph can be represented by a vector to accurately obtain a first vector corresponding to each object to be detected and a second vector corresponding to each entity object. Then, by calculating the similarity between the first vector and the second vector, the objects to be detected and the entity objects with cheating behavior can be quickly and accurately determined. There is no need to analyze the underlying code to determine whether malicious code is implanted in the terminal device used by the basic object and thus controlled by the machine, and there is no need to compile the underlying code into a code that is easy for platform developers to understand, thereby reducing the cost of manual detection and improving detection efficiency.

[0152] Optionally, in the above Figure 2 Based on the corresponding embodiment, in another optional embodiment of the method for determining the traffic fraud object provided in the embodiment of the present application, as Figure 3 As shown, step S101 obtains a target heterogeneous graph between the set of objects to be detected and the set of entity objects, including:

[0153] In step S301, traffic propagation data is obtained, wherein the traffic propagation data has a corresponding relationship with the object set to be detected and the entity object set respectively, and the traffic propagation data is used to generate a first node set and a second node set, the first node set has a corresponding relationship with the object set to be detected, and the second node set has a corresponding relationship with the traffic entity set;

[0154] In step S302, a target heterogeneous graph is generated according to the traffic propagation data.

[0155] In this embodiment, in order to better and more accurately detect traffic cheating objects with traffic cheating behavior, this embodiment obtains traffic propagation data and generates a target heterogeneous graph based on the traffic propagation data, so that the traffic propagation data can be converted into a first node set and a second node set for presentation through the target heterogeneous graph, and the association relationship between each data in the traffic propagation data can be intuitively expressed through a node edge set, which can better reflect graph data objects of multiple data types and better reflect the diversified interaction relationships or association relationships between data, so that the structural relationship and association relationship between each data in the traffic propagation data can be better captured through the target heterogeneous graph to reflect the behavioral state of the object to be detected and the entity object, thereby improving the accuracy and efficiency of detecting traffic cheating objects with traffic cheating behavior to a certain extent.

[0156] Among them, traffic propagation data can be specifically expressed as advertising behavior data corresponding to the object to be detected in a historical time period (such as the past week or month, etc.). Traffic propagation data includes but is not limited to the time of each click on the advertisement, basic object ID, scenario (browsing public accounts, using mini programs for searching, or using mini games, etc.), basic object IP, and ID of the traffic object to be processed (such as public accounts or mini programs, etc.).

[0157] Specifically, Fig. 20 As shown, when the advertiser places a target entity (such as an advertisement) on the entity object (traffic host), the object to be detected can be exposed or click on the advertisement, then the client installed on the terminal device will report the advertising behavior data of that time, that is, the traffic propagation data of that time to the access server, so that the access server first stores the exposure and click log of the object to be detected in the database (such as the advertisement exposure and click database), where, Fig.18 As shown, the traffic owner can specifically be a public account, a mini-game, a mini-program or a subscription account, etc., or other expressions, such as a video account, etc., and no specific restrictions are made here.

[0158] Furthermore, after the receiving server obtains the traffic propagation data, the receiving server requests the real-time computing server to determine whether the user's advertisement click at that time is a cheating advertisement click. The computing server extracts the user's advertisement click record within a period of time, i.e., the traffic propagation data, from the advertisement exposure click database. The first node set, the second node set, and the heterogeneous relationship between the first node and the second node can be extracted from the traffic propagation data. Then, according to the heterogeneous relationship, the first node and the second node that have an association relationship or an interaction relationship can be connected using node edges to obtain the target heterogeneous graph.

[0159] Optionally, in the above Figure 3Based on the corresponding embodiment, in another optional embodiment of the method for determining the traffic fraud object provided in the embodiment of the present application, as Figure 4 As shown, step S302 generates a target heterogeneous graph according to the traffic propagation data, including:

[0160] In step S401, a first node set, a second node set, and a heterogeneous relationship between the first node and the second node are extracted from traffic propagation data;

[0161] In step S402, according to the heterogeneous relationship, the first node and the second node are connected through node edges to obtain a target heterogeneous graph, wherein each node edge corresponds to a relationship or a scene information, and each node edge corresponds to an edge weight.

[0162] In this embodiment, after obtaining the traffic propagation data, the first node set, the second node set and the heterogeneous relationship between the first node and the second node can be extracted from the traffic propagation data, and then the first node and the second node can be connected through the node edge according to the heterogeneous relationship to obtain the target heterogeneous graph, so that a variety of interactive relationships or association relationships, that is, heterogeneous relationships, can be mined from the traffic propagation data, so that the first node and the second node with the heterogeneous relationship can be better and more accurately connected through the heterogeneous relationship in the future, and the target heterogeneous image can be better and faster portrayed, thereby improving the accuracy and efficiency of detecting traffic cheating objects with traffic cheating behavior to a certain extent.

[0163] Among them, each node edge is used to connect a first node and a second node with a heterogeneous relationship. Each node edge can correspond to a relationship or a scene information. Each node edge corresponds to an edge weight. An edge weight is positively correlated with the vector similarity between the first node and the second node connected by the node edge.

[0164] Specifically, Fig.13As shown, after obtaining the propagation traffic data, the first node set, the second node set, and the heterogeneous relationship between the first node and the second node are extracted from the traffic propagation data. Specifically, the advertising behavior data corresponding to the object to be detected in the historical time period (such as the past week or month, etc.), the traffic propagation data including but not limited to the time of each click on the advertisement, the ID of the object to be detected, the scene (browsing the official account, using the mini program to search or using the mini game, etc.), the IP of the object to be detected, and the ID of the traffic object to be processed (such as the official account or mini program, etc.) can be used as the input of the image generation model (such as the Node2vec algorithm or the word2vec algorithm, etc.). The heterogeneous relationship in the traffic propagation data is extracted through the image generation model, and the object ID and the entity object ID of the identified object to be detected are used as the first node and the second node respectively to obtain the first node set and the second node set, wherein the heterogeneous relationship can be specifically expressed as one or more of the forwarding relationship between the first node and the second node, the jump relationship between the first node and the second node, the jump relationship between each second node, and the scene information between the first node and the second node, etc., and can also be other heterogeneous relationships, which are not specifically limited here. Then, according to the heterogeneous relationship, the first node and the second node with the heterogeneous relationship can be connected through the node edge to obtain the target heterogeneous graph.

[0165] Optionally, in the above Figure 4 On the basis of the corresponding embodiment, in another optional embodiment of the method for determining the traffic fraud object provided in the embodiment of the present application, the heterogeneous relationship includes a forwarding relationship between the first node and the second node, a jump relationship between the first node and the second node, a jump relationship between each second node, and scene information between the first node and the second node;

[0166] Step S402 connects the first node and the second node through a node edge according to the heterogeneous relationship to obtain a target heterogeneous graph, including:

[0167] According to the forwarding relationship between the first node and the second node, the jump relationship between the first node and the second node, the jump relationship between each second node and the scene information between the first node and the second node, the first node and the second node are connected through node edges to obtain a target heterogeneous graph.

[0168] In this embodiment, after the traffic propagation data is obtained, the first node set, the second node set and the heterogeneous relationship between the first node and the second node can be extracted from the traffic propagation data. The first node and the second node can be connected using node edges based on one or more heterogeneous relationships including a forwarding relationship between the first node and the second node, a jump relationship between the first node and the second node, a jump relationship between each second node and scene information between the first node and the second node to obtain a target heterogeneous graph. Diverse interactive relationships or association relationships, i.e., heterogeneous relationships, can be mined from the traffic propagation data, so that the first node and the second node with a heterogeneous relationship can be better and more accurately connected in the future through the heterogeneous relationship, and the target heterogeneous image can be better and faster portrayed, thereby improving the accuracy and efficiency of detecting traffic cheating objects that have traffic cheating behavior to a certain extent.

[0169] Specifically, Fig.13 As shown, when the heterogeneous relationship between the first node and the second node is expressed as a heterogeneous relationship between the object to be detected and the entity object (such as the traffic master), assuming that the traffic master is an entity such as a public account, a third-party APP, and a mini program, the forwarding relationship between the first node and the second node can be specifically expressed as a forwarding relationship between the object to be detected and the public account. For example, Fig.13 As shown, the object to be detected is a forwarding object, and entity objects such as mini programs or public accounts can be forwarded to other groups to generate forwarding relationships such as advertising exposure and clicks; similarly, the jump relationship between the first node and the second node can be expressed as a jump relationship between the object to be detected and a third-party APP, for example, Fig.13 As shown, the object to be detected jumps to the mini program or official account through an external link in an external app or a third-party H5 page on the terminal device to generate jump relationships such as advertising exposure and clicks; the jump relationship between each second node can be expressed as a jump relationship between official accounts and official accounts, and between official accounts and mini programs, for example, Fig.13 As shown, jumping from public account A to public account B or mini program B, and from mini program A to mini program B, generates jump relationships such as advertising exposure and clicks; and the scene information between the first node and the second node can be expressed as the scene information of the user opening the public account and the mini program, where, Fig.13 As shown, the scene information can be specifically expressed as a way to open a public account or mini program, including scanning a code to open a mini program, searching by name to open a mini program, pulling down to open a mini program, or sharing a group QR code to open a mini program, etc. It can also be expressed as other scenes, which are not specifically limited here.

[0170] Furthermore, after obtaining heterogeneous relationships such as the forwarding relationship between the first node and the second node, the jump relationship between the first node and the second node, the jump relationship between each second node, and the scene information between the first node and the second node, the following can be generated based on the above types of relationship information: Fig.13 The target heterogeneous graph between the object to be detected and the entity object (such as the traffic master) shown, for example: the target heterogeneous graph between the object to be detected and the official account includes (object ID to be detected, official account ID), the target heterogeneous graph between the object to be detected and the mini program includes (object ID to be detected, mini program ID) and the target heterogeneous graph between the object to be detected and the external APP includes (object ID to be detected, external APP ID), etc.

[0171] Optionally, in the above Figure 2 Based on the corresponding embodiment, in another optional embodiment of the method for determining the traffic fraud object provided in the embodiment of the present application, as Figure 5 As shown, step S102 generates a first vector corresponding to each first node and a second vector corresponding to each second node according to the target heterogeneous graph, including:

[0172] In step S501, node sequence sampling is performed on the target heterogeneous graph to obtain a target heterogeneous node sequence corresponding to the target heterogeneous graph, wherein the target heterogeneous node sequence includes nodes and neighbor nodes of the nodes;

[0173] In step S502, the target heterogeneous node sequence is converted into a first vector and a second vector.

[0174] In this embodiment, if Fig.14 As shown, after obtaining the target heterogeneous graph, in order to better vectorize each node of the target heterogeneous graph, the node sequence sampling of the target heterogeneous graph can be performed to obtain the target heterogeneous node sequence corresponding to the target heterogeneous graph, and the target heterogeneous node sequence can be converted into a first vector and a second vector. The relationship between the first node and the second node can be better learned through the target heterogeneous node sequence, so as to obtain a more accurate first vector and a second vector, which can improve the accuracy and efficiency of detecting traffic cheating objects to a certain extent, wherein the target heterogeneous node sequence includes nodes and neighbor nodes of the nodes.

[0175] Specifically, after obtaining the target heterogeneous graph, node sequence sampling is performed on the target heterogeneous graph to obtain the target heterogeneous node sequence corresponding to the target heterogeneous graph. Specifically, the Node2vec algorithm, Metapath2vec algorithm or Metapath algorithm may be used. Other sampling algorithms may also be used, and no specific restrictions are made here. Related sequence sampling is performed on each node in the target heterogeneous graph to obtain the target heterogeneous node sequence corresponding to each node, and then, the target heterogeneous node sequence is converted into a first vector and a second vector. Specifically, the Skip-gram model in the word2vec algorithm may be used to perform deep embedding feature learning on the target heterogeneous node sequence to obtain the first vector and the second vector.

[0176] Among them, the Node2vec algorithm is a sampling algorithm that comprehensively considers depth-first sampling (DFS) and breadth-first sampling (BFS). It aims to simultaneously model the depth-first search (DFS) and breadth-first search (BFS) of the neighborhood. By adjusting the hyperparameters p and q, the inclination of the roaming strategy for BFS sampling and DFS sampling can be changed. The graph topology structure around the central node is not made, and finally the sampling can be completed to obtain a heterogeneous node sequence.

[0177] For example, Fig.14 The target heterogeneous graph shown in the figure uses the meta-path algorithm to sample the node sequence, and the following can be obtained: Fig.14 A target heterogeneous node sequence of "u1-b1-u2-w2-u3-b2-...-u4" as shown, or another target heterogeneous node sequence of "u5-w5-u6-a6-u7-w7-...-u8", where u i Can be used for the object to be detected, b i Can be used to represent public accounts, w i Can be used to represent applets as well as a i Can be used to represent external apps.

[0178] Optionally, in the above Figure 5 Based on the corresponding embodiment, in another optional embodiment of the method for determining the traffic fraud object provided in the embodiment of the present application, as Figure 6 As shown, step S501 performs node sequence sampling on the target heterogeneous graph to obtain a target heterogeneous node sequence corresponding to the target heterogeneous graph, including:

[0179] In step S601, a meta-path is generated according to a target heterogeneous graph and a sampling length, wherein the meta-path includes a node type, a sampling order of the node type, and a sampling length;

[0180] In step S602, the target heterogeneous graph is sampled according to the meta-path to obtain a target heterogeneous node sequence.

[0181] In this embodiment, after the target heterogeneous graph is obtained, a meta-path can be generated according to the target heterogeneous graph and the sampling length, and the target heterogeneous graph can be sampled according to the meta-path to obtain a target heterogeneous node sequence, so that the relationship between the first node and the second node can be better learned through the target heterogeneous node sequence, thereby obtaining a more accurate first vector and a second vector, thereby improving the accuracy and efficiency of detecting traffic fraud objects to a certain extent, wherein the target heterogeneous node sequence includes nodes and neighbor nodes of the nodes.

[0182] The meta-path includes the node type, the sampling order of the node type, and the sampling length.

[0183] Specifically, after obtaining the target heterogeneous graph, node sequence sampling is performed on the target heterogeneous graph. Specifically, the metapath in the Metapath2vec algorithm can be used to generate a metapath according to the target heterogeneous graph and a preset sampling length, and then a starting node belonging to the node type in the metapath can be selected in the target heterogeneous graph. Then, according to the sampling order of the node type, the target heterogeneous graph can be walked from the starting node sequence to the neighboring nodes until the number of nodes corresponding to the sampling length is walked, and a target heterogeneous node sequence can be obtained.

[0184] For example, assuming that Fig.14 The target heterogeneous graph shown and the preset sampling length of 7 can generate a meta-path, the meta-path "ubuwubu". Then, the meta-path and the sampling length can be used to perform node sampling in the target heterogeneous graph to obtain a target heterogeneous node sequence such as "u1-b1-u2-w2-u3-b2-u4".

[0185] Optionally, in the above Figure 6 Based on the corresponding embodiment, in another optional embodiment of the method for determining the traffic fraud object provided in the embodiment of the present application, as Figure 7 As shown, step S602 samples the target heterogeneous graph according to the meta-path to obtain a target heterogeneous node sequence, including:

[0186] In step S701, the edge weights corresponding to the node edges connecting each node with the neighboring nodes are obtained from the target heterogeneous graph;

[0187] In step S702, the sampling probability corresponding to the neighboring nodes of each node is calculated according to the edge weight;

[0188] In step S703, according to the size of the sampling probability, the node type, the sampling order of the node type and the sampling length, each node of the target heterogeneous graph is walked between its neighboring nodes to generate a target heterogeneous node sequence.

[0189] In this embodiment, in order to better express the association relationship between various data in the traffic propagation data, this embodiment uses the edge weight w corresponding to the node edge ij To represent the weight value corresponding to the node edge between each first node and the second node in the target heterogeneous graph, and then, after obtaining the meta-path, in order to better perform walking sampling on the nodes, this embodiment can obtain the probability of walking from the starting node to the next node, that is, the sampling probability, by connecting the edge weights corresponding to the node edges between each node and the neighboring nodes. Then, according to the size of the first sampling probability and the node type of the next sampling node and the sampling order of the node type, walking from each starting node to the neighboring node that meets the sampling order of the node type and the node type and has the largest first sampling probability can be generated for each node. Different walking sequences, that is, target heterogeneous node sequences, can be generated for each node, so that the relationship between the first node and the second node can be better learned through the target heterogeneous node sequence in the future, thereby obtaining more accurate first vectors and second vectors, thereby improving the accuracy and efficiency of detecting traffic fraud objects to a certain extent.

[0190] Specifically, Fig.14 As shown, the edge weight w corresponding to the node edge connecting each node with the neighboring node is obtained from the target heterogeneous graph ij Specifically, the weights of the node edges may be assigned by extracting heterogeneous relationships, and other methods may be used to obtain the edge weights, which are not specifically limited here.

[0191] Further, after obtaining the meta-path, node sequence sampling is performed according to the meta-path, specifically, walking from each node to the next neighboring node with a connection relationship according to the node type and the sampling order of the node type, which can be understood as sampling the node corresponding to each time t to the node corresponding to the next time (t+1). In this embodiment, the weight value w corresponding to the node connection edge between each node and the neighboring node can be obtained by connecting ij To calculate the sampling probability p of each ij , which can be obtained by normalizing with the Softmax function as shown in the following formula (2):

[0192]

[0193] Here, e is a constant, often used as the natural logarithm of a base.

[0194] Among them, the sampling probability p ij It can be expressed by the following formula (3):

[0195]

[0196] Among them, v i represents the node at time t, v i+1 Indicates that it is the same as v in the meta path i Adjacent nodes, that is, the node corresponding to time t to the node corresponding to the next time (t+1), E is the number of edges connecting the nodes, φ(v i+1 )=t+1 means that the node is the adjacent node of the node at the current time t in the graph at the next time.

[0197] Furthermore, it can be understood that the greater the edge weight corresponding to the edge node connecting the node and the neighboring node, the greater the sampling probability corresponding to the node edge. Then, when walking from each node to the neighboring node that has a connection relationship with each node, the node type, the sampling order of the node type, and the sampling length in the meta-path will be followed, and walking in the target heterogeneous graph will be performed from large to small sampling probability. Then, a path sequence composed of the heterogeneous nodes walked to can be generated, that is, a target heterogeneous node sequence.

[0198] Optionally, in the above Figure 7 Based on the corresponding embodiment, in another optional embodiment of the method for determining the traffic fraud object provided in the embodiment of the present application, as Figure 8 As shown, before step S702 calculates the sampling probability corresponding to the neighboring nodes of each node according to the edge weight, the method further includes: step S702 includes step S802;

[0199] In step S801, the edge weights are normalized to obtain normalized weights;

[0200] In step S802, the sampling probability corresponding to the neighboring nodes of each node is calculated according to the normalized weight.

[0201] In this embodiment, after obtaining the edge weights corresponding to the node edges between each node and its neighboring nodes, the edge weights can be normalized to obtain normalized weights, and then the sampling probabilities corresponding to the neighboring nodes of each node can be calculated based on the normalized weights. By normalizing the edge weights, weight values ​​that can better reflect the association relationship between each node and its neighboring nodes can be obtained.

[0202] Specifically, after obtaining the target heterogeneous graph, the edge weight corresponding to the node edge connecting each node and the neighboring node can be obtained according to the node edge set. If there is a one-to-one relationship between the node and the neighboring node, the weight value w corresponding to the node edge can be obtained. ij =1. On the contrary, if the relationship between a node and its neighbor nodes is not one-to-one, in order to avoid the situation where the weight value appears extremely large or extremely small due to the Matthew effect, this embodiment can use the following formula (2) to calculate the weight value w corresponding to the node edge: ij Normalize to obtain weight values ​​that better reflect the relationship between each node and its neighboring nodes:

[0203]

[0204] Among them, N u It can represent the number of neighbor nodes connected to each node, N r It can represent the number of times each neighbor node is connected by a node, where u represents the number of nodes, r represents the number of neighbor nodes that each node has a connection relationship with, and if there is no node connection between the node and its neighbor nodes, then w ij is 0.

[0205] Furthermore, after obtaining the normalized weight value, the normalized weight w ij Substitute into the above formula (2) to calculate the sampling probability p of each ij .

[0206] Optionally, in the above Figure 5 Based on the corresponding embodiment, in another optional embodiment of the method for determining the traffic fraud object provided in the embodiment of the present application, as Fig. 9 As shown, step S502 converts the target heterogeneous node sequence into a first vector and a second vector, including:

[0207] In step S901, the target heterogeneous node sequence is divided into a plurality of node subsequences;

[0208] In step S902, vector mapping processing is performed on each node in each node subsequence to obtain a prediction embedding vector corresponding to each node;

[0209] In step S903, a first vector and a second vector are obtained according to the predicted embedding vector.

[0210] In this embodiment, after obtaining the target heterogeneous node sequence, the target heterogeneous node sequence can be divided into multiple node subsequences, and vector mapping processing is performed on each node in each node subsequence to obtain the predicted embedding vector corresponding to each node, and then, the first vector and the second vector are obtained according to the predicted embedding vector. By performing vector mapping on each node in the node subsequence, the predicted embedding vector can be obtained more quickly, so that the first vector and the second vector can be better obtained.

[0211] Specifically, the target heterogeneous node sequence is divided into multiple node subsequences. Specifically, several target heterogeneous node sequences starting from the first node are taken as the input of the Skip-gram model. Multiple windows are intercepted from each target heterogeneous node sequence according to the length of the preset sliding window through the Skip-gram model to obtain the node subsequences. Specifically, the sliding window is used to capture the node sequence in sequence from the first node of each heterogeneous node sequence according to the length of the preset sliding window, so as to obtain multiple node subsequences.

[0212] For example, Fig.14 As shown, assuming that there is a target heterogeneous node sequence of "u1-b1-u2-w2-u3-b2-u4", if the preset sliding window length is 5, then starting from the first node of the target heterogeneous node sequence, the sliding window captures the node sequence to obtain a node subsequence of "u1-b1-u2-w2-u3", and then, the sliding window captures the node sequence from the second node to obtain a node subsequence of "b1-u2-w2-u3-b2". Similarly, by capturing the node sequence in sequence through the sliding window, multiple node subsequences can be obtained.

[0213] Furthermore, vector mapping is performed on each node in each node subsequence to obtain a predicted embedding vector corresponding to each node. Specifically, the central node of each node subsequence is vector mapped to obtain a first embedding vector corresponding to the central node, and the neighboring nodes of the central node can be vector mapped according to the first embedding vector to obtain a second embedding vector corresponding to the neighboring nodes, that is, the predicted embedding vector is obtained. Then, the first vector corresponding to the first node and the second vector corresponding to the second node can be traversed from the predicted embedding vector.

[0214] Optionally, in the above Fig. 9 Based on the corresponding embodiment, in another optional embodiment of the method for determining the traffic fraud object provided in the embodiment of the present application, as Fig.10As shown, the predicted embedding vector includes a first embedding vector and a second embedding vector; step S902 performs vector mapping processing on each node in each node subsequence to obtain a predicted embedding vector corresponding to each node, including: step S1001 and step S1002, and step S903 includes step S1003;

[0215] In step S1001, the central node of each node subsequence is subjected to vector mapping processing to obtain a first embedding vector;

[0216] In step S1002, vector mapping processing is performed on the neighbor nodes of the central node according to the first embedding vector to obtain a second embedding vector corresponding to the neighbor nodes;

[0217] In step S1003, a first vector and a second vector are obtained according to the first embedded vector and the second embedded vector.

[0218] In this embodiment, after obtaining the node subsequence, the central node of each node subsequence can be vector mapped to obtain a first embedding vector, and the neighbor nodes of the central node can be vector mapped according to the first embedding vector to obtain second embedding vectors corresponding to the neighbor nodes. Then, the first vector and the second vector are obtained according to the first embedding vector and the second embedding vector. By obtaining the first embedding vector, the second embedding vectors corresponding to other neighbor nodes can be more accurately predicted, so that the first vector and the second vector can be better obtained through the first embedding vector and the second embedding vector.

[0219] Specifically, vector mapping is performed on each node in each node subsequence. Specifically, a central node u2 is selected from a node subsequence such as "u1-b1-u2-w2-u3", and then, Fig.14 As shown, the central node u2 is mapped into the corresponding first embedding vector. Specifically, the node u2 can be embedded into a low-dimensional dense vector space to obtain the first embedding vector u2. Similarly, the first embedding vector u2 can be used to further predict the second embedding vectors of other nodes in the node subsequence, and the second embedding vector b1, the second embedding vector u1, the second embedding vector w2 and the second embedding vector u3 can be obtained. Then, the first vector corresponding to the first node and the second vector corresponding to the second node can be traversed from the first embedding vector and the second embedding vector.

[0220] Optionally, in the above Figure 2 Based on the corresponding embodiment, in another optional embodiment of the method for determining the traffic fraud object provided in the embodiment of the present application, as Fig.11 As shown, according to the vector similarity, the target node pairs with cheating behavior are determined, including:

[0221] In step S1101, the vector similarity is compared with a similarity threshold to obtain a comparison result;

[0222] In step S1102, if the comparison result is that the vector similarity is less than or equal to the similarity threshold, the node pair is determined to be a normal node pair;

[0223] In step S1103, if the comparison result is that the vector similarity is greater than the similarity threshold, the node pair is determined as the target node pair.

[0224] In this embodiment, since the similarity between the first vector and the second vector between each node pair, that is, the vector similarity of a node pair, can be used to reflect the degree of willingness of the object to be detected to click on the entity object (such as the traffic master), that is, the higher the vector similarity, the higher the correlation between the first node and the second node, which can be understood as the object to be detected is more inclined to click on the target entity (such as an advertisement) on the entity object (such as the traffic master). Therefore, after obtaining the vector similarity between the first vector and the second vector, the vector similarity can be compared with the similarity threshold to obtain a comparison result. If the comparison result is that the vector similarity is less than or equal to the similarity threshold, the node pair can be determined as a normal node pair. Conversely, if the comparison result is that the vector similarity is greater than the similarity threshold, the node pair can be determined as a target node pair. There is no need to analyze the underlying code to determine whether the terminal device used by the basic object is implanted with malicious code and thus controlled by the machine, and there is no need to compile the underlying code into a code that is easy for platform developers to understand, thereby reducing the cost of manual detection and improving detection efficiency.

[0225] Specifically, after obtaining the vector similarity of each node pair, the target node pairs with cheating behavior can be screened out from several node pairs according to the vector similarity. Specifically, the vector similarity can be compared with a similarity threshold to obtain a comparison result, wherein the similarity threshold is set according to actual application requirements and is not specifically limited here. If the comparison result is that the vector similarity is less than or equal to the similarity threshold, it means that the object to be detected randomly clicks on the target entity, and there is no cheating behavior between the object to be detected and the entity object, then the node pair can be determined as a normal node pair. On the contrary, if the comparison result is that the vector similarity is greater than the similarity threshold, it means that the object to be detected may be induced by some external factors to passively or actively click on the target entity (such as an advertisement), and there is cheating behavior between the object to be detected and the entity object, then the node pair can be determined as a target node pair.

[0226] Optionally, in the above Figure 2 Based on the corresponding embodiment, in another optional embodiment of the method for determining the traffic fraud object provided in the embodiment of the present application, as Fig.12As shown, according to the vector similarity, the target node pairs with cheating behavior are determined, including:

[0227] In step S1201, according to the relationship between the similarity and the score, the similarity score corresponding to the vector similarity is obtained;

[0228] In step S1202, the node pairs corresponding to the similarity scores greater than the score threshold are taken as target node pairs.

[0229] In this embodiment, since the similarity between the first vector and the second vector between each node pair, that is, the vector similarity of a node pair, can be used to reflect the degree of willingness of the object to be detected to click on the entity object (such as the traffic master), that is, the higher the vector similarity, the higher the correlation between the first node and the second node, which can be understood as the object to be detected is more inclined to click on the target entity (such as an advertisement) on the entity object (such as the traffic master). Therefore, after obtaining the vector similarity between the first vector and the second vector, the similarity score corresponding to the vector similarity can be obtained according to the relationship between the similarity and the score, and the node pair corresponding to the similarity score greater than the score threshold can be used as the target node pair. There is no need to analyze the underlying code to determine whether the terminal device used by the basic object is implanted with malicious code and thus controlled by the machine, and there is no need to compile the underlying code into a code that is easy for platform developers to understand, thereby reducing the cost of manual detection and improving detection efficiency.

[0230] Specifically, after obtaining the vector similarity of each node pair, the target node pairs with cheating behavior can be screened out from several node pairs according to the vector similarity. Specifically, the similarity score corresponding to each vector similarity can be obtained according to the relationship between the similarity and the score. Then, the node pairs corresponding to the similarity scores greater than the score threshold can be used as target node pairs, indicating that the object to be detected may be induced by some external factors to passively or actively click on the target entity (such as an advertisement), and there is cheating between the object to be detected and the entity object. The score threshold is set according to actual application requirements and is not specifically restricted here. On the contrary, the node pairs corresponding to the similarity scores less than the score threshold can be used as normal node pairs, indicating that the object to be detected randomly clicks on the target entity, and there is no cheating between the object to be detected and the entity object.

[0231] The following is a detailed description of the detection device for traffic fraud objects in this application. Fig.21 , Fig.21 This is a schematic diagram of an embodiment of a detection device for a traffic fraud object in an embodiment of the present application. The detection device 20 for a traffic fraud object includes:

[0232] An acquisition unit 201 is used to acquire a target heterogeneous graph between the set of objects to be detected and the set of entity objects, wherein the target heterogeneous graph includes a first node set and a second node set, each first node in the first node set has a corresponding relationship with each object to be detected in the set of objects to be detected, and each second node in the second node set has a corresponding relationship with each entity object in the set of entity objects;

[0233] The processing unit 202 is further configured to generate a first vector corresponding to each first node and a second vector corresponding to each second node according to the target heterogeneous graph;

[0234] The processing unit 202 is further configured to calculate the vector similarity between each node pair according to the first vector and the second vector;

[0235] The determination unit 203 is used to determine the target node pair with cheating behavior according to the vector similarity, and use the to-be-detected object and the entity object corresponding to the target node as the traffic cheating object.

[0236] Optionally, in the above Fig.21 On the basis of the corresponding embodiment, in another embodiment of the device for determining a traffic fraud object provided by the embodiment of the present application, the acquisition unit 201 can be specifically used for:

[0237] Acquire traffic propagation data, wherein the traffic propagation data respectively have corresponding relationships with the object set to be detected and the entity object set, and the traffic propagation data is used to generate a first node set and a second node set, the first node set has a corresponding relationship with the object set to be detected, and the second node set has a corresponding relationship with the traffic entity set;

[0238] Generate a target heterogeneous graph based on the traffic propagation data.

[0239] Optionally, in the above Fig.21 On the basis of the corresponding embodiment, in another embodiment of the device for determining a traffic fraud object provided by the embodiment of the present application, the acquisition unit 201 can be specifically used for:

[0240] Extracting a first node set, a second node set, and a heterogeneous relationship between the first node and the second node from the traffic propagation data;

[0241] According to the heterogeneous relationship, the first node and the second node are connected through node edges to obtain a target heterogeneous graph, wherein each node edge corresponds to a relationship or a scene information, and each node edge corresponds to an edge weight.

[0242] Optionally, in the above Fig.21 On the basis of the corresponding embodiment, in another embodiment of the device for determining a traffic fraud object provided by the embodiment of the present application, the acquisition unit 201 can be specifically used for:

[0243] According to the forwarding relationship between the first node and the second node, the jump relationship between the first node and the second node, the jump relationship between each second node and the scene information between the first node and the second node, the first node and the second node are connected through node edges to obtain a target heterogeneous graph.

[0244] Optionally, in the above Fig.21 On the basis of the corresponding embodiment, in another embodiment of the device for determining a traffic fraud object provided by the embodiment of the present application, the processing unit 202 can be specifically used for:

[0245] Perform node sequence sampling on the target heterogeneous graph to obtain a target heterogeneous node sequence corresponding to the target heterogeneous graph, wherein the target heterogeneous node sequence includes nodes and neighboring nodes of the nodes;

[0246] The target heterogeneous node sequence is converted into a first vector and a second vector.

[0247] Optionally, in the above Fig.21 On the basis of the corresponding embodiment, in another embodiment of the device for determining a traffic fraud object provided by the embodiment of the present application, the processing unit 202 can be specifically used for:

[0248] Generate a meta-path according to the target heterogeneous graph and the sampling length, wherein the meta-path includes a node type, a sampling order of the node type, and a sampling length;

[0249] The target heterogeneous graph is sampled according to the meta-path to obtain the target heterogeneous node sequence.

[0250] Optionally, in the above Fig.21 On the basis of the corresponding embodiment, in another embodiment of the device for determining a traffic fraud object provided by the embodiment of the present application, the processing unit 202 can be specifically used for:

[0251] Obtain the edge weights corresponding to the node edges connecting each node with its neighboring nodes from the target heterogeneous graph;

[0252] Calculate the sampling probability corresponding to each node's neighboring nodes according to the edge weight;

[0253] According to the size of sampling probability, node type, sampling order of node type and sampling length, it walks between each node and neighboring nodes of the target heterogeneous graph to generate a target heterogeneous node sequence.

[0254] Optionally, in the above Fig.21 Based on the corresponding embodiment, in another embodiment of the device for determining a traffic fraud object provided by the embodiment of the present application,

[0255] The processing unit 202 is further used to normalize the edge weights to obtain normalized weights;

[0256] The processing unit 202 may be specifically configured to calculate the sampling probability corresponding to the neighboring nodes of each node according to the normalized weight.

[0257] Optionally, in the above Fig.21 On the basis of the corresponding embodiment, in another embodiment of the device for determining a traffic fraud object provided by the embodiment of the present application, the processing unit 202 can be specifically used for:

[0258] Divide the target heterogeneous node sequence into multiple node subsequences;

[0259] Perform vector mapping on each node in each node subsequence to obtain the corresponding predicted embedding vector of each node;

[0260] Obtain a first vector and a second vector according to the predicted embedding vector.

[0261] Optionally, in the above Fig.21 On the basis of the corresponding embodiment, in another embodiment of the device for determining a traffic fraud object provided by the embodiment of the present application, the processing unit 202 can be specifically used for:

[0262] Perform vector mapping on the central node of each node subsequence to obtain a first embedding vector;

[0263] Performing vector mapping processing on the neighboring nodes of the central node according to the first embedding vector to obtain a second embedding vector corresponding to the neighboring nodes;

[0264] Obtaining a first vector and a second vector according to the predicted embedding vector includes:

[0265] A first vector and a second vector are obtained according to the first embedding vector and the second embedding vector.

[0266] Optionally, in the above Fig.21 On the basis of the corresponding embodiment, in another embodiment of the device for determining a traffic fraud object provided by the embodiment of the present application, the determining unit 203 can be specifically used to:

[0267] Compare the vector similarity with the similarity threshold to obtain a comparison result;

[0268] If the comparison result is that the vector similarity is less than or equal to the similarity threshold, the node pair is determined to be a normal node pair;

[0269] If the comparison result is that the vector similarity is greater than the similarity threshold, the node pair is determined as the target node pair.

[0270] Optionally, in the above Fig.21On the basis of the corresponding embodiment, in another embodiment of the device for determining a traffic fraud object provided by the embodiment of the present application, the determining unit 203 can be specifically used to:

[0271] According to the relationship between similarity and score, obtain the similarity score corresponding to the vector similarity;

[0272] The node pairs corresponding to the similarity scores greater than the score threshold are taken as the target node pairs.

[0273] On the other hand, the present application provides another schematic diagram of a computer device, such as Fig. 22 As shown, Fig. 22 3 is a schematic diagram of a computer device structure provided in an embodiment of the present application. The computer device 300 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPU) 310 (for example, one or more processors) and a memory 320, and one or more storage media 330 (for example, one or more mass storage devices) storing application programs 331 or data 332. Among them, the memory 320 and the storage medium 330 may be temporary storage or permanent storage. The program stored in the storage medium 330 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the computer device 300. Furthermore, the central processing unit 310 may be configured to communicate with the storage medium 330 to execute a series of instruction operations in the storage medium 330 on the computer device 300.

[0274] The computer device 300 may also include one or more power supplies 340, one or more wired or wireless network interfaces 350, one or more input and output interfaces 360, and / or one or more operating systems 333, such as Windows Server 2000, Windows Server 2003, Windows Server 2003E, Windows Server 2003R ... TM , Mac OS X TM , Unix TM ,Linux TM , FreeBSD TM etc.

[0275] The computer device 300 is also used to perform the following steps: Figures 2 to 12 The steps in the corresponding embodiments.

[0276] Another aspect of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the following Figures 2 to 12 The illustrated embodiments describe steps in a method.

[0277] Another aspect of the present application provides a computer program product comprising a computer program, which, when executed by a processor, implements the following Figures 2 to 12 The illustrated embodiments describe steps in a method.

[0278] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0279] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0280] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0281] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0282] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store computer programs.

Claims

1. A method for detecting traffic fraud objects, characterized in that: include: Acquire traffic propagation data, wherein the traffic propagation data respectively have corresponding relationships with the object set to be detected and the entity object set, and the traffic propagation data is used to generate a first node set and a second node set, the first node set has a corresponding relationship with the object set to be detected, and the second node set has a corresponding relationship with the traffic entity set; Generate a target heterogeneous graph according to the traffic propagation data; wherein the target heterogeneous graph includes the first node set and the second node set, each first node in the first node set has a corresponding relationship with each object to be detected in the set of objects to be detected, each second node in the second node set has a corresponding relationship with each entity object in the set of entity objects, the set of objects to be detected is an object that clicks the entity object on the client, and the set of entity objects includes a traffic master, an IP or a target device; Generate, according to the target heterogeneous graph, a first vector corresponding to each of the first nodes and a second vector corresponding to each of the second nodes; Calculating the vector similarity between each node pair according to the first vector and the second vector; the vector similarity is used to reflect the willingness of the object to be detected to click on the target entity on the physical object, and the target entity includes an advertisement; According to the vector similarity, a target node pair with cheating behavior is determined, and the object to be detected and the entity object corresponding to the target node pair are used as the traffic cheating object; the target node pair is a node pair whose vector similarity is greater than a similarity threshold or whose similarity score corresponding to the vector similarity is greater than a score threshold.

2. The method according to claim 1, characterized in that: The step of generating the target heterogeneous graph according to the traffic propagation data includes: Extracting a first node set, a second node set, and a heterogeneous relationship between the first node and the second node from the traffic propagation data; According to the heterogeneous relationship, the first node and the second node are connected through node edges to obtain the target heterogeneous graph, wherein each of the node edges corresponds to a relationship or a scene information, and each of the node edges corresponds to an edge weight.

3. The method according to claim 2, characterized in that The heterogeneous relationship includes a forwarding relationship between the first node and the second node, a jump relationship between the first node and the second node, a jump relationship between each of the second nodes, and scene information between the first node and the second node; The step of connecting the first node and the second node through a node edge according to the heterogeneous relationship to obtain the target heterogeneous graph includes: According to the forwarding relationship between the first node and the second node, the jump relationship between the first node and the second node, the jump relationship between each of the second nodes, and the scene information between the first node and the second node, the first node and the second node are connected through the node edge to obtain the target heterogeneous graph.

4. The method according to claim 1, characterized in that: The step of generating, according to the target heterogeneous graph, a first vector corresponding to each of the first nodes and a second vector corresponding to each of the second nodes, comprises: Performing node sequence sampling on the target heterogeneous graph to obtain a target heterogeneous node sequence corresponding to the target heterogeneous graph, wherein the target heterogeneous node sequence includes nodes and neighbor nodes of the nodes; The target heterogeneous node sequence is converted into the first vector and the second vector.

5. The method according to claim 4, characterized in that The performing node sequence sampling on the target heterogeneous graph to obtain a target heterogeneous node sequence corresponding to the target heterogeneous graph includes: Generate a meta-path according to the target heterogeneous graph and the sampling length, wherein the meta-path includes a node type, a sampling order of the node type, and a sampling length; The target heterogeneous graph is sampled according to the meta-path to obtain the target heterogeneous node sequence.

6. The method according to claim 5, characterized in that Sampling the target heterogeneous graph according to the meta-path to obtain the target heterogeneous node sequence includes: Obtaining edge weights corresponding to node edges connecting each node with neighboring nodes from the target heterogeneous graph; Calculate the sampling probability corresponding to the neighboring nodes of each node according to the edge weight; According to the size of the sampling probability, the node type, the sampling order of the node type and the sampling length, each node of the target heterogeneous graph is walked between its neighboring nodes to generate the target heterogeneous node sequence.

7. The method according to claim 6, characterized in that Before calculating the sampling probability corresponding to the neighboring nodes of each node according to the edge weight, the method further includes: Normalizing the edge weight to obtain a normalized weight; The calculating the sampling probability corresponding to the neighboring nodes of each node according to the edge weight includes: The sampling probability corresponding to the neighboring nodes of each node is calculated according to the normalized weight.

8. The method according to claim 4, characterized in that The converting the target heterogeneous node sequence into the first vector and the second vector includes: Dividing the target heterogeneous node sequence into a plurality of node subsequences; Performing vector mapping processing on each node in each of the node subsequences to obtain a prediction embedding vector corresponding to each of the nodes; The first vector and the second vector are obtained according to the predicted embedding vector.

9. The method according to claim 8, characterized in that The predicted embedding vector includes a first embedding vector and a second embedding vector; The performing vector mapping processing on each node in each of the node subsequences to obtain a prediction embedding vector corresponding to each of the nodes includes: Perform the vector mapping process on the central node of each of the node subsequences to obtain the first embedding vector; Perform the vector mapping process on the neighboring nodes of the central node according to the first embedding vector to obtain a second embedding vector corresponding to the neighboring nodes; The obtaining the first vector and the second vector according to the predicted embedding vector includes: The first vector and the second vector are obtained according to the first embedding vector and the second embedding vector.

10. The method according to claim 1, characterized in that When the target node pair is a node pair whose vector similarity is greater than a similarity threshold, determining the target node pair with cheating behavior according to the vector similarity includes: Comparing the vector similarity with a similarity threshold to obtain a comparison result; If the comparison result is that the vector similarity is less than or equal to the similarity threshold, the node pair is determined to be a normal node pair; If the comparison result is that the vector similarity is greater than the similarity threshold, the node pair is determined as the target node pair.

11. The method according to claim 1, characterized in that: When the target node pair is a node pair whose similarity score corresponding to the vector similarity is greater than a score threshold, determining the target node pair with cheating behavior according to the vector similarity includes: According to the relationship between the similarity and the score, obtaining the similarity score corresponding to the vector similarity; The node pair corresponding to the similarity score greater than the score threshold is taken as the target node pair.

12. A device for detecting traffic fraud objects, characterized in that: include: An acquisition unit is used to acquire a target heterogeneous graph between a set of objects to be detected and a set of entity objects; wherein the target heterogeneous graph includes a first node set and a second node set, each first node in the first node set has a corresponding relationship with each object to be detected in the set of objects to be detected, and each second node in the second node set has a corresponding relationship with each entity object in the set of entity objects; the set of objects to be detected is an object that clicks on the entity object on a client, and the set of entity objects includes a traffic master, an IP or a target device; The processing unit is further used to generate a first vector corresponding to each of the first nodes and a second vector corresponding to each of the second nodes according to the target heterogeneous graph; The processing unit is further used to calculate the vector similarity between each node pair according to the first vector and the second vector; the vector similarity is used to reflect the willingness of the object to be detected to click on the target entity on the physical object, and the target entity includes an advertisement; A determination unit is used to determine a target node pair with cheating behavior according to the vector similarity, and use the object to be detected and the entity object corresponding to the target node as the traffic cheating object; the target node pair is a node pair whose vector similarity is greater than a similarity threshold or whose similarity score corresponding to the vector similarity is greater than a score threshold; The acquisition unit can be specifically used for: Acquire traffic propagation data, wherein the traffic propagation data respectively have corresponding relationships with the object set to be detected and the entity object set, and the traffic propagation data is used to generate the first node set and the second node set, the first node set has a corresponding relationship with the object set to be detected, and the second node set has a corresponding relationship with the traffic entity set; The target heterogeneous graph is generated according to the traffic propagation data.

13. The device according to claim 12, characterized in that The acquisition unit can be specifically used for: Extracting a first node set, a second node set, and a heterogeneous relationship between the first node and the second node from the traffic propagation data; According to the heterogeneous relationship, the first node and the second node are connected through node edges to obtain the target heterogeneous graph, wherein each of the node edges corresponds to a relationship or a scene information, and each of the node edges corresponds to an edge weight.

14. The device according to claim 13, characterized in that The heterogeneous relationship includes a forwarding relationship between the first node and the second node, a jump relationship between the first node and the second node, a jump relationship between each of the second nodes, and scene information between the first node and the second node; the acquisition unit can be specifically used to: According to the forwarding relationship between the first node and the second node, the jump relationship between the first node and the second node, the jump relationship between each of the second nodes, and the scene information between the first node and the second node, the first node and the second node are connected through the node edge to obtain the target heterogeneous graph.

15. The device according to claim 12, characterized in that The processing unit can be specifically used for: Performing node sequence sampling on the target heterogeneous graph to obtain a target heterogeneous node sequence corresponding to the target heterogeneous graph, wherein the target heterogeneous node sequence includes nodes and neighbor nodes of the nodes; The target heterogeneous node sequence is converted into the first vector and the second vector.

16. The device according to claim 15, characterized in that The processing unit can be specifically used for: Generate a meta-path according to the target heterogeneous graph and the sampling length, wherein the meta-path includes a node type, a sampling order of the node type, and a sampling length; The target heterogeneous graph is sampled according to the meta-path to obtain the target heterogeneous node sequence.

17. The device according to claim 16, characterized in that The processing unit can be specifically used for: Obtaining edge weights corresponding to node edges connecting each node with neighboring nodes from the target heterogeneous graph; Calculate the sampling probability corresponding to the neighboring nodes of each node according to the edge weight; According to the size of the sampling probability, the node type, the sampling order of the node type and the sampling length, each node of the target heterogeneous graph is walked between its neighboring nodes to generate the target heterogeneous node sequence.

18. The device according to claim 17, characterized in that The processing unit is further used to normalize the edge weight to obtain a normalized weight; The processing unit may be specifically configured to calculate the sampling probability corresponding to the neighboring nodes of each node according to the normalized weight.

19. The device according to claim 15, characterized in that The processing unit can be specifically used for: Dividing the target heterogeneous node sequence into a plurality of node subsequences; Performing vector mapping processing on each node in each of the node subsequences to obtain a prediction embedding vector corresponding to each of the nodes; The first vector and the second vector are obtained according to the predicted embedding vector.

20. The device according to claim 19, characterized in that The predicted embedding vector includes a first embedding vector and a second embedding vector; The processing unit can be specifically used for: Perform the vector mapping process on the central node of each of the node subsequences to obtain the first embedding vector; Perform the vector mapping process on the neighboring nodes of the central node according to the first embedding vector to obtain a second embedding vector corresponding to the neighboring nodes; Obtaining a first vector and a second vector according to the predicted embedding vector includes: The first vector and the second vector are obtained according to the first embedding vector and the second embedding vector.

21. The device according to claim 12, characterized in that When the target node pair is a node pair whose vector similarity is greater than a similarity threshold, the determining unit may be specifically configured to: Comparing the vector similarity with a similarity threshold to obtain a comparison result; If the comparison result is that the vector similarity is less than or equal to the similarity threshold, the node pair is determined to be a normal node pair; If the comparison result is that the vector similarity is greater than the similarity threshold, the node pair is determined as the target node pair.

22. The device according to claim 12, characterized in that When the target node pair is a node pair whose similarity score corresponding to the vector similarity is greater than the score threshold, the determining unit may be specifically configured to: According to the relationship between the similarity and the score, obtaining the similarity score corresponding to the vector similarity; The node pair corresponding to the similarity score greater than the score threshold is taken as the target node pair.

23. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 11 are implemented.

24. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented.

25. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented.

Images