Abnormal user detection method, system, storage medium and electronic device

Abstract

The present invention discloses an abnormal user detection method, system, storage medium and electronic device. The method includes: obtaining a user's historical access uniform resource locator record; converting the uniform resource locator record into a uniform resource locator feature vector; performing time series processing based on the uniform resource locator feature vector to obtain features with a time series correlation relationship; and performing calculations based on the features with a time series correlation relationship to obtain abnormal results for the user corresponding to the uniform resource locator record. By implementing the present invention, the uniform resource locator record of the user's historical access is analyzed and converted into a feature vector, and based on the time sequence, the time series correlation information between the records is obtained. Finally, the risk level is divided based on the features with the time series correlation information. In this way, the detection of abnormal users is achieved without specifying the application scenario, so that the abnormal user detection method can be applied to different scenarios and has stronger adaptability.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to an abnormal user detection method, system, storage medium and electronic device. Background Art

[0002] With the increasing popularity and development of the internet, many unscrupulous businesses manipulate large numbers of users on major e-commerce platforms to create fraudulent activities such as false reviews and fake orders, leading to customers purchasing defective products and severely damaging consumer interests. These users can be categorized as legitimate users and those controlled by scripts. Abnormal users access websites through frequent and repetitive operations, which not only increases website load but also potentially causes significant financial losses to the platform.

[0003] Currently, abnormal user access is mainly intercepted through manually formulated rules, such as limiting the rate at which a single IP address can access a website. However, these rules are usually related to specific application scenarios and are not universal. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide an abnormal user detection method, system, storage medium and electronic device to solve the technical problem of the lack of universal abnormal user interception or detection in the prior art.

[0005] The technical solutions proposed by the present invention are as follows:

[0006] A first aspect of an embodiment of the present invention provides an abnormal user detection method, comprising: obtaining a uniform resource locator record of a user's historical visits; converting the uniform resource locator record into a uniform resource locator feature vector; performing time series processing based on the uniform resource locator feature vector to obtain features with a time series correlation relationship; and performing calculations based on the features with a time series correlation relationship to obtain an abnormal result for the user corresponding to the uniform resource locator record.

[0007] Optionally, obtaining the uniform resource locator record of the user's historical visits includes: obtaining the uniform resource locator record of the user's historical visits according to a preset Internet Protocol address and / or browser identifier.

[0008] Optionally, converting the uniform resource locator record into a uniform resource locator feature vector includes: using a uniform resource locator training set to train an unsupervised learning model to obtain a vector mapping model; inputting the uniform resource locator training set into the vector mapping module to obtain a uniform resource locator feature vector.

[0009] Optionally, time series processing is performed on the uniform resource locator feature vector to obtain features with a time series correlation relationship, including: position encoding the uniform resource locator feature vector to obtain position encoding information; fusing the position encoding information and the uniform resource locator feature vector to obtain fused features; and inputting the fused features into a pre-trained encoding model based on a multi-head attention mechanism or a pre-trained long short-term memory artificial neural network to obtain features with a time series correlation relationship.

[0010] Optionally, calculation is performed based on the features with a temporal correlation relationship to obtain an abnormal result of the user corresponding to the uniform resource locator record, including: inputting the features with a temporal correlation relationship into a pre-trained classification model to obtain an abnormal result of the user corresponding to the uniform resource locator record.

[0011] Optionally, the classification model includes: an average pooling layer, a fully connected layer and a classification layer; or the classification model includes a logistic regression model; or the classification model includes a support vector machine model.

[0012] Optionally, the position code is expressed by the following formula:

[0013]

[0014] Wherein, pos is the position of the uniform resource locator (pos=0, 1, 2, ..., m-1), n ​​is the dimension of the feature vector, and i is the dimension position (i=0, 1, 2, ..., n-1).

[0015] A second aspect of an embodiment of the present invention provides an abnormal user detection system, comprising: a record acquisition module for acquiring a uniform resource locator record of a user's historical access; a vector conversion module for converting the uniform resource locator record into a uniform resource locator feature vector; a time series processing module for performing time series processing based on the uniform resource locator feature vector to obtain features with a time series correlation relationship; and an abnormality judgment module for performing calculations based on the features with a time series correlation relationship to obtain an abnormal result of the user corresponding to the uniform resource locator record.

[0016] A third aspect of an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the abnormal user detection method as described in the first aspect of the embodiment of the present invention and any one of the first aspects.

[0017] A fourth aspect of an embodiment of the present invention provides an electronic device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to execute the abnormal user detection method as described in the first aspect of the embodiment of the present invention and any one of the first aspects.

[0018] The technical solution provided by the present invention has the following effects:

[0019] The abnormal user detection method, system, storage medium, and electronic device provided by embodiments of the present invention analyze the Uniform Resource Locator (URL) records of a user's historical access, converting them into feature vectors. Based on the chronological order of the URL records, they then obtain temporal correlation information between the URL records. Finally, abnormal users are detected based on features containing this temporal correlation information. This method thus enables abnormal user detection without specifying a specific application scenario, making it applicable to a variety of scenarios and offering greater adaptability.

[0020] The abnormal user detection method provided by the embodiments of the present invention can be applied to website risk management scenarios as well as user behavior analysis and management. This means that the abnormal user detection method is applicable to different scenarios. It can prevent platform financial losses and also provide customized management for different users. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0022] Figure 1 is a flow chart of a method for detecting abnormal users according to an embodiment of the present invention;

[0023] Figure 2 is a flow chart of log collection according to the abnormal user detection method according to an embodiment of the present invention;

[0024] Figure 3 2 is a schematic diagram of the Doc2Vec structure of the abnormal user detection method according to an embodiment of the present invention;

[0025] Figure 4 is a flow chart of an abnormal user detection method according to another embodiment of the present invention;

[0026] Figure 52 is a schematic diagram of the encoder structure in the transformer of the abnormal user detection method according to an embodiment of the present invention;

[0027] Figure 6 is a structural diagram of a classification model according to an abnormal user detection method according to an embodiment of the present invention;

[0028] Figure 7 is a flow chart of an abnormal user detection method according to another embodiment of the present invention;

[0029] Figure 8 is a structural block diagram of an abnormal user detection system according to an embodiment of the present invention;

[0030] Figure 9 is a schematic diagram of the structure of a computer-readable storage medium provided according to an embodiment of the present invention;

[0031] Figure 10 is a schematic structural diagram of an electronic device provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0032] To make the purpose, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative efforts shall fall within the scope of protection of the present invention.

[0033] The embodiment of the present invention provides a method for detecting abnormal users. Figure 1 As shown, the method includes the following steps:

[0034] Step S101: Obtain the Uniform Resource Locator record of the user's historical visits.

[0035] Specifically, it is possible to retrieve the Uniform Resource Locator (URL) records of all users in the existing log. The log includes both URL records of normal users and URL records of abnormal users detected based on existing preset rules, such as limiting the rate at which a single IP accesses a website. When detecting abnormal users, the corresponding user can be specified by the Internet Protocol address (IP) and / or browser identifier (UA), and the URL record information of the corresponding user can be filtered out from the log to determine whether the user is an abnormal user. When specifying, it can be specified by IP or by a combination of IP and UA. For example, specify an IP and obtain m URL records of all its visits in the past week.

[0036] In one embodiment, an open source real-time log analysis ELK platform is used to extract Uniform Resource Locator (URL) records from existing logs. ELK consists of three open source tools: ElasticSearch, Logstash, and Kibana. When the platform is working, logs are collected by Logstash, stored in ElasticSerach (storage, index generation, search), and then displayed by Kibana. Among them, Logstash is a tool for collecting, analyzing, and filtering logs; ElasticSearch, as an open source distributed search engine, can provide the functions of searching, analyzing, and storing data; Kibana can provide a web interface for log analysis provided by Logstash and ElasticSearch, which can help summarize, analyze, and search important data logs.

[0037] In one embodiment, if Figure 2 As shown, you can use the filebeat module to collect logs from multiple servers and send them to Logstatsh. ElasticSearch then performs full-text searches on them, allowing you to access them through the Kibana web interface. Filebeat is a lightweight log collection agent deployed on the client, consuming significantly fewer resources (compared to Logstash) to extract logs. Alternatively, you can directly use multiple Logstatsh instances to retrieve logs from multiple servers.

[0038] Step S102: Convert the URL record into a URL feature vector. Specifically, to better identify the URL, the URL can be converted into a feature vector, thereby facilitating subsequent processing. In one embodiment, the Doc2Vec algorithm can be used to convert and generate the feature vector. Other algorithms, such as BoW or Word2Vec, can also be used to achieve feature vector conversion.

[0039] Step S103: performing time sequence processing according to the Uniform Resource Locator feature vector to obtain features with a time sequence correlation relationship.

[0040] In one embodiment, URL records are arranged in a specific time sequence, and there is temporal correlation information between them. This information is crucial for identifying whether a user is legitimate. Therefore, the feature vectors generated by the conversion can be subjected to temporal processing, so that the generated features contain temporal correlation relationships.

[0041] When performing time series processing, a time series association algorithm can be used, for example, using the encoder module in a transformer or a long short-term memory (LSTM) artificial neural network.

[0042] Step S104: Calculate based on the features with temporal correlation to obtain the abnormal results of the user corresponding to the uniform resource locator record. Specifically, after obtaining the features with temporal correlation, it can be input into a pre-trained classification model for binary classification, and judge whether the corresponding user is an abnormal user based on the output result. Among them, after processing the features with temporal correlation by the pre-trained classification model, a score will be output, and different risk levels can be determined based on the score. Therefore, after obtaining the risk level, corresponding operations can be performed on different users according to different risk levels, such as direct interception or adding human-computer interaction operations.

[0043] In one embodiment, the pre-trained classification model can be trained using features with temporal correlation extracted from URL records of normal and abnormal users. The URL records of normal and abnormal users can be obtained from existing logs. The existing logs include both URL records of normal users and URL records of abnormal users detected based on existing pre-set rules, such as limiting the rate at which a single IP address accesses a website.

[0044] The abnormal user detection method provided by an embodiment of the present invention analyzes the Uniform Resource Locator (URL) records of a user's historical access, converts them into feature vectors, and then, based on the chronological order of the URL records, obtains temporal correlation information between the URL records. Finally, the abnormal user is identified based on the features of this temporal correlation information. As a result, the abnormal user detection method detects abnormal users without specifying a specific application scenario, making it applicable to various scenarios and more adaptable.

[0045] The abnormal user detection method provided by the embodiments of the present invention can be applied to website risk management scenarios as well as user behavior analysis and management. This means that the abnormal user detection method is applicable to different scenarios. It can prevent platform financial losses and also provide customized management for different users.

[0046] In one embodiment, converting the URL record into a URL feature vector includes: training an unsupervised learning model using a URL training set to obtain a vector mapping model; and inputting the URL training set into the vector mapping module to obtain a URL feature vector. The unsupervised learning model can be based on the Doc2Vec algorithm or other algorithms such as BoW or Word2Vec.

[0047] Specifically, the following Doc2Vec algorithm is used as an example to illustrate the training process. The Doc2Vec algorithm can map text of variable length into fixed-length feature vectors. In Doc2vec, each sentence is represented by a unique vector, such as a column of matrix D. Each word is also represented by a unique vector, such as a column of matrix W. During training, a fixed-length word is sampled from a sentence each time, one of which is selected as the predicted word, and the others are used as input words. The word vector corresponding to the input word and the paragraph vector corresponding to the sentence are used as input to the input layer. The sentence vector and the word vector sampled this time are added together to form a new vector X, which is then used to predict the predicted word within the window.

[0048] like Figure 3As shown, for example, there are N URLs in the uniform resource locator training set, each URL can be regarded as a sentence, and there are M different words in these URLs. Therefore, each URL vector corresponds to a column in the matrix D, and each word vector corresponds to a column in the matrix W. Suppose there is a URL in the training set: https: / / www.test.com / test, and the word vector in this URL includes the parts https, www, test, com and login. During training, the URL vector (sentence vector), that is, the vector containing the complete information of this URL, and the word vectors of the three words www, test and com are connected together as input, and then the classifier is used to predict the next word login, thereby completing the training of the unsupervised learning model and obtaining the vector mapping model in this embodiment.

[0049] When using this vector mapping model to calculate new URL feature vectors, we add a column to the URL vector matrix D corresponding to the newly added URL. We then keep the matrix W and the rest of the network parameters fixed, and perform gradient descent on matrix D repeatedly to obtain the final stabilized sentence vector. At this point, Doc2Vec can map m URLs into m n-dimensional feature vectors.

[0050] In one embodiment, if Figure 4 As shown, performing time sequence processing according to the Uniform Resource Locator feature vector to obtain features with a time sequence correlation relationship includes the following steps:

[0051] Step S201: Position-encode the Uniform Resource Locator feature vector to obtain position-encoding information. Since users access URLs in a specific time sequence, position encoding is required for different URLs to indicate the order of the accessed URLs. Position encoding employs trigonometric function encoding.

[0052] Specifically, the position encoding is expressed by the following formula:

[0053]

[0054] Wherein, pos is the position of the uniform resource locator (pos=0, 1, 2, ..., m-1), n ​​is the dimension of the feature vector, and i is the dimension position (i=0, 1, 2, ..., n-1).

[0055] Step S202: The position coding information and the Uniform Resource Locator feature vector are fused to obtain a fused feature. Specifically, by calculating the position coding information of the Uniform Resource Locator feature vector, for each URL feature vector having a feature dimension of n, the corresponding position coding information represented by the n-dimensional feature vector can be obtained. Therefore, the two can be fused to obtain a fused feature. For example, the Uniform Resource Locator feature vector and the position coding information represented by the n-dimensional feature vector are added together to fuse the position information into the corresponding feature vector.

[0056] Step S203: The fused features are input into a pre-trained encoding model based on a multi-head attention mechanism or a pre-trained long short-term memory artificial neural network to obtain features with temporal correlation. The fused features are then processed using an encoder or LSTM in a transformer to obtain temporal correlation information between the URLs visited by the user.

[0057] Specifically, the following takes the pre-trained encoding model based on the multi-head attention mechanism as an example to illustrate the temporal association processing process. The encoding model based on the multi-head attention mechanism can specifically adopt the encoder structure in the transformer, such as Figure 5 As shown in the figure, after the fused features are obtained, they are input into the multi-head attention mechanism module in the structure. The output of the multi-head attention mechanism module is added to the fused features of the original input for residual connection operation, and then normalized and input into the feedforward propagation module. The residual operation is also performed in the feedforward propagation module. The output of the residual module is added to the above-mentioned normalized output and then normalized to output the final features with time-series correlation.

[0058] In one embodiment, calculating based on the temporally correlated features to obtain a risk level for the user corresponding to the Uniform Resource Locator record includes: inputting the temporally correlated features into a pre-trained classification model to obtain the risk level for the user corresponding to the Uniform Resource Locator record. The classification model includes an average pooling layer, a fully connected layer, and a classification layer; or the classification model includes a logistic regression model; or the classification model includes a support vector machine model.

[0059] Specifically, when m URL records are obtained for calculation, the time series processing yields features with temporal correlation, including m feature vectors of dimension n. These feature vectors are used as input to a pre-trained classification model, and through binary classification calculations, the probability that a corresponding user is an anomaly can be obtained.

[0060] Among them, such as Figure 6As shown, when the classification model includes: an average pooling layer, a fully connected layer, and a classification layer, when features with a temporal correlation relationship are input into the pre-trained model, the average pooling layer can be used to average m feature vectors, and then a fully connected layer and a classification layer (sigmoid or softmax) can be used to perform binary classification. In addition, the pre-trained classification model can also use a logistic regression algorithm or a support vector machine (SVM) algorithm, which is not limited in this embodiment of the present invention.

[0061] The output of the pre-trained classification model is a numerical value between 0 and 1. The higher the output value, the more likely the user is an anomalous user. Therefore, this value can be used to categorize users into multiple levels, with different user levels corresponding to different actions. This means that users of different user levels are handled differently when accessing the website. If the value is 0, the user is directly blocked.

[0062] In one embodiment, if Figure 7 As shown, the following process can be used to detect abnormal users: obtain the Uniform Resource Locator (URL) records of the user's historical access from the log, and then obtain the URL records of the specified user by specifying the IP address or user account (UA) for anomaly detection. First, after obtaining the URL records, a vector mapping model such as Doc2Vec is used to convert the URL records into URL feature vectors. Then, the encoder in the transformer is used for time series processing to obtain features with time series correlations. This feature is input into a classification model with a fully connected layer and a classification layer for binary classification. The classification results are used to detect abnormal users.

[0063] The embodiment of the present invention also provides an abnormal user detection system, such as Figure 8 As shown, the system includes:

[0064] The record acquisition module is used to obtain the uniform resource locator record of the user's historical access; the specific content can be found in the corresponding part of the above method embodiment, which will not be repeated here.

[0065] The vector conversion module is used to convert the uniform resource locator record into a uniform resource locator feature vector; the specific content can be found in the corresponding part of the above method embodiment, which will not be repeated here.

[0066] The timing processing module is used to perform timing processing according to the uniform resource locator feature vector to obtain features with a timing correlation relationship; the specific content can be found in the corresponding part of the above method embodiment, which will not be repeated here.

[0067] The abnormality judgment module is used to calculate based on the features with time-series correlation to obtain abnormal results of the user corresponding to the uniform resource locator record. For details, please refer to the corresponding part of the above method embodiment, which will not be repeated here.

[0068] The abnormal user detection system provided by the embodiments of the present invention analyzes the Uniform Resource Locator (URL) records of a user's historical access, converts them into feature vectors, and then, based on the chronological order of the URL records, obtains temporal correlation information between the URL records. Finally, risk levels are classified based on the features of this temporal correlation information. This system thus detects abnormal users without specifying a specific application scenario, making it applicable to a variety of scenarios and offering greater adaptability.

[0069] The abnormal user detection system provided by the embodiments of the present invention can be applied to website risk management scenarios as well as user behavior analysis and management. In other words, the abnormal user detection system is applicable to different scenarios. It can prevent platform financial losses and also provide customized management for different users.

[0070] For a detailed description of the functions of the abnormal user detection system provided in the embodiment of the present invention, please refer to the description of the abnormal user detection method in the above embodiment.

[0071] The embodiment of the present invention also provides a storage medium, such as Figure 9 As shown, a computer program 601 is stored thereon, and when the instructions are executed by the processor, the steps of the abnormal user detection method in the above embodiment are implemented. The storage medium also stores audio and video stream data, feature frame data, interaction request signaling, encrypted data, and preset data size. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (Flash Memory), a hard disk drive (HDD), or a solid-state drive (SSD); the storage medium can also include a combination of the above types of memory.

[0072] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD), or a solid-state drive (SSD). The storage medium can also include a combination of the above-mentioned types of memory.

[0073] The embodiment of the present invention further provides an electronic device, such as Figure 10 As shown, the electronic device may include a processor 51 and a memory 52, wherein the processor 51 and the memory 52 may be connected via a bus or other means. Figure 10 The bus connection is taken as an example.

[0074] The processor 51 may be a central processing unit (CPU). The processor 51 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0075] Memory 52, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer executable programs, and modules, such as the corresponding program instructions / modules in the embodiments of the present invention. Processor 51 executes the non-transitory software programs, instructions, and modules stored in memory 52 to perform various processor functions and data processing, thereby implementing the abnormal user detection method in the above-mentioned method embodiment.

[0076] The memory 52 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created by the processor 51, etc. In addition, the memory 52 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 52 may optionally include a memory remotely located relative to the processor 51, and these remote memories may be connected to the processor 51 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0077] The one or more modules are stored in the memory 52 and when executed by the processor 51, perform the following steps: Figure 1 -7 shows the abnormal user detection method in the embodiment.

[0078] For details of the above electronic equipment, please refer to Figures 1 to 7 The corresponding descriptions and effects in the embodiments shown can be understood and will not be repeated here.

[0079] Although the embodiments of the present invention have been described with reference to the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention. Such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for detecting abnormal users, characterized in that: include: Get the Uniform Resource Locator record of the user's historical visits; Converting the uniform resource locator record into a uniform resource locator feature vector; Performing time sequence processing according to the Uniform Resource Locator feature vector to obtain features with a time sequence correlation relationship; Calculating based on the features having a temporal correlation relationship, obtaining an abnormal result of the user corresponding to the uniform resource locator record; Performing time sequence processing according to the Uniform Resource Locator feature vector to obtain features with a time sequence correlation relationship includes: Performing position coding on the Uniform Resource Locator feature vector to obtain position coding information; fusing the position coding information and the uniform resource locator feature vector to obtain a fused feature; Inputting the fused features into a pre-trained encoding model based on a multi-head attention mechanism or a pre-trained long short-term memory artificial neural network to obtain features with temporal correlation; The position encoding is expressed by the following formula: Wherein, pos is the position of the uniform resource locator (pos=0, 1, 2, ..., m-1), n ​​is the dimension of the feature vector, and i is the dimension position (i=0, 1, 2, ..., n-1).

2. The abnormal user detection method according to claim 1, characterized in that: Get the Uniform Resource Locator records of the user's historical visits, including: Obtain the Uniform Resource Locator record of the user's historical visits based on a preset Internet Protocol address and / or browser identifier.

3. The abnormal user detection method according to claim 1, characterized in that: Converting the uniform resource locator record into a uniform resource locator feature vector comprises: The unsupervised learning model is trained using the Uniform Resource Locator training set to obtain a vector mapping model; The uniform resource locator training set is input into the vector mapping module to obtain a uniform resource locator feature vector.

4. The abnormal user detection method according to claim 1, characterized in that: Calculating based on the features having a temporal correlation relationship to obtain an abnormal result of the user corresponding to the uniform resource locator record includes: The features with the temporal correlation relationship are input into a pre-trained classification model to obtain an abnormal result of the user corresponding to the uniform resource locator record.

5. The abnormal user detection method according to claim 4, characterized in that: The classification model includes: an average pooling layer, a fully connected layer and a classification layer; or The classification model includes a Logistic regression model; or The classification model includes a support vector machine model.

6. An abnormal user detection system, characterized in that: include: A record acquisition module is used to obtain the Uniform Resource Locator records of the user's historical visits; A vector conversion module, configured to convert the uniform resource locator record into a uniform resource locator feature vector; A time sequence processing module, configured to perform time sequence processing according to the uniform resource locator feature vector to obtain features with a time sequence correlation relationship; an abnormality judgment module, configured to calculate based on the features having a temporal correlation relationship to obtain an abnormality result of the user corresponding to the uniform resource locator record; Performing time sequence processing according to the Uniform Resource Locator feature vector to obtain features with a time sequence correlation relationship includes: Performing position coding on the Uniform Resource Locator feature vector to obtain position coding information; fusing the position coding information and the uniform resource locator feature vector to obtain a fused feature; Inputting the fused features into a pre-trained encoding model based on a multi-head attention mechanism or a pre-trained long short-term memory artificial neural network to obtain features with temporal correlation; The position encoding is expressed by the following formula: Wherein, pos is the position of the uniform resource locator (pos=0, 1, 2, ..., m-1), n ​​is the dimension of the feature vector, and i is the dimension position (i=0, 1, 2, ..., n-1).

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the abnormal user detection method according to any one of claims 1 to 5.

8. An electronic device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the abnormal user detection method according to any one of claims 1 to 5 by executing the computer instructions.

Images