Abnormality detection method and device

Abstract

The embodiments of this specification provide anomaly detection methods and devices, wherein the anomaly detection method includes: obtaining the invitation chain information of the target invitation chain, the invitation chain information includes multiple accounts with invitation relationships; for any account, obtaining the public user information and private user information of the account, extracting the key fields of the private user information, and constructing the user information set of the account based on the public user information and the key fields; based on the user information sets of each account, determining whether there are anomaly detection results of the same user in the target invitation chain. This is beneficial for identifying and intercepting the account corresponding to the same user in the target invitation chain when identifying the same user, which can effectively strengthen the identification of the same user in the target invitation chain, prevent preferential rights and interests from being taken away by the same user in large quantities, and have a good preventive effect. In addition, it overcomes the difficulty of not being able to detect the same user due to missing data, and can also improve the efficiency and accuracy of anomaly detection.

Description

Technical Field

[0001] The embodiments of the present specification relate to the field of computer technology, and in particular to an anomaly detection method. Background Art

[0002] With the rapid development of computer technology and Internet technology, businesses usually organize a large number of marketing activities, such as new user acquisition activities, to promote their own platforms. Human-to-human activities are a commonly used method in marketing activities, mainly through old users inviting new users and continuously spreading fission to achieve the purpose of marketing activities. After completing the invitation task, old users and / or new users can obtain greater preferential rights and interests. Therefore, some people will register many accounts, and then invite their other accounts through one of their own accounts to obtain preferential rights and interests, that is, fan communication.

[0003] In the prior art, it is generally determined whether these accounts have fan relationships based on user information such as the device, mobile phone, identity information, and card corresponding to the account. However, in some scenarios where user information is incomplete, it is impossible to obtain complete user information, and thus it is impossible to determine whether there is fan communication. Summary of the invention

[0004] In view of this, an embodiment of this specification provides an anomaly detection method. One or more embodiments of this specification also relate to an anomaly detection device, a computing device, a computer-readable storage medium and a computer program to solve the technical defects existing in the prior art.

[0005] According to a first aspect of an embodiment of this specification, there is provided an anomaly detection method, comprising:

[0006] Obtaining invitation chain information of a target invitation chain, wherein the invitation chain information includes multiple accounts having an invitation relationship;

[0007] For any account, obtain the public user information and private user information of the account, extract the key fields of the private user information, and construct a user information set of the account based on the public user information and the key fields;

[0008] According to the user information set of each account, it is determined whether the target invitation chain has an abnormal detection result of the same user.

[0009] Optionally, determining, based on the user information set of each account, whether the target invitation chain has an abnormal detection result of the same user includes:

[0010] Determine the similarity between the user information sets of the accounts to obtain multiple similarities;

[0011] In the case that there is a target similarity among the multiple similarities, it is determined that the target invitation chain has a same user, and the target similarity is greater than or equal to a preset similarity threshold.

[0012] Optionally, when there is a target similarity among the multiple similarities, determining that the target invitation chain has a same user includes:

[0013] In the case where there is a target similarity among the multiple similarities, for a first account among the multiple accounts, determining the number of similarities of the target similarity corresponding to the first account, the first account being any account;

[0014] When the number of similarities is greater than a number threshold, it is determined that the first account is an account corresponding to the same user.

[0015] Optionally, obtaining the invitation chain information of the target invitation chain includes:

[0016] Get the inviting account and invited account corresponding to multiple invitation events;

[0017] According to the inviting accounts and invited accounts corresponding to the multiple invitation events, a target invitation chain is constructed, and the invitation chain information of the target invitation chain is obtained.

[0018] Optionally, the step of constructing a target invitation chain according to the inviting accounts and invited accounts corresponding to the multiple invitation events includes:

[0019] Perform group aggregation calculation on the inviting accounts and invited accounts corresponding to the multiple invitation events to obtain the target invitation chain.

[0020] Optionally, before obtaining the public user information and private user information of any account, the process further includes:

[0021] Performing anomaly detection on the target invitation chain;

[0022] The step of obtaining the public user information and private user information of any account includes:

[0023] When the detection result does not meet the preset abnormal detection conditions, for any account, obtain the public user information and private user information of the account.

[0024] Optionally, the performing abnormality detection on the target invitation chain includes:

[0025] Determine the number of accounts included in each branch of the target invitation chain;

[0026] comparing the number of accounts with a preset threshold;

[0027] When the detection result does not meet the preset abnormal detection condition, for any account, obtaining the public user information and private user information of the account includes:

[0028] When the number of accounts is less than or equal to the preset threshold, for any account, the public user information and private user information of the account are obtained.

[0029] Optionally, after performing abnormality detection on the target invitation chain, the method further includes:

[0030] When the detection result meets the preset abnormal detection condition, an abnormal account in the target invitation chain is identified through a preset account identification strategy, and the abnormal account is any account corresponding to the same user.

[0031] Optionally, when the detection result meets a preset abnormal detection condition, identifying abnormal accounts in the target invitation chain by using a preset account identification strategy includes:

[0032] When the detection result meets the preset detection abnormality condition, determining the target branch in the target invitation chain;

[0033] By using a preset account identification strategy, abnormal accounts in the target branch are identified.

[0034] According to a second aspect of the embodiments of this specification, there is provided an abnormality detection device, including:

[0035] An acquisition module is configured to acquire invitation chain information of a target invitation chain, wherein the invitation chain information includes a plurality of accounts having an invitation relationship;

[0036] A construction module is configured to obtain, for any account, the public user information and private user information of the account, extract key fields of the private user information, and construct a user information set of the account based on the public user information and the key fields;

[0037] The determination module is configured to determine whether there is an abnormal detection result of the same user in the target invitation chain according to the user information set of each account.

[0038] According to a third aspect of an embodiment of this specification, a computing device is provided, including:

[0039] Memory and processor;

[0040] The memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions. When the computer executable instructions are executed by the processor, the steps of the above-mentioned abnormality detection method are implemented.

[0041] According to a fourth aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the steps of the above-mentioned abnormality detection method are implemented.

[0042] According to a fifth aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned abnormality detection method.

[0043] This specification provides an anomaly detection method, which obtains the invitation chain information of the target invitation chain, and the invitation chain information includes multiple accounts with invitation relationships; for any account, obtain the public user information and private user information of the account, extract the key fields of the private user information, and construct the user information set of the account based on the public user information and the key fields; according to the user information set of each account, determine whether the target invitation chain has an anomaly detection result of the same user. By combining weak medium information such as the key fields of the public user information and the private user information, it is judged whether the target invitation chain has a same-person risk, that is, the anomaly detection result of the same user, which is conducive to identifying and intercepting the account corresponding to the same user in the target invitation chain when identifying the same user, which can effectively strengthen the identification of the same user in the target invitation chain, prevent preferential rights and interests from being taken away by the same user in large quantities, and have a good preventive effect. In addition, by determining the user information set through the key fields of the public user information and the private user information, and judging whether the target invitation chain has the same user through the information set, the difficulty of failing to detect the same user due to data loss is overcome, and the efficiency and accuracy of anomaly detection can also be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 is a flow chart of an anomaly detection method provided by an embodiment of this specification;

[0045] Figure 2 is a flow chart of another anomaly detection method provided by an embodiment of this specification;

[0046] Figure 3 is a processing flow chart of an abnormality detection method provided by an embodiment of this specification;

[0047] Figure 4 is a structural schematic diagram of an abnormality detection device provided by an embodiment of this specification;

[0048] Figure 5 It is a structural block diagram of a computing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0049] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0050] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0051] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0052] First, the terms involved in one or more embodiments of this specification are explained.

[0053] Human-to-human activity: a communication and fission activity with social attributes, where one inviter invites his peers to participate, and the marketing activity continues to spread outward, which has a strong communication effect. It is often used in marketing activities to attract new users and promote activation.

[0054] Anti-fraud prevention and control: prevent black market attacks and ensure that marketing funds are not maliciously taken away.

[0055] Same-person risk: The same natural person or the same group may create many accounts to bypass activity rules and obtain marketing funds. This is a common risk in marketing anti-fraud prevention and control.

[0056] A+Rewards: A+ marketing is an operational position embedded in other fund storage in the form of a nine-square grid.

[0057] Hash encryption: also known as hash encryption, a type of data encryption, the encrypted data becomes a meaningless string.

[0058] In this specification, an anomaly detection method is provided. This specification also relates to an anomaly detection device, a computing device, and a computer-readable storage medium, which are described in detail one by one in the following embodiments.

[0059] Then, the anomaly detection method provided by one or more embodiments of this specification is described.

[0060] With the rapid development of computer technology and Internet technology, businesses usually organize a large number of marketing activities, such as new user acquisition activities, to promote their own platforms. Human-to-human activities are a commonly used method in marketing activities, mainly through old users inviting new users and continuously spreading fission to achieve the purpose of marketing activities. After completing the invitation task, old users and / or new users can obtain greater preferential rights and interests. Therefore, some people will register many accounts, and then invite their other accounts through one of their own accounts to obtain preferential rights and interests, that is, fan communication.

[0061] In scenarios with relatively complete data, such as the main site and cross-border travel, it is possible to determine whether these accounts have fan relationships, that is, the same user, through dimensions such as the device, mobile phone, identity information, and card behind the account. However, in international scenarios, especially in some online marketing activities, it is impossible to obtain complete user information, and it is impossible to use strong media such as devices, mobile phones, identity information, and cards to determine whether there are fan-to-fan problems. In other words, for some scenarios with incomplete user information, obtaining complete user information and then being unable to determine whether there is fan-to-fan communication.

[0062] In order to solve this problem, this specification provides an anomaly detection method, obtaining the invitation chain information of the target invitation chain, wherein the invitation chain information includes multiple accounts with invitation relationships; for any account, obtaining the public user information and private user information of the account, extracting the key fields of the private user information, and constructing the user information set of the account based on the public user information and the key fields; and determining whether the target invitation chain has an anomaly detection result of the same user according to the user information set of each account. By combining weak medium information such as the key fields of the public user information and the private user information, it is judged whether the target invitation chain has a same-person risk, that is, the anomaly detection result of the same user, which is conducive to identifying and intercepting the account corresponding to the same user in the target invitation chain when identifying the same user, which can effectively strengthen the identification of the same user in the target invitation chain, prevent preferential rights and interests from being taken away by the same user in large quantities, and have a good preventive effect. In addition, by determining the user information set through the key fields of the public user information and the private user information, and judging whether the target invitation chain has the same user through the information set, the difficulty of failing to detect the same user due to data loss is overcome, and the efficiency and accuracy of anomaly detection can also be improved.

[0063] See also Figure 1 , Figure 1 A flowchart of an abnormality detection method provided according to an embodiment of the present specification is shown, which specifically includes the following steps.

[0064] Step 102: Obtain invitation chain information of the target invitation chain, where the invitation chain information includes multiple accounts that have an invitation relationship.

[0065] Specifically, an invitation chain refers to the chain relationship corresponding to the invitation, such as the chain relationship formed by user A inviting user B, user B inviting user C and user D; a target invitation chain refers to the invitation chain to be detected for anomalies, which can be any invitation chain or a designated invitation chain; an account is a representative of the digital age, which is a number that represents an individual in a specific project, and an account can be composed of at least one of Chinese, English, and symbols; invitation chain information refers to the information corresponding to the target invitation chain, which mainly includes multiple accounts with invitation relationships in the target invitation chain.

[0066] In actual applications, there are multiple methods for obtaining the invitation chain information of the target invitation chain: the target invitation chain can be obtained from a preset invitation chain repository, and the invitation information carried by the target invitation chain can be identified; an acquisition request for the target invitation chain can be sent to a third-party platform or client, etc., so as to obtain the target invitation chain and the invitation chain information of the target invitation chain.

[0067] In order to improve the accuracy of obtaining invitation chain information, you can first obtain the account corresponding to each invitation event, then build a target invitation chain based on the account corresponding to each invitation event, and obtain the target invitation chain information. That is, the specific implementation process of obtaining the invitation chain information of the target invitation chain can be as follows:

[0068] Get the inviting account and invited account corresponding to multiple invitation events;

[0069] According to the inviting accounts and invited accounts corresponding to the multiple invitation events, a target invitation chain is constructed, and the invitation chain information of the target invitation chain is obtained.

[0070] Specifically, an invitation event refers to an event in which a certain account invites another account to become a new user of a certain platform, or an account is invited by another account to become a new user of a certain platform. An invitation event corresponds to two accounts, the inviting account and the invited account, where the inviting account is the account that sends the invitation, and the invited account is the account that accepts the invitation.

[0071] In actual applications, for invitation events that have occurred, the inviting accounts and invited accounts corresponding to these invitation events are obtained, and then based on the invitation relationship between each inviting account and each invited account, the target invitation chain is constructed, and the invitation chain information of the target invitation chain is obtained. In this way, the efficiency and accuracy of constructing the target invitation chain can be improved, thereby improving the speed and reliability of obtaining the invitation chain information.

[0072] For example, it is assumed that there are seven invitation events, namely, invitation event A1, invitation event A2, invitation event A3, invitation event A4, invitation event A5, invitation event A6 and invitation event A7. Get the inviting accounts and invited accounts corresponding to the seven invitation events, see Table 1, which shows the inviting accounts and invited accounts corresponding to the respective invitation events, wherein the inviting account corresponding to invitation event A1 is 123123, and the invited account is 112233, the inviting account corresponding to invitation event A2 is 123456, and the invited account is 123123, the inviting account corresponding to invitation event A3 is 112233, and the invited account is 654321, the inviting account corresponding to invitation event A4 is 445566, and the invited account is 456789, the inviting account corresponding to invitation event A5 is 456789, and the invited account is 778899, the inviting account corresponding to invitation event A6 is 654321, and the invited account is 445566, and the inviting account corresponding to invitation event A7 is 778899, and the invited account is 987654. The target invitation chain built based on these inviting accounts and invited accounts is: 123456→123123→112233→654321→445566→456789→778899→987654. The invitation chain information is 123456, 123123, 112233, 654321, 445566, 456789, 778899 and 987654, eight accounts with invitation relationships.

[0073] Table 1 Inviting account and invited account corresponding to each invitation event

[0074]

[0075]

[0076] In one or more optional embodiments of the present specification, a target invitation chain can also be constructed by performing group aggregation calculation on the inviting accounts and invited accounts corresponding to multiple invitation events. That is, the target invitation chain is constructed based on the inviting accounts and invited accounts corresponding to multiple invitation events. The specific implementation process can be as follows:

[0077] Perform group aggregation calculation on the inviting accounts and invited accounts corresponding to the multiple invitation events to obtain the target invitation chain.

[0078] Specifically, group aggregation calculation refers to the process of aggregating accounts having an invitation relationship among the inviting accounts and the invited accounts according to the invitation key.

[0079] In practical applications, an invitation group model, also known as a person-to-person group model, can be used. Multiple invitation events and the inviting accounts and invited accounts corresponding to the invitation events are input into the invitation group model. The invitation group model uses a connected graph algorithm to group accounts with invitation relationships together according to the invitation relationship, and constructs a connected graph with accounts as nodes and invitation events as edges, which is also the target invitation chain.

[0080] Referring to Table 1, each invitation event in Table 1 and the inviting account and invited account corresponding to each invitation event are input into the invitation group model, and based on the invitation event A1, a connected graph 123456→123123 is generated; then, since the invited account 123123 corresponding to the invitation event A2 is an account in the connected graph, the connected graph is updated based on the invitation event A2, and 123456→123123→112233 is obtained; then, since the invited account 112233 corresponding to the invitation event A3 is an account in the connected graph, the connected graph is updated based on the invitation event A3, and 123456→123123→112233→654321 is obtained; since the inviting account 65432 corresponding to the invitation event A6 is an account in the connected graph, the connected graph is updated based on the invitation event A6, and 123456→123123 is obtained. →112233→65432→445566; Similarly, based on the invitation event A4, the connection graph is updated to obtain 123456→123123→112233→65432→445566→456789, and based on the invitation event A5, the connection graph is updated to obtain 123456→123123→112233→65432→445566→456789→77 8899. Based on the invitation event A7, the connectivity graph is updated to obtain 123456→123123→112233→654321→445566→456789→778899→987654. That is, the target invitation chain is 123456→123123→112233→654321→445566→456789→778899→987654.

[0081] Step 104: For any account, obtain the public user information and private user information of the account, extract the key fields of the private user information, and construct a user information set of the account based on the public user information and the key fields.

[0082] On the basis of obtaining the invitation chain information of the target invitation chain, for any account in the invitation chain information, obtain the public user information and private user information of the account, extract the key fields of the private user information, and construct the user information set of the account based on the public user information and the key fields.

[0083] Specifically, private user information refers to the user's private, exclusive information that the user does not want others to know or interfere with, such as mobile phone number, date of birth, ID number, Internet Protocol (IP) address, etc.; public user information refers to the information that the user makes public, such as account registration time, registration avatar, etc.; key fields refer to the valid fields of private user information; user information set refers to the user information that is a combination of public user information and key fields.

[0084] In actual applications, after obtaining the invitation chain information of the target invitation chain, for any account in the invitation chain information, the public user information and private user information of the account can be obtained from the account registration center, or the public user information and private user information of the account can be obtained from the locally stored user registration information. Furthermore, since the private user information is encrypted, such as hash encryption, generally only part of the real data and encrypted data of the private user information can be obtained, such as the first 8 digits of the encrypted mobile phone number, and the first 3 segments of real data of the encrypted IP address number information. Therefore, it is necessary to process the private user information: delete the invalid fields of the obtained private user information to obtain the key fields, or directly extract the key fields from the private user information. Then combine or splice the public user information and key fields corresponding to the account to obtain the user information set corresponding to the user. Traverse all accounts in the invitation chain information to obtain the user information set of each account.

[0085] For example, account 1 is an account included in the invitation chain information. The registration time (public user information) of account 1 is January 1, 2022, and the mobile phone number (private user information) is 11122334***. The key field of the mobile phone number is 11122334. Based on the registration time January 1, 2022 and the key field 11122334, the user information set of account 1 "2022-1-1-11122334" is obtained.

[0086] For another example, account 2 is an account included in the invitation chain information. The registration time (public user information) of account 1 is obtained as "2012.11.11", and the IP address is "100.4.**.**". The key field of the IP address is "100.4". Based on the registration time "2012.11.11" and the key field "100.4", the user information set of account 2 is obtained as "2012.11.11-100.4".

[0087] In addition, after obtaining the public user information and private user information, the target invitation chain can also be group checked to see if there is any abnormality in the target invitation chain. If no abnormality is detected, the public user information and private user information can be obtained. That is, for any account, before obtaining the public user information and private user information of the account, it also includes:

[0088] Performing anomaly detection on the target invitation chain;

[0089] Accordingly, for any account, obtaining the public user information and private user information of the account may be specifically implemented as follows:

[0090] When the detection result does not meet the preset abnormal detection conditions, for any account, obtain the public user information and private user information of the account.

[0091] Specifically, the preset detection abnormality condition refers to a condition set in advance for measuring whether a detection result is abnormal.

[0092] In actual applications, the target invitation chain can be first detected for anomalies according to the preset anomaly detection strategy to obtain the detection results, and then the detection results can be compared with the preset detection anomaly conditions. If the detection results do not meet the preset detection anomaly conditions, it is preliminarily indicated that the target invitation chain has no anomalies. Further, the public user information and private user information of each account can be obtained. In this way, the target invitation chain is preliminarily detected for anomalies. If there is no anomaly in the preliminary detection, the public user information and private user information are obtained, and further anomaly detection is performed, which can improve the efficiency of anomaly detection.

[0093] In one or more optional embodiments of the present specification, the target invitation chain may be detected for abnormality by the number of accounts, that is, the specific implementation process of detecting abnormality on the target invitation chain may be as follows:

[0094] Determine the number of accounts included in each branch of the target invitation chain;

[0095] comparing the number of accounts with a preset threshold;

[0096] Accordingly, when the detection result does not meet the preset detection abnormality condition, the specific implementation process of obtaining the public user information and private user information of any account can be as follows:

[0097] When the number of accounts is less than or equal to the preset threshold, for any account, the public user information and private user information of the account are obtained.

[0098] Specifically, a branch refers to a link in the target invitation chain; the number of accounts refers to the number of included accounts; and the preset threshold refers to a pre-set value used to measure whether the number of accounts is abnormal.

[0099] In actual applications, anomaly detection can be to compare the number of accounts in each branch of the target invitation chain with a preset threshold; the preset detection anomaly condition is that the number of accounts is less than or equal to the preset threshold. That is, first identify each branch in the target invitation chain, then determine the number of accounts contained in each branch, and compare the number of accounts in each branch with the preset threshold. If the number of accounts is less than or equal to the preset threshold, it is preliminarily stated that there is no anomaly in the target invitation chain. Further, the public user information and private user information of each account can be obtained. In this way, the target invitation chain is preliminarily detected for anomalies based on the number of branch accounts and the preset threshold, which can improve the efficiency and accuracy of determining anomaly detection.

[0100] For example, the target invitation chain has only one branch, and the branch contains 8 accounts, that is, the number of accounts is 8. Assuming the preset threshold is 10, the public user information and private user information of these 8 accounts can be obtained respectively.

[0101] After performing anomaly detection on the target invitation chain, the detection result may also meet the preset anomaly detection condition, indicating that the target invitation chain is abnormal and it is necessary to identify abnormal accounts in the target invitation chain. That is, after performing anomaly detection on the target invitation chain, the method further includes:

[0102] When the detection result meets the preset abnormal detection condition, an abnormal account in the target invitation chain is identified through a preset account identification strategy, and the abnormal account is any account corresponding to the same user.

[0103] Specifically, the preset account identification strategy refers to a pre-set plan or method for identifying abnormal accounts in the target invitation chain; an abnormal account refers to any account among multiple accounts applied for by a user; the same user means that multiple accounts in the target invitation chain are the same user.

[0104] In actual applications, the target invitation chain is first detected for anomalies according to the pre-set anomaly detection strategy. After the detection result is obtained, the detection result is compared with the preset detection anomaly condition. If the detection result meets the preset detection anomaly condition, it is preliminarily explained that the target invitation chain is abnormal. Furthermore, the abnormal account can be identified from multiple accounts in the target invitation chain according to the preset account identification strategy. In this way, the target invitation chain is preliminarily detected for anomalies. In the case of preliminary detection of anomalies, there is no need to obtain public user information and private user information. The abnormal account can be directly identified based on the preset account identification strategy, which reduces the amount of data processing and improves the efficiency and speed of anomaly detection.

[0105] In one or more optional embodiments of the present specification, when the detection result meets the preset abnormal detection condition, the target branch can be determined first, and then the abnormal account can be determined in the target branch based on the preset account identification strategy. That is, when the detection result meets the preset abnormal detection condition, the abnormal account in the target invitation chain is identified by the preset account identification strategy. The specific implementation process can be as follows:

[0106] When the detection result meets the preset detection abnormality condition, determining the target branch in the target invitation chain;

[0107] By using a preset account identification strategy, abnormal accounts in the target branch are identified.

[0108] Specifically, the target branch refers to a branch that includes a number of accounts greater than a preset threshold, that is, the number of accounts included in the target branch is greater than the preset threshold.

[0109] In actual applications, when the detection results meet the preset abnormal detection conditions, the target branch is first determined from the branches of the target invitation chain, and then the abnormal account is determined from the multiple accounts in the target branch through the preset account identification strategy. In this way, the range of abnormal accounts is narrowed from the target invitation chain to the target branch, which greatly reduces the amount of data processing and further improves the efficiency of abnormal detection.

[0110] For example, anomaly detection is to compare the number of accounts in each branch of the target invitation chain with a preset threshold; the preset detection anomaly condition is that the number of accounts is less than or equal to the preset threshold. Then the target invitation chain has only two branches, and the first branch contains 8 accounts, that is, the number of accounts in the first branch is 8, and the second branch contains 12 accounts, that is, the number of accounts in the second branch is 12. Assuming the preset threshold is 10, the number of accounts in the first branch is less than the preset threshold, and the number of accounts in the second branch is greater than the preset threshold, that is, the anomaly detection meets the preset detection anomaly condition. At this time, the target branch in the target invitation chain is determined. Since the number of accounts in the second branch is greater than the preset threshold, the second branch is the target branch, and then based on the preset account identification strategy, the abnormal accounts in the second branch are identified.

[0111] It should be noted that after determining the target branch in the target invitation chain, the target branch needs to be monitored in order to promptly determine the abnormal accounts added by the target branch in subsequent invitation events. In addition, when identifying abnormal accounts in the target invitation chain or target branch through the preset account identification strategy, the problem of not being able to identify abnormal accounts may occur. At this time, the user information of each account in the target invitation chain or target branch can be obtained to further identify abnormal accounts.

[0112] Step 106: Determine, based on the user information set of each account, whether the target invitation chain has an abnormal detection result of the same user.

[0113] For any account in the invitation chain information, after obtaining the public user information and private user information of the account, extracting the key fields of the private user information, and building the user information set of the account based on the public user information and key fields, further, based on the user information sets of each account, determine whether there are abnormal detection results of the same user in the target invitation chain.

[0114] Specifically, the same user means that multiple accounts in the target invitation chain are the same user; the anomaly detection result refers to the result of anomaly detection on the target invitation chain, and there are two types of anomaly detection results, namely, the same user exists and the same user does not exist.

[0115] In actual applications, after determining the user information set of each account, the user information set of each account can be classified, and then the number of user information sets contained in each category can be compared with the preset value. If the number of user information sets contained in a certain category is greater than the preset value, it means that the same user exists in the target invitation chain. If the number of user information sets contained in each category is not greater than the preset value, it means that the same user does not exist in the target invitation chain.

[0116] For example, there are five accounts, that is, there are five user information sets. These five user information sets are classified into two categories. The first category contains two user information sets, and the second category contains three user information sets. Assuming the preset value is four, the number of user information sets contained in the first category is 2 which is less than 4, and the number of user information sets contained in the second category is 3 which is less than 4. Therefore, the same user does not exist in the target invitation chain.

[0117] After determining the user information set of each account, the similarity between each user information set can also be calculated, and then each similarity is compared with a preset similarity threshold. If there is a similarity greater than the preset similarity threshold, it means that the target invitation chain has the same user. That is, according to the user information set of each account, determining whether the target invitation chain has an abnormal detection result of the same user, the specific implementation process can be as follows:

[0118] Determine the similarity between the user information sets of the accounts to obtain multiple similarities;

[0119] In the case that there is a target similarity among the multiple similarities, it is determined that the target invitation chain has a same user, and the target similarity is greater than or equal to a preset similarity threshold.

[0120] Specifically, similarity refers to a numerical value that represents the degree of similarity between two user information sets; and a preset similarity threshold refers to a numerical value preset for measuring similarity.

[0121] In actual applications, after determining the user information set of each account, the similarity between the user information sets is calculated two by two, that is, the similarity between each user information set is calculated. Further, each similarity is compared with a preset similarity threshold. If there is a similarity greater than the preset similarity threshold among the similarities, that is, there is a target similarity, indicating that the target invitation chain has the same user; if there is no similarity greater than the preset similarity threshold among the similarities, that is, there is no target similarity, indicating that the target invitation chain does not have the same user. In this way, determining the anomaly detection result based on the similarity of the user information set and the preset similarity threshold is simple and easy, and has high reliability, thereby improving the efficiency and credibility of anomaly detection.

[0122] For example, there are three accounts: account B1, account B2, and account B3. The similarity between the user information set of account B1 and the user information set of account B2 is calculated to be 0.7, the similarity between the user information set of account B1 and the user information set of account B3 is calculated to be 0.8, and the similarity between the user information set of account B2 and the user information set of account B3 is calculated to be 0.9. Assuming that the preset similarity threshold is 0.85, 0.9 is greater than 0.85, that is, there is target similarity, indicating that the same user exists in the target invitation chain.

[0123] In addition, when there is a target similarity among the multiple similarities, after determining that the target invitation chain has the same user, the multiple accounts corresponding to the target similarity may also be determined as accounts corresponding to the same user.

[0124] In order to further improve the accuracy and reliability of anomaly detection, it is also necessary to determine the anomaly detection result based on the number of similarities of the target similarities, that is, when the target similarity exists in the multiple similarities, it is determined that the target invitation chain has the same user. The specific implementation process can be as follows:

[0125] In the case where there is a target similarity among the multiple similarities, for a first account among the multiple accounts, determining the number of similarities of the target similarity corresponding to the first account, the first account being any account;

[0126] When the number of similarities is greater than a number threshold, it is determined that the first account is an account corresponding to the same user.

[0127] Specifically, the similarity number refers to the number of target similarities.

[0128] In actual applications, when it is determined that there is a target similarity among multiple similarities, it means that the target invitation chain may have the same user. At this time, for any account, determine the number of similarities with the target similarity among the similarities corresponding to the account. If the number of similarities is greater than the number threshold, it means that the account is the account corresponding to the same user. If the number of similarities is less than or equal to the number threshold, it means that the account is not the account corresponding to the same user. Then traverse each account to determine whether each account is the account corresponding to the same user. Since there is a problem of high similarity in determining that there are user information sets of different users in actual scenarios, the number threshold can avoid the error of determining the accounts of different users as the same user, which improves the efficiency of determining the same user while also improving the accuracy and reliability of anomaly detection.

[0129] In addition, when determining whether there is an abnormal detection result of the same user in the target invitation chain based on the user information set of each account, the number of user information sets in each account that are target user information sets can also be determined, where the target user information set is any user information set; when the target account number exists in multiple first account numbers, it is determined that the multiple accounts corresponding to the target account number are the same account; when the target account number does not exist in multiple first account numbers, it is determined that the multiple accounts corresponding to the target account number are not the same account, where the target account number is a first account number greater than the first preset threshold.

[0130] See also Figure 2 , Figure 2 A flowchart of another anomaly detection method provided by an embodiment of the present specification is shown: first, the obtained invitation event and the inviting account and the invited account corresponding to the invitation event are input into the invitation group model, and the invitation group model outputs the target invitation chain. Then, anomaly detection is performed on the target invitation chain to determine whether the target invitation chain is group abnormal, that is, whether the detection result meets the preset detection abnormality condition. If it is met, the abnormal account in the target invitation chain is identified based on the preset account identification strategy; if it is not met, the registration time and the key fields of each account are obtained, the registration time and the key fields are combined to obtain a user information set, and then based on the user information set, it is determined whether the target invitation chain has the same user. If so, the abnormal account in the target invitation chain is identified, and if not, it is determined that the target invitation chain detection is normal.

[0131] This specification provides an anomaly detection method, which obtains the invitation chain information of the target invitation chain, and the invitation chain information includes multiple accounts with invitation relationships; for any account, obtain the public user information and private user information of the account, extract the key fields of the private user information, and construct the user information set of the account based on the public user information and the key fields; according to the user information set of each account, determine whether the target invitation chain has an anomaly detection result of the same user. By combining weak medium information such as the key fields of the public user information and the private user information, it is judged whether the target invitation chain has a same-person risk, that is, the anomaly detection result of the same user, which is conducive to identifying and intercepting the account corresponding to the same user in the target invitation chain when identifying the same user, which can effectively strengthen the identification of the same user in the target invitation chain, prevent preferential rights and interests from being taken away by the same user in large quantities, and have a good preventive effect. In addition, by determining the user information set through the key fields of the public user information and the private user information, and judging whether the target invitation chain has the same user through the information set, the difficulty of failing to detect the same user due to data loss is overcome, and the efficiency and accuracy of anomaly detection can also be improved.

[0132] The following combination Figure 3 , taking the application of the anomaly detection method provided in this specification in the new customer acquisition activity scenario as an example, the anomaly detection method is further described. Figure 3 A processing flow chart of an abnormality detection method provided by an embodiment of the present specification is shown, which specifically includes the following steps.

[0133] Step 302: Obtain inviting accounts and invited accounts corresponding to multiple invitation events in the new member acquisition activity.

[0134] Step 304: performing group aggregation calculation on the inviting accounts and invited accounts corresponding to the multiple invitation events, constructing a target invitation chain, and obtaining invitation chain information of the target invitation chain.

[0135] Step 306: Determine the number of accounts included in each branch of the target invitation chain.

[0136] Step 308: Determine whether the number of accounts is greater than a preset threshold.

[0137] If yes, go to step 310 ; if no, go to step 314 .

[0138] Step 310: Determine the target branch in the target invitation chain.

[0139] Step 312: Identify abnormal accounts in the target invitation chain through a preset account identification strategy.

[0140] Among them, the abnormal account is any account corresponding to the same user.

[0141] Step 314: For any account, obtain the public user information and private user information of the account.

[0142] Step 316: Extract key fields of private user information.

[0143] Step 318: Build a user information set for the account based on the public user information and key fields.

[0144] Step 320: Determine the similarities between the user information sets of each account and obtain multiple similarities.

[0145] Step 322: For any account among the multiple accounts, determine the number of similarities of the target similarity corresponding to the account.

[0146] Step 324: When the number of similarities is greater than the number threshold, determine that the account is an account corresponding to the same user.

[0147] This specification provides an anomaly detection method, which combines weak medium information such as key fields of public user information and private user information to determine whether there is a same-person risk in the target invitation chain, that is, the anomaly detection result of the same user. This is conducive to identifying and intercepting the account corresponding to the same user in the target invitation chain when identifying the same user, which can effectively strengthen the identification of the same user in the target invitation chain and prevent preferential rights from being taken away by the same user in large quantities, and has a good preventive effect. In addition, by determining the user information set through the key fields of public user information and private user information, and judging whether there is the same user in the target invitation chain through the information set, the difficulty of failing to detect the same user due to missing data is overcome, and the efficiency and accuracy of anomaly detection can also be improved.

[0148] Corresponding to the above method embodiment, this specification also provides an abnormality detection device embodiment, Figure 4 FIG. 2 shows a schematic diagram of the structure of an abnormality detection device provided by an embodiment of the present specification. Figure 4 As shown, the device comprises:

[0149] The acquisition module 402 is configured to acquire the invitation chain information of the target invitation chain, wherein the invitation chain information includes a plurality of accounts having an invitation relationship;

[0150] The construction module 404 is configured to obtain, for any account, the public user information and private user information of the account, extract the key fields of the private user information, and construct a user information set of the account based on the public user information and the key fields;

[0151] The determination module 406 is configured to determine whether there is an abnormal detection result of the same user in the target invitation chain according to the user information set of each account.

[0152] Optionally, the determining module 406 is further configured to:

[0153] Determine the similarity between the user information sets of the accounts to obtain multiple similarities;

[0154] In the case that there is a target similarity among the multiple similarities, it is determined that the target invitation chain has a same user, and the target similarity is greater than or equal to a preset similarity threshold.

[0155] Optionally, the determining module 406 is further configured to:

[0156] In the case where there is a target similarity among the multiple similarities, for a first account among the multiple accounts, determining the number of similarities of the target similarity corresponding to the first account, the first account being any account;

[0157] When the number of similarities is greater than a number threshold, it is determined that the first account is an account corresponding to the same user.

[0158] Optionally, the acquisition module 402 is configured to:

[0159] Get the inviting account and invited account corresponding to multiple invitation events;

[0160] According to the inviting accounts and invited accounts corresponding to the multiple invitation events, a target invitation chain is constructed, and the invitation chain information of the target invitation chain is obtained.

[0161] Optionally, the acquisition module 402 is configured to:

[0162] Perform group aggregation calculation on the inviting accounts and invited accounts corresponding to the multiple invitation events to obtain the target invitation chain.

[0163] Optionally, the device further comprises a detection module configured to:

[0164] Performing anomaly detection on the target invitation chain;

[0165] The construction module 404 is further configured to:

[0166] When the detection result does not meet the preset abnormal detection conditions, for any account, obtain the public user information and private user information of the account.

[0167] Optionally, the detection module is configured to:

[0168] Determine the number of accounts included in each branch of the target invitation chain;

[0169] comparing the number of accounts with a preset threshold;

[0170] The construction module 404 is further configured to:

[0171] When the number of accounts is less than or equal to the preset threshold, for any account, the public user information and private user information of the account are obtained.

[0172] Optionally, the device further includes an identification module configured to:

[0173] When the detection result meets the preset abnormal detection condition, an abnormal account in the target invitation chain is identified through a preset account identification strategy, and the abnormal account is any account corresponding to the same user.

[0174] Optionally, the identification module is further configured to:

[0175] When the detection result meets the preset detection abnormality condition, determining the target branch in the target invitation chain;

[0176] By using a preset account identification strategy, abnormal accounts in the target branch are identified.

[0177] This specification provides an anomaly detection device, which obtains the invitation chain information of the target invitation chain, and the invitation chain information includes multiple accounts with invitation relationships; for any account, the public user information and private user information of the account are obtained, the key fields of the private user information are extracted, and the user information set of the account is constructed according to the public user information and the key fields; according to the user information sets of each account, it is determined whether the target invitation chain has an anomaly detection result of the same user. By combining weak medium information such as the key fields of the public user information and the private user information, it is judged whether the target invitation chain has a same-person risk, that is, the anomaly detection result of the same user, which is conducive to identifying and intercepting the account corresponding to the same user in the target invitation chain when identifying the same user, which can effectively strengthen the identification of the same user in the target invitation chain, prevent preferential rights and interests from being taken away by the same user in large quantities, and have a good preventive effect. In addition, by determining the user information set through the key fields of the public user information and the private user information, and judging whether the target invitation chain has the same user through the information set, the difficulty of failing to detect the same user due to data missing is overcome, and the efficiency and accuracy of anomaly detection can also be improved.

[0178] The above is a schematic scheme of an abnormality detection device of this embodiment. It should be noted that the technical scheme of the abnormality detection device and the technical scheme of the abnormality detection method described above are of the same concept, and the details not described in detail in the technical scheme of the abnormality detection device can be referred to the description of the technical scheme of the abnormality detection method described above.

[0179] Figure 5 The structure block diagram of a computing device 500 provided according to an embodiment of the present specification is shown. The components of the computing device 500 include but are not limited to a memory 510 and a processor 520. The processor 520 is connected to the memory 510 via a bus 530, and the database 550 is used to store data.

[0180] The computing device 500 also includes an access device 540 that enables the computing device 500 to communicate via one or more networks 560. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 540 may include one or more of any type of network interface (e.g., a network interface card (NIC)) of wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a world-wide interoperability for microwave access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, a near field communication (NFC) interface, and the like.

[0181] In one embodiment of the present specification, the above components of the computing device 500 and Figure 5 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 5 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0182] The computing device 500 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or PC. The computing device 500 may also be a mobile or stationary server.

[0183] The processor 520 is used to execute the following computer executable instructions, which implement the steps of the above-mentioned abnormality detection method when executed by the processor.

[0184] The above is a schematic scheme of a computing device of this embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the above-mentioned anomaly detection method belong to the same concept, and the details not described in detail in the technical scheme of the computing device can be referred to the description of the technical scheme of the above-mentioned anomaly detection method.

[0185] An embodiment of the present specification further provides a computer-readable storage medium storing computer-executable instructions, which can implement the steps of the above-mentioned abnormality detection method when executed by a processor.

[0186] The above is a schematic scheme of a computer-readable storage medium of this embodiment. It should be noted that the technical scheme of the storage medium and the technical scheme of the above-mentioned anomaly detection method belong to the same concept, and the details not described in detail in the technical scheme of the storage medium can be referred to the description of the technical scheme of the above-mentioned anomaly detection method.

[0187] An embodiment of the present specification further provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned abnormality detection method.

[0188] The above is an illustrative solution of a computer program of this embodiment. It should be noted that the technical solution of the computer program and the technical solution of the above-mentioned anomaly detection method belong to the same concept, and the details not described in detail in the technical solution of the computer program can be referred to the description of the technical solution of the above-mentioned anomaly detection method.

[0189] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0190] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc.

[0191] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0192] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0193] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. An anomaly detection method, comprising: Obtaining invitation chain information of a target invitation chain, wherein the invitation chain information includes multiple accounts having an invitation relationship; For any account, obtaining the public user information and private user information of the account, extracting the key fields of the private user information, and constructing a user information set of the account according to the public user information and the key fields, wherein constructing the user information set of the account according to the public user information and the key fields includes: combining or concatenating the public user information and the key fields corresponding to the account to obtain the user information set corresponding to the account; Determine, based on the user information sets of each account, whether the target invitation chain has abnormal detection results of the same user, wherein, based on the user information sets of each account, determining, based on the user information sets of each account, whether the target invitation chain has abnormal detection results of the same user includes: classifying the user information sets of each account, and comparing the number of user information sets included in each category with a preset value to determine whether the target invitation chain has abnormal detection results of the same user.

2. According to the method of claim 1, determining whether the target invitation chain contains an abnormal detection result of the same user based on the user information set of each account comprises: Determine the similarity between the user information sets of the accounts to obtain multiple similarities; In the case that there is a target similarity among the multiple similarities, it is determined that the target invitation chain has a same user, and the target similarity is greater than or equal to a preset similarity threshold.

3. The method according to claim 2, wherein when there is a target similarity among the multiple similarities, determining that the target invitation chain has the same user comprises: In the case where there is a target similarity among the multiple similarities, for a first account among the multiple accounts, determining the number of similarities of the target similarity corresponding to the first account, the first account being any account; When the number of similarities is greater than a number threshold, it is determined that the first account is an account corresponding to the same user.

4. According to the method of claim 1, the step of obtaining the invitation chain information of the target invitation chain comprises: Get the inviting account and invited account corresponding to multiple invitation events; According to the inviting accounts and invited accounts corresponding to the multiple invitation events, a target invitation chain is constructed, and the invitation chain information of the target invitation chain is obtained.

5. The method according to claim 4, wherein the step of constructing a target invitation chain based on the inviting accounts and invited accounts corresponding to the plurality of invitation events comprises: Perform group aggregation calculation on the inviting accounts and invited accounts corresponding to the multiple invitation events to obtain the target invitation chain.

6. The method according to claim 1, before obtaining the public user information and private user information of any account, further comprising: Performing anomaly detection on the target invitation chain; The step of obtaining the public user information and private user information of any account includes: When the detection result does not meet the preset abnormal detection conditions, for any account, obtain the public user information and private user information of the account.

7. The method according to claim 6, wherein the performing abnormality detection on the target invitation chain comprises: Determine the number of accounts included in each branch of the target invitation chain; comparing the number of accounts with a preset threshold; When the detection result does not meet the preset abnormal detection condition, for any account, obtaining the public user information and private user information of the account includes: When the number of accounts is less than or equal to the preset threshold, for any account, the public user information and private user information of the account are obtained.

8. The method according to claim 6 or 7, after performing abnormality detection on the target invitation chain, further comprising: When the detection result meets the preset abnormal detection condition, an abnormal account in the target invitation chain is identified through a preset account identification strategy, and the abnormal account is any account corresponding to the same user.

9. The method according to claim 8, wherein when the detection result meets the preset abnormal detection condition, identifying the abnormal account in the target invitation chain by using a preset account identification strategy comprises: When the detection result meets the preset detection abnormality condition, determining the target branch in the target invitation chain; By using a preset account identification strategy, abnormal accounts in the target branch are identified.

10. An abnormality detection device, comprising: An acquisition module is configured to acquire invitation chain information of a target invitation chain, wherein the invitation chain information includes a plurality of accounts having an invitation relationship; A construction module is configured to obtain, for any account, the public user information and private user information of the account, extract the key fields of the private user information, and construct a user information set of the account based on the public user information and the key fields, wherein the construction module is further configured to: combine or concatenate the public user information and the key fields corresponding to the account to obtain the user information set corresponding to the account; The determination module is configured to determine whether the target invitation chain has abnormal detection results of the same user based on the user information sets of each account, wherein the determination module is further configured to: classify the user information sets of each account, and compare the number of user information sets contained in each category with a preset value to determine whether the target invitation chain has abnormal detection results of the same user.

11. A computing device comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the anomaly detection method according to any one of claims 1 to 9 are implemented.

12. A computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the anomaly detection method according to any one of claims 1 to 9.

Images