A method and device for detecting low-rate cheating traffic

Abstract

The present application provides a method and device for detecting low-rate fraudulent traffic. The detection method includes character feature processing: obtaining an abnormal score S of the character feature; str ; Numerical feature processing: Get the abnormal score S of the numerical feature num ; Dataset identification: Anomaly score S based on character features str and the abnormality score S of the numerical feature num , get the final sample evaluation score Score fin ; Data cleaning; Data balancing; XGBoost classification, and the final result is obtained. The low-rate cheating traffic detection method and device of the present invention can efficiently and accurately identify and detect cheating traffic generated by manual clicks and cheating traffic generated by basic semi-automatic scripts. The present application decouples the overall architecture, facilitates deployment and trial and error inspection, and has good scalability and portability.

Description

Technical Field

[0001] The present invention relates to the field of detection of online advertising cheating behavior, and in particular to a method and device for detecting low-rate cheating traffic. Background Art

[0002] The description in this section merely provides background information related to the present disclosure and does not constitute prior art.

[0003] With the rapid development of information technology, online advertising business continues to increase, and online advertising fraud has also been exposed and has an exponential growth trend. Online advertising fraud - fraudulent traffic refers to the use of automated script technology or artificial simulation of normal network users to interact with online advertisements for the purpose of seeking improper benefits. Fraudulent traffic not only directly damages the economic interests of advertisers, but also reduces the commercial credit and public reputation of advertising platforms. Therefore, how to efficiently identify and filter fraudulent traffic is a top priority for the advertising industry. Among the existing solutions, most solutions can efficiently identify fraudulent traffic generated by automatic scripts, but they perform poorly in identifying fraudulent traffic generated by manual clicks and fraudulent traffic generated randomly at a low rate.

[0004] It should be noted that the above introduction to the technical background is only for the convenience of providing a clear and complete description of the technical solutions of the present invention and for the convenience of understanding by those skilled in the art. It cannot be considered that the above technical solutions are well known to those skilled in the art simply because these solutions are described in the background technology section of the present invention. Summary of the invention

[0005] The technical problem to be solved by the present invention is to provide a method and device for detecting low-rate cheating traffic.

[0006] In order to solve the above technical problems, a method for detecting low-rate cheating traffic includes:

[0007] Character feature processing: Get the abnormal score S of the character feature str ;

[0008] Numerical feature processing: Get the abnormal score S of the numerical feature num ;

[0009] Dataset tokenization: Anomaly score S based on character features str and the abnormality score S of the numerical feature num , get the final sample evaluation score Score fin .

[0010] Preferably, the character feature processing includes:

[0011] Encoding is performed based on character features;

[0012] Determine whether the field after encoding is empty, and use the indicator function to express the influence of the empty field, where s null >s ok , when the field is empty, I = s null , when the field is not empty, I = s ok ,

[0013]

[0014] Field probability statistics: The field probability value is Where n represents the number of character features, c i Indicates a certain type of character features;

[0015] Anomaly score setting: Calculate the anomaly score S of character features str ,

[0016] S str =I*(1-Pr c ) (2).

[0017] Preferably, the numerical feature processing includes:

[0018] Null value processing: Use an indicative function to express the impact of an empty field, where s null >s ok , when the field is empty, I = s null , when the field is not empty, I = s ok ;

[0019]

[0020] Standardization processing: make the data obey normal distribution;

[0021] Similarity calculation based on Gaussian kernel function: By using the kernel function, the standardized data is mapped to the high-dimensional feature space. In formula (3), the Gaussian kernel function is used for similarity calculation. Formula (4) is the formula for calculating the Euclidean distance, where d is the weight, α = {α1, α2, ..., α n},in

[0022]

[0023]

[0024] Anomaly score setting: In formula (5), according to the known abnormal samples Calculate the anomaly score of unknown data and obtain the numerical feature anomaly score S num ,

[0025]

[0026] The dataset identification includes calculating the final sample evaluation score Score fin , where ω p To allocate to S str The weight of

[0027] Score fin =ω p S str +(1-ω p )S num (6).

[0028] Preferably, the detection method further includes data cleaning, and the data cleaning includes:

[0029] Identify anomalies based on strict strategies: Calculate the anomaly score S of character features str and numerical feature abnormality score S num When the difference is within the set threshold, the data sample is output. When the difference exceeds the set threshold, the data sample is manually audited to determine whether the sample is a usable sample set. When it is determined to be a collectable sample, the collectable data sample set is output. When it is determined to be an uncollectable sample, the sample is discarded.

[0030] The data cleaning also includes identifying anomalies based on advertising effects: when the final sample evaluation score Score fin If it is not within the preset range, the advertising effect is marked as abnormal. When the advertising effect is marked as abnormal, all the content of the same category in the historical data is marked as abnormal, and a manual audit is performed to determine whether the sample is a usable sample set. When the advertising effect is marked as non-abnormal, the abnormal identification step based on strict strategies is performed.

[0031] The detection method further includes performing data balancing on the data sample set after data cleaning, wherein the data balancing includes:

[0032] Calculate the k neighbors of the minority class samples: Find the k value based on cross-validation. In formula (7), based on the Euclidean distance, calculate the distance from each minority class sample to the k neighbors.

[0033]

[0034] Calculate the amount of samples to be synthesized: amount com =amount multi -amount less (8) Among them, amount multi is the normal traffic quantity in the dataset, amountless The number of cheating traffic in the dataset;

[0035] Random linear interpolation: The synthetic minority class samples to be added are randomly selected on these k “straight lines” using the sampling method with replacement. The positions of the synthetic samples are determined by equation (8), where x is the position of the original sample point, is the periapsis position, x new is the position of the synthetic sample,

[0036]

[0037] The data balancing also includes data fusion, and the data fusion includes splicing the synthesized samples with the original samples to synthesize a positive and negative sample data set with equal proportions.

[0038] Preferably, the detection method further comprises directly calling the XGBoost model based on the sk-learn library to classify the data set, wherein the hyper parameters include max_depth, eta, and objective, and the classification accuracy of the model is improved by adjusting the hyper parameters, wherein the objective function objective is shown in Formulas 10 and 11,

[0039]

[0040]

[0041] in, Represents the predicted value of the model, y i represents the category label of the i-th sample, k represents the number of trees, and f k represents the k-th tree model, T represents the number of leaf nodes of each tree, w represents the set of scores of the leaf nodes of each tree, γ and λ represent coefficients, which need to be adjusted in practical applications.

[0042] The present application provides a low-rate fraud traffic detection device, the detection device comprising a character feature processing module for obtaining an abnormal score S of the character feature. str ;

[0043] Numerical feature processing module, used to obtain the abnormal score S of the numerical feature num ;

[0044] Dataset tokenization module, used to score anomalies S based on character features str and the abnormality score S of the numerical feature num , get the final sample evaluation score Score fin .

[0045] Preferably, the character feature processing module includes:

[0046] The encoding processing submodule is used to perform encoding processing based on character features;

[0047] The empty judgment submodule is used to judge whether the field after encoding is empty or not, and uses an indicative function to express the influence of the empty field, where s null >s ok , when the field is empty, I = s null , when the field is not empty, I = s ok ,

[0048]

[0049] The field probability statistics submodule is used to calculate the field probability value Where n represents the number of character features, c i Indicates a certain type of character features;

[0050] The character feature anomaly score setting submodule is used to calculate the anomaly score S of the character feature. str ,

[0051] S str =I*(1-Pr e ) (2),

[0052] The numerical feature processing module includes:

[0053] The null value processing submodule is used to express the influence of the null field using an indicative function, where s null >s ok , when the field is empty, I = s null , when the field is not empty, I = s ok ,

[0054]

[0055] The standardization processing submodule is used to make the data conform to normal distribution;

[0056] The similarity calculation submodule based on Gaussian kernel function is used to map the processed data into a high-dimensional feature space by using the kernel function. In formula (3), the Gaussian kernel function is used for similarity calculation. Formula (4) is the formula for calculating the Euclidean distance, where α is the weight, α = {α1, α2, ..., α n},in

[0057]

[0058]

[0059] The numerical feature anomaly score setting submodule is used to set the anomaly score based on known anomaly samples. Calculate the anomaly score of unknown data and obtain the numerical feature anomaly score S num ,

[0060]

[0061] The dataset identification module calculates the final sample evaluation score Score fin , where ω p To allocate to S str The weight of

[0062] Score fin =ω p S str +(1-ω p )S num (6).

[0063] Preferably, the detection device further includes a data cleaning module and a data balancing module.

[0064] The data cleaning module is used to identify anomalies with strict policies and calculate the anomaly score S of character features. str and numerical feature abnormality score S num When the difference is within the set threshold, the data sample is output. When the difference exceeds the set threshold, the data sample is manually audited to determine whether the sample is a usable sample set. If it is determined to be a collectable sample, the collectable data sample set is output. If it is determined to be an uncollectable sample, the sample is discarded.

[0065] The data cleaning module is also used to identify outliers based on advertising effects. fin If it is not within the preset range, the advertising effect is marked as abnormal. When the advertising effect is marked as abnormal, all the content of the same category in the historical data is marked as abnormal, and a manual audit is performed to determine whether the sample is a usable sample set. When the advertising effect is marked as non-abnormal, the abnormal identification step based on strict strategies is performed.

[0066] The data sample set output by the data cleaning module is used as the input of the data balancing module. The data balancing module is used to calculate the k neighbors of the minority class samples and find the k value based on cross-validation. In formula (7), the distance from each minority class sample to the k neighbors is calculated based on the Euclidean distance.

[0067]

[0068] The data balancing module is also used to calculate the amount of samples to be synthesized: amount com =amountmulti -amount less (8), where amount multi is the normal traffic quantity in the dataset, amount less The number of cheating traffic in the dataset;

[0069] The data balancing module is also used for random linear interpolation. It uses the method of sampling with replacement to randomly select synthetic minority class samples to be added on these k “straight lines”. The position of the synthetic sample is determined by formula (8), x is the position of the original sample point, is the periapsis position, x new is the position of the synthetic sample,

[0070]

[0071] The data balancing module also includes a data fusion submodule, which is used to splice the synthesized samples with the original samples to synthesize a positive and negative sample data set with equal proportions.

[0072] The present application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the above-mentioned detection method is implemented when the processor executes the computer program.

[0073] The present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned detection method is implemented.

[0074] By means of the above technical solution, the beneficial effects of the present invention are as follows:

[0075] The low-rate fraud traffic detection method and device of the present invention can efficiently and accurately identify and detect fraud traffic generated by manual clicking and fraud traffic generated by basic semi-automatic scripts. The present application decouples the overall architecture to facilitate deployment and trial and error checking, and also has good scalability and portability. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] Figure 1 This is the overall framework diagram of the low-rate cheating traffic detection of this application;

[0077] Figure 2 is a character feature anomaly scoring flow chart of this application;

[0078] Figure 3 It is a flowchart of the numerical feature anomaly scoring of this application;

[0079] Figure 4 It is the logic flow chart of the data cleaning stage of this application;

[0080] Figure 5 This is a flow chart of data balancing processing implemented in this application. DETAILED DESCRIPTION

[0081] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0082] It should be noted that, in the description of the present invention, the terms "first", "second", etc. are only used for descriptive purposes and to distinguish similar objects. There is no order of precedence between the two, and they cannot be understood as indicating or implying relative importance. In addition, in the description of the present invention, unless otherwise specified, "plurality" means two or more.

[0083] Reference Figure 1 The low-rate cheating traffic detection method of the present application includes character feature processing: obtaining an abnormal score S of the character feature str ; Numerical feature processing: Get the abnormal score S of the numerical feature num ; Dataset identification: Anomaly score S based on character features str and the abnormality score S of the numerical feature num , get the final sample evaluation score Score fin ; Data cleaning; Data balancing; XGBoost classification to get the final result.

[0084] Reference Figure 2 This is a character feature abnormality scoring flow chart of the present application, wherein the character feature processing specifically includes:

[0085] Encoding is performed for character features, such as advertising accounts, user device models, etc. Encoding is required. Since there are too many value categories for character features, direct encoding is not conducive to model construction. Therefore, before encoding, filtering rules are needed to merge some similar value categories and limit their value categories. For example, "xxx video-13-0317" and "xxx video-0309-30" should be considered as one category;

[0086] Determine whether the encoded field is empty. Considering that a field is empty, it may be an abnormal situation. Based on this, an abnormal score value can be set for each data. For example, cheating by replaying data packets may cause some fields of the collected data to be empty. Here, an indicative function is used to express the impact of an empty field, where snull >s ok , when the field is empty, I = s null , when the field is not empty, I = s ok ,

[0087]

[0088] Field probability statistics: The probability of each value in a field is different. The lower the probability, the greater the possibility of abnormality, which in turn affects the value of the abnormality score. For example, by replaying the data packet to cheat, the value of a field is not a legal value. The field probability value is Where n represents the number of character features, c i Indicates a certain type of character features;

[0089] Anomaly score setting: The anomaly score for character features is shown in Formula 2. When the field is empty,

[0090] I=s null , the higher the anomaly score is. The lower the probability of the field value appearing, the higher the anomaly score is.

[0091] S str =I*(1-Pr c ) (2).

[0092] Reference Figure 3 This is a flowchart of the numerical feature anomaly scoring of the present application. The numerical feature processing includes:

[0093] Null value processing: Null value processing in numerical features is an indispensable process for model detection. For key fields used to judge anomalies, if they are null values, it may be an abnormal situation, and an abnormal value can be set directly for them. The indicative function in formula 1 can be used to express the influence of the empty field. For other non-key fields, they need to be filled according to the mode for subsequent model evaluation.

[0094] Standardization processing: make the data obey normal distribution, which is convenient for subsequent similarity calculation;

[0095] Similarity calculation based on Gaussian kernel function: By using the kernel function, the processed data is mapped to a high-dimensional feature space, so that the relationship between them can be better reflected when calculating the similarity. Specifically, in formula (3), the Gaussian kernel function is used for similarity calculation, and formula (4) is the formula for calculating the Euclidean distance, where α is the weight, α = {α1, α2, ..., α n},in

[0096]

[0097]

[0098] The Gaussian kernel function is a scalar function that is radially symmetric. It is usually defined as a monotonic function of the Euclidean distance between any point x in space and a certain center xc. Its function is often to calculate similarity.

[0099] Anomaly scoring setting: Using manually labeled data sets, we can Calculate the anomaly score of unknown data. The anomaly score for numerical features is shown in Formula 5. When the key field is empty, the anomaly score value is relatively higher. When the similarity between the unknown sample and the abnormal sample is higher and the sample distance is smaller, the anomaly score value is relatively higher.

[0100]

[0101] Dataset identification includes calculating the final sample evaluation score Score fin , where ω p To allocate to S str The weight of

[0102] Score fin =ω p S str +(1-ω p )S num (6).

[0103] like Figure 4 As shown, it is a flow chart of the logic explanation of the data cleaning stage of the present application, and the data cleaning includes:

[0104] Identification anomalies based on advertising effect: When the final sample evaluation score Score fin If it is not within the preset range, the advertising effect is marked as abnormal. When the advertising effect is marked as abnormal, all the content of the same category in the historical data is marked as abnormal, and a manual audit is performed to determine whether the sample of this category is a usable sample set. When the advertising effect is marked as non-abnormal, the step of marking abnormalities based on strict strategies is performed;

[0105] Identify anomalies based on strict strategies: Calculate the anomaly score S of character features str and numerical feature abnormality score S num When the difference is within the set threshold, the data sample is output; when the difference exceeds the set threshold, the data sample is manually audited to determine whether the sample is a usable sample set; if it is determined to be a collectable sample, the collectable data sample set is output; if it is determined to be an uncollectable sample, the sample is discarded.

[0106] like Figure 5As shown, the detection method further includes performing data balancing on the data sample set after data cleaning, and the data balancing includes:

[0107] Based on cross-validation, a suitable k value is found to ensure that overfitting does not occur. Based on the Euclidean distance as shown in Formula 7, the distance from each minority class sample to its k neighbors is calculated;

[0108]

[0109] Calculate the number of samples to be synthesized: Based on the concept of zero-trust network, we assume that there is one cheating traffic in every two traffic. Therefore, we will consider a 1:1 positive and negative sample data set. Therefore, the number of samples to be synthesized for the minority class is shown in Formula 8,

[0110] amount com =amount multi -amount less (8)

[0111] Among them, amount multi is the normal traffic quantity in the dataset, amount less The number of cheating traffic in the dataset;

[0112] Random linear interpolation uses the method of sampling with replacement to randomly select synthetic minority class samples to be added on these k “straight lines”, where the position of the synthetic sample is determined by formula (8), x is the position of the original sample point, is the periapsis position, x new is the position of the synthetic sample,

[0113]

[0114] Data fusion: Perform a splicing operation to splice the synthetic samples with the original samples to synthesize a positive and negative sample dataset with equal ratios.

[0115] The detection method also includes directly calling the XGBoost model based on the sk-1earn library to classify the data set, wherein the hyper parameters are max_depth, eta, and objective, wherein max_depth is the tree depth, eta is the learning rate, and objective is the objective function. XGBoost is eXtreme Gradient Boosting, which is an integrated learning model based on decision trees. The classification accuracy of the model is improved by adjusting the hyper parameters, and the objective function objective is shown in equations 10 and 11.

[0116]

[0117]

[0118] The present application also provides a low-rate cheating traffic detection device, the detection device comprising:

[0119] Character feature processing module, used to obtain the abnormal score S of character features str ;

[0120] Numerical feature processing module, used to obtain the abnormal score S of the numerical feature num ;

[0121] Dataset tokenization module, used to score anomalies S based on character features str and the abnormality score S of the numerical feature num , get the final sample evaluation score Score fin .

[0122] Data cleaning module and data balancing module.

[0123] The character feature processing module includes:

[0124] The encoding processing submodule is used to perform encoding processing based on character features;

[0125] The empty judgment submodule is used to judge whether the field after encoding is empty or not, and uses an indicative function to express the influence of the empty field, where s null >s ok , when the field is empty, I = s null , when the field is not empty, I = s ok ,

[0126]

[0127] The field probability statistics submodule is used to calculate the field probability value Where n represents the number of character features, c i Indicates a certain type of character features;

[0128] The character feature anomaly score setting submodule is used to calculate the anomaly score S of the character feature. str ,

[0129] S str =I*(1-Pr c ) (2),

[0130] The numerical feature processing module includes:

[0131] The null value processing submodule is used to express the influence of the null field using an indicative function, where s null >s ok , when the field is empty, I = snull , when the field is not empty, I = s ok ,

[0132]

[0133] The standardization processing submodule is used to make the data conform to normal distribution;

[0134] The similarity calculation submodule based on Gaussian kernel function is used to map the processed data into a high-dimensional feature space by using the kernel function. In formula (3), the Gaussian kernel function is used for similarity calculation. In formula (4), different weights α = {α1, α2, ..., α n},in

[0135]

[0136]

[0137] The numerical feature anomaly score setting submodule is used to set the anomaly score based on known anomaly samples. Calculate the anomaly score of unknown data and obtain the numerical feature anomaly score S num ,

[0138]

[0139] The dataset identification module calculates the final sample evaluation score Score fin , where ω p To allocate to S str , the weight of

[0140] Score fin =ω p S str +(1-ω p )S num (6).

[0141] The data cleaning module is used to identify anomalies with strict policies and calculate the anomaly score S of character features. str and numerical feature abnormality score S num When the difference is within the set threshold, the data set is output; when the difference exceeds the set threshold, the data sample is manually audited to determine whether the sample is a usable sample set; if it is determined to be a collectable sample, the data set is output; if it is determined to be an uncollectable sample, the sample is discarded;

[0142] The data cleaning module is also used to identify outliers based on advertising effects. finIf it is not within the preset range, the advertising effect is marked as abnormal. When the advertising effect is marked as abnormal, all the content of the same category in the historical data is marked as abnormal, and a manual audit is performed to determine whether the sample is a usable sample set. When the advertising effect is marked as non-abnormal, the abnormal identification step based on strict strategies is performed.

[0143] The data sample set output by the data cleaning module is used as the input of the data balancing module. The data balancing module is used to calculate the k neighbors of the minority class samples and find the k value based on cross-validation. In formula (7), the distance from each minority class sample to the k neighbors is calculated based on the Euclidean distance.

[0144]

[0145] The data balancing module is also used to calculate the amount of samples to be synthesized: amount com =amount multi -amount less (8), where amount multi is the normal traffic quantity in the dataset, amount less The number of cheating traffic in the dataset;

[0146] The data balancing module is also used for random linear interpolation. It uses the method of sampling with replacement to randomly select synthetic minority class samples to be added on these k “straight lines”. The position of the synthetic sample is determined by formula (8), x is the position of the original sample point, is the periapsis position, x new is the position of the synthetic sample,

[0147]

[0148] The data balancing module also includes a data fusion submodule, which is used to splice the synthesized samples with the original samples to synthesize a positive and negative sample data set with equal proportions.

[0149] The present application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the above-mentioned detection method is implemented when the processor executes the computer program.

[0150] The present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned detection method is implemented.

[0151] The above-described embodiments are only preferred embodiments for fully illustrating the present invention, and the protection scope of the present invention is not limited thereto. Equivalent substitutions or changes made by those skilled in the art based on the present invention are within the protection scope of the present invention. The protection scope of the present invention shall be subject to the claims.

Claims

1. A method for detecting low-rate cheating traffic, characterized in that: include, Character feature processing: Get the abnormal score S of the character feature str ; Numerical feature processing: Get the abnormal score S of the numerical feature num ; Dataset tokenization: Anomaly score S based on character features str and the abnormality score S of the numerical feature num , get the final sample evaluation score Score fin ; The character feature processing includes: Encoding is performed based on character features; Determine whether the field after encoding is empty, and use the indicator function to express the influence of the empty field, where s null >s ok , when the field is empty, I = s null , when the field is not empty, I = s ok , Field probability statistics: The field probability value is Where n represents the number of character features, c i Indicates a certain type of character features; Anomaly score setting: Calculate the anomaly score S of character features str , S str =I*(1-Pr c ) (2); The numerical feature processing includes: Null value processing: Use an indicative function to express the impact of an empty field, where s null >s ok , when the field is empty, I = s null , when the field is not empty, I = s ok ; Standardization processing: make the data obey normal distribution; Similarity calculation based on Gaussian kernel function: By using the kernel function, the standardized data is mapped to the high-dimensional feature space. In formula (3), the Gaussian kernel function is used for similarity calculation. Formula (4) is the formula for calculating the Euclidean distance, where α is the weight, α = {α1, α2, ..., α n },in Anomaly score setting: In formula (5), according to the known abnormal samples Calculate the anomaly score of unknown data and obtain the numerical feature anomaly score S num , The dataset identification includes calculating the final sample evaluation score Score fin , where ω p Assigned to S str The weight of Score fin =ω p S str +(1-ω p )S num (6); The detection method further includes data cleaning, and the data cleaning includes: Identify anomalies based on strict strategies: Calculate the anomaly score S of character features str and numerical feature abnormality score S num When the difference is within the set threshold, the data sample is output. When the difference exceeds the set threshold, the data sample is manually audited to determine whether the sample is a usable sample set. When it is determined to be a collectable sample, the collectable data sample set is output. When it is determined to be an uncollectable sample, the sample is discarded. The data cleaning also includes identifying anomalies based on advertising effects: when the final sample evaluation score Score fin If it is not within the preset range, the advertising effect is marked as abnormal. When the advertising effect is marked as abnormal, all the content of the same category in the historical data is marked as abnormal, and it is determined by manual audit whether the sample of this category is an available sample set. When the advertising effect is marked as non-abnormal, the step of marking abnormality based on strict strategy is performed. The detection method also includes data balancing processing of the data sample set after data cleaning, and the data balancing includes, Calculate the k neighbors of the minority class samples: Find the k value based on cross-validation. In formula (7), based on the Euclidean distance, calculate the distance from each minority class sample to the k neighbors. Calculate the amount of samples to be synthesized: amount com =amount multi -amount less (8) Among them, amount multi is the normal traffic quantity in the dataset, amount less The number of cheating traffic in the dataset; Random linear interpolation: The synthetic minority class samples to be added are randomly selected on these k "straight lines" using sampling with replacement. The positions of the synthetic samples are determined by equation (9), where x is the position of the original sample point, is the position of the neighboring point, x new is the position of the synthetic sample, The data balancing also includes data fusion, and the data fusion includes splicing the synthesized samples with the original samples to synthesize a positive and negative sample data set with equal proportions; The detection method also includes directly calling the XGBoost model based on the sk-learn library to classify the data set, wherein the hyper parameters are max_depth, eta, and objective, and the classification accuracy of the model is improved by adjusting the hyper parameters, wherein the objective function objective is shown in Formulas 10 and 11. in, Represents the predicted value of the model, yi represents the category label of the i-th sample, k represents the number of trees, fk represents the k-th tree model, T represents the number of leaf nodes of each tree, w represents the set of scores of the leaf nodes of each tree, and γ and λ represent coefficients.

2. A low-rate cheating traffic detection device, characterized in that: The detection device comprises: Character feature processing module, used to obtain the abnormal score S of character features str ; Numerical feature processing module, used to obtain the abnormal score S of the numerical feature num ; Dataset tokenization module, used to score anomalies S based on character features str and the abnormality score S of the numerical feature num , get the final sample evaluation score Score fin , The character feature processing module includes: The encoding processing submodule is used to perform encoding processing based on character features; The empty judgment submodule is used to judge whether the field after encoding is empty or not, and uses an indicative function to express the influence of the empty field, where s null >s ok , when the field is empty, I = s null , when the field is not empty, I = s ok , The field probability statistics submodule is used to calculate the field probability value Where n represents the number of character features, c i Indicates a certain type of character features; The character feature anomaly score setting submodule is used to calculate the anomaly score S of the character feature. str , S str =I*(1-Pr c ) (2), The numerical feature processing module includes: The null value processing submodule is used to express the influence of the null field using an indicative function, where s null >s ok , when the field is empty, I = s null , when the field is not empty, I = s ok , The standardization processing submodule is used to make the data conform to normal distribution; The similarity calculation submodule based on Gaussian kernel function is used to map the processed data into a high-dimensional feature space by using the kernel function. In formula (3), the Gaussian kernel function is used for similarity calculation. Formula (4) is the formula for calculating the Euclidean distance, where α is the weight, α = {α1, α2, ..., α n },in The numerical feature anomaly score setting submodule is used to set the anomaly score based on known anomaly samples. Calculate the anomaly score of unknown data and obtain the numerical feature anomaly score S num , The dataset identification module calculates the final sample evaluation score Score fin , where ω p Assigned to S str The weight of Score fin =ω p S str +(1-ω p )S num (6), The detection device also includes a data cleaning module and a data balancing module. The data cleaning module is used to identify anomalies with strict policies and calculate the anomaly score S of character features. str and numerical feature abnormality score S num When the difference is within the set threshold, the data sample is output. When the difference exceeds the set threshold, the data sample is manually audited to determine whether the sample is a usable sample set. If it is determined to be a collectable sample, the collectable data sample set is output. If it is determined to be an uncollectable sample, the sample is discarded. The data cleaning module is also used to identify anomalies based on advertising effects. fin If the advertising effect is not within the preset range, the advertising effect is marked as abnormal. When the advertising effect is marked as abnormal, all the content of the same category in the historical data is marked as abnormal, and a manual audit is performed to determine whether the sample of this category is a usable sample set. When the advertising effect is marked as non-abnormal, the abnormal identification step based on strict strategies is performed. The data sample set output by the data cleaning module is used as the input of the data balancing module. The data balancing module is used to calculate the k neighbors of the minority class samples and find the k value based on cross-validation. In formula (7), the distance from each minority class sample to the k neighbors is calculated based on the Euclidean distance. The data balancing module is also used to calculate the amount of samples to be synthesized: amount com =amount multi -amount less (8) Among them, amount multi is the normal traffic quantity in the dataset, amount less The number of cheating traffic in the dataset; The data balancing module is also used for random linear interpolation. It uses the method of sampling with replacement to randomly select synthetic minority class samples to be added on these k "straight lines". The position of the synthetic sample is determined by formula (9), x is the position of the original sample point, is the position of the neighboring point, x new is the position of the synthetic sample, The data balancing module also includes a data fusion submodule, which is used to splice the synthesized samples with the original samples to synthesize a positive and negative sample data set with equal proportions.

3. A computer device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method according to claim 1 is implemented.

4. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to claim 1 is implemented.

Images