Abnormal account identification method, device, equipment, storage medium and program product

Abstract

The embodiments of the present application disclose a method, apparatus, device, storage medium, and program product for identifying abnormal accounts, belonging to the field of artificial intelligence. The method includes: obtaining at least two account relationship matrices, wherein different account relationship matrices correspond to different relationship dimensions, and the account relationship matrix is ​​used to characterize the correlation relationship between different accounts under the corresponding relationship dimension; generating a target diffusion kernel based on the at least two account relationship matrices, wherein the target diffusion kernel is used to characterize the diffusion of the correlation relationship between accounts; and identifying abnormal accounts from unlabeled accounts based on the target diffusion kernel and labeled accounts, wherein the labeled accounts and unlabeled accounts are accounts in the account relationship matrix. Since abnormal accounts usually have correlations, when identifying abnormal accounts, the relationship between accounts is mined based on the account relationship matrix, and the labeled accounts are used as anchor points to mine potential abnormal accounts, which helps to improve the accuracy of identifying abnormal accounts.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of artificial intelligence, and in particular to a method, apparatus, device, storage medium, and program product for identifying abnormal accounts. Background Art

[0002] Abnormal accounts on the platform can cause serious harm to the platform, so how to identify abnormal accounts has become an important issue in platform maintenance.

[0003] In related technologies, a large amount of account information is collected to identify abnormal accounts based on their own account characteristics. However, in the above solution, each account is identified as an independent individual, resulting in low recognition accuracy. Summary of the Invention

[0004] The present invention provides a method, apparatus, device, storage medium, and program product for identifying abnormal accounts. The technical solution is as follows:

[0005] In one aspect, an embodiment of the present application provides a method for identifying abnormal accounts, the method comprising:

[0006] Obtain at least two account relationship matrices, where different account relationship matrices correspond to different relationship dimensions, and the account relationship matrices are used to represent the association relationships between different accounts under the corresponding relationship dimensions;

[0007] generating a target diffusion kernel based on at least two of the account relationship matrices, wherein the target diffusion kernel is used to characterize the diffusion of the association relationship between the accounts;

[0008] Based on the target diffusion kernel and the labeled accounts, abnormal accounts are identified from the unlabeled accounts, wherein the labeled accounts and the unlabeled accounts are accounts in the account relationship matrix.

[0009] On the other hand, an embodiment of the present application provides a device for identifying abnormal accounts, the device comprising:

[0010] An acquisition module, configured to acquire at least two account relationship matrices, wherein different account relationship matrices correspond to different relationship dimensions, and the account relationship matrices are used to represent the association relationships between different accounts under the corresponding relationship dimensions;

[0011] a generating module, configured to generate a target diffusion kernel based on at least two of the account relationship matrices, wherein the target diffusion kernel is used to characterize the diffusion of the association relationship between the accounts;

[0012] An identification module is configured to identify abnormal accounts from unlabeled accounts based on the target diffusion kernel and labeled accounts, wherein the labeled accounts and the unlabeled accounts are accounts in the account relationship matrix.

[0013] On the other hand, an embodiment of the present application provides a computer device, which includes a processor and a memory, wherein the memory stores at least one program, and the at least one program is loaded and executed by the processor to implement the method for identifying abnormal accounts as described in the above aspects.

[0014] On the other hand, an embodiment of the present application provides a computer-readable storage medium, in which at least one program is stored. The at least one program is loaded and executed by a processor to implement the method for identifying abnormal accounts as described in the above aspects.

[0015] On the other hand, an embodiment of the present application provides a computer program product, which includes computer instructions. When the computer instructions are executed by a processor, the method for identifying abnormal accounts described in the above aspects is implemented.

[0016] In an embodiment of the present application, a computer device obtains at least two account relationship matrices representing the relationships between different accounts, and generates a target diffusion kernel representing the diffusion of the relationships between the accounts based on the at least two account relationship matrices, thereby identifying abnormal accounts among unlabeled accounts based on the target diffusion kernel and the labeled accounts in the account relationship matrix. Since abnormal accounts are generally associated with each other, when identifying abnormal accounts, the relationships between accounts are mined based on the account relationship matrix, and potential abnormal accounts can be mined using the labeled accounts as anchor points, which helps to improve the accuracy of identifying abnormal accounts. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly introduce the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0018] Figure 1 is a schematic diagram of an implementation environment provided by an exemplary embodiment of the present application;

[0019] Figure 2 A flowchart of a method for identifying abnormal accounts provided by an exemplary embodiment of the present application is shown;

[0020] Figure 3 A flowchart of a method for identifying abnormal accounts provided by another exemplary embodiment of the present application is shown;

[0021] Figure 4 is a flow chart of a parameter training process shown in an exemplary embodiment of the present application;

[0022] Figure 5 This is a schematic diagram illustrating an implementation of parameter training and abnormal account identification processes according to an exemplary embodiment of the present application;

[0023] Figure 6 A structural block diagram of an abnormal account identification device provided by an exemplary embodiment of the present application is shown. DETAILED DESCRIPTION

[0024] Figure 1 1 is a schematic diagram of an implementation environment provided by an exemplary embodiment of the present application, wherein the implementation environment includes a terminal 110 and a server 120 .

[0025] The terminal 110 is an electronic device used to set an abnormal account identification task, and the electronic device may be a smart phone, a tablet computer, a personal computer, a personal workstation, or the like. Figure 1 The terminal 110 is described as a personal computer as an example, but this is not a limitation.

[0026] Optionally, terminal 110 is configured to issue an abnormal account identification task to server 120. The abnormal account identification task may include an identification scope of abnormal accounts and abnormal account types. The identification scope of abnormal accounts may be divided based on account location, account level, account registration time, etc., and the abnormal account types may include gray market accounts, water army accounts, cheating accounts, etc. The embodiments of this application do not limit the specific content of the abnormal account identification task.

[0027] Server 120 is a server used to perform the task of identifying abnormal accounts. It can be a single server or a server group consisting of multiple servers. It can be a physical server or a cloud server, which is not limited in this embodiment of the application. Optionally, server 120 is the backend server of an application, website, or forum, and is used to identify abnormal accounts registered in the application, website, or forum.

[0028] In the embodiments of the present application, since an account relationship matrix is ​​required for identifying abnormal accounts, in one possible implementation, server 120 is further connected to other servers to obtain data from these other servers for constructing the account relationship matrix. Furthermore, since abnormal account identification requires using previously labeled accounts as anchor points, server 120 also needs to obtain manually labeled normal and abnormal accounts. For example, these manually labeled accounts are provided by terminal 110.

[0029] In one possible implementation, for the identified abnormal accounts, the server 120 directly processes the abnormal accounts, for example, bans the accounts, issues warnings, etc.; in another possible implementation, the server 120 feeds back the identified abnormal accounts to the terminal 110, which manually reviews the abnormal accounts and then processes the abnormal accounts that pass the review.

[0030] The above embodiments illustrate the use of a server to identify abnormal accounts. In other possible implementations, abnormal account identification can also be performed by a terminal, or by a terminal and server working together to achieve abnormal account identification. This embodiment does not limit this. For ease of description, the following embodiments illustrate the abnormal account identification method performed by a computer device.

[0031] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.), and signals involved in the embodiments of this application are all authorized by the user or fully authorized by all parties, and the collection, use, and processing of relevant data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. For example, the social relationship chains and historical online behaviors involved in this application are all obtained with full authorization.

[0032] Please refer to Figure 2 , which shows a flowchart of a method for identifying abnormal accounts provided by an exemplary embodiment of the present application. The method may include the following steps.

[0033] Step 201 : Obtain at least two account relationship matrices. Different account relationship matrices correspond to different relationship dimensions, and the account relationship matrices are used to represent the association relationships between different accounts under the corresponding relationship dimensions.

[0034] In one possible implementation, a computer device obtains the associations of accounts under different relationship dimensions, and generates different account relationship matrices based on the associations. The relationship dimensions may include social relationships, online behavioral relationships, interactive relationships, and the like. The present embodiment does not limit the specific types of relationship dimensions.

[0035] It should be noted that different account relationship matrices correspond to the same account. That is, different account relationship matrices are used to represent the relationship between the same group of accounts under different relationship dimensions. For example, the account relationship matrix is ​​an n×n matrix, where n is the number of accounts.

[0036] Step 202 : Generate a target diffusion kernel based on at least two account relationship matrices. The target diffusion kernel is used to characterize the diffusion of the association relationship between the accounts.

[0037] A kernel function is a function that maps the input space to a high-dimensional feature space through nonlinear transformation, while a diffusion kernel is a kernel function used to characterize the diffusion of relationships between objects.

[0038] Since the account relationship matrix can represent the relationship network between accounts, in order to explore the similarity between the accounts represented by the account relationship matrix, the computer device generates a target diffusion kernel based on the account association relationships represented by at least two account relationship matrices. The target diffusion kernel is used to represent the diffusion of the association relationships between the accounts corresponding to the account relationship matrix.

[0039] Because the target diffusion kernel is generated based on the account relationship matrix under different relationship dimensions, the target diffusion kernel more accurately represents the diffusion of the associated relationship, thereby improving the accuracy of subsequent abnormal account identification using the target diffusion kernel. The specific method for generating the target diffusion kernel will be detailed in the following embodiments.

[0040] Step 203 : Based on the target diffusion kernel and the labeled accounts, abnormal accounts are identified from the unlabeled accounts. The labeled accounts and the unlabeled accounts are accounts in the account relationship matrix.

[0041] In the embodiment of the present application, the accounts corresponding to the account relationship matrix include some marked accounts and some unmarked accounts, wherein the marked accounts include corresponding labels for indicating whether the accounts are abnormal accounts or normal accounts.

[0042] When identifying anomalous accounts among unlabeled accounts, the computer device uses the labeled accounts as anchors and uses a target diffusion kernel to identify the anomalous accounts from the unlabeled accounts. In some embodiments, the target diffusion kernel can determine the distance between different accounts, where a larger distance indicates a lower degree of similarity between the accounts, and a smaller distance indicates a higher degree of similarity between the accounts.

[0043] In one possible implementation, the computer device implements a classification algorithm after the target diffusion kernel. The classification algorithm classifies unlabeled accounts based on the distance between them and labeled accounts. For example, if the distance between an unlabeled account and a labeled anomalous account is less than a distance threshold, the unlabeled account is determined to be an anomalous account.

[0044] It should be noted that the accuracy of identifying abnormal accounts is related to the proportion of marked accounts. The higher the proportion of marked accounts to the total number of accounts (marked accounts + unmarked accounts), the higher the accuracy of identifying abnormal accounts; the lower the proportion of marked accounts to the total number of accounts, the lower the accuracy of identifying abnormal accounts.

[0045] In summary, in an embodiment of the present application, a computer device obtains at least two account relationship matrices that represent the relationships between different accounts, and generates a target diffusion kernel that represents the diffusion of the relationships between the accounts based on the at least two account relationship matrices, thereby identifying abnormal accounts among unlabeled accounts based on the target diffusion kernel and the labeled accounts in the account relationship matrix. Since abnormal accounts usually have correlations, when identifying abnormal accounts, the relationships between accounts are mined based on the account relationship matrix, and potential abnormal accounts can be mined using the labeled accounts as anchor points, which helps to improve the accuracy of identifying abnormal accounts.

[0046] In one possible implementation, each account relationship matrix is ​​an adjacency matrix. When generating a target diffusion kernel based on at least two account relationship matrices, it is necessary to fuse the account relationship matrices. Specifically, the associations between accounts in different relationship dimensions must be fused to generate the target diffusion kernel based on the fused relationship matrices. This is illustrated below using an exemplary embodiment.

[0047] Please refer to Figure 3 , which shows a flowchart of a method for identifying abnormal accounts provided by another exemplary embodiment of the present application. The method may include the following steps.

[0048] Step 301 : Generate a first account relationship matrix based on the social relationship chains corresponding to the respective accounts. The matrix elements in the first account relationship matrix are used to represent whether a social relationship is established between the accounts.

[0049] In one possible implementation, the computer device generates a first account relationship matrix based on the social relationships between accounts represented by the social relationship chains. When the social relationship chains of n accounts are obtained, the first account relationship matrix is ​​an n×n adjacency matrix.

[0050] Optionally, for a social relationship chain representing different social relationships, the computer device may generate multiple first account relationship matrices corresponding to the different social relationships. The social relationships represented by the social relationship chain may include friend relationships, follower relationships, colleague relationships, guild relationships, and the like, which are not limited in this embodiment of the present application.

[0051] In an illustrative example, taking friend relationships as an example, the first account relationship matrix generated based on the friend relationship chain corresponding to the account can be expressed as:

[0052]

[0053] Step 302 : Based on the historical online behaviors of each account, a second account relationship matrix is ​​generated. The matrix elements in the second account relationship matrix are used to represent whether there is any intersection between the historical online behaviors of the accounts.

[0054] The types of historical online behaviors may vary depending on the application scenario. Optionally, when used to identify abnormal accounts on a video platform, the historical online behaviors may include commenting on videos; when used to identify abnormal accounts on a gaming platform, the historical online behaviors may include teaming; when used to identify abnormal accounts on a live streaming platform, the historical online behaviors may include watching live streaming; when used to identify abnormal accounts on a social networking platform, the historical online behaviors may include matching in chat rooms, etc. The embodiments of this application do not limit the types of historical online behaviors.

[0055] Because accounts with similar or identical online behaviors are often associated, in one possible implementation, the computer device compares the historical online behaviors corresponding to different accounts and generates a second account relationship matrix based on the intersection of these historical online behaviors. When the historical online behaviors of n accounts are obtained, the second account relationship matrix is ​​an n×n adjacency matrix.

[0056] Optionally, the computer device may generate multiple second account relationship matrices to represent different types of historical online behaviors.

[0057] In an illustrative example, the second account relationship matrix generated by the computer device based on the historical video comment records corresponding to the account can be expressed as:

[0058]

[0059] In another illustrative example, the second account relationship matrix generated by the computer device based on the historical game team records corresponding to the accounts can be expressed as:

[0060]

[0061] It should be noted that the above account relationship matrix is ​​only used for illustrative purposes. The computer device can form other types of account relationship matrices based on the social relationship chain or historical online behavior actually obtained, and the embodiments of the present application are not limited to this.

[0062] Step 303: fuse at least two account relationship matrices to obtain a target relationship matrix.

[0063] Furthermore, the computer device fuses the relationship matrices between at least two accounts to obtain a target relationship matrix that fuses the multi-dimensional relationships. The target relationship matrix has the same size as the account relationship matrices. For example, if the account relationship matrix is ​​an n×n matrix, the target relationship matrix is ​​also an n×n matrix.

[0064] When performing matrix fusion, considering that different relationship dimensions represent different levels of importance of the association relationships, in one possible implementation, the computer device fuses at least two account relationship matrices based on the target fusion weights corresponding to the respective account relationship matrices to obtain a target relationship matrix.

[0065] In an illustrative example, when three account relationship matrices A1, A2, and A3 are obtained, the fused target relationship matrix can be expressed as:

[0066] A=αA1+βA2+γA3

[0067] In one possible implementation, the target fusion weights corresponding to each account relationship matrix are obtained through pre-training. The following embodiment will specifically illustrate the process of determining the target fusion weights.

[0068] Step 304: Generate a target diffusion kernel based on the target relationship matrix.

[0069] Regarding the specific method of generating the target diffusion kernel based on the target relationship matrix, in one possible implementation, the computer device first determines the target Laplace matrix corresponding to the target relationship matrix, and then generates (calculates) the target diffusion kernel based on the target Laplace matrix and the target diffusion kernel calculation parameters.

[0070] The target Laplace matrix corresponding to the target relationship matrix can be expressed as:

[0071] L=DA

[0072] Among them, D is the degree matrix corresponding to the target relationship matrix.

[0073] The target diffusion kernel can be calculated based on the target Laplace matrix and the target diffusion kernel calculation parameters as follows:

[0074] K τ =exp(-τL)

[0075] Among them, τ is the target diffusion kernel calculation parameter (constant parameter), and exp() is the matrix exponential operation.

[0076] In a possible implementation, the target diffusion kernel calculation parameters are obtained through pre-training. The following embodiment will specifically illustrate the process of determining the target diffusion kernel calculation parameters.

[0077] Step 305 : Based on the target diffusion kernel and the labeled accounts, abnormal accounts are identified from the unlabeled accounts. The labeled accounts and the unlabeled accounts are accounts in the account relationship matrix.

[0078] The implementation of this step can refer to the above-mentioned step 201, and will not be described in detail in this embodiment.

[0079] As can be seen from the above examples, the settings for target fusion weights and target diffusion kernel calculation parameters directly affect the generated target diffusion kernel, and thus the accuracy of abnormal account identification using the target diffusion kernel. To improve account identification accuracy, in one possible implementation, a computer device uses a logistic regression algorithm to determine target fusion weights and target diffusion kernel calculation parameters based on labeled accounts. The labeled accounts used in parameter training are the same as those used in the actual abnormal account identification process.

[0080] In one possible implementation, Figure 4 As shown, the parameter training process may include the following steps.

[0081] Step 401: Obtain at least two sample account relationship matrices. The sample account relationship matrices are used to represent the association relationship between the labeled accounts.

[0082] The sample account relationship matrix corresponds to the same relationship dimension as the account relationship matrix used in the actual account identification process. Furthermore, because the sample account relationship matrix only contains relationships between labeled accounts, the size of the sample account relationship matrix is ​​smaller than that of the account relationship matrix. For example, the account relationship matrix is ​​an n×n matrix, while the sample account relationship matrix is ​​an m×m matrix, where m is smaller than n.

[0083] Step 402 : Based on the fusion weights corresponding to the sample account relationship matrices, at least two sample account relationship matrices are fused to obtain a sample relationship matrix.

[0084] In one possible implementation, the computer device sets initial fusion weights for each sample account relationship matrix. During each round of training, the computer device performs weighted fusion on each sample account relationship matrix based on the fusion weights obtained from the previous round of training to obtain a sample relationship matrix. The size of the sample relationship matrix is ​​consistent with the size of the sample account relationship matrix.

[0085] Step 403: Determine the sample Laplacian matrix corresponding to the sample relationship matrix.

[0086] Optionally, based on the degree matrix corresponding to the sample relationship matrix, a sample Laplace matrix corresponding to the sample relationship matrix is ​​determined.

[0087] Step 404 : Generate a sample diffusion kernel based on the sample Laplacian matrix and the diffusion kernel calculation parameters.

[0088] In a possible implementation, the computer device sets initial diffusion kernel calculation parameters. In each round of training, the computer device calculates the sample diffusion kernel based on the sample Laplacian matrix and the diffusion kernel calculation parameters obtained after the previous round of training.

[0089] Step 405 : Determine a predicted label for the second labeled account based on the sample diffusion kernel and the first labeled account using a logistic regression algorithm. The first labeled account and the second labeled account are already labeled accounts.

[0090] In a possible implementation, the computer device divides the labeled accounts into first labeled accounts and second labeled accounts, wherein the first labeled accounts are accounts of known types during training, and the second labeled accounts are accounts to be predicted during training.

[0091] In an illustrative example, the computer device divides the marked accounts into the first marked account and the second marked account in a ratio of 9:1.

[0092] During the training process, the computer device uses the first labeled account as an anchor point and uses the sample diffusion kernel to identify abnormal accounts for the second labeled account, thereby obtaining a predicted label for the second labeled account. The predicted label is used to characterize whether the second labeled account is an abnormal account or a normal account.

[0093] Step 406 : Optimize the fusion weight and diffusion kernel calculation parameters based on the true value annotation and the predicted annotation of the second annotation account.

[0094] In one possible implementation, the computer device determines a prediction loss based on the predicted and true annotations of the second labeled account (used to characterize whether the second labeled account is actually an abnormal account or a normal account), thereby optimizing the current fusion weights and diffusion kernel calculation parameters based on the prediction loss. The prediction loss is used to characterize the degree of difference between the predicted result and the actual result. Optionally, the prediction loss may be a cross-entropy loss between the predicted and true annotations.

[0095] Regarding the method of optimizing the fusion weights and diffusion kernel calculation parameters, in some embodiments, the computer device uses a gradient descent algorithm to adjust the fusion weights and diffusion kernel calculation parameters, thereby using the adjusted fusion weights and diffusion kernel calculation parameters for the next round of training.

[0096] When identifying abnormal accounts, the computer device's desired identification targets differ for different types of abnormal accounts. For example, for cheating accounts, accuracy is more important than recall because incorrectly blocking a cheating account can cause significant losses. For black market accounts, recall is more important than accuracy because they pose a greater threat to the platform.

[0097] Based on the above characteristics, in order to further improve the recognition quality in different abnormal account recognition scenarios, in one possible implementation, this step may include the following sub-steps:

[0098] 1. Determine an evaluation metric based on the account type of the abnormal account, where the evaluation metric includes at least one of accuracy and recall.

[0099] In one possible implementation, the computer device is configured with a correspondence between the account type of the abnormal account and the evaluation index. After obtaining the parameter training task, the computer device determines the evaluation index from the correspondence based on the account type of the abnormal account to be identified.

[0100] Optionally, the evaluation index is related to the risk level of the abnormal account. The higher the risk level of the abnormal account, the more comprehensive the recall of the abnormal account is required during the identification process. The lower the risk level of the abnormal account, the more accurate the recall of the abnormal account is required during the identification process (to reduce the misidentification of normal accounts). Therefore, in some embodiments, the computer device classifies account types based on risk level and sets corresponding evaluation indicators.

[0101] Optionally, if the abnormal account belongs to a first account type, the computer device determines the evaluation indicator as recall; if the abnormal account belongs to a second account type, the computer device determines the evaluation indicator as accuracy. The risk level of accounts belonging to the first account type is higher than the risk level of accounts belonging to the second account type.

[0102] In an illustrative example, the corresponding relationship between account type, risk level and evaluation index is shown in Table 1.

[0103] Table 1

[0104] Account Type Evaluation Metrics Risk Level Black market accounts and illegal accounts Recall high Cheating accounts and water army accounts Accuracy Low

[0105] 2. Based on the true value annotation and predicted annotation of the second annotation account, determine the prediction loss under the evaluation indicator.

[0106] In a possible implementation, under different evaluation indicators, the prediction losses determined by the computer device based on the true value labeling and the predicted labeling are different.

[0107] Optionally, the prediction loss consists of two parts: recognition loss and index loss. Among them, under different evaluation indicators, the recognition loss contained in the prediction loss is the same (such as cross entropy loss), but the index loss is different. For example, when the evaluation indicator is accuracy, the computer device calculates the accuracy based on the predicted labeling and the true value labeling, and thus determines the index loss based on the accuracy, and the index loss is positively correlated with the accuracy; when the evaluation indicator is recall, the computer device calculates the recall based on the predicted labeling and the true value labeling, and thus determines the index loss based on the recall, and the index loss is positively correlated with the recall.

[0108] Among them, the accuracy of identifying abnormal accounts can be expressed as (the number of correct annotations) / the number of abnormal accounts in the predicted annotations, and the recall rate of identifying abnormal accounts can be expressed as (the number of correct annotations) / the number of abnormal accounts in the true value annotations.

[0109] 3. Optimize fusion weights and diffusion kernel calculation parameters based on prediction loss.

[0110] Furthermore, the computer device jointly optimizes the fusion weights and the diffusion kernel calculation parameters based on the determined prediction loss.

[0111] Step 407 : When the optimization end condition is met, the optimized fusion weight is determined as the target fusion weight, and the optimized diffusion kernel calculation parameter is determined as the target diffusion kernel calculation parameter.

[0112] In one possible implementation, the computer device performs training using a ten-fold cross-validation approach and terminates training when an optimization termination condition is met. The fusion weights obtained in the final round of training are then determined as target fusion weights, and the diffusion kernel calculation parameters obtained in the final round of training are determined as target diffusion kernel calculation parameters. The optimization termination condition may include at least one of a number of training rounds and a loss convergence condition, which are not limited in this embodiment.

[0113] It should be noted that when the evaluation indicator is recall rate, in the actual application stage, in order to further reduce the accuracy of subsequent processing of abnormal accounts, in one possible implementation method, the computer device pushes the identified abnormal accounts to the manual review platform so that the manual review platform can manually review the abnormal accounts.

[0114] Optionally, the computer device can obtain the audit results fed back by the manual audit platform, and then generate true value annotations based on the audit results for subsequent model update training, which is not described in detail in this embodiment.

[0115] In this embodiment, when the computer device performs parameter optimization based on the predicted labeling and the true value labeling, it determines the evaluation index in combination with the account type of the abnormal account to be identified, and then determines the prediction loss under the evaluation index based on the predicted labeling and the true value labeling. This helps to improve the recall rate when subsequently identifying high-risk abnormal accounts, as well as the accuracy rate when identifying low-risk abnormal accounts, and improves the applicability in different abnormal account identification scenarios.

[0116] In combination with the above embodiment, the complete process of parameter training and abnormal account number of the computer device is as follows: Figure 5 shown.

[0117] During the parameter training phase, the computer device generates a first sample relationship matrix 504 and a second sample relationship matrix 505 based on the first association relationship graph 502 and the second association relationship graph 503 corresponding to the labeled account 501. The computer device performs weighted fusion based on the first fusion weight α corresponding to the first sample relationship matrix 504 and the second fusion weight β corresponding to the second sample relationship matrix 504 to obtain a sample relationship matrix 506. The computer device generates a sample Laplacian matrix 507 based on the sample relationship matrix 506 and calculates the parameter τ based on the sample diffusion kernel to obtain a sample diffusion kernel 508.

[0118] Labeled accounts 501 are divided into first-labeled accounts and second-labeled accounts in a ratio of 9:1. The first-labeled accounts are used as identification anchors and input into a sample diffusion kernel 508 to obtain predicted labels 509 corresponding to the second sample accounts. Based on the true value labels 510 and predicted labels 509 corresponding to the second sample accounts, the computer device determines a prediction loss 511 and optimizes the parameters α, β, and τ based on the prediction loss 511.

[0119] During the application phase, the computer device adds unlabeled accounts to the labeled accounts 501, thereby generating a first relationship matrix 514 and a second relationship matrix 515 based on the corresponding third and fourth relationship graphs 512 and 513, respectively. The computer device then performs a weighted fusion on the first and second relationship matrices 514 and 515 based on the final optimized first and second fusion weights α and β, generating a target relationship matrix 516. The computer device generates a target Laplacian matrix 517 based on the target relationship matrix 516 and calculates a target diffusion kernel 518 based on the final optimized target diffusion kernel calculation parameter τ.

[0120] The labeled account 501 is used as an identification anchor point to input the target diffusion kernel 518 to obtain the account labels corresponding to the unlabeled accounts, and finally the abnormal accounts 519 contained therein are determined through the account labels.

[0121] Please refer to Figure 6, which shows a structural block diagram of an abnormal account identification device provided by an exemplary embodiment of the present application. The device includes:

[0122] An acquisition module 601 is configured to acquire at least two account relationship matrices, where different account relationship matrices correspond to different relationship dimensions, and the account relationship matrices are used to represent the association relationships between different accounts under the corresponding relationship dimensions.

[0123] A generating module 602 is configured to generate a target diffusion kernel based on at least two of the account relationship matrices, wherein the target diffusion kernel is used to characterize the diffusion of the association relationship between the accounts;

[0124] The identification module 603 is configured to identify abnormal accounts from unlabeled accounts based on the target diffusion kernel and labeled accounts, where the labeled accounts and the unlabeled accounts are accounts in the account relationship matrix.

[0125] Optionally, the generating module 602 is configured to:

[0126] fusing at least two of the account relationship matrices to obtain a target relationship matrix;

[0127] A target diffusion kernel is generated based on the target relationship matrix.

[0128] Optionally, in the process of fusing at least two of the account relationship matrices to obtain a target relationship matrix, the generating module 602 is configured to:

[0129] fusing at least two of the account relationship matrices based on target fusion weights corresponding to the respective account relationship matrices to obtain the target relationship matrix;

[0130] Optionally, in the process of generating the target diffusion kernel based on the target relationship matrix, the generating module 602 is configured to:

[0131] Determining a target Laplace matrix corresponding to the target relationship matrix;

[0132] The target diffusion kernel is generated based on the target Laplacian matrix and target diffusion kernel calculation parameters.

[0133] Optionally, the device further includes:

[0134] A training module is configured to determine the target fusion weight and the target diffusion kernel calculation parameter based on the labeled account number by using a logistic regression algorithm.

[0135] Optionally, the training module is used to:

[0136] Obtain at least two sample account relationship matrices, where the sample account relationship matrices are used to represent the association relationships between the labeled accounts;

[0137] fusing at least two of the sample account relationship matrices based on the fusion weights corresponding to the sample account relationship matrices to obtain a sample relationship matrix;

[0138] Determine a sample Laplace matrix corresponding to the sample relationship matrix;

[0139] generating a sample diffusion kernel based on the sample Laplace matrix and diffusion kernel calculation parameters;

[0140] determining, using a logistic regression algorithm, a predicted label for a second labeled account based on the sample diffusion kernel and a first labeled account, wherein the first labeled account and the second labeled account belong to the labeled accounts;

[0141] Optimizing the fusion weight and the diffusion kernel calculation parameters based on the true value annotation and the predicted annotation of the second labeled account;

[0142] When the optimization end condition is met, the optimized fusion weight is determined as the target fusion weight, and the optimized diffusion kernel calculation parameter is determined as the target diffusion kernel calculation parameter.

[0143] Optionally, in the process of optimizing the fusion weight and the diffusion kernel calculation parameter based on the true value annotation and the predicted annotation of the second labeled account, the training module is configured to:

[0144] determining an evaluation metric based on the account type of the abnormal account, the evaluation metric comprising at least one of accuracy and recall;

[0145] Determining a prediction loss under the evaluation indicator based on the true value annotation and the predicted annotation of the second labeled account;

[0146] The fusion weight and the diffusion kernel calculation parameters are optimized based on the prediction loss.

[0147] Optionally, in the process of determining the evaluation indicator based on the account type of the abnormal account, the training module is used to:

[0148] In a case where the abnormal account belongs to the first account type, determining that the evaluation indicator is a recall rate;

[0149] In a case where the abnormal account belongs to the second account type, determining that the evaluation indicator is accuracy;

[0150] The risk level of an account belonging to the first account type is higher than the risk level of an account belonging to the first account type.

[0151] Optionally, when the evaluation indicator is a recall rate, the apparatus further includes:

[0152] The push module is used to push the identified abnormal account to the manual review platform so that the manual review platform can manually review the abnormal account.

[0153] Optionally, the acquisition module 601 is configured to:

[0154] generating a first account relationship matrix based on the social relationship chains corresponding to the respective accounts, wherein the matrix elements in the first account relationship matrix are used to indicate whether a social relationship is established between the accounts; and / or,

[0155] Based on the historical online behaviors of the accounts, a second account relationship matrix is ​​generated. The matrix elements in the second account relationship matrix are used to represent whether there is an intersection between the historical online behaviors of the accounts.

[0156] In summary, in an embodiment of the present application, a computer device obtains at least two account relationship matrices that represent the relationships between different accounts, and generates a target diffusion kernel that represents the diffusion of the relationships between the accounts based on the at least two account relationship matrices, thereby identifying abnormal accounts among unlabeled accounts based on the target diffusion kernel and the labeled accounts in the account relationship matrix. Since abnormal accounts usually have correlations, when identifying abnormal accounts, the relationships between accounts are mined based on the account relationship matrix, and potential abnormal accounts can be mined using the labeled accounts as anchor points, which helps to improve the accuracy of identifying abnormal accounts.

[0157] In an exemplary embodiment, the present application also provides a computer device, which includes a processor and a memory, wherein the memory stores a computer program, and the computer program is loaded and executed by the processor to implement the method for identifying abnormal accounts provided in the above embodiments.

[0158] An embodiment of the present application further provides a computer-readable storage medium storing at least one program, which is loaded and executed by a processor to implement the method for identifying abnormal accounts as described in the above embodiments.

[0159] According to one aspect of the present application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the method for identifying abnormal accounts provided in various optional implementations of the aforementioned aspects.

[0160] Those skilled in the art will appreciate that in one or more of the above examples, the functions described in the embodiments of the present application can be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions can be stored in a computer-readable storage medium or transmitted as one or more instructions or codes on a computer-readable storage medium. Computer-readable storage media include computer storage media and communication media, wherein communication media include any media that facilitates the transmission of computer programs from one place to another. The storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0161] The above description is merely an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for identifying abnormal accounts, characterized in that: The method comprises: generating a first account relationship matrix based on the social relationship chains corresponding to the respective accounts, wherein the matrix elements in the first account relationship matrix are used to represent whether a social relationship is established between the accounts; Based on the historical online behaviors of each account, a second account relationship matrix is ​​generated. Matrix elements in the second account relationship matrix are used to indicate whether there is any intersection between the historical online behaviors of the accounts. Different account relationship matrices correspond to different relationship dimensions, and the account relationship matrix is ​​used to indicate the association relationships between different accounts under the corresponding relationship dimensions. The account relationship matrix is ​​an adjacency matrix. generating a target diffusion kernel based on at least two account relationship matrices, the target diffusion kernel being used to characterize the diffusion of association relationships between accounts, the at least two account relationship matrices comprising the first account relationship matrix and the second account relationship matrix; Based on the target diffusion kernel and the labeled accounts, abnormal accounts are identified from the unlabeled accounts, wherein the labeled accounts and the unlabeled accounts are accounts in the account relationship matrix.

2. The method according to claim 1, characterized in that Generating a target diffusion kernel based on at least two of the account relationship matrices includes: fusing at least two of the account relationship matrices to obtain a target relationship matrix; A target diffusion kernel is generated based on the target relationship matrix.

3. The method according to claim 2, characterized in that The fusing of at least two account relationship matrices to obtain a target relationship matrix includes: fusing at least two of the account relationship matrices based on target fusion weights corresponding to the respective account relationship matrices to obtain the target relationship matrix; Generating a target diffusion kernel based on the target relationship matrix includes: Determining a target Laplace matrix corresponding to the target relationship matrix; The target diffusion kernel is generated based on the target Laplacian matrix and target diffusion kernel calculation parameters.

4. The method according to claim 3, characterized in that The method further comprises: The target fusion weight and the target diffusion kernel calculation parameter are determined based on the labeled account number through a logistic regression algorithm.

5. The method according to claim 4, characterized in that The determining the target fusion weight and the target diffusion kernel calculation parameter based on the labeled account by a logistic regression algorithm includes: Obtain at least two sample account relationship matrices, where the sample account relationship matrices are used to represent the association relationships between the labeled accounts; fusing at least two of the sample account relationship matrices based on the fusion weights corresponding to the sample account relationship matrices to obtain a sample relationship matrix; Determine a sample Laplace matrix corresponding to the sample relationship matrix; generating a sample diffusion kernel based on the sample Laplace matrix and diffusion kernel calculation parameters; determining, using a logistic regression algorithm, a predicted label for a second labeled account based on the sample diffusion kernel and a first labeled account, wherein the first labeled account and the second labeled account belong to the labeled accounts; Optimizing the fusion weight and the diffusion kernel calculation parameters based on the true value annotation and the predicted annotation of the second labeled account; When the optimization end condition is met, the optimized fusion weight is determined as the target fusion weight, and the optimized diffusion kernel calculation parameter is determined as the target diffusion kernel calculation parameter.

6. The method according to claim 5, characterized in that The optimizing the fusion weight and the diffusion kernel calculation parameter based on the true value annotation and the predicted annotation of the second labeled account includes: determining an evaluation metric based on the account type of the abnormal account, the evaluation metric comprising at least one of accuracy and recall; Determining a prediction loss under the evaluation indicator based on the true value annotation and the predicted annotation of the second labeled account; The fusion weight and the diffusion kernel calculation parameters are optimized based on the prediction loss.

7. The method according to claim 6, characterized in that The determining of the evaluation index based on the account type of the abnormal account includes: In a case where the abnormal account belongs to the first account type, determining that the evaluation indicator is a recall rate; In a case where the abnormal account belongs to the second account type, determining that the evaluation indicator is accuracy; The risk level of an account belonging to the first account type is higher than the risk level of an account belonging to the first account type.

8. The method according to claim 6, characterized in that When the evaluation indicator is recall rate, the method further includes: The identified abnormal account number is pushed to a manual review platform so that the manual review platform can manually review the abnormal account number.

9. A device for identifying abnormal accounts, characterized in that: The device comprises: an acquisition module, configured to generate a first account relationship matrix based on the social relationship chains corresponding to the respective accounts, wherein the matrix elements in the first account relationship matrix are used to represent whether a social relationship is established between the accounts; Based on the historical online behaviors of each account, a second account relationship matrix is ​​generated. Matrix elements in the second account relationship matrix are used to indicate whether there is any intersection between the historical online behaviors of the accounts. Different account relationship matrices correspond to different relationship dimensions, and the account relationship matrix is ​​used to indicate the association relationships between different accounts under the corresponding relationship dimensions. The account relationship matrix is ​​an adjacency matrix. a generating module configured to generate a target diffusion kernel based on at least two account relationship matrices, the target diffusion kernel being used to characterize the diffusion of association relationships between accounts, the at least two account relationship matrices comprising the first account relationship matrix and the second account relationship matrix; An identification module is configured to identify abnormal accounts from unlabeled accounts based on the target diffusion kernel and labeled accounts, wherein the labeled accounts and the unlabeled accounts are accounts in the account relationship matrix.

10. A computer device, characterized in that: The computer device includes a processor and a memory, wherein the memory stores at least one program, and the at least one program is loaded and executed by the processor to implement the abnormal account identification method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that The readable storage medium stores at least one program, and the at least one program is loaded and executed by the processor to implement the abnormal account identification method according to any one of claims 1 to 8.

12. A computer program product, characterized in that The computer program product includes computer instructions, and when the computer instructions are executed by a processor, the method for identifying abnormal accounts according to any one of claims 1 to 8 is implemented.

Images