A method for determining entity type and related device

Abstract

The present application discloses an entity type determination method and related device. The method utilizes cluster analysis in an artificial intelligence model to obtain first behavior data of an entity in a mailbox system. The first behavior data is used to identify the mailbox usage behavior of the corresponding entity in a first time period. Multiple initial behavior patterns are determined based on the first behavior data. Second behavior data of a target entity in the mailbox system is obtained. The second behavior data is used to identify the mailbox usage behavior of the corresponding target entity in a second time period. The target entity is an entity whose mailbox usage behavior changes in the second time period, and the second time period is later than the first time period. Based on the second behavior data and the initial behavior pattern, a target behavior pattern of the target entity in the second time period that is different from the initial behavior pattern is determined. The entity type of the target entity is determined based on the behavior type corresponding to the target behavior pattern. Since the number of behavior patterns is relatively limited, target entity recognition is performed more quickly.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to a method for determining an entity type and a related device. Background Art

[0002] Email allows users to send and receive emails, enabling convenient information exchange. Email is now widely used in people's lives, work, and studies. Consequently, spam has emerged. Some users send spam in bulk and repeatedly, spreading harmful information and stealing private information, negatively impacting the use of email.

[0003] To identify malicious entities spreading spam from users, current automated email anti-spam systems automatically blacklist these entities. Existing automatic identification methods use graph clustering: users in the email system are treated as entities, and a relationship graph is constructed based on entity relationships. Clustering is then performed using community partitioning algorithms (such as Fast Unfolding with Density), and the behavior of these clusters is integrated to evaluate and identify malicious entities in batches.

[0004] However, since constructing a relationship graph requires rich relationships, a sufficient number of entities, and edges, the amount of data constructed is very large (for example, the sender entity graph contains hundreds of millions of nodes and billions of edges), and the update cycle is long. This makes the entire graph clustering process slow to execute and makes it difficult to detect newly emerging malicious entities. Summary of the Invention

[0005] In order to solve the above technical problems, the present application provides an entity type determination method and related devices, which can not only improve the execution speed of the process of identifying entity types, but also discover newly emerging malicious entities.

[0006] The embodiments of this application disclose the following technical solutions:

[0007] In one aspect, the present application provides a method for determining an entity type, the method comprising:

[0008] Acquire first behavior data of an entity in a mailbox system, where the first behavior data is used to identify mailbox usage behavior of the corresponding entity within a first time period;

[0009] determining a plurality of initial behavior patterns according to the first behavior data;

[0010] Acquiring second behavior data of a target entity in the mailbox system, where the second behavior data is used to identify mailbox usage behavior of the corresponding target entity within a second time period, where the target entity is an entity whose mailbox usage behavior changes during the second time period, and the second time period is later than the first time period;

[0011] determining, based on the second behavior data and the initial behavior pattern, a target behavior pattern of the target entity during the second time period that is different from the initial behavior pattern;

[0012] The entity type of the target entity is determined according to the behavior type corresponding to the target behavior pattern.

[0013] On the other hand, the present application provides an entity type determination device, the device comprising: an acquisition unit and a determination unit;

[0014] The acquiring unit is configured to acquire first behavior data of an entity in the mailbox system, where the first behavior data is used to identify mailbox usage behavior of the corresponding entity within a first time period;

[0015] The determining unit is configured to determine a plurality of initial behavior patterns based on the first behavior data;

[0016] The acquiring unit is further configured to acquire second behavior data of a target entity in the mailbox system, the second behavior data being used to identify mailbox usage behavior of the corresponding target entity within a second time period, the target entity being an entity whose mailbox usage behavior changes during the second time period, the second time period being later than the first time period;

[0017] The determination unit is further used to determine a target behavior pattern of the target entity that is different from the initial behavior pattern during the second time period based on the second behavior data and the initial behavior pattern; and determine the entity type of the target entity based on the behavior type corresponding to the target behavior pattern.

[0018] In another aspect, the present application provides a computer device, comprising a processor and a memory:

[0019] The memory is used to store program code and transmit the program code to the processor;

[0020] The processor is configured to execute the method described above according to the instructions in the program code.

[0021] On the other hand, an embodiment of the present application provides a computer-readable storage medium, which is used to store a computer program, and the computer program is used to execute the method described in the above aspects.

[0022] In another aspect, embodiments of the present application provide a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the method described in the above aspects.

[0023] As can be seen from the above technical solution, for entities in the mailbox system, first behavioral data corresponding to the entity's mailbox usage behavior during a first period is obtained. Based on the similarities and characteristics between the mailbox usage behaviors reflected in the first behavioral data, multiple initial behavioral patterns can be determined. Since the first behavioral data covers a large number of entities in the mailbox system, the obtained initial behavioral patterns are relatively rich and comprehensive, and thus can serve as the basis for subsequent determination of target behavioral patterns. Moreover, by converting the large amount of first behavioral data into a smaller number of initial behavioral patterns, determining the target behavioral pattern based on the smaller number of initial behavioral patterns reduces the computational load and improves the speed of subsequent entity type modeling. Second behavioral data corresponding to the target entity's mailbox usage behavior during a second period is obtained. The target entity is the entity whose mailbox usage behavior changes during the second period. Since the number of target entities is small, the amount of second behavioral data is small compared to the behavioral data of all entities during the second period. Determining the target behavioral pattern based on the smaller amount of second behavioral data reduces the computational load and can improve the speed of subsequent entity type recognition. Based on the second behavioral data and the initial behavioral pattern, a target behavioral pattern for the target entity during the second period that differs from the initial behavioral pattern is determined. Since the second time period is later than the first time period, new behavior patterns that are not included in the initial behavior pattern can be discovered through the new behavior data of the target entity in the new time period. The target behavior pattern is used as a supplement to the initial behavior pattern to improve the timeliness of identifying the new behavior pattern. After determining the behavior type of the target behavior pattern, the entity type of the target entity in the mailbox system can be quickly determined based on the behavior type of the target entity. Since the number of behavior patterns is relatively limited, generally much smaller than the number of entity nodes in the relationship graph used by related technologies, target entity recognition is performed more quickly, and through the target behavior pattern, the coverage of the behavior pattern is comprehensive, which can also ensure the overall recognition accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0025] Figure 1 A schematic diagram of an application scenario of the entity type determination method provided in an embodiment of the present application;

[0026] Figure 2 A flowchart of a method for determining an entity type provided in an embodiment of the present application;

[0027] Figure 3 A schematic diagram of a jump table provided in an embodiment of the present application;

[0028] Figure 4 A schematic diagram of an HNSW algorithm provided in an embodiment of the present application;

[0029] Figure 5a A schematic diagram of a distribution of undetermined eigenvectors provided in an embodiment of the present application;

[0030] Figure 5b A schematic diagram of a distribution of undetermined eigenvectors provided in an embodiment of the present application;

[0031] Figure 6 A schematic diagram of a hierarchical clustering dendrogram provided in an embodiment of the present application;

[0032] Figure 7 A schematic diagram of determining inter-cluster distances provided in an embodiment of the present application;

[0033] Figure 8 A schematic diagram of a method for determining an initial behavior mode provided in an embodiment of the present application;

[0034] Figure 9 A schematic diagram of a scenario of a method for determining an entity type provided in an embodiment of the present application;

[0035] Figure 10 A flowchart for determining a target behavior pattern provided in an embodiment of the present application;

[0036] Figure 11 A schematic diagram of an entity type determination device provided in an embodiment of the present application;

[0037] Figure 12 A schematic diagram of the structure of the server provided in the embodiment of the present application;

[0038] Figure 13 A schematic diagram of the structure of the terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0039] The embodiments of the present application are described below with reference to the accompanying drawings.

[0040] Given that the related art requires a large amount of data to construct a relationship graph based on entity relationship data, the graph clustering process is slow to execute, making it difficult to detect newly emerging malicious entities. This embodiment of the present application proposes an entity type determination method and related apparatus that determine entity types based on entity behavior data, which not only improves the speed of entity type recognition but also ensures entity type recognition accuracy.

[0041] The entity type determination method provided in the embodiments of the present application is based on artificial intelligence. Artificial Intelligence (AI) is a theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new type of intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines so that machines have the functions of perception, reasoning and decision-making.

[0042] Artificial intelligence (AI) technology is a comprehensive discipline encompassing a wide range of fields, encompassing both hardware and software technologies. Foundational AI technologies generally include sensors, specialized AI chips, cloud computing, distributed storage, big data processing, operating / interaction systems, and mechatronics. AI software technologies primarily encompass computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0043] In the embodiments of this application, the main artificial intelligence software technologies involved include the aforementioned natural language processing, machine learning, and other fields. For example, they may involve text preprocessing and semantic understanding in natural language processing (NLP), or cluster analysis in machine learning (ML).

[0044] The entity type determination method provided in this application can be applied to entity type determination devices with data processing capabilities, such as terminal devices and servers. Specifically, the terminal device may be, but is not limited to, a smartphone, desktop computer, laptop computer, tablet computer, smart speaker, smartwatch, etc.; the server may be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The terminal device and server may be connected directly or indirectly via wired or wireless communication, and this application does not impose any restrictions thereon.

[0045] The entity type determination device may have the ability to implement natural language processing, and natural language processing (NLP) is an important direction in the fields of computer science and artificial intelligence. It studies various theories and methods that can enable effective communication between humans and computers using natural language. Natural language processing is a science that integrates linguistics, computer science, and mathematics. Therefore, research in this field will involve natural language, that is, the language people use in daily life, so it is closely related to the study of linguistics. Natural language processing technology generally includes text processing, semantic understanding, machine translation, robot question answering, knowledge graphs and other technologies. In an embodiment of the present application, the text processing device can process the text through technologies such as text preprocessing and semantic understanding in natural language processing.

[0046] This entity type determines whether the device possesses machine learning capabilities. Machine learning is a multidisciplinary field that encompasses probability theory, statistics, approximation theory, convex analysis, and algorithmic complexity theory. It specifically studies how computers simulate or implement human learning behaviors to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is at the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications span all areas of artificial intelligence. Machine learning and deep learning typically include technologies such as artificial neural networks.

[0047] The artificial intelligence model used in the entity type determination method provided in the embodiment of the present application mainly involves the application of cluster analysis, and the initial behavior pattern and the target behavior pattern are correspondingly obtained from the first behavior data and the second behavior data through clustering.

[0048] To facilitate understanding of the technical solution of the present application, the entity type determination method provided in the embodiment of the present application is introduced below in conjunction with actual application scenarios. A mailbox system is a system that supports communication between users. For example, users communicate through email, text messages, and applications. Entities are users of the mailbox system, such as senders. During the use of the mailbox by the entity, a large amount of behavioral data is generated. The behavioral data identifies the entity's mailbox usage behavior within a corresponding period of time, such as the frequency of emails sent, the cumulative number of emails sent, and whether the emails carry virus links.

[0049] See also Figure 1 , Figure 1 Schematic diagram of the application scenario of the entity type determination method provided in the embodiment of this application. Figure 1 In the application scenario shown, the aforementioned entity type determination device is server 100, which is used to determine the entity type of the entity in the mailbox system, for example, whether the entity is a malicious entity. The malicious entity will continuously send spam to other entities in the mailbox system, affecting the usage experience of other entities.

[0050] In order to identify the entity type of an entity, the first behavior data corresponding to the mailbox usage behavior of the entity in the first time period is obtained. Based on the similarities and characteristics between the mailbox usage behaviors reflected in the first behavior data, multiple initial behavior patterns can be determined. Since the first behavior data covers a large number of entities in the mailbox system, the obtained initial behavior patterns are relatively rich and comprehensive, so they can be used as the basis for subsequent determination of target behavior patterns. Moreover, the large number of first behavior data is converted into a smaller number of initial behavior patterns, which reduces the amount of calculation for determining the target behavior pattern based on the initial behavior pattern and improves the subsequent recognition speed of entity types. For example, in Figure 1 In the scenario shown, n initial behavior patterns can be identified from the first behavior data within three days. These n initial behavior patterns represent n types of behavioral characteristics within the first behavior data within three days. The number of n initial behavior patterns is smaller than the number of first behavior data. Therefore, the speed of subsequent entity type recognition can be improved based on a smaller number of behavior patterns.

[0051] Obtain second behavior data corresponding to the target entity's mailbox usage behavior in the second time period, wherein the target entity is an entity whose mailbox usage behavior changes in the second time period. The number of target entities is relatively small, so compared with the behavior data of all entities in the second time period, the amount of second behavior data is relatively small. Determining the target behavior pattern based on a smaller amount of second behavior data can reduce the amount of calculation and improve the recognition speed of subsequent entity types.

[0052] Based on the second behavior data and the initial behavior pattern, a target behavior pattern of the target entity in the second time period that is different from the initial behavior pattern is determined. Since the second time period is later than the first time period, new behavior patterns that are not included in the initial behavior pattern can be discovered through the new behavior data of the target entity in the new time period. For example, the target entity has not sent any emails in the first time period, but continues to send emails in the second time period. This way of sending emails by the target entity can be regarded as a behavior pattern. If this behavior pattern is different from the initial behavior pattern, then this behavior pattern may be a newly emerging behavior pattern and can be used as a target behavior pattern. Therefore, by using the target behavior pattern as a supplement to the initial behavior pattern, the timeliness of identifying the newly added behavior pattern is improved.

[0053] The embodiment of the present application does not specifically limit the second time period. For example, the duration identified by the second time period is similar to the duration identified by the first time period, so that the behavior pattern determined by the behavior data is more referenceable. Figure 1 In the scenario shown, the duration indicated by the second period is 3 days.

[0054] After determining the target behavior pattern, the entity type of the target entity in the mailbox system can be quickly determined based on the behavior type of the target behavior pattern and the behavior type of the target entity's behavior data, so as to quickly distinguish whether the target entity is a malicious entity, so as to intercept emails sent by malicious entities, reduce the number of spam emails received by other entities in the mailbox system, and improve the usage experience of other entities.

[0055] In the following, in conjunction with the accompanying drawings, a method for determining an entity type provided in an embodiment of the present application is introduced with a server as the entity type determination device.

[0056] See also Figure 2 , Figure 2 This is a flow chart of a method for determining an entity type provided in an embodiment of the present application. Figure 2 As shown, the entity type determination method includes the following steps:

[0057] S201: Acquire the first line data of an entity in the mailbox system.

[0058] In order to identify malicious entities in the mailbox system, related technologies use graph clustering to identify whether an entity is a malicious entity. Intercepting emails sent by malicious entities can reduce the amount of spam received by other entities in the mailbox system, thereby improving the user experience.

[0059] However, graph clustering uses entity relationships to construct a relationship graph. The nodes in the relationship graph represent entities, and the edges between the nodes represent the shipping information of the two entities corresponding to the edge. This constructed relationship graph is very data-intensive, and running this relationship graph for entity recognition consumes considerable time, resulting in slow entity type recognition. Furthermore, due to the sheer volume of the relationship graph, updating the graph to add new entities and their shipping information takes a long time, resulting in a long update cycle and making it difficult to quickly detect newly added malicious entities.

[0060] Based on this, the embodiment of the present application analyzes from the perspective of the entity's behavioral data. Through the similarities and characteristics between the behavioral data, multiple behavioral patterns of the entity can be analyzed, thereby converting a large amount of behavioral data into a smaller number of behavioral patterns. Entity recognition based on a smaller number of behavioral patterns consumes less time, thereby improving the recognition speed of subsequent entity types.

[0061] Thus, the first behavior data of the entity in the mailbox system is obtained. For example, the entity is extracted from the emails sent in the mailbox system, and the behavior data corresponding to different entities is accumulated, such as the number of emails sent by the entity on the same day. The accumulated behavior data is placed in a collection, such as a behavior data table.

[0062] To facilitate subsequent analysis, behavioral data that is strongly correlated with the degree of maliciousness can be selected to construct a behavior vector and normalized.

[0063] S202: Determine a plurality of initial behavior patterns according to the first behavior data.

[0064] The first behavior data identifies the mailbox usage behavior of the entity corresponding to the first behavior data within the first time period. Based on the similarities and characteristics of the mailbox usage behaviors reflected in the first behavior data, multiple initial behavior patterns can be determined. An initial behavior pattern represents a type of first behavior data with similarities and characteristics. Therefore, a relatively large number of first behavior data can be converted into a relatively small number of initial behavior patterns.

[0065] The first period is a period of time before the subsequent second period. For example, the first period can be from January 1, 2020 to January 10, 2020. For another example, the first time can be from January 10, 2020 to January 30, 2020. The first behavior data corresponding to the first period covers a large number of entities in the mailbox system, and the obtained initial behavior pattern is relatively rich and comprehensive, so it can serve as the basis for the subsequent determination of the target behavior pattern. Moreover, the large amount of first behavior data is converted into a smaller number of initial behavior patterns. Determining the target behavior pattern based on the initial behavior pattern reduces the amount of calculation and improves the recognition speed of subsequent entity types.

[0066] The embodiment of the present application can adjust the first time period based on demand. For example, as the duration identified by the first time period increases, the amount of first behavior data increases, and more initial behavior patterns can be obtained.

[0067] In order to ensure the speed of entity type recognition while ensuring accuracy, the first behavior data can be processed offline to obtain an initial behavior pattern, and the initial behavior pattern can be used to directly perform subsequent analysis.

[0068] The embodiment of the present application does not specifically limit the method for determining the initial behavior pattern. For example, the initial behavior pattern is analyzed from the first behavior data by a clustering algorithm. The clustering algorithm can be, for example, a k-means++ algorithm, a density-based spatial clustering of applications with noise (Density-Based Spatial Clustering of Applications with Noise, DBSCAN) algorithm, a balanced iterative reduction and clustering using hierarchies (Balanced Iterative Reducing and Clustering Using Hierarchies, BIRCH) algorithm, etc. The k-means++ algorithm will be used as an example for explanation. Please refer to S2021-S2023 for details, which will not be repeated here.

[0069] S203: Acquire the second behavior data of the target entity in the mailbox system.

[0070] Malicious entities constantly add new behavior patterns to avoid being intercepted when sending spam to other entities. This prevents email systems from identifying them. Using only initial behavior patterns to identify malicious entities may not allow for timely detection of these new patterns, leading to delays in detecting even newly emerging malicious entities. For example, a malicious entity that first appeared half an hour ago may not be detected in time, and may send spam again half an hour later.

[0071] Thus, the initial behavior pattern can be supplemented to expand the coverage of the behavior pattern, so that it can not only quickly identify the newly added behavior pattern, but also make the identified behavior pattern more accurate.

[0072] Obtain second behavioral data from the mailbox system. The second behavioral data is used to identify the mailbox usage behavior of the target entity within a second time period. The second time period is later than the first time period, and the duration of the second time period is similar to the duration of the first time period. As a possible implementation method, the duration of the second time period is equal to the duration of the first time period. Therefore, the behavioral pattern determined by the behavioral data of the same time period is more referenceable, thereby improving the accuracy of entity type recognition. For example, if the first time period is from January 1, 2020 to January 10, 2020, the second time period can be from January 11, 2020 to January 20, 2020, or the second time period can be from January 2, 2020 to January 11, 2020.

[0073] Among them, the target entity is the entity whose mailbox usage behavior changes in the second time period. In the period after the first time period, the entity's mailbox usage behavior changes, and the behavior pattern determined by the behavior data of the entity is more likely to be different from the initial behavior pattern, that is, a new behavior pattern. Compared with all entities in the mailbox system, the number of target entities is small. Therefore, compared with the behavior data of all entities in the second time period, the number of second behavior data is small. Determining the target behavior pattern based on a small number of second behavior data reduces the amount of calculation and can improve the recognition speed of subsequent entity types.

[0074] For example, if the target entity is newly emerged in the second period, meaning there is no historical behavior, the second behavior data reflects the entity's email usage habits over a shorter period. New behavior patterns may be reflected by newly emerged entities in the second period, or by entities with behavioral data from the first period.

[0075] As a possible implementation method, you can first determine the entity whose mailbox usage behavior changes in the third time period and determine it as the target entity, where the third time period is a period of time in the second time period, and the duration identified by the third time period is shorter than the duration identified by the second time period. Then obtain the second behavior data of the target entity in the second time period. For example, the first time period is from 1:00 on January 1, 2020 to January 10, 2020, the third time period is from 0:00 on January 11, 2020 to 2:00 on January 11, 2020, and the second time period can be from 0:00 on January 11, 2020 to 24:00 on January 20, 2020. In this way, the target entity can be quickly determined through the shorter third time period, so that the recognition speed of subsequent entity types can be improved.

[0076] S204: Determine a target behavior pattern of the target entity that is different from the initial behavior pattern during the second time period based on the second behavior data and the initial behavior pattern.

[0077] Based on the similarities and characteristics of the email usage behaviors reflected in the second behavioral data, and the similarities and characteristics of the email usage behaviors reflected in the initial behavioral patterns, a target behavioral pattern can be determined. The target behavioral pattern represents a different behavioral pattern from the initial behavioral pattern and can serve as a supplement to the initial behavioral pattern, thereby expanding the coverage of the behavioral pattern. The number of target behavioral patterns can be one or more, and this application does not impose specific restrictions on this.

[0078] As time goes by, new behavioral patterns may continue to emerge. To quickly capture these newly added patterns, the second period can be a time period that occurs after the first period. Furthermore, the second period can be continuously adjusted. For example, if the first period can be the accumulated email usage between January 1st and January 30th, the second period can be the accumulated email usage between February 1st and March 2nd, and then the second period can be adjusted to the accumulated email usage between March 1st and March 30th, and so on. By continuously adjusting the second period, the second behavioral data can be continuously adjusted, allowing for the continuous discovery of new behavioral patterns.

[0079] The target behavior pattern is determined through the second behavior data and the initial behavior pattern, so that new behavior patterns are continuously discovered over time through the target behavior pattern. The amount of second behavior data is generally less than that of first behavior data. Compared with the method of continuously discovering new behavior patterns through behavior data over a longer period of time, discovering new behavior patterns through second behavior data is faster.

[0080] S205: Determine the entity type of the target entity according to the behavior type corresponding to the target behavior pattern.

[0081] Compared to initial behavior patterns, target behavior patterns are the continuously added behavior patterns of the target entity. This allows for more behavior patterns to be identified, resulting in more comprehensive behavior pattern coverage. Compared to the massive amount of data associated with the relationship graph structure, target behavior patterns correspond to fewer behavior types. Using target behavior patterns to identify the target entity's behavior type results in shorter execution times and faster recognition.

[0082] Understandably, only a small number of entities in the mailbox system are malicious, while the vast majority are non-malicious. Malicious and non-malicious entities differ in their behavior patterns, which can be categorized as normal or abnormal. If an entity's behavior pattern corresponds to an abnormal behavior type, then that entity is malicious, and emails sent by that malicious entity can be intercepted, reducing the amount of spam received by other entities in the mailbox system and improving their user experience.

[0083] If the behavior type of the target behavior pattern is evaluated based on the behavior data of a single target entity, the corresponding behavior type may not be obtained due to the small amount of behavior data of the single target entity (for example, the target entity only sends an email occasionally).

[0084] Based on this, the behavioral data of multiple target entities can be obtained, and the characteristic vectors corresponding to the behavioral patterns corresponding to the behavioral data of multiple target entities can be clustered into vector clusters, that is, the vector cluster includes the superposition of the behavioral data of multiple target entities. Compared with the behavioral data of a single target entity, the behavioral data of multiple target entities are richer, thereby improving the accuracy of the evaluation of the behavior type.

[0085] Therefore, as a possible implementation method, S205 can be implemented through S2051-S2052, as shown below.

[0086] S2051: Determine the behavior type of the target behavior pattern according to the second behavior data corresponding to the second vector cluster corresponding to the target behavior pattern.

[0087] S2052: Determine the target entity associated with the second vector cluster corresponding to the malicious behavior pattern with a malicious behavior type as a malicious entity.

[0088] The second vector cluster corresponds to the second behavior data corresponding to the multiple target entities. The behavior data of the multiple target entities are integrated to determine the behavior type, which can be a malicious type, a non-malicious type, a neutral type, etc.

[0089] The embodiments of the present application do not specifically limit the method for evaluating entity types. For example, the behavioral data of all target entities in the second vector cluster can be scored using a scoring model. If the score of the cluster exceeds a threshold, the cluster is considered to be a "bad cluster" and its representative behavior pattern is malicious. All entities in the cluster are malicious entities.

[0090] If clustering is performed based on entity relationship data as in related techniques, the same entity may send multiple emails, and its behavior is constantly changing. Therefore, the entity may constantly transform into different clusters, which makes it difficult to subsequently evaluate entity types based on clusters. Only when cluster evaluation and non-malicious entity elimination are sufficiently fast can the accuracy of malicious entity identification be guaranteed. However, by using the embodiment of the present application to perform clustering based on entity behavior data, there is no need to require a high speed for cluster evaluation and non-malicious entity elimination, which facilitates the identification of entity types.

[0091] The present embodiment does not specifically limit the form of the scoring model. For example, the scoring model can be a binary classification model such as logistic regression. The training data is based on user reports in the email system, customer service personnel review data, and a pre-built sample library. After the model is trained, the sample scores are calculated using the model, but no logistic function is used to transform them.

[0092] As can be seen from the above technical solution, for entities in the mailbox system, first behavioral data corresponding to the entity's mailbox usage behavior during a first period is obtained. Based on the similarities and characteristics between the mailbox usage behaviors reflected in the first behavioral data, multiple initial behavioral patterns can be determined. Since the first behavioral data covers a large number of entities in the mailbox system, the obtained initial behavioral patterns are relatively rich and comprehensive, and can therefore serve as the basis for subsequent determination of target behavioral patterns. Moreover, by converting the large amount of first behavioral data into a smaller number of initial behavioral patterns, determining the target behavioral pattern based on the smaller number of initial behavioral patterns reduces the computational load and improves the speed of subsequent entity type modeling. Second behavioral data corresponding to the target entity's mailbox usage behavior during a second period is obtained. The target entity is the entity whose mailbox usage behavior changes during the second period. Since the number of target entities is small, the amount of second behavioral data is small compared to the behavioral data of all entities during the second period. Determining the target behavioral pattern based on the smaller amount of second behavioral data reduces the computational load and can improve the speed of subsequent entity type recognition. Based on the second behavioral data and the initial behavioral pattern, a target behavioral pattern for the target entity during the second period that differs from the initial behavioral pattern is determined. Since the second time period is later than the first time period, new behavior patterns that are not included in the initial behavior pattern can be discovered through the new behavior data of the target entity in the new time period. The target behavior pattern is used as a supplement to the initial behavior pattern to improve the timeliness of identifying the new behavior pattern. After determining the behavior type of the target behavior pattern, the entity type of the target entity in the mailbox system can be quickly determined based on the behavior type of the target entity. Since the number of behavior patterns is relatively limited, generally much smaller than the number of entity nodes in the relationship graph used by related technologies, target entity recognition is performed more quickly, and through the target behavior pattern, the coverage of the behavior pattern is comprehensive, which can also ensure the overall recognition accuracy.

[0093] The present embodiment does not specifically limit the method for determining the target behavior pattern in S204. An implementation example is described below using a Hierarchical Navigable Small World (HNSW) algorithm, as shown in S2041-S2044. It is understood that other clustering algorithms may also be used, and this is not specifically limited.

[0094] The following first introduces the HNSW algorithm and explains why the HNSW algorithm is selected to determine the target behavior pattern in the scenario shown in the embodiment of the present application. Then, the method for determining the target behavior pattern in S204 is explained in combination with the HNSW algorithm.

[0095] The HNSW algorithm is an improved version of the Navigable Small World (NSW) algorithm. It is a type of approximate nearest neighbor search algorithm. It starts by controlling the average degree of nodes (that is, the number of friend nodes), limits the upper limit of node degrees by a constant, and hierarchically structures the NSW algorithm. It uses the idea of ​​skip lists to improve search efficiency and achieve true O(logN) search time complexity.

[0096] To better understand the HNSW algorithm, we first introduce the skip table idea and then the HNSW algorithm that combines the skip table idea.

[0097] Assume that the original linked list has a total of N elements, and one element is extracted from every two elements as the index of the previous level, then the first-level index in the jump list retains N / 2 elements, the second-level index retains N / 4 elements, and the k-th level index retains N / 2 elements. k elements until the top-level index holds two elements, i.e., the index level height h = log(N) - 1. The total height of the skip list is the sum of the original linked list level and the index level, which equals log(N). The overall search time complexity is the product of the number of elements traversed at each index level and the index height.

[0098] See also Figure 3 This figure is a schematic diagram of a skip list provided by an embodiment of the present application. This skip list includes eight elements. For example, to search for element 5, the search first traverses elements 1 and 7 in the second-level index. Finding that 1<5<7, the search then descends to the first-level index at element 1 and then traverses 4 and 7. When traversing to 7, the search finds that 4<5<7. Therefore, the search descends from element 7 to the original linked list layer and then traverses element 5 to find the element being searched.

[0099] As can be seen from the example above, when building the skip list, we use the rule of extracting one element from every two elements as the upper index, so that the number of elements traversed per index level during a search does not exceed 3. Therefore, the final query time complexity is O(logN).

[0100] The following combination Figure 4 This paper introduces the HNSW algorithm, which is formed by integrating the skip table idea into the NSW algorithm.

[0101] The index of the skip list can be constructed by continuously extracting the index of the lower layer. During the integration process, it is necessary to determine which elements are in each layer. During the mapping process, for each newly inserted element, HNSW will pre-calculate a level number L as the highest level that the element can reach, and then insert the point from the Lth layer of HNSW until the bottom layer (0). Where L is randomly selected through an exponentially decaying probability distribution, see formula (1):

[0102] L=-ln(unif(0..1))·m L (1)

[0103] Among them, unif(0..1) means randomly selecting a number from a uniform distribution between 0 and 1, m L Represents the normalization factor, which can be regarded as a constant.

[0104] When a new element (hereinafter referred to as a query point) is inserted into each layer, the n nearest neighboring points of the inserted point in the layer are calculated and connected using a greedy algorithm. Figure 4 , which is a schematic diagram of a HNSW algorithm provided in an embodiment of the present application. The HNSW algorithm includes layer 0, layer 1, and layer 2, that is, L=2.

[0105] Starting from any point H, the process of finding the nearest neighbor of query point D is to select point A, the closest friend of point H, from the second layer. Then, descend to the first layer and calculate the distance between point A's friends and point D to select the closest point, C. Then, descend to layer 0 and repeat the previous operation. Finally, the nearest neighbor of query point D is found to be point D itself.

[0106] The above is an introduction to the HNSW algorithm. Based on this, the reason for choosing the HNSW algorithm to identify target behavior patterns is that it has a fast search speed and can improve the recognition efficiency of target behavior patterns, thereby improving the recognition speed of entity types.

[0107] The following describes in detail the method for determining the target behavior pattern in S204 in conjunction with the HNSW algorithm.

[0108] S2041: After obtaining the second behavior data, determine the second feature vectors corresponding to the target entities in the mailbox system according to the second behavior data.

[0109] S2042: Determine the vector distance between the second eigenvector and the eigenvector corresponding to the initial behavior pattern, and use the second eigenvector whose vector distance is greater than a distance threshold as a pending eigenvector.

[0110] In the feature space, the vector distance between the feature vectors can be used to analyze whether the feature vectors are similar. Specifically, if the vector distance between the second feature vector and the feature vector corresponding to the initial behavior pattern is smaller, it means that the behavior pattern corresponding to the second feature vector is more similar to the initial behavior pattern; if the vector distance between the second feature vector and the feature vector corresponding to the initial behavior pattern is larger, it means that the behavior pattern corresponding to the second feature vector is less similar to the initial behavior pattern.

[0111] In order to discover the target behavior pattern that is different from the initial behavior pattern, the second eigenvector corresponding to the target entity can be obtained, the vector distance between the second eigenvector and the eigenvector corresponding to the initial behavior pattern can be determined, and the second eigenvector whose vector distance is greater than the distance threshold is used as the undetermined eigenvector, and the target behavior pattern is analyzed through the undetermined eigenvector.

[0112] Taking the HNSW algorithm as an example, after clustering the second characteristic behavior vectors using the HNSW algorithm, the Euclidean distance of each second characteristic vector to its approximate nearest neighbor index, that is, the characteristic vector corresponding to the initial behavior pattern, can be obtained. If this Euclidean distance is greater than a distance threshold, the second characteristic behavior vector is considered to represent a new behavior pattern and is used as the undetermined characteristic vector. In other words, the HNSW algorithm can obtain the approximate nearest neighbor points of the characteristic vector corresponding to the initial behavior pattern, that is, the second characteristic vectors clustered near the characteristic vector corresponding to the initial behavior pattern, thereby quickly determining the undetermined characteristic vector.

[0113] The undetermined feature vector will largely represent a behavior pattern that is different from the initial behavior pattern. The distance threshold can be used to quickly filter out the undetermined feature vector from the second feature vector, thereby improving the speed of determining the target behavior pattern and further improving the speed of identifying the entity type.

[0114] The embodiment of the present application does not specifically limit the setting method of the distance threshold used in the aforementioned determination of the pending behavior pattern. The following introduces a method for determining the distance threshold, see steps 1 to 3.

[0115] Step 1: Determine the undetermined vector distance between the second eigenvector and the target vector.

[0116] The target vector is one of the cluster eigenvectors corresponding to the initial behavior pattern. It can be obtained by sampling the eigenvectors in the vector cluster corresponding to the initial behavior pattern, i.e., the cluster eigenvector. A target vector can represent the initial behavior pattern of the corresponding vector cluster. The second eigenvector is matched with the target vector. The matching process is an approximate nearest neighbor search, that is, searching for the approximate nearest neighbors of the target vector. The approximate nearest neighbors of a target vector are clustered near the target vector. In other words, the second eigenvectors that hit the same target vector are considered to be clustered in the same cluster.

[0117] In particular, for the analysis of a single cluster A, the distance between the second eigenvector in cluster A and the target vector is the undetermined vector distance.

[0118] Step 2: According to the threshold sequence arranged from large to small, determine in sequence the number of vectors whose distance from the undetermined vector satisfies the second eigenvector of the undetermined threshold in the threshold sequence.

[0119] A threshold sequence arranged from large to small is pre-set, and each threshold in the threshold sequence is a pending threshold. For example, the threshold sequence can be {20, 15, 10}, where 15 is the second pending threshold. The number of vectors whose distance from the pending vector to the second eigenvector satisfies the pending threshold in the threshold sequence is sequentially determined. For example, if there are 100 second eigenvectors in the aforementioned cluster A, it is determined that there are 100 second eigenvectors whose distance from the pending vector to the second eigenvector is less than the pending threshold of 20, 90 second eigenvectors whose distance from the pending vector to the second eigenvector is less than the pending threshold of 15, and 5 second eigenvectors whose distance from the pending vector to the second eigenvector is less than the pending threshold of 10.

[0120] Step 3: If the difference between the number of vectors at the i-th pending threshold and the number of vectors at the (i+1)-th pending threshold meets a predetermined condition, determine the distance threshold based on the i-th pending threshold.

[0121] In feature space, a circle is drawn with the target vector as the center and the undetermined threshold as the radius, gradually shrinking from the large circle. That is, the radius of the circle centered on the target vector gradually decreases according to the threshold sequence, from the i-th undetermined threshold to the i+1-th undetermined threshold. If the number of second eigenvectors within the circle suddenly decreases, and the decrease meets a predetermined condition, it indicates that the second eigenvectors are clustered within the reduced range. They are likely clustered in the same vector cluster as the target vector and exhibit the same behavior pattern as the target vector. Therefore, the i-th undetermined threshold can be used as the distance threshold.

[0122] Continuing with the example in step 2, the difference between the number of vectors at the second pending threshold 15 and the number of vectors at the third pending threshold 10 is 85. This difference meets the preset condition, so the pending threshold 15 is used as the distance threshold.

[0123] Calculate according to steps one to three for multiple clusters respectively, and take the average distance threshold of multiple clusters as the distance threshold for identifying the undetermined feature vector.

[0124] Thus, the distance threshold used when determining the pending behavior pattern can be determined by the above method. The pending feature vector can be screened out by the distance threshold. The following will further explain how to obtain the second vector cluster based on the pending feature vector.

[0125] S2043: Obtain at least one second vector cluster by performing vector clustering on the determined eigenvectors.

[0126] As can be seen from the above, the undetermined feature vectors may represent different behavior patterns than the initial ones. However, only when the undetermined feature vectors are clustered together, that is, when the undetermined feature vectors are clustered to form at least one second vector cluster, and this second vector cluster represents the same behavior pattern, can it be considered a valuable behavior pattern, such as the behavior pattern corresponding to a large-scale outbreak of malicious entities.

[0127] See also Figure 5a , which is a schematic diagram of a distribution of undetermined feature vectors provided in an embodiment of the present application. Figure 5a In the figure, solid dots A, B, C, and D represent the target vectors corresponding to the four initial behavior patterns, and blank dots and striped dots represent the second eigenvectors. If the vector distance between striped dots E, F, G, and H and their nearest neighbor target vectors is greater than the distance threshold, then striped dots E, F, G, and H represent four undetermined eigenvectors, which may represent a new behavior pattern. Striped dots E, F, G, and H are clustered together, indicating that these four undetermined eigenvectors may represent a new behavior pattern. Figure 5b , which is a schematic diagram of a distribution of undetermined feature vectors provided in an embodiment of the present application. Figure 5a The difference is that the striped dots E, F, G and H are scattered and not gathered together, and will not form a vector cluster. Their corresponding behavioral patterns are of low value and need to be excluded.

[0128] If the number of pending feature vectors is large, it largely indicates that malicious entities are active, such as sending spam in batches. At this time, there is a large amount of redundant data for the same behavior pattern. For example, in order to reduce the amount of data and shorten the calculation time, the pending feature vectors can be uniformly sampled to obtain sampled feature vectors. Since the sampled feature vectors are uniformly sampled from the pending feature vectors, their number will be less than the number of pending feature vectors. In the feature space, the pattern composed of the sampled feature vectors is equivalent to proportionally reducing the pattern composed of the pending feature vectors, without losing information, and the corresponding behavior pattern can still be identified. Therefore, the uniform sampling method can reduce the useless calculation of redundant data and shorten the calculation time while ensuring accuracy. Afterwards, vector clustering can be performed based on the sampled feature vectors to obtain at least one second vector cluster.

[0129] The embodiment of the present application does not specifically limit the method of performing vector clustering on the undetermined feature vectors, and hierarchical clustering is used as an example for explanation below.

[0130] Hierarchical clustering is divided into two clustering methods: "bottom-up" and "top-down". "Bottom-up" means that each point is initially regarded as a cluster, and the closest clusters are merged in each cycle. The distance between clusters is used as the branch height to build a dendrogram. Finally, the preset maximum distance between clusters, that is, the aforementioned distance threshold, is used to cut the dendrogram horizontally at the corresponding height, that is, to form several clusters by cutting. "Top-down" is the opposite, and will not be described here. Figure 6 Let’s take “bottom-up” as an example to explain.

[0131] See also Figure 6 , which is a schematic diagram of a hierarchical clustering tree diagram provided in an embodiment of the present application. Figure 6 In this example, 11 second eigenvectors are included. Initially, each second eigenvector is considered a cluster. Each iteration merges the closest clusters, constructing a dendrogram with inter-cluster distances as branch heights. Finally, the dendrogram is split horizontally at the corresponding heights using the preset maximum inter-cluster distances, forming three clusters. Hierarchical clustering eliminates the need to pre-define the number of clusters.

[0132] The embodiment of the present application does not specifically limit the setting method of the inter-cluster distance. For example, it can be a single linkage method, a complete linkage method, an average linkage method, etc.

[0133] See also Figure 7 , which is a schematic diagram of determining the inter-cluster distance provided by an embodiment of the present application. As shown on the left side of Figure 7, it is a single connection method. The single connection method uses the distance between the closest points in two clusters as the inter-cluster distance. The clusters formed in this way are relatively loose and easily affected by outliers. Figure 7 The middle one shows the full connection method. The full connection method uses the distance between the farthest points of two clusters as the distance between clusters. The clusters formed are relatively dense, but the clustering conditions are relatively strict, making it difficult to form clusters. It is also easily affected by outliers. Figure 7 The right side shows the mean connection method, which is a compromise between the two. The mean distance between each point in the two clusters is used as the distance between clusters. The calculation amount is large but it is not easily affected by outliers.

[0134] Therefore, the embodiment of the present application can use the mean connection method as the method for calculating the inter-cluster distance, and cluster through the "bottom-up" method. The setting method of the maximum distance between clusters can refer to the setting method of the aforementioned distance threshold, see steps 1 to 3, and will not be repeated here.

[0135] S2044: Determine the target behavior pattern according to the undetermined feature vectors included in the second vector cluster.

[0136] like Figure 5aAs shown, the striped dots E, F, G, and H are clustered into a second vector cluster, which is different from the vector clusters where the solid dots A, B, C, and D are located. That is, the target behavior pattern is different from the initial behavior pattern. The target behavior pattern can represent a newly added behavior pattern as a supplement to the initial behavior pattern to expand the coverage of the behavior pattern.

[0137] It should be noted that, in the second vector clusters, a small number of undetermined feature vectors may be sampled for each second vector cluster as the target behavior pattern.

[0138] After determining the target behavior pattern, the entity type of the target entity can be determined using the method described in S2051-S2052. Specifically, the behavior type of the target behavior pattern is determined based on the second behavior data corresponding to the second vector cluster. If a malicious behavior pattern of a malicious behavior type is determined from the target behavior pattern, the target entity associated with the second vector cluster corresponding to the malicious behavior pattern is determined to be a malicious entity.

[0139] From the above description, we can see that the HNSW algorithm can be used to quickly query approximate nearest neighbor points and can be applied to clustering scenarios: when a batch of query points is given, the indexes most similar to these points are queried separately, and then the query points that hit the same index can be clustered into a cluster.

[0140] In the scenario of the mailbox system provided in the embodiment of the present application, the second behavior data can be regarded as the above-mentioned query point. HNSW can be used to quickly find the approximate nearest neighbor point of the second behavior data, that is, the distance between the second eigenvector corresponding to the second behavior data and the eigenvector corresponding to the initial behavior pattern can be used to determine the initial behavior pattern similar to the second behavior data. The second eigenvectors that hit the same initial behavior pattern will be divided into the same cluster.

[0141] Therefore, when using the HNSW algorithm to determine the target behavior pattern, the selection of the initial index required by the HNSW algorithm can affect the accuracy of subsequent entity type recognition. To ensure the accuracy of the initial index required by the HNSW algorithm, a method for determining the initial index required by the HNSW algorithm is described below. Specifically, the determination of the initial behavior pattern in S202 can be implemented using the methods of S2021-S2023, as shown below.

[0142] S2021: Determine first feature vectors corresponding to entities in the mailbox system according to the first behavior data.

[0143] S2022: Obtain multiple first vector clusters by performing vector clustering on the first eigenvector.

[0144] The embodiment of the present application does not specifically limit the clustering algorithm, and the k-means++ algorithm is used as an example for explanation below.

[0145] In order to prevent the problem of poor clustering effect caused by randomly selecting the initial cluster center and setting the number of clusters based on experience, the embodiment of the present application adopts the k-means++ algorithm and the elbow method based on the silhouette coefficient for improvement, which is described in detail below.

[0146] First, the k-means++ algorithm is used to prevent the traditional k-means algorithm from randomly selecting the initial cluster center. Specifically, the first eigenvector with the farthest distance as possible is selected as the initial cluster center to solve the problem that the random selection of the initial cluster center will affect the clustering effect if the distance is too close.

[0147] Secondly, the number of clusters can be determined based on the silhouette coefficient using the elbow method.

[0148] (1) Silhouette coefficient.

[0149] The method for determining the silhouette coefficient S(i) is shown in formula (2):

[0150]

[0151] Where b(i) represents the average distance from the first eigenvector i to all the first eigenvectors in the nearest cluster; a(i) represents the average distance from the first eigenvector i to all the first eigenvectors in its cluster.

[0152] The value range of the silhouette coefficient S(i) is [-1, 1]. The closer it is to 1, the tighter the clusters are, the higher the degree of separation between clusters is, and the better the clustering effect is.

[0153] (2) Elbow method.

[0154] The elbow method selects a sequence of cluster numbers at a fixed step size, such as [2000, 4000, 6000, 8000, 10000]. It then uses the k-means++ algorithm to cluster these clusters. It then calculates the silhouette coefficient based on the clustering results, identifying an "inflection point." This method is characterized by a sudden slowdown in the change in the silhouette coefficient near the inflection point as the number of clusters increases. This means that increasing the number of clusters no longer yields a significant gain in the silhouette coefficient. This ensures that the number of clusters determined by the silhouette coefficient and elbow method is neither too large nor too small, improving clustering effectiveness and accurately reflecting the number of initial behavioral patterns included in the first behavioral data.

[0155] S2023: Determine, based on the first eigenvectors included in the first vector cluster, a plurality of initial behavior patterns corresponding one-to-one to the plurality of first vector clusters.

[0156] The first eigenvectors corresponding to the entities in the mailbox system are classified by clustering, that is, divided into multiple first vector clusters, each first vector cluster represents an initial behavior pattern, and each first eigenvector in the first vector cluster can represent the corresponding behavior pattern.

[0157] It should be noted that after determining the target behavior pattern based on the initial behavior pattern and the second behavior data, the determined target behavior pattern can also be used as the initial index in the HNSW algorithm to increase the accuracy of the initial index. Then, the newly added target behavior pattern is continuously iterated based on the newly determined initial index and the second behavior data, so as to quickly identify new behavior patterns, expand the coverage of behavior patterns, and improve the accuracy of entity type recognition.

[0158] To reduce the computational complexity of the subsequent HNSW algorithm and improve the speed of entity type recognition, a small number of first eigenvectors can be sampled from the first vector cluster. The sampled first eigenvectors can be used to determine the cluster eigenvector of the first vector cluster, which represents the initial behavior pattern of the first vector cluster. Thus, the cluster eigenvectors corresponding to the multiple first vector clusters are determined as the eigenvectors of the multiple initial behavior patterns, thereby forming the initial index required by the HNSW algorithm.

[0159] See also Figure 8 This figure is a schematic diagram of a method for determining initial behavior patterns provided in an embodiment of the present application. First behavior data accumulated over multiple days for entities in a mailbox system can be selected. Clustering is then used to obtain multiple first vector clusters. Sampling is performed on each first vector cluster to obtain multiple initial behavior patterns.

[0160] Although the target behavior pattern determined above can continuously supplement the initial behavior pattern, so that the behavior pattern corresponding to the entity covers a wider range, as the behavior patterns continue to increase, the recognition speed of the entity type will decrease. Therefore, the initial behavior pattern and / or target behavior pattern that has not been hit for a long time can be eliminated, so that when the initial behavior pattern and / or target behavior pattern can be used as the initial index of the HNSW algorithm, the number of initial indexes can be reduced while ensuring the correctness of the initial index, thereby improving the recognition speed of the entity type. For example, the target behavior pattern and the initial behavior pattern can be added to the database, and the information such as the storage time and the cumulative number of hits of the target behavior pattern and the initial behavior pattern can be recorded in the data table. If the initial behavior pattern and / or the target behavior pattern have not been hit for a long time, or the storage time is relatively long but the number of hits is small, they can be eliminated.

[0161] As one possible implementation, after determining the target entity type based on the behavior type corresponding to the target behavior pattern, the mailbox system's entity blacklist can be updated based on the determined entity type. Update methods include addition and deletion, which are not specifically limited in this application.

[0162] For example, by continuously updating the initial behavior pattern and / or target behavior pattern, i.e., continuously determining the initial behavior pattern and / or target behavior pattern at a high frequency scrolling speed, malicious entities of a malicious entity type can be continuously added to an entity blacklist, thereby intercepting emails sent by the malicious entity based on the records in the entity blacklist. The entity blacklist can be a database, which is not specifically limited in this application.

[0163] For example, to further avoid false interceptions, an automated blacklist removal mechanism can be added based on the entity's behavioral data, such as real-time behavioral data and entity feedback data. For example, if an entity sends spam in bulk for a period of time, but later starts sending normal emails (for example, if the entity's mailbox is stolen), the automatic removal mechanism can promptly remove entities that are no longer malicious, allowing the entities recorded in the entity blacklist to change over time, thereby making the identification of entity types more stable.

[0164] To better understand the entity type determination method provided by the embodiments of this application, the following describes the entity type determination method provided by the embodiments of this application using the scenario of helping a mailbox system identify online whether an entity is a malicious entity. The clustering methods involved in the embodiments of this application are the k-means++ algorithm, the hierarchical clustering algorithm, and the HNSW algorithm.

[0165] See also Figure 9 , which is a scene diagram of a method for determining entity type provided by an embodiment of the present application. Figure 9 In the scenario shown, the server is used as the entity type to determine the device, and there will be an entity as the sender in the mailbox system that sends a large number of emails.

[0166] S901: Obtaining bulk emails.

[0167] S902: Extract the corresponding sender.

[0168] The behavior data corresponding to the sender is recorded in the behavior data table.

[0169] S903: Constructing the behavior data into a behavior vector.

[0170] Get the first behavior data within 30 days of January and the second behavior data within 30 days of March from the behavior data table.

[0171] S904: Clustering the behavior vectors.

[0172] The HNSW algorithm is used to cluster the second behavior data based on the target behavior pattern and the initial behavior pattern, and 20 second vector clusters are obtained. Figure 10 , the determination of the target behavior pattern is explained and will not be repeated here.

[0173] The initial behavior pattern is determined by k-means++ clustering. For specific steps, refer to S2021-S2023 and Figure 8 After obtaining the initial behavior pattern, it is necessary to periodically identify and add new behavior patterns, namely target behavior patterns. For specific methods, refer to S2041-S2044 and Figure 10 In addition, useless behavior patterns can be eliminated at regular intervals. S903 and S904 are the process of analyzing behavior patterns from behavior data.

[0174] S905: Evaluate clusters.

[0175] For details, see S2051-S2052, where cluster scores are performed on the 20 second vector clusters. Among them, the scores of 10 second vector clusters are higher than the threshold, and these 10 second vector clusters are all "bad clusters".

[0176] S906: Identify malicious entities.

[0177] According to the behavior types corresponding to the 10 "bad clusters", if the sender's behavior pattern when sending emails hits the above 10 behavior patterns, the sender is a malicious entity and needs to be added to the malicious entity blacklist to intercept the emails sent by it.

[0178] Therefore, starting from the entity behavior side, we construct feature vectors by selecting behavioral data that is strongly correlated with the entity's maliciousness, and then clustering them using the HNSW algorithm with a time complexity of logN. This has the following three advantages:

[0179] (1) Timeliness: The frequency of automated identification of malicious entities (such as malicious senders) is reduced from hours to minutes compared to the graph clustering method, which increases the frequency of automated identification by at least 12 times.

[0180] (2) Malicious entity blacklist coverage: After adding HNSW clustering, the average daily number of newly identified malicious entities increased by 12%-60% compared to the graph clustering method.

[0181] (3) Spam interception: After applying HNSW clustering, the average daily volume of newly intercepted spam by malicious entities increased by 30%. Newly intercepted spam refers to the number of intercepted emails that were only intercepted by malicious entities and not covered by other policies. The average overall interception rate increased by 15%. After identifying and blacklisting malicious entities, they were processed later, with an average of 300,000 emails being deferred from the spam folder per day. This not only resulted in fewer spam emails being received by users, improving their experience, but also reduced the reuse rate of malicious entities, making it more difficult to combat them and increasing the cost of combating them.

[0182] The following combination Figure 10 The target behavior pattern in S904 is obtained. Figure 10 , which is a flowchart of determining a target behavior pattern provided in an embodiment of the present application.

[0183] S1001: Obtain a second feature vector of the second behavior data.

[0184] The second behavior data for 30 days in March is obtained from the behavior data table, and a second feature vector corresponding to the second behavior data is obtained. For details, see S2041.

[0185] S1002: Perform query using the HNSW algorithm.

[0186] The vector distance is obtained by the HNSW algorithm. The vector distance is the Euclidean distance between the second eigenvector corresponding to the second line of data and the target vector. For details, see S2042.

[0187] S1003: Determine whether the vector distance is greater than a distance threshold.

[0188] If not, execute S1004; if so, execute S1005.

[0189] S1004: Obtain HNSW clustering results.

[0190] At this time, the second eigenvectors are all concentrated near the target vector, and no outliers appear.

[0191] S1005: Determine whether the number of undetermined feature vectors is greater than a number threshold.

[0192] At this time, the second eigenvectors are not all gathered near the target vector, and the second eigenvectors greater than the distance threshold are undetermined eigenvectors.

[0193] If yes, execute S1006; if no, execute S1007.

[0194] S1006: Sampling the undetermined feature vector.

[0195] Uniformly sample the undetermined eigenvectors, thereby reducing the number of undetermined eigenvectors.

[0196] S1007: Perform hierarchical clustering.

[0197] Hierarchical clustering is performed on the undetermined feature vector in S1005 or the undetermined feature vector after uniform sampling in S1007.

[0198] S1008: Filter clusters.

[0199] S1009: Sampling cluster.

[0200] S1010: Update the index library.

[0201] Determine the target behavior pattern and add the target behavior pattern to the index library where the initial behavior pattern is located so that S1002 can query it through the HNSW algorithm.

[0202] The HNSW query then generates clustering results. These clustering results are obtained by querying HNSW using the second eigenvector and the index library. To batch detect malicious entities, cluster evaluation can also be performed on these clustering results. The periodic query, clustering, cluster evaluation, and discovery of malicious entities through HNSW is called the entity clustering cycle. This entity clustering cycle is relatively short, such as 10 minutes. This means that malicious entities can be batch detected and blacklisted every 10 minutes.

[0203] In response to the entity type determination method provided in the above embodiment, an embodiment of the present application also provides an entity type determination device.

[0204] See also Figure 11 , which is a schematic diagram of an entity type determination device provided in an embodiment of the present application. Figure 11 As shown, the entity type determination device 1100 includes: an acquisition unit 1101 and a determination unit 1102;

[0205] The acquiring unit 1101 is configured to acquire first behavior data of an entity in the mailbox system, where the first behavior data is used to identify mailbox usage behavior of the corresponding entity within a first period of time;

[0206] The determining unit 1102 is configured to determine a plurality of initial behavior patterns according to the first behavior data;

[0207] The acquiring unit 1101 is further configured to acquire second behavior data of a target entity in the mailbox system, the second behavior data being used to identify mailbox usage behavior of the corresponding target entity within a second time period, the target entity being an entity whose mailbox usage behavior changes during the second time period, the second time period being later than the first time period;

[0208] The determination unit 1102 is further used to determine a target behavior pattern of the target entity that is different from the initial behavior pattern during the second time period based on the second behavior data and the initial behavior pattern; and to determine the entity type of the target entity based on the corresponding behavior type of the target behavior pattern.

[0209] As a possible implementation manner, the determining unit 1102 is configured to:

[0210] Determining second feature vectors corresponding to the target entities respectively according to the second behavior data;

[0211] determining a vector distance between the second eigenvector and the eigenvector corresponding to the initial behavior pattern, and taking the second eigenvector whose vector distance is greater than a distance threshold as a pending eigenvector;

[0212] Obtain at least one second vector cluster by performing vector clustering on the undetermined feature vector;

[0213] The target behavior pattern is determined according to the undetermined feature vector included in the second vector cluster.

[0214] As a possible implementation manner, the determining unit 1102 is configured to:

[0215] determining a behavior type of the target behavior pattern according to second behavior data corresponding to the second vector cluster;

[0216] If a malicious behavior pattern whose behavior type is a malicious type is determined from the target behavior pattern, the target entity associated with the second vector cluster corresponding to the malicious behavior pattern is determined as a malicious entity.

[0217] As a possible implementation manner, the determining unit 1102 is configured to:

[0218] uniformly sampling the undetermined feature vectors to obtain sampled feature vectors, wherein the number of the sampled feature vectors is less than the number of the undetermined feature vectors;

[0219] Vector clustering is performed based on the sampled feature vectors to obtain at least one second vector cluster.

[0220] As a possible implementation, the target vector is one of the cluster feature vectors corresponding to the initial behavior pattern, and the distance threshold is determined as follows:

[0221] determining an undetermined vector distance between the second eigenvector and the target vector;

[0222] According to a threshold sequence arranged from large to small, the number of vectors of the second eigenvector whose distance from the undetermined vector satisfies the undetermined threshold in the threshold sequence is determined in sequence;

[0223] If the difference between the number of vectors at the i-th pending threshold and the number of vectors at the (i+1)-th pending threshold meets a predetermined condition, the distance threshold is determined according to the i-th pending threshold.

[0224] As a possible implementation manner, the determining unit 1102 is configured to:

[0225] determining first feature vectors corresponding to entities in the mailbox system according to the first behavior data;

[0226] Performing vector clustering on the first eigenvector to obtain a plurality of first vector clusters;

[0227] A plurality of initial behavior patterns corresponding one-to-one to the plurality of first vector clusters are determined according to the first eigenvectors included in the first vector clusters.

[0228] As a possible implementation manner, the determining unit 1102 is configured to:

[0229] Sampling a vector from the first eigenvectors included in the first vector cluster, and determining a cluster eigenvector based on the sampled first eigenvectors;

[0230] The cluster feature vectors corresponding to the plurality of first vector clusters are determined as the feature vectors of the plurality of initial behavior patterns.

[0231] As a possible implementation manner, the duration identified by the second time period is equal to the duration identified by the first time period.

[0232] As a possible implementation manner, the to-be-determined behavior pattern is any one of the initial behavior patterns or any one of the target behavior patterns. In the process of determining, based on the second behavior data and the initial behavior pattern, a target behavior pattern of the target entity that is different from the initial behavior pattern during the second time period, the device 1100 is further configured to:

[0233] If the matching frequency between the pending behavior pattern and the second behavior data is lower than a frequency threshold, the pending behavior pattern is deleted.

[0234] As a possible implementation manner, after determining the entity type of the target entity according to the behavior type corresponding to the target behavior pattern, the apparatus 1100 is further configured to:

[0235] The entity blacklist of the mailbox system is updated according to the determined entity type.

[0236] The present application provides an entity type determination device. For an entity in a mailbox system, first behavior data corresponding to the entity's mailbox usage behavior during a first period of time is obtained. Based on the similarities and characteristics between the mailbox usage behaviors reflected in the first behavior data, multiple initial behavior patterns can be determined. Because the first behavior data covers a large number of entities in the mailbox system, the obtained initial behavior patterns are relatively rich and comprehensive, and thus can serve as the basis for subsequent determination of target behavior patterns. Furthermore, the large amount of first behavior data is converted into a smaller number of initial behavior patterns. Determining the target behavior pattern based on the smaller number of initial behavior patterns reduces computational effort and improves the speed of subsequent entity type modeling. Second behavior data corresponding to the target entity's mailbox usage behavior during a second period of time is obtained. The target entity is an entity whose mailbox usage behavior has changed during the second period of time. Since the number of target entities is relatively small, the amount of second behavior data is relatively small compared to the behavior data of all entities during the second period of time. Determining the target behavior pattern based on the smaller number of second behavior data reduces computational effort and can improve the speed of subsequent entity type recognition. Based on the second behavior data and the initial behavior pattern, a target behavior pattern for the target entity during the second period of time that differs from the initial behavior pattern is determined. Since the second time period is later than the first time period, new behavior patterns that are not included in the initial behavior pattern can be discovered through the new behavior data of the target entity in the new time period. The target behavior pattern is used as a supplement to the initial behavior pattern to improve the timeliness of identifying the new behavior pattern. After determining the behavior type of the target behavior pattern, the entity type of the target entity in the mailbox system can be quickly determined based on the behavior type of the target entity. Since the number of behavior patterns is relatively limited, generally much smaller than the number of entity nodes in the relationship graph used by related technologies, target entity recognition is performed more quickly, and through the target behavior pattern, the coverage of the behavior pattern is comprehensive, which can also ensure the overall recognition accuracy.

[0237] The aforementioned entity type determination device may be a computer device, which may be a server or a terminal device. The following will introduce the computer device provided in the embodiment of the present application from the perspective of hardware entity. Figure 12 FIG13 is a schematic diagram of the structure of the server, and FIG14 is a schematic diagram of the structure of the terminal device.

[0238] See also Figure 12 , Figure 1214 is a schematic diagram of a server structure provided in an embodiment of the present application. The server 1400 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPUs) 1422 (for example, one or more processors) and memories 1432, and one or more storage media 1430 (for example, one or more mass storage devices) storing application programs 1442 or data 1444. Among them, the memories 1432 and the storage media 1430 may be temporary storage or permanent storage. The program stored in the storage medium 1430 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the server. Furthermore, the central processing unit 1422 may be configured to communicate with the storage medium 1430 to execute a series of instruction operations in the storage medium 1430 on the server 1400.

[0239] The server 1400 may also include one or more power supplies 1426, one or more wired or wireless network interfaces 1450, one or more input and output interfaces 1458, and / or one or more operating systems 1441, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0240] The steps performed by the server in the above embodiment can be based on the Figure 12 The server structure shown.

[0241] The CPU 1422 is configured to execute the following steps:

[0242] Acquire first behavior data of an entity in a mailbox system, where the first behavior data is used to identify mailbox usage behavior of the corresponding entity within a first time period;

[0243] determining a plurality of initial behavior patterns according to the first behavior data;

[0244] Acquiring second behavior data of a target entity in the mailbox system, where the second behavior data is used to identify mailbox usage behavior of the corresponding target entity within a second time period, where the target entity is an entity whose mailbox usage behavior changes during the second time period, and the second time period is later than the first time period;

[0245] determining, based on the second behavior data and the initial behavior pattern, a target behavior pattern of the target entity during the second time period that is different from the initial behavior pattern;

[0246] The entity type of the target entity is determined based on the behavior type corresponding to the target behavior pattern. Optionally, the CPU 1422 may also execute the method steps of any specific implementation of the entity type determination method in the embodiments of the present application.

[0247] See also Figure 13 , Figure 13 This is a block diagram of a terminal device provided in an embodiment of the present application. Figure 13 The smartphone includes components such as a radio frequency (RF) circuit 1510, a memory 1520, an input unit 1530, a display unit 1540, a sensor 1550, an audio circuit 1560, a wireless fidelity (WiFi) module 1570, a processor 1580, and a power supply 1590. Those skilled in the art will appreciate that Figure 13 The structure of the smartphone shown in the figure does not constitute a limitation on the smartphone, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0248] The following combination Figure 13 A detailed introduction to the various components of a smartphone:

[0249] The RF circuit 1510 can be used to receive and send signals during information transmission or calls. In particular, after receiving downlink information from the base station, it is sent to the processor 1580 for processing. In addition, the designed uplink data is sent to the base station. Generally, the RF circuit 1510 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (LNA), a duplexer, etc. In addition, the RF circuit 1510 can also communicate with the network and other devices through wireless communication. The above-mentioned wireless communication can use any communication standard or protocol, including but not limited to Global System of Mobile Communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), email, Short Messaging Service (SMS), etc.

[0250] The memory 1520 can be used to store software programs and modules. The processor 1580 implements various functional applications and data processing of the smartphone by running the software programs and modules stored in the memory 1520. The memory 1520 may mainly include a program storage area and a data storage area. The program storage area may store an operating system, at least one application required for a function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created based on the use of the smartphone (such as audio data, a phone book, etc.). In addition, the memory 1520 may include a high-speed random access memory and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device.

[0251] The input unit 1530 can be used to receive input digital or character information, and to generate key signal input related to the user settings and function control of the smartphone. Specifically, the input unit 1530 may include a touch panel 1531 and other input devices 1532. The touch panel 1531, also known as a touch screen, can collect user touch operations on or near it (such as operations performed by the user using a finger, stylus, or any other suitable object or accessory on or near the touch panel 1531) and drive the corresponding connection device according to a pre-set program. Optionally, the touch panel 1531 may include two parts: a touch detection device and a touch controller. The touch detection device detects the user's touch direction and detects the signal generated by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device and converts it into touch point coordinates, which are then sent to the processor 1580. It can also receive commands sent by the processor 1580 and execute them. In addition, the touch panel 1531 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch panel 1531, the input unit 1530 may further include other input devices 1532. Specifically, the other input devices 1532 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, power keys, etc.), a trackball, a mouse, and a joystick.

[0252] The display unit 1540 can be used to display information input by the user or information provided to the user and various menus of the smartphone. The display unit 1540 may include a display panel 1541. Optionally, the display panel 1541 may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), etc. Further, the touch panel 1531 may cover the display panel 1541. When the touch panel 1531 detects a touch operation on or near it, it is transmitted to the processor 1580 to determine the type of touch event. Subsequently, the processor 1580 provides corresponding visual output on the display panel 1541 according to the type of touch event. Although in Figure 13 In the embodiment, the touch panel 1531 and the display panel 1541 are used as two independent components to realize the input and output functions of the smartphone, but in some embodiments, the touch panel 1531 and the display panel 1541 can be integrated to realize the input and output functions of the smartphone.

[0253] The smartphone may also include at least one sensor 1550, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 1541 according to the brightness of the ambient light, and the proximity sensor may turn off the display panel 1541 and / or the backlight when the smartphone is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in all directions (generally three axes), and can detect the magnitude and direction of gravity when stationary. It can be used for applications that identify the posture of the smartphone (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for other sensors that can be configured in the smartphone, such as gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc., they will not be described here.

[0254] Audio circuit 1560, speaker 1561, and microphone 1562 provide an audio interface between the user and the smartphone. Audio circuit 1560 converts received audio data into electrical signals and transmits them to speaker 1561, where they are converted into sound signals for output. Microphone 1562, on the other hand, converts collected sound signals into electrical signals, which are then received by audio circuit 1560 and converted into audio data. The audio data is then processed by processor 1580 and transmitted to, for example, another smartphone via RF circuit 1510, or stored in memory 1520 for further processing.

[0255] WiFi is a short-range wireless transmission technology. Smartphones can help users send and receive emails, browse the web, and access streaming media through the WiFi module 1570. It provides users with wireless broadband Internet access. Figure 13 A WiFi module 1570 is shown, but it is understandable that it is not an essential component of the smartphone and can be omitted as needed without changing the essence of the invention.

[0256] Processor 1580 is the control center of the smartphone, connecting all components of the smartphone using various interfaces and circuits. By running or executing software programs and / or modules stored in memory 1520 and accessing data stored in memory 1520, it executes various smartphone functions and processes data, thereby providing overall smartphone monitoring. Optionally, processor 1580 may include one or more processing units; preferably, processor 1580 may integrate an application processor and a modem processor, with the application processor primarily handling the operating system, user interface, and application programs, while the modem processor primarily handles wireless communications. It is understood that the modem processor may not be integrated into processor 1580.

[0257] The smartphone also includes a power supply 1590 (such as a battery) for supplying power to various components. Preferably, the power supply can be logically connected to the processor 1580 through a power management system, thereby managing functions such as charging, discharging, and power consumption through the power management system.

[0258] Although not shown, the smartphone may also include a camera, a Bluetooth module, etc., which will not be described in detail here.

[0259] In the embodiment of the present application, the memory 1520 included in the smart phone can store program codes and transmit the program codes to the processor.

[0260] The processor 1580 included in the smart phone can execute the entity type determination method provided in the above embodiment according to the instructions in the program code.

[0261] An embodiment of the present application further provides a computer-readable storage medium for storing a computer program, wherein the computer program is used to execute the entity type determination method provided in the above embodiment.

[0262] Embodiments of the present application also provide a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the entity type determination method provided in various optional implementations of the above aspects.

[0263] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the above-mentioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the above-mentioned storage medium can be at least one of the following media: read-only memory (English: read-only memory, abbreviated: ROM), RAM, magnetic disk or optical disk, etc., various media that can store program codes.

[0264] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments. The device and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. A person of ordinary skill in the art can understand and implement it without expending creative work.

[0265] The above is merely one specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A method for determining an entity type, characterized in that: The method comprises: Acquire first behavior data of an entity in a mailbox system, where the first behavior data is used to identify mailbox usage behavior of the corresponding entity within a first time period; determining a plurality of initial behavior patterns based on the first behavior data, wherein each initial behavior pattern represents a type of the first behavior data having similarities and characteristics, and the number of the plurality of initial behavior patterns is less than the number of the first behavior data; Acquiring second behavior data of a target entity in the mailbox system, where the second behavior data is used to identify mailbox usage behavior of the corresponding target entity within a second time period, where the target entity is an entity whose mailbox usage behavior changes during the second time period, and the second time period is later than the first time period; determining, based on the second behavior data and the initial behavior pattern, a target behavior pattern of the target entity during the second time period that is different from the initial behavior pattern; The entity type of the target entity is determined according to the behavior type corresponding to the target behavior pattern.

2. The method according to claim 1, characterized in that The determining, based on the second behavior data and the initial behavior pattern, a target behavior pattern of the target entity during the second time period that is different from the initial behavior pattern includes: Determining second feature vectors corresponding to the target entities respectively according to the second behavior data; determining a vector distance between the second eigenvector and the eigenvector corresponding to the initial behavior pattern, and taking the second eigenvector whose vector distance is greater than a distance threshold as a pending eigenvector; Obtain at least one second vector cluster by performing vector clustering on the undetermined feature vector; The target behavior pattern is determined according to the undetermined feature vector included in the second vector cluster.

3. The method according to claim 2, characterized in that The determining the entity type of the target entity according to the behavior type corresponding to the target behavior pattern includes: determining a behavior type of the target behavior pattern according to second behavior data corresponding to the second vector cluster; If a malicious behavior pattern whose behavior type is a malicious type is determined from the target behavior pattern, the target entity associated with the second vector cluster corresponding to the malicious behavior pattern is determined as a malicious entity.

4. The method according to claim 2, characterized in that The step of performing vector clustering on the undetermined feature vector to obtain at least one second vector cluster includes: uniformly sampling the undetermined feature vectors to obtain sampled feature vectors, wherein the number of the sampled feature vectors is less than the number of the undetermined feature vectors; Vector clustering is performed based on the sampled feature vectors to obtain at least one second vector cluster.

5. The method according to claim 2, characterized in that The target vector is one of the cluster feature vectors corresponding to the initial behavior pattern, and the distance threshold is determined as follows: determining an undetermined vector distance between the second eigenvector and the target vector; According to a threshold sequence arranged from large to small, the number of vectors of the second eigenvector whose distance from the undetermined vector satisfies the undetermined threshold in the threshold sequence is determined in sequence; If the difference between the number of vectors at the i-th pending threshold and the number of vectors at the (i+1)-th pending threshold meets a predetermined condition, the distance threshold is determined according to the i-th pending threshold.

6. The method according to claim 1, characterized in that The determining of a plurality of initial behavior patterns according to the first behavior data includes: determining first feature vectors corresponding to entities in the mailbox system according to the first behavior data; Performing vector clustering on the first eigenvector to obtain a plurality of first vector clusters; A plurality of initial behavior patterns corresponding one-to-one to the plurality of first vector clusters are determined according to the first eigenvectors included in the first vector clusters.

7. The method according to claim 6, characterized in that The determining, based on the first eigenvector included in the first vector cluster, a plurality of initial behavior patterns corresponding one-to-one to the plurality of first vector clusters includes: Sampling a vector from the first eigenvectors included in the first vector cluster, and determining a cluster eigenvector based on the sampled first eigenvectors; The cluster feature vectors corresponding to the plurality of first vector clusters are determined as the feature vectors of the plurality of initial behavior patterns.

8. The method according to any one of claims 1 to 7, characterized in that The duration identified by the second time period is equal to the duration identified by the first time period.

9. The method according to any one of claims 1 to 7, characterized in that: The pending behavior pattern is any one of the initial behavior patterns or any one of the target behavior patterns. In the process of determining, based on the second behavior data and the initial behavior pattern, a target behavior pattern of the target entity that is different from the initial behavior pattern during the second time period, the method further includes: If the matching frequency between the pending behavior pattern and the second behavior data is lower than a frequency threshold, the pending behavior pattern is deleted.

10. The method according to any one of claims 1 to 7, characterized in that: After determining the entity type of the target entity according to the behavior type corresponding to the target behavior pattern, the method further includes: The entity blacklist of the mailbox system is updated according to the determined entity type.

11. An entity type determination device, characterized in that: The device includes: an acquisition unit and a determination unit; The acquiring unit is configured to acquire first behavior data of an entity in the mailbox system, where the first behavior data is used to identify mailbox usage behavior of the corresponding entity within a first time period; The determining unit is configured to determine a plurality of initial behavior patterns based on the first behavior data, wherein each initial behavior pattern represents a type of the first behavior data having similarities and characteristics, and the number of the plurality of initial behavior patterns is less than the number of the first behavior data; The acquiring unit is further configured to acquire second behavior data of a target entity in the mailbox system, the second behavior data being used to identify mailbox usage behavior of the corresponding target entity within a second time period, the target entity being an entity whose mailbox usage behavior changes during the second time period, the second time period being later than the first time period; The determination unit is further used to determine a target behavior pattern of the target entity that is different from the initial behavior pattern during the second time period based on the second behavior data and the initial behavior pattern; and determine the entity type of the target entity based on the behavior type corresponding to the target behavior pattern.

12. The device according to claim 11, characterized in that The determining unit is configured to: Determining second feature vectors corresponding to the target entities respectively according to the second behavior data; determining a vector distance between the second eigenvector and the eigenvector corresponding to the initial behavior pattern, and taking the second eigenvector whose vector distance is greater than a distance threshold as a pending eigenvector; Obtain at least one second vector cluster by performing vector clustering on the undetermined feature vector; The target behavior pattern is determined according to the undetermined feature vector included in the second vector cluster.

13. The device according to claim 12, characterized in that The determining unit is configured to: determining a behavior type of the target behavior pattern according to second behavior data corresponding to the second vector cluster; If a malicious behavior pattern whose behavior type is a malicious type is determined from the target behavior pattern, the target entity associated with the second vector cluster corresponding to the malicious behavior pattern is determined as a malicious entity.

14. A computer device, characterized in that: The device includes a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is configured to execute the method according to any one of claims 1 to 10 according to the instructions in the program code.

15. A computer-readable storage medium, characterized in that The computer-readable storage medium is used to store a computer program, and the computer program is used to execute the method according to any one of claims 1 to 10.

Images