A method and system for automatically handling user chat risk levels

Abstract

The present invention provides a method and system for automatically handling user chat risk levels, the method comprising: processing and analyzing the user's chat behavior based on a training model of a big data platform to obtain corresponding detection results; conducting a portrait study and analysis on the data of the big data platform to extract identification information as a measurement standard and reference basis for anti-cheating identification description; analyzing the possible risks of users and digitizing them to obtain risk values, and distinguishing accounts that pose hidden dangers to the platform. The present invention combines the automated anti-fraud process to propose a complete set of risk level handling for the risk level of reported data and an automated process for complaints from handled users, which greatly speeds up the processing speed, improves the processing efficiency, and reduces and avoids the losses caused by anti-fraud.

Description

Technical Field

[0001] The present invention relates to the technical field of computer programming, and in particular to a method and system for automatically handling user chat risk levels. Background Art

[0002] Currently, user behaviors such as fraud often exist in online interactions. The investigation process only begins after other users report it. The investigation process requires a lot of manpower and time to judge. The final result is that it takes too long and cannot fully recover the funds. In serious cases, all the funds are even defrauded, causing irreparable losses to other users. Summary of the invention

[0003] In view of this, the purpose of the present invention is to combine the automated anti-fraud process to check the risk level of the reported data, and design a complete set of automated processes for risk level handling and user complaints, so as to speed up the processing.

[0004] The present invention provides a method for automatically handling user chat risk levels, comprising the following steps:

[0005] S1. Process and analyze the user's chat behavior based on the training model of the big data platform to obtain the corresponding detection results;

[0006] The training method of the training model includes constructing a number of training set samples based on the user's information in different behavior scenarios, behavior content, basic information of the behavior user, and information dimensions of the device where the behavior occurs, using devices, configuring models and training parameters, and calculating each training set sample to obtain a detection result;

[0007] Since there are multiple dimensions of information, different experiments are conducted on the model parameters;

[0008] UB1 represents the scene where the behavior occurs, UB2 represents the content of the behavior, UB3 represents the basic information of the behavior user, and UB4 represents the device information where the behavior occurs;

[0009] Give UB1 an initial value, and then adjust UB1 step by step through training and iteration to finally get a suitable value;

[0010] Give UB1 and UB2 an initial value, and then adjust UB1 and UB2 step by step through training and iteration to finally get the appropriate value;

[0011] UB1...UB4 are calculated crosswise;

[0012] Give UB1, UB2, UB3 and UB4 an initial value, and then adjust UB1, UB2, UB3 and UB4 step by step through training, and finally get the appropriate value;

[0013] Through continuous training, the model parameters are made more and more accurate, so that the detection results are reliable for various user behaviors input;

[0014] The detection results of the chat action include three levels: release, observation, and interception; among which:

[0015] Release: indicates that the user's device operation behavior is normal;

[0016] Observation: For example, if the user's operation behavior (mouse click / move) is frequent or exceeds a certain threshold (such as 1,000 times per second), it is considered to be some bad behavior operation, which can be marked or used as a warning to the user;

[0017] Interception: For example, if the user's operation data contains data forgery, tampering with system parameter information, or data risk control blacklist, that is, the user's operation is very abnormal and harmful to the system, it can be determined to be harmful user behavior and needs to be restricted, punished, or blocked;

[0018] S2. Conduct image research and analysis on the data on the big data platform to extract identification information as a measurement standard and reference for anti-cheating identification description;

[0019] The method of portrait research and analysis includes:

[0020] Constructing a user portrait based on the data according to the required device model, device IP address, device MAC address, device software version information, device unique identification code, sensor data, installation list, user number, md5 encryption method of the user's mobile phone, user IP, user gender, and user level. The method for constructing the user portrait includes: analyzing various dimensions of the user and calculating label weights;

[0021] Set the label weight threshold. The labels constructed and analyzed include: data anomaly, behavior anomaly, and verification anomaly.

[0022] Analyze whether the label of the sample user's device IP address dimension is normal or abnormal based on the data outliers, behavior outliers, and verification outliers of the sample user's device model dimension, as well as the data outliers, behavior outliers, and verification outliers of the device IP address dimension;

[0023] For example, if the label weight threshold is set to 5.0, the labels constructed and analyzed include: data anomaly, behavior anomaly, and verification anomaly;

[0024] The device model dimensions of sample user A0001 are: data anomaly -0.1, behavior anomaly -0.1, verification anomaly -0.4;

[0025] The dimensions of device IP address are: data anomaly -1.4, behavior anomaly -0.3, verification anomaly -0.8;

[0026] The verification of the device IP address dimension of sample user A0001 is abnormal, but the identification information is normal.

[0027] The device model dimensions of sample user A0002 are: data anomaly -0.4, behavior anomaly -0.1, verification anomaly -0.3;

[0028] The device IP address dimensions are: data anomaly - 2.4, behavior anomaly - 1.3, verification anomaly - 9.8;

[0029] Then the verification of the device IP address dimension of sample user A0002 is abnormal, and the identification information is verification abnormality;

[0030] The measurement criteria and reference bases include:

[0031] Normal: indicates that the user's operation behavior is normal;

[0032] Data anomaly: indicates that the data integrity check fails or the data is forged;

[0033] Behavior anomaly: indicates that the user's operation behavior (mouse click / move, etc.) cannot pass the behavior verification model;

[0034] Device model: indicates that there is information such as device fingerprint that cannot pass the device verification model;

[0035] Business model: indicates that there are database collisions, batch operations, and violations of business rules;

[0036] Verification abnormality: indicates that the data strong verification result is abnormal or the data is forged;

[0037] Simulator: indicates that there is an Android end using a mobile phone simulator;

[0038] Jailbreak or ROOT: Indicates that the iOS system has been jailbroken or the Android system has been rooted;

[0039] Browser abnormality: indicates that parameters such as browser resolution are abnormal or have been tampered with;

[0040] IP anomaly: indicates that the terminal IP profiling result is a risky IP or a high-risk IP;

[0041] Blacklist: EasyShield’s own and customer-defined blacklist data;

[0042] Whitelist: Yidun’s own and customer-defined whitelist data;

[0043] High-risk accounts: Indicates risky account types such as group accounts or abnormal shared accounts;

[0044] Multiple small accounts opened: indicates that multiple accounts have been opened in batches;

[0045] Tampering with hardware information: means tampering with hardware device parameter information;

[0046] Tampering with system information: means tampering with system parameter information;

[0047] High-risk equipment: indicates the risk score of high-risk equipment portraits, black market characteristic equipment, and other types;

[0048] Group control or cloud control: refers to group control studio equipment or cloud machines;

[0049] Installation modification tool: indicates installation of Hook modification, Xposed modification, and Magisk modification;

[0050] Virtual environment: refers to a non-real device access environment, which is different from the Android emulator, such as the editing background;

[0051] Script tools: refers to script tools used by black and gray industries for cheating;

[0052] S3. Analyze the possible risks of users and quantify the risk values ​​to distinguish accounts that pose hidden dangers to the platform; the accounts with hidden dangers include: soliciting people, black and gray industries, and diverting traffic.

[0053] The higher the numerical score, the more serious the abnormal performance of the user;

[0054] Specifically, for example, if 0.5≤User Risk Value<0.7, it means that the user has a certain risk; if 0.7≤User Risk Value≤1, it means that the user has a high risk and is a harmful account to the platform, such as when the user's operation behavior touches data anomalies, verification anomalies, simulators, IP anomalies, or high-risk devices;

[0055] Furthermore, the method of processing and analyzing the user's chat behavior based on the training model of the big data platform in step S1 includes the following steps:

[0056] S11. Report suspected fraudulent chat behaviors. In order to serve as a basis for verification and analysis, as well as automated processing, the reporter, the reported party, the reporting type, the reporting scenario, the reporting time, the reporting content and the corresponding data are imported into the reporting information database (MySQL);

[0057] S12, importing the user ID, user client anti-cheating code, user mobile phone: md5 encryption method, user IP, activity identifier, user registration type, user gender, user level, number of friends, and rewards into the digital content risk control engine (Dun) through the big data platform;

[0058] The quasi-real-time approach of the big data platform improves resource utilization and speeds up data processing.

[0059] Furthermore, after the step S3, if the reported user takes the initiative to file a complaint, the following steps are also included:

[0060] The detection result, the anti-cheating identification description and the risk value are used as evaluation criteria to judge the reported user, thereby reducing the amount of complex manual review, repeated work, etc.;

[0061] If the chat behavior of the reported user is allowed in the anti-cheating identification description, the operation will be revoked and the account status of the user will be quickly restored;

[0062] If the chat behavior detection result of the reported user is blocked, and / or the anti-cheating identification description is blacklisted, and / or the risk value is 0.9, it means that the account is very harmful. There is no need to process the withdrawal appeal. Click Refund to compensate the reporting user with a certain amount of virtual currency.

[0063] Furthermore, the method for determining the reported user includes:

[0064] S31, determine whether the basic data information of both users of the reporting data complies with the identification rules;

[0065] The basic data information includes: amount data, user gender, and user level;

[0066] Specifically, assuming that the recharge amount of user A does not reach RMB 1,000.00, the reported user B is female and the level of user B does not reach level 5, the system can make an automatic judgment;

[0067] S32, determine the prosecution period, and determine whether the in-depth information of both users of the reporting data meets the identification rules;

[0068] The in-depth information includes: the length of time from when the chat took place to when it was reported;

[0069] For example, if the time between the first text chat between user A and user B and the reporting time is 20 days, they can be allowed to enter the system automation process;

[0070] S33. Determine whether the reported data complies with the identification rules through supplementary strategies;

[0071] Specifically, through the supplementary algorithm, the corresponding number of hits of the reported user will be found in the reporting data archive. If it is more than 2 times, it can be determined that the number of hits is too many, and the automated process can be skipped and transferred to the manual process. Otherwise, it will enter the automated penalty process.

[0072] The present invention also provides a user chat risk level automatic handling system, which executes the user chat risk level automatic handling method as described above, including:

[0073] Processing and analyzing test results module: Based on the training model of the big data platform, the user's chat behavior is processed and analyzed to obtain the corresponding test results;

[0074] Anti-fraud identification description module: This module conducts image research and analysis on the data of the big data platform, extracts identification information, and serves as the measurement standard and reference for anti-fraud identification description;

[0075] Numerical risk value module: used to analyze the possible risks of users and quantify the risk values ​​to distinguish accounts that pose hidden dangers to the platform.

[0076] Furthermore, the user chat risk level automatic handling system also includes:

[0077] Suspected fraud data import module: used to report suspected fraudulent chat behaviors, and import the reporter, reported party, report type, report scenario, report time, report content and corresponding data into the report information database;

[0078] Risk control module: import the user number, user client anti-cheating code, user mobile phone: md5 encryption method, user IP, activity ID, user registration type, user gender, user level, number of friends, and rewards into the digital content risk control engine (Dun) through the big data platform.

[0079] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the above-mentioned method for automatically handling user chat risk levels are implemented.

[0080] The present invention also provides a computer device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps of the method for automatically handling user chat risk levels as described above are implemented.

[0081] Compared with the prior art, the present invention has the following beneficial effects:

[0082] The present invention combines the automated anti-fraud process and proposes a complete set of risk level processing for the risk level of reported data and an automated process for complaints from processed users, which greatly speeds up the processing speed, improves the processing efficiency, and reduces and avoids the losses caused by anti-fraud. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] Various other advantages and benefits will become apparent to users of ordinary skill in the art by reading the following detailed description of the preferred embodiment.The drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention.

[0084] In the attached picture:

[0085] Figure 1 It is a flow chart of a method for automatically handling user chat risk levels of the present invention;

[0086] Figure 2 is a schematic diagram of the structure of a computer device according to an embodiment of the present invention;

[0087] Figure 3 It is a flow chart of an embodiment of the present invention for processing and analyzing a user's chat behavior based on a training model of a big data platform;

[0088] Figure 4 is a flow chart of a method for determining a reported user according to an embodiment of the present invention;

[0089] Figure 5 This is a schematic diagram of the architecture of a system for automatically handling user chat risk levels according to an embodiment of the present invention;

[0090] Figure 6 is a schematic diagram of a flow chart of determining a reported user in an embodiment of the present invention;

[0091] Figure 7 It is a schematic diagram of the process of automatically handling the risk level of user chats in an embodiment of the present invention. DETAILED DESCRIPTION

[0092] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0093] The terms used in this disclosure are for the purpose of describing specific embodiments only and are not intended to limit the disclosure. The singular forms of "a", "said" and "the" used in this disclosure and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0094] It should be understood that although the terms first, second, and third may be used to describe various signals in the present disclosure, these signals should not be limited to these terms. These terms are only used to distinguish signals of the same type from each other. For example, without departing from the scope of the present disclosure, the first signal may also be referred to as the second signal, and similarly, the second signal may also be referred to as the first signal. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0095] The embodiment of the present invention provides a method for automatically handling the risk level of user chat. Figure 1 As shown, the following steps are included:

[0096] S1. Process and analyze the user's chat behavior based on the training model of the big data platform to obtain the corresponding detection results;

[0097] The training method of the training model includes constructing a number of training set samples based on the user's information in different behavior scenarios, behavior content, basic information of the behavior user, and information dimensions of the device where the behavior occurs, using devices, configuring models and training parameters, and calculating each training set sample to obtain a detection result;

[0098] Since there are multiple dimensions of information, different experiments are conducted on the model parameters;

[0099] UB1 represents the scene where the behavior occurs, UB2 represents the content of the behavior, UB3 represents the basic information of the behavior user, and UB4 represents the device information where the behavior occurs;

[0100] Give UB1 an initial value, and then adjust UB1 step by step through training and iteration to finally get a suitable value;

[0101] Give UB1 and UB2 an initial value, and then adjust UB1 and UB2 step by step through training and iteration to finally get the appropriate value;

[0102] UB1...UB4 are calculated crosswise;

[0103] Give UB1, UB2, UB3 and UB4 an initial value, and then adjust UB1, UB2, UB3 and UB4 step by step through training, and finally get the appropriate value;

[0104] Through continuous training, the model parameters are made more and more accurate, so that the detection results are reliable for various user behaviors input;

[0105] The detection results of the chat action include three levels: release, observation, and interception; among which:

[0106] Release: indicates that the user's device operation behavior is normal;

[0107] Observation: For example, if the user's operation behavior (mouse click / move) is frequent or exceeds a certain threshold (such as 1,000 times per second), it is considered to be some bad behavior operation, which can be marked or used as a warning to the user;

[0108] Interception: For example, if the user's operation data contains data forgery, tampering with system parameter information, or data risk control blacklist, that is, the user's operation is very abnormal and harmful to the system, it can be determined to be harmful user behavior and needs to be restricted, punished, or blocked;

[0109] S2. Conduct image research and analysis on the data on the big data platform to extract identification information as a measurement standard and reference for anti-cheating identification description;

[0110] The method of portrait research and analysis includes:

[0111] Constructing a user portrait based on the data according to the required device model, device IP address, device MAC address, device software version information, device unique identification code, sensor data, installation list, user number, md5 encryption method of the user's mobile phone, user IP, user gender, and user level. The method for constructing the user portrait includes: analyzing various dimensions of the user and calculating label weights;

[0112] Set the label weight threshold. The labels constructed and analyzed include: data anomaly, behavior anomaly, and verification anomaly.

[0113] Analyze whether the label of the sample user's device IP address dimension is normal or abnormal based on the data outliers, behavior outliers, and verification outliers of the sample user's device model dimension, as well as the data outliers, behavior outliers, and verification outliers of the device IP address dimension;

[0114] In this embodiment, the label weight threshold is set to 5.0, and the labels that need to be constructed and analyzed include: data anomaly, behavior anomaly, and verification anomaly;

[0115] The device model dimensions of sample user A0001 are: data anomaly -0.1, behavior anomaly -0.1, verification anomaly -0.4;

[0116] The dimensions of device IP address are: data anomaly -1.4, behavior anomaly -0.3, verification anomaly -0.8;

[0117] The verification of the device IP address dimension of sample user A0001 is abnormal, but the identification information is normal.

[0118] The device model dimensions of sample user A0002 are: data anomaly -0.4, behavior anomaly -0.1, verification anomaly -0.3;

[0119] The device IP address dimensions are: data anomaly - 2.4, behavior anomaly - 1.3, verification anomaly - 9.8;

[0120] Then the verification of the device IP address dimension of sample user A0002 is abnormal, and the identification information is verification abnormality;

[0121] The measurement criteria and reference bases include:

[0122] Normal: indicates that the user's operation behavior is normal;

[0123] Data anomaly: indicates that the data integrity check fails or the data is forged;

[0124] Behavior anomaly: indicates that the user's operation behavior (mouse click / move, etc.) cannot pass the behavior verification model;

[0125] Device model: indicates that there is information such as device fingerprint that cannot pass the device verification model;

[0126] Business model: indicates that there are database collisions, batch operations, and violations of business rules;

[0127] Verification abnormality: indicates that the data strong verification result is abnormal or the data is forged;

[0128] Simulator: indicates that there is an Android end using a mobile phone simulator;

[0129] Jailbreak or ROOT: Indicates that the iOS system has been jailbroken or the Android system has been rooted;

[0130] Browser abnormality: indicates that parameters such as browser resolution are abnormal or have been tampered with;

[0131] IP anomaly: indicates that the terminal IP profiling result is a risky IP or a high-risk IP;

[0132] Blacklist: EasyShield’s own and customer-defined blacklist data;

[0133] Whitelist: Yidun’s own and customer-defined whitelist data;

[0134] High-risk accounts: Indicates risky account types such as group accounts or abnormal shared accounts;

[0135] Multiple small accounts opened: indicates that multiple accounts have been opened in batches;

[0136] Tampering with hardware information: means tampering with hardware device parameter information;

[0137] Tampering with system information: means tampering with system parameter information;

[0138] High-risk equipment: indicates the risk score of high-risk equipment portraits, black market characteristic equipment, and other types;

[0139] Group control or cloud control: refers to group control studio equipment or cloud machines;

[0140] Installation modification tool: indicates installation of Hook modification, Xposed modification, and Magisk modification;

[0141] Virtual environment: refers to a non-real device access environment, which is different from the Android emulator, such as the editing background;

[0142] Script tools: refers to script tools used by black and gray industries for cheating;

[0143] S3. Analyze the possible risks of users and quantify the risk values ​​to distinguish accounts that pose hidden dangers to the platform; the accounts with hidden dangers include: soliciting people, black and gray industries, and diverting traffic.

[0144] The higher the numerical score, the more serious the abnormal performance of the user;

[0145] Specifically, for example, if 0.5≤User Risk Value<0.7, it means that the user has a certain risk; if 0.7≤User Risk Value≤1, it means that the user has a high risk and is a harmful account to the platform, such as when the user's operation behavior touches data anomalies, verification anomalies, simulators, IP anomalies, or high-risk devices;

[0146] The method for processing and analyzing the user's chat behavior based on the training model of the big data platform in step S1 is described in detail in Figure 3 As shown, the following steps are included:

[0147] S11. Report suspected fraudulent chat behaviors. In order to serve as a basis for verification and analysis, as well as automated processing, the reporter, the reported party, the reporting type, the reporting scenario, the reporting time, the reporting content and the corresponding data are imported into the reporting information database (MySQL);

[0148] S12, importing the user ID, user client anti-cheating code, user mobile phone: md5 encryption method, user IP, activity identifier, user registration type, user gender, user level, number of friends, and rewards into the digital content risk control engine (Dun) through the big data platform;

[0149] The quasi-real-time approach of the big data platform improves resource utilization and speeds up data processing.

[0150] If the reported user takes the initiative to file a complaint after step S3, the following steps are also included:

[0151] The detection result, the anti-cheating identification description and the risk value are used as evaluation criteria to judge the reported user, thereby reducing the amount of complex manual review, repeated work, etc.;

[0152] If the chat behavior of the reported user is allowed in the anti-cheating identification description, the operation will be revoked and the account status of the user will be quickly restored;

[0153] If the chat behavior detection result of the reported user is blocked, and / or the anti-cheating identification description is blacklisted, and / or the risk value is 0.9, it means that the account is very harmful. There is no need to process the withdrawal appeal. Click Refund to compensate the reporting user with a certain amount of virtual currency.

[0154] For the method of judging reported users, see Figure 4 As shown, including:

[0155] S31, determine whether the basic data information of both users of the reporting data complies with the identification rules;

[0156] The basic data information includes: amount data, user gender, and user level;

[0157] Specifically, assuming that the recharge amount of user A does not reach RMB 1,000.00, the reported user B is female and the level of user B does not reach level 5, the system can automatically determine;

[0158] S32, determine the prosecution period, and determine whether the in-depth information of both users of the reporting data meets the identification rules;

[0159] The in-depth information includes: the length of time from when the chat took place to when it was reported;

[0160] For example, if the time between the first text chat between user A and user B and the reporting time is 20 days, they can be allowed to enter the system automation process;

[0161] S33. Determine whether the reported data complies with the identification rules through supplementary strategies;

[0162] Specifically, through the supplementary algorithm, the corresponding number of hits of the reported user will be found in the reporting data archive. If it is more than 2 times, it can be determined that the number of hits is too many, and the automated process can be skipped and transferred to the manual process. Otherwise, it will enter the automated penalty process.

[0163] Figure 6 The figure is a flow chart of judging a reported user according to an embodiment of the present invention.

[0164] The embodiment of the present invention further provides a user chat risk level automatic handling system, which executes the user chat risk level automatic handling method as described above, including:

[0165] Processing and analyzing test results module: Based on the training model of the big data platform, the user's chat behavior is processed and analyzed to obtain the corresponding test results;

[0166] Anti-fraud identification description module: This module conducts image research and analysis on the data of the big data platform, extracts identification information, and serves as the measurement standard and reference for anti-fraud identification description;

[0167] Numerical risk value module: used to analyze the possible risks of users and quantify the risk values ​​to distinguish accounts that pose hidden dangers to the platform.

[0168] The user chat risk level automatic handling system also includes:

[0169] Suspected fraud data import module: used to report suspected fraudulent chat behaviors, and import the reporter, reported party, report type, report scenario, report time, report content and corresponding data into the report information database;

[0170] Risk control module: import the user number, user client anti-cheating code, user mobile phone: md5 encryption method, user IP, activity ID, user registration type, user gender, user level, number of friends, and rewards into the digital content risk control engine (Dun) through the big data platform.

[0171] Figure 5 Schematic diagram of the architecture of the system for automatically handling user chat risk levels according to an embodiment of the present invention.

[0172] Figure 7 The figure is a flow chart of automatic handling of user chat risk levels according to an embodiment of the present invention.

[0173] The embodiment of the present invention combines the automated anti-fraud process to propose a complete set of risk level processing for the risk level of reported data and an automated process for complaints from processed users, which greatly speeds up the processing speed, improves the processing efficiency, and reduces and avoids the losses caused by anti-fraud.

[0174] The embodiment of the present invention further provides a computer device, Figure 2 is a schematic diagram of the structure of a computer device provided by an embodiment of the present invention; see the accompanying drawings Figure 2As shown, the computer device includes: an input device 23, an output device 24, a memory 22 and a processor 21; the memory 22 is used to store one or more programs; when the one or more programs are executed by the one or more processors 21, the one or more processors 21 implement the user chat risk level automatic handling method provided by the above embodiment; wherein the input device 23, the output device 24, the memory 22 and the processor 21 can be connected by a bus or other means, Figure 2 The example of connecting through bus is taken in the following.

[0175] The memory 22 is a readable and writable storage medium of a computing device, which can be used to store software programs and computer executable programs, such as program instructions corresponding to the method for automatically handling the user chat risk level described in the embodiment of the present invention; the memory 22 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system and at least one application required for a function; the data storage area can store data created according to the use of the device, etc.; in addition, the memory 22 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device; in some instances, the memory 22 can further include a memory remotely arranged relative to the processor 21, and these remote memories can be connected to the device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0176] The input device 23 may be used to receive input digital or character information, and to generate key signal input related to user settings and function control of the device; the output device 24 may include a display device such as a display screen.

[0177] The processor 21 executes various functional applications and data processing of the device by running the software programs, instructions and modules stored in the memory 22, that is, implements the above-mentioned method for automatically handling the user chat risk level.

[0178] The computer device provided above can be used to execute the user chat risk level automatic handling method provided in the above embodiment, and has corresponding functions and beneficial effects.

[0179] The embodiment of the present invention also provides a storage medium containing computer executable instructions, which are used to execute the user chat risk level automatic disposal method provided by the above embodiment when executed by a computer processor. The storage medium is any of various types of memory devices or storage devices, and the storage medium includes: installation media, such as CD-ROM, floppy disk or tape device; computer system memory or random access memory, such as DRAM, DDR RAM, SRAM, EDO RAM, Rambus RAM, etc.; non-volatile memory, such as flash memory, magnetic media (such as hard disk or optical storage); registers or other similar types of memory elements, etc.; the storage medium may also include other types of memory or combinations thereof; in addition, the storage medium may be located in the first computer system in which the program is executed, or may be located in a different second computer system, the second computer system is connected to the first computer system via a network (such as the Internet); the second computer system may provide program instructions to the first computer for execution. The storage medium includes two or more storage media that can reside in different locations (such as in different computer systems connected via a network). The storage medium can store program instructions (such as specifically implemented as a computer program) that can be executed by one or more processors.

[0180] Of course, the storage medium containing computer executable instructions provided in an embodiment of the present invention is not limited to the automatic handling method of user chat risk level as described in the above embodiment, and can also execute related operations in the automatic handling method of user chat risk level provided in any embodiment of the present invention.

[0181] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for users skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, users skilled in the art can make the same changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0182] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For technical users in the field, the present invention may have various modifications and changes. Any modification, replacement, and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for automatically handling user chat risk levels, characterized in that: The following steps are involved: S1. Based on the training model of the big data platform, the user's chat behavior is processed and analyzed to obtain the corresponding detection results; The training method of the training model includes constructing a number of training set samples based on the user's information in different behavior scenarios, behavior content, basic information of the behavior user, and information dimensions of the device where the behavior occurs, using devices, configuring models and training parameters, and calculating each training set sample to obtain a detection result; The test results include three levels: release, observation, and interception; S2. Conduct image research and analysis on the data on the big data platform to extract identification information as a measurement standard and reference for anti-cheating identification description; The method of portrait research and analysis includes: Constructing a user portrait based on the data according to the required device model, device IP address, device MAC address, device software version information, device unique identification code, sensor data, installation list, user number, md5 encryption method of the user's mobile phone, user IP, user gender, and user level. The method for constructing the user portrait includes: analyzing various dimensions of the user and calculating label weights; Set the label weight threshold. The labels constructed and analyzed include: data anomaly, behavior anomaly, and verification anomaly. Analyze whether the label of the sample user's device IP address dimension is normal or abnormal based on the data outliers, behavior outliers, and verification outliers of the sample user's device model dimension, as well as the data outliers, behavior outliers, and verification outliers of the device IP address dimension; S3. Analyze the possible risks of users and quantify the risk values ​​to distinguish accounts that pose hidden dangers to the platform; the accounts with hidden dangers include: soliciting people, black and gray industries, and diverting traffic; The training method of the training model in step S1 comprises the following steps: UB1 represents the scene where the behavior occurs, UB2 represents the content of the behavior, UB3 represents the basic information of the behavior user, and UB4 represents the device information where the behavior occurs; Give UB1 an initial value, and then adjust UB1 step by step through training and iteration to finally get a suitable value; Give UB1 and UB2 an initial value, and then adjust UB1 and UB2 step by step through training and iteration to finally get the appropriate value; UB1, UB2, UB3 and UB4 are calculated crosswise; Give UB1, UB2, UB3 and UB4 an initial value, and then adjust UB1, UB2, UB3 and UB4 step by step through training, and finally get the appropriate value; Through continuous training, the parameters of the model become more and more accurate; If the reported user takes the initiative to file a complaint after step S3, the following steps are also included: Using the detection result, the anti-cheating identification description and the risk value as evaluation criteria to judge the reported user; If the chat behavior of the reported user is allowed in the anti-cheating identification description, the operation will be revoked and the account status of the user will be quickly restored; If the chat behavior detection result of the reported user is blocked, and / or the anti-cheating identification description is blacklisted, and / or the risk value is 0.9, click Refund to compensate the reporting user with a certain amount of virtual currency; The method for determining the reported user includes: S31, determine whether the basic data information of both users of the reporting data complies with the identification rules; The basic data information includes: amount data, user gender, and user level; S32, determine the prosecution period, and determine whether the in-depth information of both users of the reporting data meets the identification rules; The in-depth information includes: the length of time from when the chat took place to when it was reported; S33. Determine whether the reported data complies with the identification rules through supplementary strategies.

2. The method for automatically handling user chat risk levels according to claim 1, characterized in that: The measurement criteria and reference basis of the step S2 include: Normal: indicates that the user's operation behavior is normal; Data abnormality: indicates that the data integrity check fails or the data is forged; Behavior abnormality: indicates that some user operations cannot pass the behavior verification model; Device model: indicates that the device fingerprint information cannot pass the device verification model; Business model: indicates that there are database collisions, batch operations, and violations of business rules; Verification abnormality: indicates that the data strong verification result is abnormal or the data is forged; Simulator: indicates that there is an Android end using a mobile phone simulator; Jailbreak or ROOT: Indicates that the iOS system has been jailbroken or the Android system has been rooted; Browser abnormality: indicates that the browser resolution parameters are abnormal or have been tampered with; IP anomaly: indicates that the terminal IP profiling result is a risky IP or a high-risk IP; Blacklist: EasyShield’s own and customer-defined blacklist data; Whitelist: Yidun’s own and customer-defined whitelist data; High-risk account: indicates a risky account type such as a gang account or an abnormal shared account; Multiple small accounts opened: indicates that multiple accounts have been opened in batches; Tampering with hardware information: means tampering with hardware device parameter information; Tampering with system information: means tampering with system parameter information; High-risk equipment: indicates the risk score of high-risk equipment portrait and the type of equipment with black market characteristics; Group control or cloud control: refers to group control studio equipment or cloud machines; Installation modification tool: indicates installation of Hook modification, Xposed modification, and Magisk modification; Virtual environment: refers to a non-real device access environment; Script tools: refers to script tools used by black and gray industries for cheating.

3. The method for automatically handling user chat risk levels according to claim 1, characterized in that: The method for processing and analyzing the user's chat behavior based on the training model of the big data platform in step S1 comprises the following steps: S11. Report suspected fraudulent chat behavior, and import the reporter, reported party, report type, report scenario, report time, report content and corresponding data into the report information database; S12. Import the user ID, user client anti-cheating code, user mobile phone MD5 encryption method, user IP, activity ID, user registration type, user gender, user level, number of friends, and rewards into the digital content risk control engine through the big data platform.

4. A user chat risk level automatic handling system, characterized in that: Executing the method for automatically handling user chat risk levels as described in any one of claims 1 to 3, comprising: Processing and analyzing test results module: Based on the training model of the big data platform, the user's chat behavior is processed and analyzed to obtain the corresponding test results; Anti-fraud identification description module: This module conducts image research and analysis on the data of the big data platform, extracts identification information, and serves as the measurement standard and reference for anti-fraud identification description; Numerical risk value module: used to analyze the possible risks of users and quantify the risk values ​​to distinguish accounts that pose hidden dangers to the platform.

5. The user chat risk level automatic handling system according to claim 4 is characterized in that: Also includes: Suspected fraud data import module: used to report suspected fraudulent chat behaviors, and import the reporter, reported party, report type, report scenario, report time, report content and corresponding data into the report information database; Risk control module: The user number, user client anti-cheating code, user mobile phone MD5 encryption method, user IP, activity ID, user registration type, user gender, user level, number of friends, and rewards are imported into the digital content risk control engine through the big data platform.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method for automatically handling user chat risk levels described in any one of claims 1-3 are implemented.

7. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method for automatically handling user chat risk levels as described in any one of claims 1-3 are implemented.

Images