Method, apparatus, device and medium for identifying malicious sharing behavior of a user account

Abstract

The application provides a method, device, equipment and medium for identifying malicious sharing behavior of a user account, which comprises the following steps: firstly, obtaining a use behavior log in a current time period and a use behavior log in a historical time period of the user account; then, evaluating the use behavior log in the current time period by an evaluation model to obtain an evaluation result; the evaluation model is obtained by training a use behavior log of a sample user account carrying a label as a training sample; in addition, determining whether the user account satisfies a postcondition rule according to the use behavior log in the historical time period; finally, determining whether the user account has malicious sharing behavior according to the evaluation result and whether the user account satisfies the postcondition rule. The application analyzes the behavior log of the user account by the evaluation model, and combines the evaluation result of the model with the postcondition rule, so as to accurately determine whether the user account has malicious sharing behavior.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data analysis, and particularly relates to a method, device and equipment for identifying malicious sharing behavior of a user account and a medium. BACKGROUND

[0002] For a member user, the behavior of lending a member account to a friend or relative to exercise member rights for free is a normal sharing behavior, which can enable the content that can be enjoyed under the member right to be accessed by more audiences and have a chance to generate more new members, and is a mutually beneficial behavior. However, this can also easily lead to the fact that some users maliciously rent out a large number of member accounts to others for a charge, causing potential member loss, and the prevalence of low-price sharing member accounts on the market can also damage the brand image of a merchant.

[0003] The difficulty in identifying such malicious sharing behavior lies in how to distinguish between normal sharing behavior and malicious sharing profit-making behavior of a member user. Once the identification result is wrong, the normal user will be treated as a malicious sharing user, and a large number of normal users who are disturbed will make complaints and seek rights, and negative public opinion will also damage the brand image of a merchant.

[0004] Therefore, it is necessary to develop a method for identifying malicious sharing behavior of a user account to solve the problem of difficulty in identifying malicious sharing behavior. SUMMARY

[0005] In view of the above problems, the embodiments of the present application provide a method, device, equipment and medium for identifying malicious sharing behavior of a user account, so as to overcome the above problems or at least partially solve the above problems.

[0006] The first aspect of the embodiments of the present application provides a method for identifying malicious sharing behavior of a user account, comprising:

[0007] obtaining a use behavior log in a current time period of a user account, and a use behavior log in a historical time period of the user account, the historical time period at least containing the current time period;

[0008] evaluating the use behavior log in the current time period by a pre-trained evaluation model to obtain an evaluation result, the evaluation model being trained by a use behavior log of a sample user account carrying a label to obtain a preset model, the label representing whether the sample user account has malicious sharing behavior;

[0009] determining whether the user account satisfies a postcondition rule in the historical time period according to the use behavior log in the historical time period of the user account, the postcondition rule being used to determine whether the user account has malicious sharing behavior in the historical time period;

[0010] determining whether the user account has the malicious sharing behavior in the current time period according to the evaluation result and whether the user account satisfies the post-rule.

[0011] Optionally, the post-rule is that a total number of devices used by the user account in a unit time period exceeds a first preset number and / or a total number of cities in which the devices used by the user account in the unit time period exceeds a second preset number.

[0012] Optionally, the evaluation result is an evaluation score, and determining whether the user account has the malicious sharing behavior in the current time period according to the evaluation result and whether the user account satisfies the post-rule comprises:

[0013] determining that the user account does not have the malicious sharing behavior in the current time period when the evaluation score is lower than a preset score threshold;

[0014] determining that the user account does not have the malicious sharing behavior in the current time period when the evaluation score is not lower than the preset score threshold and the user account does not satisfy the post-rule in the historical time period;

[0015] determining that the user account has the malicious sharing behavior in the current time period when the evaluation score is not lower than the preset score threshold and the user account satisfies the post-rule in the historical time period;

[0016] wherein the preset score threshold is obtained after being adjusted multiple times in a training process of the evaluation model according to a ratio of a number of positive samples to a number of negative samples in a training sample set of the evaluation model.

[0017] Optionally, after determining that the user account has the malicious sharing behavior in the current time period, the method further comprises:

[0018] suspending the user account for a suspension duration corresponding to the evaluation result, wherein the higher the malicious degree represented by the evaluation result is, the longer the corresponding suspension duration is.

[0019] Optionally, the evaluation result is obtained by evaluating the use behavior log in the current time period through a pre-trained evaluation model, comprising:

[0020] extracting N-dimensional evaluation features from the use behavior log in the current time period through the pre-trained evaluation model, wherein the N-dimensional evaluation features comprise at least one of the following: login behavior features, registration behavior features, payment behavior features, playback behavior features, password change behavior features, and historical suspension record features.

[0021] The pre-trained evaluation model is used to evaluate the N-dimensional evaluation features, and the evaluation result is output.

[0022] Optionally, the pre-trained evaluation model is used to evaluate the evaluation features, and the evaluation result is output, including:

[0023] For each dimension of the evaluation feature, a target coding value corresponding to a target threshold range of the evaluation feature of the dimension is determined according to the target threshold range.

[0024] The target coding value corresponding to each of the N-dimensional evaluation features is input into the evaluation model to obtain the evaluation result.

[0025] Optionally, the N model parameters of the evaluation model represent the influence degree of the N-dimensional evaluation features on the evaluation result and one-to-one correspond to the N-dimensional evaluation features; the target coding value corresponding to each of the N-dimensional evaluation features is input into the evaluation model to obtain the evaluation result, including:

[0026] According to the target coding value corresponding to each of the N-dimensional evaluation features and the corresponding model parameter, a sub-evaluation result corresponding to the evaluation feature of the dimension is determined.

[0027] According to the sub-evaluation result corresponding to each of the N-dimensional evaluation features, the evaluation result is determined and output.

[0028] Optionally, for each dimension of the evaluation feature, the following steps are used to determine the threshold range of the evaluation feature of the dimension:

[0029] In the case that the evaluation feature of the dimension is a 0-1 type feature, the threshold range of the evaluation feature of the dimension is 0 or 1.

[0030] In the case that the evaluation feature of the dimension is a non-0-1 type feature, the distribution of the evaluation feature of the dimension in the training sample set is analyzed to determine a split threshold of the evaluation feature of the dimension, and according to the split threshold of the evaluation feature of the dimension, a plurality of threshold ranges of the evaluation feature of the dimension are obtained.

[0031] Optionally, for each dimension of the evaluation feature, the following steps are used to determine the coding value corresponding to each threshold range of the evaluation feature of the dimension:

[0032] According to the number of positive samples and negative samples in the training sample set of the evaluation model, the number of positive samples and negative samples of the evaluation feature of the dimension in the threshold range, the positive sample being a sample with malicious sharing behavior and the negative sample being a sample without malicious sharing behavior, the corresponding coding value of the evaluation feature of the dimension in the threshold range is determined.

[0033] Optionally, when there are multiple user accounts to be identified, the use behavior logs in a current time period of a user account and the use behavior logs in a historical time period of the user account are obtained, and the historical time period includes the current time period.

[0034] The current use behavior logs generated by each of the multiple user accounts to be identified in the current time period and the historical use behavior logs generated by each of the multiple user accounts to be identified in a historical time period are obtained, and the historical time period includes the current time period, to determine whether each of the multiple user accounts to be identified has malicious sharing behavior in the current time period.

[0035] The multiple user accounts to be identified are determined according to the following steps:

[0036] According to the account activity of each of the multiple candidate accounts, multiple user accounts with an activity higher than a preset threshold are determined; and / or

[0037] According to the account level of each of the multiple candidate accounts, multiple user accounts are extracted from the multiple candidate accounts according to the proportion of the number of accounts of each account level.

[0038] The second aspect of the embodiment of the application further provides a device for identifying malicious sharing behavior of a user account, comprising:

[0039] An obtaining module is configured to obtain use behavior logs in a current time period of a user account and use behavior logs in a historical time period of the user account, and the historical time period includes at least the current time period.

[0040] An evaluation module is configured to evaluate the use behavior logs in the current time period by using a pre-trained evaluation model to obtain an evaluation result, wherein the evaluation model is obtained by training a preset model using use behavior logs of sample user accounts carrying labels as training samples, and the labels represent whether the sample user accounts have malicious sharing behavior.

[0041] A judgment module is configured to determine whether the user account satisfies a postcondition in the historical time period according to the use behavior logs in the historical time period of the user account, and the postcondition is used to determine whether the user account has malicious sharing behavior in the historical time period.

[0042] A determination module is configured to determine whether the user account has malicious sharing behavior in the current time period according to the evaluation result and whether the user account satisfies the postcondition.

[0043] The third aspect of the embodiment of the present application further provides an electronic device, including a memory, a processor and a computer program stored in the memory, and the processor executes the computer program to implement the steps in the method for identifying the malicious sharing behavior of a user account according to the first aspect of the embodiment of the present application.

[0044] The fourth aspect of the embodiment of the present application further provides a computer readable storage medium, which stores a computer program / instruction, and the computer program / instruction is executed by a processor to implement the steps in the method for identifying the malicious sharing behavior of a user account according to the first aspect of the embodiment of the present application.

[0045] The method provided by the embodiment of the present application includes the following steps: first, obtaining a use behavior log in a current time period of a user account and a use behavior log in a historical time period, and the historical time period at least contains the current time period; then, evaluating the use behavior log in the current time period by an evaluation model to obtain an evaluation result; the evaluation model is obtained by training with the use behavior log of a sample user account carrying a label; in addition, determining whether the user account satisfies a postcondition rule in the historical time period according to the use behavior log in the historical time period, and the postcondition rule is used to determine whether the user account has a malicious sharing behavior in the historical time period; finally, determining whether the user account has a malicious sharing behavior in the current time period according to the evaluation result and whether the user account satisfies the postcondition rule. The embodiment of the present application analyzes the use behavior log of the user account by the evaluation model, and combines the evaluation result of the model with the postcondition rule to determine whether the user account has a malicious sharing behavior. On the one hand, the evaluation model is obtained by training with the use behavior log of the sample user account carrying the label as training data, and the evaluation of the user account by the evaluation model is more accurate and efficient; on the other hand, the evaluation result is combined with the postcondition rule to determine whether the user account has a malicious sharing behavior, which further ensures the accuracy of the identification result, reduces the probability of misjudgment and the possibility of user complaints. BRIEF DESCRIPTION OF DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the description of the embodiments of the present application. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative labor.

[0047] Figure 1 is a step flow chart of a method for identifying a malicious sharing behavior of a user account provided by the embodiment of the present application;

[0048] Figure 2 is a schematic diagram of determining a split threshold value by using a decision tree provided by the embodiment of the present application;

[0049] Figure 3 is a structural schematic diagram of a device for identifying malicious sharing behavior of a user account provided by an embodiment of the present application;

[0050] Figure 4 is a schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0051] Exemplary embodiments of the present application will be described in greater detail below with reference to the accompanying drawings so as to be readily understood by one of ordinary skill in the art. Although exemplary embodiments of the present application are shown in the drawings, it is to be understood that the present application can be carried out in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the application to those skilled in the art.

[0052] The present application provides a method for identifying malicious sharing behavior of a user account, with reference to Figure 1 , Figure 1 A method for identifying malicious sharing behavior of a user account provided by an embodiment of the present application is shown in the flow chart of Figure 1 The method comprises:

[0053] Step 101, obtaining the use behavior log in the current time period of the user account, and the use behavior log in the historical time period of the user account, the historical time period at least containing the current time period;

[0054] In the present embodiment, for the user account to be identified, the use behavior log in the current time period and the use behavior log in the historical time period of the user account are first obtained. The historical time period at least contains the current time period. Exemplarily, the use behavior log in the current time period can be all use behavior logs in the day, and the use behavior log in the historical time period can be all use behavior logs in the past 7 days. The use behavior log includes login behavior data and playback behavior data of the user account.

[0055] In one embodiment, when there are multiple user accounts to be identified, obtaining the use behavior log in the current time period of the user account, and the use behavior log in the historical time period of the user account, comprises:

[0056] Obtaining the current use behavior log generated by each of the multiple user accounts to be identified in the current time period, and obtaining the historical use behavior log generated by each of the multiple user accounts to be identified in the historical time period, the historical time period including the current time period, to determine whether each of the multiple user accounts to be identified has malicious sharing behavior in the current unit time period.

[0057] Specifically, the current use behavior log generated in the current time period is obtained. Exemplarily, the current time period can be set as one day, that is, the use behavior log of the user account for one day is obtained for analysis. Through analysis of the log, it can be concluded whether the user account has generated a malicious sharing behavior in the day, so that the sharing behavior of the user can be more accurately judged. Correspondingly, the historical use behavior log obtained is the historical use behavior log generated in the historical time period. Exemplarily, the historical time period can be set as 7 days, and the historical use behavior log of the user account in the past 7 days is obtained. In this embodiment, when a large number of user accounts need to be identified and judged, by limiting the time of the obtained use behavior log, the data amount obtained can be reduced while a plurality of users are identified in batches, and the efficiency of analysis and evaluation is improved. Wherein, the malicious sharing behavior means that the user frequently shares his own user account to others for profit, so that others can obtain relevant resources by using the user account. Such malicious sharing behavior belongs to irregular account transaction, which not only leads to loss of users of the merchant and damage of interests, but also damages the brand image of the merchant. When defining the malicious sharing behavior, the device ID data of each user account login can be used to assist in judging whether it is the user himself using the user account. Exemplarily, the user account which logs in 4 or more different devices in a day can be defined as a user account with malicious sharing behavior, without specific limitation.

[0058] In step 102, the use behavior log in the current time period is evaluated by a pre-trained evaluation model to obtain an evaluation result. The evaluation model takes the use behavior log of a sample user account carrying a label as a training sample, and is obtained by training a preset model. The label represents whether the sample user account has a malicious sharing behavior.

[0059] The evaluation model is a model pre-trained by using training samples, and the preset model can be designed with reference to a score card model. Specifically, the training samples are usage behavior logs of sample user accounts with labels. Similarly, the usage behavior logs also include login behavior data and playback behavior data. Before training the evaluation model, the training samples need to be labeled. In order to ensure the accuracy of the labeling, the operation needs to be performed by relevant business personnel. Through the labeling, it is determined whether the sample user account corresponding to the sample has a malicious sharing behavior. For example, the usage behavior log of the sample user account with a malicious sharing behavior is a positive sample, and the usage behavior log of the sample user account without a malicious sharing behavior is a negative sample. Specifically, the length of the preset time period is set to one day, and a corresponding training sample represents the usage behavior log of the sample user account in one day. If the training sample is labeled as a positive sample, it indicates that the sample user account has a malicious sharing behavior in one day.

[0060] In step 103, it is determined whether the user account satisfies a postcondition rule in the historical time period according to the usage behavior log of the user account in the historical time period. The postcondition rule is used to determine whether the user account has a malicious sharing behavior in the historical time period.

[0061] In this embodiment, the pre-trained evaluation model is used to evaluate the usage behavior log in the current time period. In addition, the usage behavior log in the historical time period is used to analyze whether the user account satisfies a postcondition rule in the historical time period. The postcondition rule is used to determine whether the user account has a malicious sharing behavior in the historical time period. Specifically, according to the analysis of the usage behavior log in the historical time period, if the user account satisfies the postcondition rule, it indicates that the user account has a malicious sharing behavior in the historical time period. Otherwise, if the user account does not satisfy the postcondition rule, it indicates that the user account does not have a malicious sharing behavior in the historical time period.

[0062] In one embodiment, the postcondition rule is that the total number of devices used by the user account in a unit time period exceeds a first preset number and / or the total number of cities where the devices used by the user account in a unit time period are located exceeds a second preset number.

[0063] In the embodiment, the post rule indicates that the total number of devices used by the user account in a unit time period exceeds a first preset number and / or the total number of cities where the devices used by the user account in a unit time period exceeds a second preset number. For example, the first preset number is set to 4, and the user account uses 5 different ID devices to log in and watch a movie in one day, which satisfies the post rule and indicates that the user account is likely to have a malicious sharing behavior. The second preset number is set to 4, and the user account logs in from devices in Beijing, Nanjing, Suzhou, Chengdu and Shanghai in one day, which satisfies the post rule and indicates that the user account is likely to have a malicious sharing behavior.

[0064] In step 104, whether the user account has a malicious sharing behavior in the current time period is determined according to the evaluation result and whether the user account satisfies the post rule.

[0065] The embodiment analyzes the use behavior log of the user account by using the pre-trained evaluation model, combines the evaluation result of the model with the post rule, and determines whether the user account has a malicious sharing behavior. On the one hand, the use behavior log of the labeled sample user account is used as training data, and the evaluation model obtained by training is more accurate and efficient in evaluating the user account. On the other hand, the evaluation result is combined with the post rule to determine whether the user account has a malicious sharing behavior, which further ensures the accuracy of the recognition result, reduces the probability of misjudgment, and reduces the possibility of user complaints.

[0066] In one embodiment, the evaluation result is an evaluation score, and whether the user account has a malicious sharing behavior in the current time period is determined according to the evaluation result and whether the user account satisfies the post rule, including:

[0067] When the evaluation score is lower than a preset score threshold, it is determined that the user account does not have a malicious sharing behavior in the current time period;

[0068] When the evaluation score is not lower than the preset score threshold and the user account does not satisfy the post rule in the historical time period, it is determined that the user account does not have a malicious sharing behavior in the current time period;

[0069] When the evaluation score is not lower than the preset score threshold and the user account satisfies the post rule in the historical time period, it is determined that the user account has a malicious sharing behavior in the current time period;

[0070] The preset score threshold is obtained by adjusting the ratio of the number of positive samples to the number of negative samples in the training sample set of the evaluation model multiple times in the training process of the evaluation model.

[0071] In the embodiment, the evaluation result obtained by the evaluation model calculating the use behavior log in the current time period can be a specific score value. For example, the total score can be set to 100 points, and the higher the score, the more likely it is that the user account has malicious sharing behavior. The preset score threshold is set to 85-100 points. When the evaluation score output by the evaluation model is lower than 85 points, which is lower than the preset score threshold, it is automatically determined that the user account does not have malicious sharing behavior. When the evaluation score output by the evaluation model is not lower than the preset score threshold, the historical use behavior log is used to determine whether the user account satisfies the post-rule. Only when the evaluation score is within the preset score threshold and the user account satisfies the post-rule, it is determined that the user account has malicious sharing behavior.

[0072] For the preset score threshold, the preset score threshold is part of the parameters of the evaluation model, which can be set according to the ratio of the number of positive samples to the number of negative samples in the training sample set, and is continuously adjusted according to the training result in the process of training the evaluation model, so that a more accurate preset score threshold is obtained when the final model training is completed. For example, the total score is calculated as 100 points. When the number ratio of positive samples to negative samples in the sample is 1:3, the score threshold is first set to 75 points. When it is found in the model training process that the scores of negative samples are concentrated in the range of 80-100, the final preset score threshold is adjusted to 80 points.

[0073] For the evaluation model, the higher the score, the more likely it is that the user account has malicious sharing behavior. However, considering the impact of false disturbance on normal users, post-rules need to be added to ensure the interpretability of the results.

[0074] In one embodiment, after it is determined that the user account has malicious sharing behavior in the historical time period, the method further comprises:

[0075] The user account is continuously suspended for a suspension duration corresponding to the evaluation result, wherein the higher the malicious degree represented by the evaluation result, the longer the corresponding suspension duration.

[0076] In the embodiment, after determining that the user account has malicious sharing behavior, the user account is closed and stopped. Different user accounts are closed and stopped respectively, and the higher the malicious degree represented by the evaluation result, the longer the corresponding closed and stopped time. Specifically, the size of the closed and stopped time can be controlled. When the evaluation result indicates that the malicious sharing degree of the user account is high or the malicious sharing behavior occurs frequently, the closed and stopped time is long. When the evaluation result indicates that the malicious sharing degree of the user account is low, or only individual malicious sharing behavior occurs, the closed and stopped time can be short, thereby playing a warning role for the user. For example, when the malicious degree is high, for example, the evaluation score of the user account is above 95, the user account can be permanently closed and stopped, and the permanently closed and stopped user account can be unblocked only through customer feedback consultation. When the malicious degree is low, for example, the evaluation score of the user account is between 85 and 95, the user account is temporarily closed and stopped, and the temporarily closed and stopped user account can be unblocked by modifying the password and logging in again.

[0077] In an embodiment, the use behavior log in the current time period is evaluated by a pre-trained evaluation model to obtain an evaluation result, including:

[0078] The N-dimensional evaluation features are extracted from the use behavior log in the current time period by the pre-trained evaluation model, wherein the N-dimensional evaluation features include at least one of the following: login behavior features, registration behavior features, payment behavior features, playback behavior features, password change behavior features, and historical closed and stopped record features.

[0079] The N-dimensional evaluation features are evaluated by the pre-trained evaluation model, and the evaluation result is output.

[0080] In the embodiment, when the trained evaluation model is used for evaluation, the use behavior log in the current time period is extracted, the extracted features are input into the evaluation model for calculation and analysis, and finally the evaluation result is output. The use behavior log in the current time period can be the behavior log generated by the user account in the last day, and the evaluation result output by the evaluation model can represent whether the user account has malicious sharing behavior in the day. In the embodiment, the feature extraction is mainly considered from the application scenario of the video website. Specifically, the N-dimensional evaluation features extracted from the use behavior log in the current time period can be extracted from the behavior log data by using the groupedDataFrame data structure of the Spark program, and at least one of the following: login behavior features, registration behavior features, payment behavior features, playback behavior features, password change behavior features, and historical closed and stopped record features. Each dimension of the features can be further divided into multiple specific features.

[0081] Specifically, the login behavior features include at least one of the following: total number of logins, representing the total number of login attempts of the user account within a preset time period, including the number of successful logins and the number of failed logins; login success ratio, representing the proportion of the number of successful logins of the user account on the same day in the total number of login attempts; login type number, representing the total number of login types of the user account on the same day, the login types including third-party login, account password login, mobile phone verification code login, mobile phone scan code login, etc.; login did number, representing the number of all de-duplicated device IDs when the user account logs in on the same day; login dfp number, representing the number of all de-duplicated device fingerprints when the user account logs in on the same day; login qc5 number, representing the number of all de-duplicated qc005 when the user account logs in on the same day, wherein the qc005 is a device dimension parameter sent synchronously with the login and playback behavior of the APP accompanying the user account, and is used to tell the server the device information of the user account, and subsequent repeated qc005 also represents this meaning, which will not be described again; login ip+ua+referer+api+agentType number, representing the number of all de-duplicated IP addresses, user agents, jump sources, APP request interface sources, and terminal combinations when the user account logs in on the same day; for example, the maximum value of multiple feature data can also be selected as a feature data, such as the maximum value of the login did number, the login dfp number, the login qc5 number, and the login ip+ua+referer+api+agentType number; login city number, representing the number of cities after the IP addresses of the user account on the same day are matched with cities; login province number, representing the number of provinces after the IP addresses of the user account on the same day are matched with provinces; login ua ratio, representing the proportion of the number of the maximum type of ua user agent in the total number of login requests on the same day, wherein ua is user agent, and the login and viewing behavior of the user account is equivalent to sending one or more HTTP requests to the server, and ua is a parameter fixedly included in the request, which contains device information, network information, etc. of the user account when sending the request; login app version ratio, representing the proportion of the number of the most device version in the total number of login requests on the same day; login business risk level, representing whether a high risk level appears in the login request of the user account on the same day.

[0082] The registration behavior features include at least one of the following: the number of accounts registered under the same IP+UA, indicating the number of other accounts with the same combination of IP address+UA when the user account is registered; the number of registered accounts under the same province+the same hour+UA, indicating the combination of province name+hour+user agent and the combination of how many other accounts when the user account is registered; the time from registration, indicating the difference between the registration date of the user account and the evaluation date; the registration business risk level, indicating the risk level when the user account is registered; the proportion of registered email suffixes in registered accounts; the proportion of registered UAs in registered accounts; the registered username; whether the registered city is consistent with the last login location, indicating whether the city matched by the IP address used for the last login of the user account is consistent with the city corresponding to the IP address at the time of registration; whether the registered city appears in today's viewing cities; and the registered mobile phone number.

[0083] The payment behavior features include at least one of the following: the number of accounts paid under the same IP+UA, indicating the number of other accounts with the same combination of IP address+UA when the user account is paid; the number of registered accounts under the same province+the same hour+UA, indicating the combination of province name+hour+user agent and the combination of how many other accounts when the user account is registered; the payment order ratio, indicating the proportion of the number of payment orders of the user account in the total number of member orders; the payment amount in the past year, indicating the total amount of member orders of the user account in the past year; the number of member types purchased, indicating how many types of member packages or products the user account has ever purchased; the member level, indicating the member level of the user account on the day; whether the last payment location and the login location are consistent, indicating whether the city of the last payment order of the user account and the login city are consistent; whether the last payment location and the viewing location are consistent, indicating whether the city of the last payment order of the user account and the viewing city are consistent.

[0084] The playing behavior features include at least one of the following: total authentication times, representing the number of times of watching member videos by the user account on the day; authentication hours, representing the number of hours in which the user account watched member videos on the day; authentication tvid numbers, representing the number of sets of member videos watched by the user account on the day; authentication ip+ua numbers, representing the number of ip+ua combinations when the user account watched member videos on the day; maximum authentication times under the same tvid, representing the maximum number of times of repeatedly watching a set by the user account; maximum authentication hours under the same tvid, representing the maximum number of hours of repeatedly watching a set by the user account; maximum authentication ip+ua numbers under the same tvid, representing the maximum number of times of all ip+ua combinations when the user account watched a set; maximum authentication times under the same hour, representing the maximum number of dramas watched in an hour (including repetitions) by the user account; maximum authentication tvid numbers under the same hour, representing the maximum number of dramas watched in an hour by the user account; maximum authentication ip+ua numbers under the same hour, representing the maximum number of times of all ip+ua combinations in the viewing record of the user account in an hour; viewing duration, representing the total duration of videos watched by the user account on the day; average playing duration of each tvid, representing the average duration of each set of dramas watched by the user account; average playing duration of each authentication, representing the total playing duration of the user account on the day divided by the number of sets watched; authentication did numbers, representing the total number of device IDs used for viewing by the user account on the day; authentication dfp numbers, representing the total number of device fingerprints used for viewing by the user account on the day; authentication qc5 numbers, representing the number of qc005 types in the viewing request of the user account on the day; authentication ua+platformCode numbers, representing the number of ua+platformCode combinations in the viewing request of the user account on the day; maximum authentication did numbers under the same tvid, representing the maximum value of the total number of device IDs used for viewing a set by the user account on the day; maximum authentication dfp numbers under the same tvid, representing the maximum value of the total number of device fingerprints used for viewing a set by the user account on the day; maximum authentication qc5 numbers under the same tvid, representing the maximum value of the total number of qc005s in the viewing request of the user account on the day; maximum authentication ua+platformCode numbers under the same tvid, representing the maximum value of the total number of ua+platformCode combinations in the viewing request of the user account on the day; the number of times of triggering concurrent monitoring, representing the number of times of concurrent playing of videos by three or more devices at the same time by the user account on the day; authentication city numbers, representing the number of cities corresponding to the IP addresses of the playing logs of the user account on the day; authentication province numbers, representing the number of provinces corresponding to the IP addresses of the playing logs of the user account on the day; whether the user account watched videos in the commonly used login place, representing whether the playing request of the user account on the day has a city corresponding to an IP which is not in the commonly used login place list of the user account.Whether the device fingerprint when watching the video is a common device fingerprint, indicating whether the device fingerprint of a certain device exists in the common device fingerprint list of the user account on the same day; and material legality.

[0085] The password change behavior features include at least one of the following: total password change times, indicating the number of times the password of the user account is changed on the same day; password change success times, indicating the number of times the password of the user account is changed and successfully changed; password change failure ratio, indicating the number of times the password of the user account is changed and failed divided by the total password change times; password change did number, indicating the number of all de-duplicated device IDs when the password of the user account is changed on the same day; password change dfp number, indicating the number of all de-duplicated device fingerprints when the password of the user account is changed on the same day; password change qc5 number, indicating the number of all de-duplicated qc005 when the password of the user account is changed on the same day; password change ip+ua+referer+api+agentType number, indicating the number of all de-duplicated IP addresses, user agents, jump sources, APP request interface sources, and terminal combinations used when the password of the user account is changed on the same day; password change city number, indicating the number of cities after the city matched by the IP address when the password of the user account is changed on the same day; password change province number, indicating the number of provinces after the province matched by the IP address when the password of the user account is changed on the same day; number of accounts using the same old password, indicating how many other account passwords are the same as the old password when the password of the user account is changed; number of accounts using the same new password, indicating how many other account passwords are the same as the new password when the password of the user account is changed; number of accounts with the same ip+ua password change, indicating how many other account combinations are the same as the IP address+user agent combination when the password of the user account is changed; number of accounts with the same province+same hour+ua password change, indicating how many other account combinations are the same as the province name+hour+user agent combination when the password of the user account is changed.

[0086] The historical suspension record features include at least one of the following: total historical suspension times, indicating the number of times the user account has been suspended since registration; suspension type number, the suspension type including anti-stealing number protection suspension, model suspension, manual suspension, etc., indicating the number of times the user account has been suspended by type since registration; time length from the last suspension, indicating the number of days from the last suspension date.

[0087] Some of the above features are explained, including: d id or device ID, which refers to the unique identification of the device dimension, which does not change over time, and each device using the user account, such as mobile phones, computers, tablets, cars, smart homes, etc. will have a unique device ID; dfp, which is a device fingerprint similar to device ID but will expire every certain period of time, during which the user can log in without logging in on this device. Once the dfp expires, the system will require the user to log in again, and after a successful login, a new dfp will be issued; ua, which is a user agent, and the user's login and playback behavior is equivalent to sending one or more HTTP requests to the server. ua is a parameter fixed in the request, which includes device information, network information, etc. when the user account sends the request; qc005, which refers to the device dimension parameter sent by the APP along with the user's login and playback behavior, which tells the server the user's device information; agentType and platformCode, which are the user's end code, a string of numbers indicating which end (mobile end, computer end, tablet computer end, car networking end, television end, smart home end, etc.) the user account login and playback behavior comes from; tvid, which is the video content ID, and each video content has its own unique ID. For example, a TV series has 50 episodes, and each episode has its own corresponding tvid; referer, which is the request source, and the user's login and viewing behavior is equivalent to sending one or more HTTP requests to the server. referer is a parameter fixed in the request, indicating where the request comes from if it is redirected. For example, if a user searches for a certain drama on website A and then jumps to website B to watch the video on the corresponding website, the referer will be the domain name of website A.

[0088] The embodiment extracts features in multiple dimensions from the usage behavior log in the current time period, obtains feature data from multiple aspects, and analyzes and calculates whether the user account has malicious sharing behavior in multiple dimensions, thereby improving the accuracy and reliability of the evaluation model.

[0089] In one embodiment, the evaluation features are evaluated by the pre-trained evaluation model, and the evaluation result is output, including:

[0090] For each dimension of the evaluation feature, according to the target threshold range in which the evaluation feature of the dimension is located, a target coding value corresponding to the target threshold range is determined;

[0091] The target coding value corresponding to each of the N dimensions of the evaluation feature is input into the evaluation model to obtain the evaluation result.

[0092] In the embodiment, the evaluation model is evaluated with the use behavior log of the sample user account carrying the label as a training sample, and a preset model is trained to obtain the preset model, which can be any classification model. Specifically, in the case of using a logistic regression model as the preset model, since the logistic regression model only accepts numerical values as input, it is necessary to assign a specific number to the previously obtained feature, and the number should have the characteristic that the larger the value, the easier it is to determine that the user exists malicious sharing. Therefore, for each dimension of the extracted feature, a corresponding encoding value needs to be determined first, which is used as the data of the input model corresponding to the dimension feature. Specifically, it is first determined in which threshold range the value of the extracted feature falls, and each preset range corresponds to an encoding value, which is determined in advance in the training stage of the evaluation model. The determination method of the encoding value corresponding to each threshold range can be any existing method, and the WOE encoding value calculation formula can be used to calculate it, for details, refer to the related paragraphs describing the WOE encoding value calculation, which will not be repeated here. After determining the encoding value of the evaluation feature of the dimension, the encoding value is input into the evaluation model for analysis and calculation. Each dimension of the evaluation feature has multiple threshold ranges, and each evaluation feature of the dimension in the use behavior log has a specific value, and the threshold range where the value falls is represented as the target threshold range of the evaluation feature of the dimension. For example, taking the feature of "authentication city number" as an example, the threshold range of the feature is 0-2, 3-6, and 6-100. The encoding value corresponding to the threshold range of 0-2 is -1, the encoding value corresponding to the threshold range of 3-6 is 2, and the encoding value corresponding to the threshold range of 6-100 is 10. When the city number of the "authentication city number" feature of the extracted user account is 5, it is determined that the target threshold range of the evaluation feature of the dimension is the threshold range of 3-6, and the corresponding encoding value 2 is input into the evaluation model for analysis and calculation.

[0093] In an embodiment, the N model parameters of the evaluation model represent the influence degree of the N evaluation features on the evaluation result and correspond one-to-one to the N evaluation features; the target encoding value corresponding to each of the N evaluation features is input into the evaluation model to obtain the evaluation result, including:

[0094] According to the target encoding value corresponding to each of the N evaluation features and the corresponding model parameter, a sub-evaluation result corresponding to the evaluation feature of the dimension is determined;

[0095] According to the sub-evaluation result corresponding to each of the N evaluation features, the evaluation result is determined and output.

[0096] In the embodiment, a sample is evaluated by the evaluation model to obtain an evaluation result, which can be expressed as a specific score of 0-100. Correspondingly, in the process of model training, a specific score of 0-100 can also be obtained for each sample, and in the evaluation process, each feature also has a score of positive or negative, that is, a target encoding value. In addition, a corresponding model parameter is also set for each feature, which can be expressed as a weight, and the value of the weight represents the degree of influence of the feature on the evaluation result. For example, in the evaluation process, the target encoding value of the evaluation feature of dimension A of the user account usage behavior log is 5 points, and then the corresponding model parameter (weight) of the feature A is 0.2, so the final score of the feature A is 1 point. It should be noted that the process of obtaining the evaluation result by the model is not limited to the above process, and other links can also be used, for example, the score can be processed by bias after being multiplied by the weight, and in this embodiment, it is not limited. In addition, the value of the weight is a parameter of the model, which is obtained in the process of training the evaluation model.

[0097] In one embodiment, for each dimension of the evaluation feature, the threshold value range of the evaluation feature of the dimension is determined according to the following steps:

[0098] In the case that the evaluation feature of the dimension is a 0-1 type feature, the threshold value range of the evaluation feature of the dimension is 0 or 1.

[0099] In the case that the evaluation feature of the dimension is a non-0-1 type feature, the distribution of the evaluation feature of the dimension in the training sample set is analyzed to determine the split threshold of the evaluation feature of the dimension, and the multiple threshold value ranges of the evaluation feature of the dimension are obtained according to the split threshold of the evaluation feature of the dimension.

[0100] According to the above embodiment, it can be known that the evaluation feature has multiple dimensions, which can be roughly divided into two categories, that is, 0-1 type feature and non-0-1 type feature. The 0-1 type feature means that the corresponding situation of the feature only has two possibilities, for example, the feature "whether to watch video in the frequently used login place" is a 0-1 type feature, and the corresponding situation only has two possibilities of "watching video in the frequently used login place" and "not watching video in the frequently used login place". The non-0-1 type feature has multiple possible values, for example, the feature "authentication city number" is a non-0-1 type feature, and the corresponding situation can have 1 city number, 5 city numbers, or even 30 city numbers.

[0101] For such a non-0-1 type feature with more values, if no processing is done, the feature is directly input into the model after extraction, which will result in poor classification effect of the model in the model training stage. In the present application, the feature column and the label column are selected one by one, and the decision tree algorithm is run to obtain the optimal split threshold value of the feature calculated by the decision tree. In the present embodiment, the algorithm can use the ml.classification.DecisionTreeClassifier function of the Spark program to calculate. Thus, by analyzing the distribution of the evaluation feature of the dimension in the training sample set, the reasonable split threshold value of the evaluation feature is determined, and according to the split threshold value of the evaluation feature of the dimension, a plurality of threshold value ranges of the evaluation feature of the dimension are obtained. For example, taking the feature of "authentication city number" as an example, when the decision tree model considers that the data with city number greater than or equal to 6 is likely to exist malicious sharing, the data with city number greater than 2 and less than 6 has a certain possibility of sharing, and the data with city number less than or equal to 2 is less likely to exist sharing, the reasonable split threshold value of the authentication city number evaluation feature is 2 and 6, and the feature will be divided into three segments and given corresponding numbers 1, 2 and 3.

[0102] Among them, the decision tree (DecisionTree) is also called a decision tree, which is another special root tree. It is one of the commonly used tools in operations research, and its application range has been expanding ever since. It is one of the common machine learning methods in artificial intelligence. Assuming that a business needs multiple rounds of decision-making, a decision tree can be constructed, starting from the root node. Each branch point represents a decision in a round, and different child nodes represent different decision results in the round. The leaf node represents the result of the final decision. For example, referring to Figure 2 , Figure 2 shows a schematic diagram of determining a split threshold value using a decision tree, as Figure 2 described, starting from the "age" root node, the feature column and the label column are selected one by one. When the age is less than 30 years old, if it is a student, the positive result is output, otherwise the negative result is output; when the age is between 30 and 40 years old, the positive result is output; when the age is greater than 40 years old, if the credit rating is good, the negative result is output, and if the credit rating is general, the positive result is output. By the above method, the threshold value of each dimension feature is divided, and a plurality of reasonable split threshold values corresponding to the evaluation feature are determined, and the threshold value is applied to the evaluation model training and the evaluation process of the user account to be identified, which improves the accuracy of the evaluation result of the evaluation model.

[0103] In one embodiment, for each dimension evaluation feature, the encoding value corresponding to each threshold value range of the dimension evaluation feature is determined according to the following steps:

[0104] According to the number of positive samples and negative samples in the training sample set of the evaluation model, the number of positive samples and negative samples of the evaluation feature in the threshold range of the dimension, the corresponding encoding value of the evaluation feature in the threshold range of the dimension is determined, the positive sample is a sample with malicious sharing behavior, and the negative sample is a sample without malicious sharing behavior.

[0105] In the present application, the corresponding encoding value is set for each threshold range of the evaluation feature, which can be performed by WOE encoding, and the specific calculation formula is as follows:

[0106]

[0107] WOE i Bad i Bad t Good i Good t The specific number of positive samples under each threshold range of each evaluation feature can be calculated based on the groupedDataFrame data structure of the Spark program in the embodiment, and the specific WOE value is obtained by dividing the total number of positive samples. Similarly, the number of negative samples under each threshold range can be calculated, and the specific WOE value is obtained by processing the total number of negative samples. For example, referring to Table 1, Table 1 shows a calculation method of WOE value of an authentication city number feature, as shown in Table 1 below, for the authentication city number feature, the total number of positive samples Bad t is 5844, the total number of negative samples Good t is 12485, and the number of positive samples Bad i with more than 6 cities in the authentication city number feature is 3619, the number of negative samples Good i with more than 6 cities is 305, and thus according to the above formula, the WOE value corresponding to the threshold range of the authentication city number greater than 6 is 1.403967.

[0108] Number of authentication cities Number Positive samples Total positive samples Negative samples Total negative samples WOE value x<＝2 1 251 5844 9772 12485 -1.26063 2<x<＝6 2 1974 5844 2408 12485 0.243369 x>6 3 3619 5844 305 12485 1.403967

[0109] Table 1

[0110] In an embodiment, the plurality of user accounts to be identified are determined according to the following steps:

[0111] determine a plurality of user accounts with an account activity higher than a preset threshold according to the account activity of each of the plurality of candidate accounts; and / or

[0112] extract a plurality of user accounts from the plurality of candidate accounts according to the proportion of the number of accounts of each account level.

[0113] In this embodiment, since there are many user accounts, when there are a large number of to-be-identified user accounts, active users can be selected from the to-be-identified user accounts for analysis and evaluation. An active user refers to a user account that has watched at least one drama in a period of time. Whether the user account is an active user account can be confirmed by using behavior log analysis. Correspondingly, when the evaluation model is trained, the training samples can also be selected as active sample user accounts, so as to ensure the effectiveness of the training sample data. The inactive user accounts, or silent user accounts, do not have a play behavior, and even less have a malicious sharing behavior. Therefore, the user accounts are filtered out, the efficiency of the evaluation analysis in the evaluation process can be improved, the effectiveness of the training sample in the model training process can be improved, and the accuracy and reliability of the evaluation model can be improved.

[0114] In addition, the embodiment performs stratified sampling on the large number of user accounts according to the key features. Specifically, stratified sampling is performed according to the proportion of the number of accounts of the member levels. For example, referring to Table 2, Table 2 shows a user account member level number distribution table. As shown in Table 2, the number of user accounts of level 1 accounts for 20% of the total number, and the number of user accounts of level 2 accounts for 15% of the total number. According to the proportion, if 100 user accounts are to be extracted, 20 user accounts of level 1 and 15 user accounts of level 2 are extracted for evaluation and analysis. Correspondingly, when the evaluation model is trained, the training samples can also be stratified sampled according to the proportion of the number of accounts of the member levels. In this way, the data feature distribution of the training samples can be consistent with the real distribution.

[0115] Optional sampling ratio Ratio Member level 1 20％ Member level 2 15％ Member level 3 25％ Member level 4 20％ Member level 5 10％ Member level 6 7％ Member level 7 3％

[0116] Table 2

[0117] When the sample user accounts of the training samples of the evaluation model are selected, the total user accounts can be filtered first to filter out the active user accounts. Then, the sample user accounts are extracted according to the proportion of the member levels of the active user accounts. In this way, the problem that a large number of silent and lost members are deposited in member levels 1 and 2 and cannot accurately reflect the current situation of active users is avoided, and the classification effect of the evaluation model is improved.

[0118] In an embodiment, the number of positive samples in the training sample set of the evaluation model is less than the number of negative samples; the positive sample is a sample with malicious sharing behavior, and the negative sample is a sample without malicious sharing behavior; the evaluation model is obtained by the following steps:

[0119] According to the ratio of positive and negative samples, the negative training samples are extracted to obtain a plurality of training sample sets;

[0120] The plurality of training sample sets are used to train the preset model respectively to obtain a plurality of candidate evaluation models;

[0121] The plurality of candidate evaluation models are tested to obtain a test result;

[0122] According to the test result, a target evaluation model is determined from the plurality of candidate evaluation models.

[0123] In the original data set, 20% is randomly extracted as a test set, and the remaining 80% is used as a training set to train the evaluation model. Since in the actual situation, the number of positive and negative samples in the training data set obtained in the process of training the model is often greatly different, for example, there are only 6949 positive samples and 993051 negative samples. The extremely uneven proportion will lead to the fact that the model cannot be fitted at all. The model only needs to evaluate all samples as negative samples to achieve a very high accuracy rate. Therefore, the present embodiment proposes downsampling, that is, saving all positive samples, and randomly extracting negative training samples to obtain a plurality of training sample sets. For example, according to the ratio of positive and negative samples 1:3, 1:5, 1:10, 1:20, and 1:50, the negative samples are extracted to obtain five training sample sets. By using a single training sample set for model training respectively, a plurality of trained evaluation models are finally obtained. Then, the plurality of evaluation models are tested by using a pre-set test set, and the best one of the evaluation models is selected as the final evaluation model according to the test result. The trained evaluation model is tested by the test set, and the accuracy rate can reach 90%, and the recall rate can reach 86%.

[0124] Correspondingly, in the case of extremely uneven proportion of samples, after the proportion is adjusted by downsampling, since the proportion of positive samples and negative samples is increased by many times compared with the real proportion, the model is more likely to judge that the normal user account is a user account with malicious sharing behavior, and the preset score threshold of the final evaluation model can be moderately increased to increase the difficulty of being judged as a positive sample, so that the evaluation model has better classification effect. For example, according to the total score of 100 points, when the number ratio of positive samples and negative samples in the sample is 1:3, the score threshold is first set to 75-100 points, and when it is found in the model training process that the scores of negative samples are concentrated in the range of 80-100, the final preset score threshold is appropriately increased to 80-100.

[0125] In an embodiment, using each training sample set, a preset model is trained to obtain a candidate evaluation model, comprising:

[0126] Using all positive samples and n times of negative samples of the positive sample number in the training data set, the preset model is trained to obtain a first trained evaluation model;

[0127] Using all positive samples and negative samples incorrectly evaluated by the first trained evaluation model in the training data set, the preset model is trained to obtain a second trained evaluation model;

[0128] Using all positive samples and negative samples incorrectly evaluated by the second trained evaluation model in the training data set, the preset model is trained to obtain a third trained evaluation model;

[0129] According to the model parameters of the three obtained trained evaluation models respectively, the model parameters of the candidate evaluation model are determined.

[0130] In the embodiment, the model is trained by using the training sample set based on the ml.classification.LogisticRegression of the Spark program. In the above embodiment, the down-sampling method is used to construct the training sample set due to the large difference in the number ratio of positive samples and negative samples, but the down-sampling is prone to strong overfitting. Therefore, the three-stage training method is proposed in the embodiment, that is, the first training uses all the positive training samples and 10 times the number of negative training samples in the training sample set, the second training selects all the positive training samples and the negative training samples that are misclassified in the first training, and the third training selects all the positive training samples and the negative training samples that are misclassified in the second training. Thus, three models with slightly different parameter values are generated, and the model parameters represent the weight values of each feature, which represent the influence of the feature on the evaluation result. Since the model parameters are different, the voting method can be used to determine the model parameters of the final evaluation model. The voting method is a method of majority over minority, that is, for a parameter, when the values of two of the above three trained evaluation models are the same and the value of the other model is different, the value of the majority is selected.

[0131] The embodiment of the application further provides a device for identifying malicious sharing behavior of a user account, referring to Figure 3 , Figure 3 is a structural schematic diagram of a device for identifying malicious sharing behavior of a user account according to an embodiment of the application, as shown in Figure 3 , the device comprises:

[0132] The acquisition module is configured to acquire a use behavior log in a current time period of a user account and a use behavior log in a historical time period of the user account, wherein the historical time period at least contains the current time period.

[0133] The evaluation module is configured to evaluate the use behavior log in the current time period by using a pre-trained evaluation model to obtain an evaluation result, wherein the evaluation model is trained by using a use behavior log of a sample user account carrying a label as a training sample, and the label represents whether the sample user account has malicious sharing behavior.

[0134] The judgment module is configured to determine whether the user account satisfies a postcondition rule in the historical time period according to the use behavior log in the historical time period of the user account, wherein the postcondition rule is used to determine whether the user account has malicious sharing behavior in the historical time period.

[0135] determining, according to the evaluation result and whether the user account satisfies a postcondition rule, whether the user account has a malicious sharing behavior in the current time period.

[0136] In an embodiment, the postcondition rule is that a total number of devices used by the user account in a unit time period exceeds a first preset number and / or a total number of cities in which the devices used by the user account in the unit time period exceeds a second preset number.

[0137] In an embodiment, the evaluation result is an evaluation score, and the determining module includes:

[0138] A first determining submodule is configured to determine that the user account does not have a malicious sharing behavior in the current time period when the evaluation score is lower than a preset score threshold.

[0139] A second determining submodule is configured to determine that the user account does not have a malicious sharing behavior in the current time period when the evaluation score is not lower than the preset score threshold and the user account does not satisfy the postcondition rule in the historical time period.

[0140] A third determining submodule is configured to determine that the user account has a malicious sharing behavior in the current time period when the evaluation score is not lower than the preset score threshold and the user account satisfies the postcondition rule in the historical time period.

[0141] The preset score threshold is obtained by adjusting a ratio of a number of positive samples to a number of negative samples in a training sample set of the evaluation model multiple times in a training process of the evaluation model.

[0142] In an embodiment, after determining that the user account has a malicious sharing behavior in the current time period, the apparatus further includes:

[0143] A suspension module is configured to suspend the user account for a suspension duration corresponding to the evaluation result, wherein the higher the malicious degree represented by the evaluation result is, the longer the corresponding suspension duration is.

[0144] In an embodiment, the evaluation module includes:

[0145] A first evaluation submodule is configured to extract N-dimensional evaluation features from the use behavior log in the current time period by using the pre-trained evaluation model, wherein the N-dimensional evaluation features include at least one of the following: login behavior features, registration behavior features, payment behavior features, playback behavior features, password change behavior features, and historical suspension record features.

[0146] a second evaluation submodule, configured to evaluate the N dimensions of evaluation features by using the pre-trained evaluation model, and output the evaluation result.

[0147] In an embodiment, the first evaluation submodule comprises:

[0148] a first evaluation unit, configured to determine, for each dimension of evaluation feature, a target encoding value corresponding to a target threshold range of the dimension of evaluation feature according to the target threshold range of the dimension of evaluation feature;

[0149] a second evaluation unit, configured to input the target encoding value corresponding to each dimension of evaluation feature into the evaluation model to obtain the evaluation result.

[0150] In an embodiment, the N model parameters of the evaluation model represent the influence degree of the N dimensions of evaluation features on the evaluation result and correspond to the N dimensions of evaluation features one by one; and the second evaluation unit comprises:

[0151] a first determination submodule, configured to determine a sub evaluation result corresponding to each dimension of evaluation feature according to the target encoding value corresponding to the dimension of evaluation feature and the influence degree corresponding to the dimension of evaluation feature;

[0152] an output submodule, configured to determine and output the evaluation result according to the sub evaluation result corresponding to each dimension of evaluation feature.

[0153] In an embodiment, the first evaluation unit is further configured to determine, for each dimension of evaluation feature, a plurality of threshold ranges of the dimension of evaluation feature according to the following steps:

[0154] a second determination submodule, configured to determine that the threshold range of the dimension of evaluation feature is 0 or 1 in the case that the dimension of evaluation feature is a 0-1 type feature;

[0155] a third determination submodule, configured to analyze the distribution of the dimension of evaluation feature in the training sample set in the case that the dimension of evaluation feature is a non-0-1 type feature, determine a split threshold of the dimension of evaluation feature, and obtain a plurality of threshold ranges of the dimension of evaluation feature according to the split threshold of the dimension of evaluation feature.

[0156] In an embodiment, the first evaluation unit is further configured to determine, for each dimension of evaluation feature, an encoding value corresponding to each threshold range of the dimension of evaluation feature, and the first evaluation unit further comprises:

[0157] The first evaluation subunit is configured to determine a corresponding encoding value of the evaluation feature of the dimension in the threshold value range according to the number of positive samples and negative samples in the training sample set of the evaluation model, and the number of positive samples and negative samples of the evaluation feature of the dimension in the threshold value range.

[0158] In an embodiment, when there are multiple user accounts to be identified, the obtaining module comprises:

[0159] The first obtaining sub-module is configured to obtain a current use behavior log generated by each of the multiple user accounts to be identified in a current time period, and obtain a historical use behavior log generated by each of the multiple user accounts to be identified in a historical time period, the historical time period including the current time period, to determine whether each of the multiple user accounts to be identified has malicious sharing behavior in the current time period.

[0160] The first obtaining sub-module is further configured to determine the multiple user accounts to be identified, and the first obtaining sub-module further comprises:

[0161] The first obtaining unit is configured to determine multiple user accounts with an account activity higher than a preset threshold according to the account activity of each of the multiple candidate accounts; and / or

[0162] The second obtaining unit is configured to extract multiple user accounts from the multiple candidate accounts according to the proportion of the number of accounts of each account level in the multiple candidate accounts according to the account level of each of the multiple candidate accounts.

[0163] In an embodiment, the number of positive samples in the training sample set of the evaluation model is less than the number of negative samples, the positive samples are samples with malicious sharing behavior, and the negative samples are samples without malicious sharing behavior. The device further comprises an obtaining module configured to obtain the evaluation model, and the obtaining module further comprises:

[0164] The first obtaining sub-module is configured to extract multiple training sample sets from the negative training samples according to a plurality of positive and negative sample ratios.

[0165] The second obtaining sub-module is configured to train a preset model using the multiple training sample sets to obtain multiple candidate evaluation models.

[0166] The third obtaining sub-module is configured to test the multiple candidate evaluation models to obtain a test result.

[0167] The fourth obtaining sub-module is configured to determine a target evaluation model from the multiple candidate evaluation models according to the test result.

[0168] In an embodiment, the second obtaining sub-module comprises:

[0169] The first training unit is configured to train the preset model using all positive samples in the training data set and n times of the number of negative samples to obtain a first post-training evaluation model;

[0170] The second training unit is configured to train the preset model using all positive samples in the training data set and negative samples evaluated as wrong by the first post-training evaluation model to obtain a second post-training evaluation model;

[0171] The third training unit is configured to train the preset model using all positive samples in the training data set and negative samples evaluated as wrong by the second post-training evaluation model to obtain a third post-training evaluation model;

[0172] The fourth training unit is configured to determine model parameters of a candidate evaluation model according to model parameters of the three post-training evaluation models.

[0173] The embodiment of the present application further provides an electronic device, which refers to Figure 4 , Figure 4 is a schematic diagram of the electronic device provided by the embodiment of the present application. As shown in Figure 4 , the electronic device 100 comprises a memory 110 and a processor 120, the memory 110 and the processor 120 are communicatively connected through a bus, the memory 110 stores a computer program, the computer program can run on the processor 120, and then the steps in the method for identifying malicious sharing behavior of a user account disclosed by the embodiment of the present application are implemented.

[0174] The embodiment of the present application further provides a computer readable storage medium, which stores a computer program / instruction, and the computer program / instruction is executed by a processor to implement the steps in the method for identifying malicious sharing behavior of a user account disclosed by the embodiment of the present application.

[0175] The method provided by the embodiment of the present application comprises the following steps: first, obtaining a use behavior log in a current time period of a user account and a use behavior log in a historical time period, the historical time period at least containing the current time period; then, evaluating the use behavior log in the current time period by an evaluation model to obtain an evaluation result, the evaluation model being trained by using the use behavior log of a sample user account carrying a label as a training sample; in addition, determining whether the user account satisfies a postcondition rule in the historical time period according to the use behavior log in the historical time period, the postcondition rule being used to determine whether the user account has a malicious sharing behavior in the historical time period; finally, determining whether the user account has a malicious sharing behavior in the current time period according to the evaluation result and whether the user account satisfies the postcondition rule. The embodiment of the present application analyzes the use behavior log of the user account by the evaluation model, and combines the evaluation result of the model with the postcondition rule to determine whether the user account has a malicious sharing behavior. On the one hand, the evaluation model is trained by using the use behavior log of the sample user account carrying the label as the training data, so that the evaluation of the user account by the evaluation model is more accurate and efficient; on the other hand, the evaluation result is combined with the postcondition rule to determine whether the user account has a malicious sharing behavior, so as to further ensure the accuracy of the identification result, reduce the probability of misjudgment, and reduce the possibility of user complaints.

[0176] Each embodiment in the specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. The same or similar parts between embodiments can be referred to each other.

[0177] The embodiments of the present application are described with reference to flowcharts and / or block diagrams of the methods, devices, electronic equipment and computer program products according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be realized by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing terminal equipment to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal equipment realize the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in one flow or multiple flows and / or blocks Figure 1 The functions specified in one flow or multiple flows and / or blocks

[0178] These computer program instructions can also be stored in a computer readable memory which can guide the computer or other programmable data processing terminal equipment to work in a specific way, so that the instructions stored in the computer readable memory generate a product including instruction devices, which realize the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in one flow or multiple flows and / or blocksFigure 1 The function specified in one or more boxes.

[0179] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0180] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present invention.

[0181] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0182] The present invention has provided a detailed description of a method, apparatus, device, and medium for identifying malicious sharing behavior of user accounts. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method of identifying a malicious sharing behavior of a user account, the method comprising: The method comprises: obtaining a use behavior log in a current time period of a user account, and a use behavior log in a historical time period of the user account, the historical time period at least containing the current time period; evaluating the use behavior log in the current time period by a pre-trained evaluation model to obtain an evaluation result, the evaluation model being trained by a use behavior log of a sample user account carrying a label, the label representing whether the sample user account has malicious sharing behavior; determining whether the user account satisfies a postcondition rule in the historical time period according to the use behavior log in the historical time period of the user account, the postcondition rule being used to determine whether the user account has malicious sharing behavior in the historical time period; determining whether the user account has malicious sharing behavior in the current time period according to the evaluation result and whether the user account satisfies the postcondition rule; wherein the evaluation result is an evaluation score, and determining whether the user account has malicious sharing behavior in the current time period according to the evaluation result and whether the user account satisfies the postcondition rule comprises: when the evaluation score is lower than a preset score threshold, determining that the user account does not have malicious sharing behavior in the current time period; when the evaluation score is not lower than the preset score threshold and the user account does not satisfy the postcondition rule in the historical time period, determining that the user account does not have malicious sharing behavior in the current time period; when the evaluation score is not lower than the preset score threshold and the user account satisfies the postcondition rule in the historical time period, determining that the user account has malicious sharing behavior in the current time period; wherein the preset score threshold is obtained by adjusting a ratio of a number of positive samples to a number of negative samples in a training sample set of the evaluation model for multiple times in a training process of the evaluation model.

2. The method of claim 1, wherein, The postcondition rule is that a total number of devices used by the user account in a unit time period exceeds a first preset number and / or a total number of cities where the devices used by the user account in the unit time period exceeds a second preset number.

3. The method of claim 1, wherein, After determining that the user account has malicious sharing behavior in the current time period, the method further comprises: continuously suspending the user account for a suspension duration corresponding to the evaluation result, wherein the higher the malicious degree represented by the evaluation result is, the longer the corresponding suspension duration is.

4. The method of claim 1, wherein, Evaluating the use behavior log in the current time period by the pre-trained evaluation model to obtain an evaluation result comprises: extracting N-dimensional evaluation features from the use behavior log in the current time period by the pre-trained evaluation model, wherein the N-dimensional evaluation features comprise at least one of the following: login behavior features, registration behavior features, payment behavior features, playback behavior features, password change behavior features, and historical suspension record features; evaluating the N-dimensional evaluation features by the pre-trained evaluation model to output the evaluation result.

5. The method of claim 4, wherein, The evaluation model is pre-trained, and the evaluation model is used to evaluate the evaluation features to obtain the evaluation result, including: For each dimension of the evaluation feature, according to the target threshold range in which the evaluation feature of the dimension is located, the target coding value corresponding to the target threshold range is determined; The target coding value corresponding to each of the N dimensions of the evaluation feature is input into the evaluation model to obtain the evaluation result.

6. The method of claim 5, wherein, The N model parameters of the evaluation model represent the influence degree of the N dimensions of the evaluation feature on the evaluation result and one-to-one correspond to the N dimensions of the evaluation feature; The target coding value corresponding to each of the N dimensions of the evaluation feature is input into the evaluation model to obtain the evaluation result, including: According to the target coding value corresponding to each of the N dimensions of the evaluation feature and the corresponding model parameter, the sub-evaluation result corresponding to the evaluation feature of the dimension is determined; According to the sub-evaluation result corresponding to each of the N dimensions of the evaluation feature, the evaluation result is determined and output.

7. The method of claim 5, wherein, For each dimension of the evaluation feature, the threshold range of the evaluation feature of the dimension is determined according to the following steps: In the case that the evaluation feature of the dimension is a 0-1 type feature, the threshold range of the evaluation feature of the dimension is 0 or 1; In the case that the evaluation feature of the dimension is a non-0-1 type feature, the distribution of the evaluation feature of the dimension in the training sample set is analyzed to determine the split threshold of the evaluation feature of the dimension, and according to the split threshold of the evaluation feature of the dimension, the threshold range of the evaluation feature of the dimension is obtained.

8. The method according to any of claims 5-7, characterized by, For each dimension of the evaluation feature, the coding value corresponding to each threshold range of the evaluation feature of the dimension is determined according to the following steps: According to the number of positive samples and negative samples in the training sample set of the evaluation model, the number of positive samples and negative samples of the evaluation feature of the dimension in the threshold range, the corresponding coding value of the evaluation feature of the dimension in the threshold range is determined, and the positive sample is a sample with malicious sharing behavior, and the negative sample is a sample without malicious sharing behavior.

9. The method of claim 1, wherein, When there are multiple user accounts to be identified, the use behavior log of the user account in the current time period is obtained, and the use behavior log of the user account in the historical time period is obtained, including: Obtain the current use behavior log generated by each of the plurality of user accounts to be identified in the current time period, and obtain the historical use behavior log generated by each of the plurality of user accounts to be identified in the historical time period, the historical time period includes the current time period, to determine whether the plurality of user accounts to be identified exist malicious sharing behavior in the current time period; Wherein, the plurality of user accounts to be identified are determined according to the following steps: According to the account activity of each of the plurality of candidate accounts, a plurality of user accounts with an activity higher than a preset threshold are determined; and / or According to the account level of each of the plurality of candidate accounts, a plurality of user accounts are extracted from the plurality of candidate accounts according to the proportion of the number of accounts of each account level.

10. An apparatus for identifying a malicious sharing behavior of a user account, the apparatus comprising: Including: The acquisition module is configured to acquire a use behavior log in a current time period of a user account and a use behavior log in a historical time period of the user account, the historical time period at least containing the current time period. The evaluation module is configured to evaluate the use behavior log in the current time period by a pre-trained evaluation model to obtain an evaluation result, the evaluation model being trained by a use behavior log of a sample user account carrying a label, the label representing whether the sample user account has a malicious sharing behavior. The judgment module is configured to determine whether the user account satisfies a postcondition in the historical time period according to the use behavior log in the historical time period of the user account, the postcondition being used to determine whether the user account has a malicious sharing behavior in the historical time period. The determination module is configured to determine whether the user account has a malicious sharing behavior in the current time period according to the evaluation result and whether the user account satisfies the postcondition. The evaluation result is an evaluation score, and the judgment module includes: The first judgment submodule is configured to determine that the user account does not have a malicious sharing behavior in the current time period when the evaluation score is lower than a preset score threshold. The second judgment submodule is configured to determine that the user account does not have a malicious sharing behavior in the current time period when the evaluation score is not lower than the preset score threshold and the user account does not satisfy the postcondition in the historical time period. The third judgment submodule is configured to determine that the user account has a malicious sharing behavior in the current time period when the evaluation score is not lower than the preset score threshold and the user account satisfies the postcondition in the historical time period. The preset score threshold is obtained by adjusting a ratio of a number of positive samples to a number of negative samples in a training sample set of the evaluation model for multiple times in a training process of the evaluation model.

11. An electronic device comprising a memory, a processor, and a computer program stored on the memory, wherein the computer program comprises instructions that, when executed by the processor, cause the electronic device to perform the method of any one of claims 1-10. The processor executes the computer program to implement the steps in the method for identifying a malicious sharing behavior of a user account according to any one of claims 1 to 9.

12. A computer readable storage medium having stored thereon computer programs / instructions, characterized in that, The computer program / instruction is executed by the processor to implement the steps in the method for identifying a malicious sharing behavior of a user account according to any one of claims 1 to 9.

Images