Method, device, equipment and storage medium for identifying abnormal identity identification

Abstract

The present disclosure provides a method, apparatus, device, and storage medium for identifying abnormal identity identifiers, and relates to the field of computer technology, particularly to technical fields such as big data and user understanding. A specific implementation scheme is as follows: using a machine learning model to perform abnormal identification on at least one identity identifier to be identified, and obtaining the abnormality degree of at least one identity identifier to be identified; and determining an abnormal identity identifier among at least one identity identifier to be identified based on the abnormality degree of at least one identity identifier to be identified; wherein the machine learning model is trained according to the following method: determining an abnormal original identity identifier among multiple original identity identifiers based on the association relationship between multiple original identity identifiers, the life cycle, frequency of occurrence, and attribute information of each original identity identifier among the multiple original identity identifiers; extracting behavioral characteristics of each abnormal original identity identifier; and training the machine learning model based on the behavioral characteristics.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to technical fields such as big data and user understanding. Background Art

[0002] With the rapid development of the internet, we have entered the era of big data. When users use applications or websites, the servers of these applications or websites record identifiers that reflect basic user information. For example, when a website user logs in using an account, the server typically records identifiers such as IP addresses, cookies, user IDs, or MAC addresses (Media Access Control). Some users may engage in inappropriate behavior when using applications or websites, thus affecting the normal operation of the applications or websites. Therefore, it is necessary to identify the identifiers used by these users for verification. Summary of the Invention

[0003] The present disclosure provides a method, apparatus, device, storage medium, and program product for identifying abnormal identity identification.

[0004] According to one aspect of the present disclosure, there is provided a method for performing abnormality identification on at least one identity identifier to be identified using a machine learning model to obtain the abnormality degree of the at least one identity identifier to be identified; and determining an abnormal identity identifier among the at least one identity identifier to be identified based on the abnormality degree of the at least one identity identifier to be identified; wherein the machine learning model is trained according to the following method: determining an abnormal original identity identifier among the multiple original identity identifiers based on the association relationship between the multiple original identity identifiers, the life cycle, occurrence frequency and attribute information of each original identity identifier among the multiple original identity identifiers; extracting behavioral characteristics of each abnormal original identity identifier; and training the machine learning model based on the behavioral characteristics.

[0005] According to another aspect of the present disclosure, a device for identifying abnormal identity identifiers is provided, comprising: an identification module for performing abnormal identification on at least one identity identifier to be identified using a machine learning model to obtain a degree of abnormality of the at least one identity identifier to be identified; and an abnormality determination module for determining an abnormal identity identifier among the at least one identity identifier to be identified based on the degree of abnormality of the at least one identity identifier to be identified; an original determination module for determining an abnormal original identity identifier among the multiple original identity identifiers based on an association relationship between the multiple original identity identifiers, a life cycle, an occurrence frequency, and attribute information of each of the multiple original identity identifiers; an extraction module for extracting behavioral features of each of the abnormal original identity identifiers; and a training module for training the machine learning model based on the behavioral features.

[0006] Another aspect of the present disclosure provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method shown in the embodiment of the present disclosure.

[0007] According to another aspect of an embodiment of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the method shown in the embodiment of the present disclosure.

[0008] According to another aspect of an embodiment of the present disclosure, a computer program product is provided, including a computer program / instruction, wherein the computer program / instruction implements the steps of the method shown in the embodiment of the present disclosure when executed by a processor.

[0009] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The accompanying drawings are used to better understand the present invention and do not constitute a limitation of the present invention.

[0011] Figure 1 Schematic diagram of an application scenario of the method, device, electronic device, and storage medium for identifying abnormal identity identification according to an embodiment of the present disclosure;

[0012] Figure 2 The following is a flow chart schematically illustrating a method for identifying abnormal identity identifiers according to an embodiment of the present disclosure:

[0013] Figure 3 is a flowchart of a method for training a machine learning model according to an embodiment of the present disclosure;

[0014] Figure 4 is a flow chart of a method for determining an abnormal original identity according to an embodiment of the present disclosure;

[0015] Figure 5 is a flow chart of a method for determining an abnormal original identity according to another embodiment of the present disclosure;

[0016] Figure 6 is a flow chart of a method for determining an abnormal original identity according to another embodiment of the present disclosure;

[0017] Figure 7 is a flow chart of a method for determining an abnormal original identity according to another embodiment of the present disclosure;

[0018] Figure 8 A block diagram schematically illustrates an apparatus for identifying abnormal identity markers according to an embodiment of the present disclosure; and

[0019] Figure 9 A block diagram schematically illustrates an example electronic device that may be used to implement embodiments of the present disclosure. DETAILED DESCRIPTION

[0020] The following description of exemplary embodiments of the present disclosure is made in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding. These details should be considered as merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0021] The following will be combined Figure 1 The application scenarios of the method and device for identifying abnormal identity identification provided by the present disclosure are described.

[0022] Figure 1 Schematic diagram of the application scenario of the method, device, electronic device and storage medium for identifying abnormal identity identification according to the embodiment of the present disclosure. Figure 1 The examples shown are merely examples of system architectures to which the embodiments of the present disclosure may be applied, to help those skilled in the art understand the technical content of the present disclosure, but do not mean that the embodiments of the present disclosure may not be used in other devices, systems, environments or scenarios.

[0023] like Figure 1 As shown, the application scenario 100 may include a terminal device 110 , a server 120 , an identity database 130 , and an abnormal identity database 140 .

[0024] The user can use the terminal device 110 to interact with the server 120 via the network to receive or send messages, etc. Various communication client applications can be installed on the terminal device 110, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0025] According to an embodiment of the present disclosure, the terminal device 110 may be any electronic device having a display screen and supporting web browsing, including but not limited to a smart phone, a tablet computer, a laptop computer, a desktop computer, and the like.

[0026] According to an embodiment of the present disclosure, the server 120 may be a server that provides various services, such as a background management server that provides support for websites browsed or applications used by users using the terminal device 110. The background management server may analyze and process received data such as user requests, and feed back processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device 110.

[0027] According to an embodiment of the present disclosure, the terminal device 110 may carry an identity in the user request sent to the server 120. The identity may include, for example, a cookie, a MAC address, an IP address, a device identifier, a user identifier (userid), an application identifier (appid), etc. The server 120 may store the identity carried in the user request in the identity database 130.

[0028] According to embodiments of the present disclosure, identities may be associated with each other. For example, when a user logs in via terminal device 110, the terminal device may send a login request message containing a user identifier and a device identifier to a server. Based on this, server 120 may determine that the user identifier and the device identifier in the login request message are associated with each other. Furthermore, server 120 may record the associated identities in the form of identity pairs in an identity database. Each identity pair includes two original identities that are associated with each other.

[0029] Some users may violate regulations when using applications or websites, thus affecting the normal operation of the applications or websites. The identities used by these users are called abnormal identities.

[0030] According to embodiments of the present disclosure, abnormal identity identifiers may be present in identity identifier database 130. For example, in this embodiment, the identity identifiers stored in identity identifier database 130 may be identified to determine abnormal identity identifiers. These abnormal original identity identifiers may then be stored in abnormal identity identifier database 140, i.e., a database is filled.

[0031] According to an embodiment of the present disclosure, when identifying abnormal identity identifiers, in order to improve the recognition accuracy, for example, a machine learning model can be used to perform abnormal identification on each identity identifier stored in the identity identifier database 130, obtain the abnormality degree of each identity identifier, and then determine the abnormal identity identifiers among these identity identifiers based on the abnormality degrees of these identity identifiers. The machine learning model can be trained according to the following method: based on the association relationship between multiple original identity identifiers, the life cycle, frequency of occurrence, and attribute information of each original identity identifier in the multiple original identity identifiers, determine the abnormal original identity identifiers among the multiple original identity identifiers. Then, the behavioral characteristics of each abnormal original identity identifier are extracted. Next, the machine learning model is trained based on the behavioral characteristics.

[0032] According to an embodiment of the present disclosure, after an abnormal identity identifier is stored in abnormal identity identifier database 140, the abnormal identity identifier in abnormal identity identifier database 140 can be retrieved upon user request. For example, in this embodiment, a user can input an identity identifier to be identified through terminal device 110. Based on the identity identifier to be identified input by the user, a query can be performed to determine whether an abnormal identity identifier corresponding to the identity identifier to be identified is found among the abnormal identity identifiers stored in abnormal identity identifier database 140. If so, the identity identifier to be identified is an abnormal identity identifier. If not, the identity identifier to be identified is not an abnormal identity identifier.

[0033] In the technical solution disclosed herein, the collection, storage, use, processing, transmission, provision, disclosure and application of user personal information such as identity identification are in compliance with the provisions of relevant laws and regulations, necessary confidentiality measures have been taken, and do not violate public order and good morals.

[0034] In the technical solution disclosed herein, the user's authorization or consent is obtained before obtaining or collecting the user's personal information such as identity identification.

[0035] The following will be combined Figure 2 The method for identifying abnormal identity identification provided by the present disclosure is described.

[0036] Figure 2 The flowchart of the method for identifying abnormal identity identification according to an embodiment of the present disclosure is schematically shown.

[0037] like Figure 2 As shown, the method 200 for identifying abnormal identity identifiers includes, in operation S210, performing abnormality identification on at least one identity identifier to be identified using a machine learning model to obtain an abnormality degree of the at least one identity identifier to be identified.

[0038] According to an embodiment of the present disclosure, the identity identifier may include, for example, a cookie, a MAC address, an IP address, a device identifier, a user identifier (userid), an application identifier (appid), and the like.

[0039] According to embodiments of the present disclosure, the input of a machine learning model may be the behavioral characteristics corresponding to an identity identifier, and the output of the machine learning model may be an abnormality degree. The abnormality degree may be used to indicate the degree of abnormality of the identity identifier. Machine learning models may include, for example, Bayesian models, neural network models, decision trees, and support vector machines (SVMs).

[0040] Then, in operation S220, an abnormal identity identifier among the at least one identity identifier to be identified is determined according to the abnormality degree of the at least one identity identifier to be identified.

[0041] According to embodiments of the present disclosure, for example, an identity identifier to be identified whose abnormality exceeds an abnormality threshold can be determined as an abnormal identity identifier. The abnormality threshold can be set based on actual needs. For example, the abnormality value range can be set to 0-1. The abnormality threshold can be set to 0.5. That is, if the abnormality of an identity identifier is greater than 0.5, it is considered an abnormal identity identifier.

[0042] According to the embodiments of the present disclosure, abnormal original identity identifiers are identified based on the associations between original identity identifiers, their lifecycles, frequency of occurrence, and attribute information. Behavioral characteristics of the abnormal original identity identifiers are then extracted, and a machine learning model is trained based on these behavioral characteristics. The trained machine learning model is capable of identifying abnormal identity identifiers with high accuracy.

[0043] The following will be combined Figure 3 The present invention describes a method for training a machine learning model.

[0044] Figure 3 Flowchart of a method for training a machine learning model according to an embodiment of the present disclosure.

[0045] like Figure 3 As shown, the method for training a machine learning model includes, in operation S330, determining an abnormal original identity identifier among the multiple original identity identifiers based on the association relationship between the multiple original identity identifiers, the life cycle, occurrence frequency and attribute information of each original identity identifier in the multiple original identity identifiers.

[0046] According to embodiments of the present disclosure, original identity identifiers may be associated with each other. For example, when a user logs in through a terminal device, the terminal device may send a login request message containing a user identifier and a device identifier to a server. The server may determine that the user identifier and the device identifier in the login request message are associated with each other. Furthermore, the server may record the associated identity identifiers as identifier pairs. Each identity identifier pair includes two associated original identity identifiers.

[0047] According to an embodiment of the present disclosure, the original identity identifier may be provided with a life cycle, which is used to indicate a time period between the earliest appearance time and the latest appearance time of the original identity identifier.

[0048] According to an embodiment of the present disclosure, each time each original identity identifier appears in the server, it can be recorded, thereby obtaining the appearance frequency of each original identity identifier.

[0049] According to an embodiment of the present disclosure, the attribute information of the original identity identifier may include, for example, device attributes and operation attributes. Device attributes may include, for example, the operating system (OS), device name (device), and browser (browser). Operation attributes may include, for example, clicks, screen swipes, page dwell time, and request frequency.

[0050] In operation S340 , behavioral features of each abnormal original identity are extracted.

[0051] According to embodiments of the present disclosure, for example, behavioral data corresponding to an abnormal original identity identifier can be obtained. The behavioral data includes at least one of the following: click data, access address, and visitor fingerprint information. The behavioral characteristics of the abnormal original identity identifier can then be determined based on the behavioral data corresponding to the abnormal original characteristics. For example, feature extraction can be performed on the behavioral data corresponding to the abnormal original characteristics to obtain the behavioral characteristics of the abnormal original identity identifier.

[0052] In operation S350, a machine learning model is trained based on the behavioral characteristics.

[0053] According to an embodiment of the present disclosure, for example, the behavioral features of an abnormal original identity can be marked as abnormal. These behavioral features can then be used to train a machine learning model. This enables the machine learning model to be able to identify the degree of abnormality of the behavioral features.

[0054] According to another embodiment of the present disclosure, for example, behavioral features that are not abnormal after identification can also be marked as normal, so that the machine learning model can also learn the behavioral features marked as normal, thereby further improving the recognition accuracy.

[0055] The following will be combined Figure 4 The method for determining abnormal original identity provided by the present disclosure is described.

[0056] Figure 4 The present invention is a flowchart of a method for determining an abnormal original identity according to an embodiment of the present disclosure.

[0057] like Figure 4 As shown, the method 430 for determining abnormal original identity identifiers may include, in operation S431 , obtaining a plurality of original identity identifier pairs.

[0058] According to an embodiment of the present disclosure, for example, original identity identifiers with associated relationships may be recorded in advance in the form of identity identifier pairs to obtain multiple original identity identifier pairs, wherein each of the multiple original identity identifier pairs includes two original identity identifiers with associated relationships.

[0059] In operation S432 , the number of identities associated with each original identity is determined based on the plurality of original identity pairs.

[0060] According to an embodiment of the present disclosure, for example, the number of times each original identity identifier appears in different original identity identifier pairs may be counted, thereby obtaining the number of the original identity identifiers.

[0061] In operation S433 , original identity identifiers whose number exceeds a number threshold are determined as target original identity identifiers, and the target original identity identifier and original identity identifiers associated with the target original identity identifier are determined as abnormal original identity identifiers.

[0062] According to an embodiment of the present disclosure, the quantity threshold can be set according to actual needs. For example, the quantity threshold can be set to 60, that is, one cookie cannot be associated with more than 60 user identifiers. Once exceeded, it can be determined that the cookie and the user identifier associated with the cookie are abnormal identity identifiers.

[0063] The following will be combined Figure 5 A method for determining an abnormal original identity identifier according to another embodiment of the present disclosure is described.

[0064] Figure 5 The present invention is a flowchart of a method for determining an abnormal original identity according to another embodiment of the present invention.

[0065] like Figure 5 As shown, the method 530 for determining abnormal original identity identifiers may include, in operation S534, determining a first attribute value for each original identity identifier according to a device attribute of the original identity identifier.

[0066] According to embodiments of the present disclosure, device attributes may include, for example, operating system (OS), device name (device), browser (browser), and other attributes. For example, in this embodiment, the timestamp and duration of a user's use of the corresponding device can be determined based on the device attributes. A first attribute value can then be determined based on the timestamp and duration of use. For example, the sum of the timestamp and duration of use can be calculated as the first attribute value.

[0067] In operation S535 , a second attribute value is determined according to the operation attribute of the original identity identifier.

[0068] According to embodiments of the present disclosure, operation attributes may include, for example, clicks, screen scrolling, page dwell time, and request frequency. For example, in this embodiment, the frequency of user triggering corresponding actions can be determined based on the operation attributes. The second attribute value can then be determined based on the frequency of action triggering. For example, the number of times the action is triggered per unit time can be calculated based on the frequency of action triggering as the second attribute value.

[0069] In operation S536 , the weight of the product line corresponding to the original identity identifier is obtained.

[0070] According to embodiments of the present disclosure, product lines may include, for example, applications, websites, and the like. Different product lines are assigned different weights. For example, weights can be set based on actual needs. For example, a larger weight can be assigned to a more important product line, while a smaller weight can be assigned to a less important product line. This allows for greater emphasis on data such as device attributes and operational attributes obtained from more important product lines, while minimizing the impact of data such as device attributes and operational attributes from less important product lines.

[0071] In operation S537, an evaluation value is determined based on the first attribute value, the second attribute value, and the weight, and if the evaluation value meets a predetermined condition, the original identity identifier is determined as an abnormal original identity identifier.

[0072] According to an embodiment of the present disclosure, the evaluation value can be calculated according to the following formula, for example:

[0073] V=a1*p1+......+an*pn

[0074] Where V is the evaluation value, p1, ..., pn represent the number of times the identity pair appears in each product line, and a1...an represent the weight of each product line. For example, pn represents the number of times the identity pair appears in product line n, and an represents the weight of product line n.

[0075] The following will be combined Figure 6 A method for determining an abnormal original identity identifier according to another embodiment of the present disclosure is described.

[0076] Figure 6 The present invention is a flowchart of a method for determining an abnormal original identity according to another embodiment of the present invention.

[0077] like Figure 6 As shown, the method 630 for determining abnormal original identity identifiers may include, in operation S638 , determining whether the life cycles of each original identity identifier overlap.

[0078] In operation S639 , the original identity identifiers with overlapping life cycles are determined as abnormal original identity identifiers.

[0079] According to embodiments of the present disclosure, for example, the difference between the earliest and latest appearance times of an original identity identifier can be calculated to obtain the lifetime of the original identity identifier. The original identity identifiers are sorted by lifetime length, with the longest one at the top. The original identity identifiers are looped through, and if any lifetimes overlap, the original identity identifier is identified as abnormal.

[0080] The following will be combined Figure 7 A method for determining an abnormal original identity identifier according to another embodiment of the present disclosure is described.

[0081] Figure 7 The present invention is a flowchart of a method for determining an abnormal original identity according to another embodiment of the present invention.

[0082] like Figure 7 As shown, the method 730 for determining abnormal original identity identifiers may include, in operation S7310, determining the occurrence frequency of each original identity identifier within a first time period.

[0083] According to an embodiment of the present disclosure, the first time period can be set according to actual needs.

[0084] In operation S7311, an original identity identifier whose appearance frequency in a first time period is less than a first frequency threshold is determined as a candidate original identity identifier.

[0085] According to an embodiment of the present disclosure, the first frequency threshold may be set according to actual needs.

[0086] In operation S7312, the occurrence frequency of each candidate original identity identifier in the second time period is determined.

[0087] According to an embodiment of the present disclosure, the second time period can be set according to actual needs.

[0088] In operation S7313, candidate original identity identifiers whose occurrence frequency in the second time period is less than a second frequency threshold are determined as abnormal original identity identifiers.

[0089] According to an embodiment of the present disclosure, the second frequency threshold may be set according to actual needs.

[0090] According to an embodiment of the present disclosure, for example, the first time period may be 1 year, and the second time period may be 1 month. The first frequency threshold may be 3 times. The second frequency threshold may be 1 time. Based on this, if the identity identifier appears less than 3 times in a specified product line or all product lines within the past year, the identity identifier will be marked as a candidate original identity identifier. If the candidate original identity identifier has not appeared within the next month, that is, the number of appearances is less than 1, the candidate original identity identifier is determined to be an abnormal original identity identifier. If the number of appearances of the candidate original identity identifier is greater than or equal to 1 within the next month, the mark of the candidate original identity identifier can be cleared.

[0091] According to another embodiment of the present disclosure, after the abnormal identity identifier is obtained through machine learning model identification, an abnormal identity identifier table can be generated based on the abnormal identity identifier, that is, a database is filled for query by the user. The abnormal identity identifier table can be in simpleDB format, for example.

[0092] For example, in this embodiment, when filling the database, the abnormal identity identifier can be converted into a protobuf format, and then a unit64 key value is generated through hashing and shifting operations and stored in a temporary path. The key includes information related to the identity identifier (information), product line information (product), timestamp, occurrence count, etc.

[0093] The generated protobuf format data can then be converted into simpleDB format data and stored in the official path of the simpleDB database, that is, the address that can be found by the query service.

[0094] To improve system scalability, you can set the Abnormal Identity Query parameter to enable or disable the Abnormal Identity Query feature. If you are unsure whether a sample's identity is abnormal, you can set the Abnormal Identity Query parameter to true to enable the Abnormal Identity Query feature.

[0095] When querying, the user enters the sample ID of the suspected anomaly and sets the abnormal ID query parameter to true. Then, in the same way as generating keys in the database filling phase, a key' is generated based on the sample ID. Then, the key' is queried in the simpleDB database. If the same key is found in the simpleDB database, it means that the record corresponding to this key contains the sample ID entered by the user and its related attribute information. You can traverse the records corresponding to this key until you find a record with the same ID as the input sample ID, and return this record as the output result. If there is no identical key, "not found" is returned, indicating that no relevant records were found.

[0096] According to another embodiment of the present disclosure, the sample identification identifier entered by the user may be non-standard. For example, the sample identification identifier should have a suffix of "|0", but the user entered it as "|O". Based on this, the incorrect suffix "|O" in the sample identification identifier entered by the user can be identified and corrected to "|0". The corrected identifier can then be queried in the database, thereby improving query accuracy.

[0097] The following will be combined Figure 8 The present invention describes a device for identifying abnormal identity identification.

[0098] Figure 8 A block diagram of an apparatus for identifying abnormal identity identification according to an embodiment of the present disclosure is schematically shown.

[0099] like Figure 8 As shown, the apparatus 800 for identifying abnormal identity identification may include an identification module 810 , an abnormality determination module 820 , an originality determination module 830 , an extraction module 840 and a training module 850 .

[0100] The identification module 810 can be used to use a machine learning model to perform abnormality identification on at least one identity identifier to be identified, and obtain an abnormality degree of the at least one identity identifier to be identified.

[0101] The abnormality determination module 820 may be configured to determine an abnormal identity identifier among at least one identity identifier to be identified based on the abnormality degree of at least one identity identifier to be identified.

[0102] The original identification module 830 can be used to determine abnormal original identity identifiers among the multiple original identity identifiers based on the association relationship between the multiple original identity identifiers, the life cycle, occurrence frequency and attribute information of each original identity identifier in the multiple original identity identifiers.

[0103] The extraction module 840 can be used to extract the behavioral characteristics of each abnormal original identity.

[0104] The training module 850 can be used to train a machine learning model based on behavioral characteristics.

[0105] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0106] According to another embodiment of the present disclosure, the original determination module may include an original identity pair acquisition submodule, an identity quantity determination submodule, and a first abnormality determination submodule. The original identity pair acquisition submodule may be used to acquire multiple original identity pairs, wherein each of the multiple original identity pairs includes two original identities that are associated with each other. The identity quantity determination submodule may be used to determine the number of identities associated with each original identity based on the multiple original identity pairs. The first abnormality determination submodule may be used to determine an original identity whose number of identities exceeds a quantity threshold as a target original identity, and to determine the target original identity and the original identity associated with the target original identity as abnormal original identities.

[0107] According to another embodiment of the present disclosure, the attribute information may include device attributes and operation attributes. The original determination module may also include a first attribute value determination submodule, a second attribute value determination submodule, a weight acquisition submodule, an evaluation value determination submodule and a second abnormality determination submodule. Among them, the first attribute value determination submodule can be used to determine the first attribute value for each original identity identifier according to the device attribute of the original identity identifier. The second attribute value determination submodule can be used to determine the second attribute value according to the operation attribute of the original identity identifier. The weight acquisition submodule can be used to obtain the weight of the product line corresponding to the original identity identifier. The evaluation value determination submodule can be used to determine the evaluation value based on the first attribute value, the second attribute value and the weight. The second abnormality determination submodule can be used to determine the original identity identifier as an abnormal original identity identifier when the evaluation value meets a predetermined condition.

[0108] According to another embodiment of the present disclosure, the originality determination module may further include an overlap determination submodule and a third anomaly determination submodule. The overlap determination submodule may be configured to determine whether the lifecycles of each original identity identifier overlap. The third anomaly determination submodule may be configured to determine original identity identifiers with overlapping lifecycles as an anomaly original identity identifier.

[0109] According to another embodiment of the present disclosure, the original determination module may further include a frequency determination submodule, a candidate determination submodule, a frequency determination submodule, and a fourth abnormality determination submodule. Among them, the frequency determination submodule can be used to determine the frequency of occurrence of each original identity identifier in the first time period. The candidate determination submodule can be used to determine the original identity identifier whose frequency of occurrence in the first time period is less than the first frequency threshold as a candidate original identity identifier. The frequency determination submodule can be used to determine the frequency of occurrence of each candidate original identity identifier in the second time period. The fourth abnormality determination submodule can be used to determine the candidate original identity identifier whose frequency of occurrence in the second time period is less than the second frequency threshold as an abnormal original identity identifier.

[0110] According to another embodiment of the present disclosure, the extraction module may include a behavior data acquisition submodule and a behavior feature determination submodule. The behavior data acquisition submodule may be configured to acquire, for each abnormal original identity identifier, behavior data corresponding to the abnormal original identity identifier, where the behavior data may include at least one of the following: click data, access address, and visitor fingerprint information. The behavior feature determination submodule may be configured to determine the behavior features of the abnormal original identity identifier based on the behavior data corresponding to the abnormal original features.

[0111] Figure 9 A block diagram of an example electronic device 900 that can be used to implement embodiments of the present disclosure is schematically shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0112] like Figure 9 As shown, the device 900 includes a computing unit 901, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 902 or a computer program loaded from a storage unit 908 into a random access memory (RAM) 903. Various programs and data required for the operation of the device 900 can also be stored in the RAM 903. The computing unit 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0113] Various components in the device 900 are connected to the I / O interface 905, including an input unit 906, such as a keyboard, a mouse, etc.; an output unit 907, such as various types of displays, speakers, etc.; a storage unit 908, such as a magnetic disk, an optical disk, etc.; and a communication unit 909, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 909 allows the device 900 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0114] The computing unit 901 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the computing unit 901 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 901 performs the various methods and processes described above, such as the method for identifying abnormal identifiers. For example, in some embodiments, the method for identifying abnormal identifiers can be implemented as a computer software program tangibly embodied in a machine-readable medium, such as the storage unit 908. In some embodiments, part or all of the computer program can be loaded and / or installed onto the device 900 via the ROM 902 and / or the communication unit 909. When the computer program is loaded into the RAM 903 and executed by the computing unit 901, one or more steps of the method for identifying abnormal identifiers described above can be performed. Alternatively, in other embodiments, the computing unit 901 can be configured to perform the method for identifying abnormal identifiers by any other suitable means (e.g., via firmware).

[0115] Various embodiments of the systems and techniques described above can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0116] The program code for implementing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0117] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0118] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0119] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0120] Computer systems may include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The client and server relationship arises through computer programs running on the respective computers and having a client-server relationship to each other.

[0121] The server can be a cloud server, also known as a cloud computing server or cloud host. It is a host product within the cloud computing service system that addresses the management difficulties and poor scalability of traditional physical hosts and VPS services ("Virtual Private Servers" or "VPS"). The server can also be a distributed system server or a server integrated with blockchain.

[0122] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved. This is not a limitation herein.

[0123] The above specific embodiments do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure shall be included within the scope of protection of this disclosure.

Claims

1. A method for identifying abnormal identity identification, comprising: Performing abnormality identification on at least one identity identifier to be identified using a machine learning model to obtain an abnormality degree of the at least one identity identifier to be identified; as well as determining an abnormal identity identifier among the at least one identity identifier to be identified according to the abnormality degree of the at least one identity identifier to be identified; The machine learning model is trained according to the following method: Determining an abnormal original identity identifier among the multiple original identity identifiers based on the association relationship between the multiple original identity identifiers, the life cycle, the frequency of occurrence, and the attribute information of each original identity identifier among the multiple original identity identifiers; Extracting behavioral features of each abnormal original identity identifier; and Training the machine learning model according to the behavioral characteristics; The attribute information includes device attributes and operation attributes, and the determining of abnormal original identity identifiers among the multiple original identity identifiers further includes: For each original identity, Determining a first attribute value according to the device attribute of the original identity, where the first attribute value includes a sum of a timestamp and a usage duration of the corresponding device determined according to the device attribute; determining a second attribute value according to the operation attribute of the original identity identifier, where the second attribute value is determined based on a triggering frequency of a behavior corresponding to the operation attribute; Obtaining a weight of the product line corresponding to the original identity identifier, wherein the weight represents the importance of the product line corresponding to the original identity identifier; and determining an evaluation value according to the first attribute value, the second attribute value, and the weight; In a case where the evaluation value satisfies a predetermined condition, the original identity identifier is determined as the abnormal original identity identifier.

2. The method according to claim 1, wherein The determining of an abnormal original identity identifier among the multiple original identity identifiers based on the association relationship among the multiple original identity identifiers, the life cycle, the occurrence frequency, and the attribute information of each original identity identifier among the multiple original identity identifiers includes: Acquire a plurality of original identity identification pairs, wherein each of the plurality of original identity identification pairs includes two original identity identifications that are associated with each other; Determining the number of identities associated with each original identity based on the multiple original identity pairs; and The original identity identifiers whose number exceeds a number threshold are determined as target original identity identifiers, and the target original identity identifier and the original identity identifiers associated with the target original identity identifier are determined as abnormal original identity identifiers.

3. The method according to claim 1, wherein The determining of abnormal original identity identifiers among the multiple original identity identifiers based on the association relationship among the multiple original identity identifiers, the life cycle, the occurrence frequency, and the attribute information of each original identity identifier among the multiple original identity identifiers further includes: Determining whether the lifecycles of each of the original identity identifiers overlap; and The original identity identifier with overlapping life cycles is determined as the abnormal original identity identifier.

4. The method according to claim 3, wherein: The determining of abnormal original identity identifiers among the multiple original identity identifiers based on the association relationship among the multiple original identity identifiers, the life cycle, the occurrence frequency, and the attribute information of each original identity identifier among the multiple original identity identifiers further includes: Determining the frequency of occurrence of each original identity identifier within the first time period; Determine an original identity identifier whose appearance frequency in the first time period is less than a first frequency threshold as a candidate original identity identifier; Determining the frequency of occurrence of each candidate original identity within the second time period; and A candidate original identity identifier whose appearance frequency in the second time period is less than a second frequency threshold is determined as the abnormal original identity identifier.

5. The method according to claim 1, wherein The extracting the behavioral features of each abnormal original identity identifier includes: For each abnormal original identity, Obtaining behavioral data corresponding to the abnormal original identity identifier, wherein the behavioral data includes at least one of the following: click data, access address, and visitor fingerprint information; and Determine the behavioral characteristics of the abnormal original identity identifier based on the behavioral data corresponding to the abnormal original identity identifier.

6. A device for identifying abnormal identity identification, comprising: an identification module, configured to perform abnormality identification on at least one identity identifier to be identified using a machine learning model, and obtain an abnormality degree of the at least one identity identifier to be identified; an abnormality determination module, configured to determine an abnormal identity identifier among the at least one identity identifier to be identified based on the abnormality degree of the at least one identity identifier to be identified; an original identification module, configured to determine an abnormal original identity identifier among the multiple original identity identifiers based on an association relationship between the multiple original identity identifiers, a life cycle, an occurrence frequency, and attribute information of each original identity identifier among the multiple original identity identifiers; An extraction module, configured to extract behavioral features of each abnormal original identity identifier; as well as A training module, configured to train the machine learning model based on the behavioral characteristics; Wherein, the attribute information includes device attributes and operation attributes; The original determination module further includes: A first attribute value determination submodule, configured to determine, for each original identity identifier, a first attribute value according to the device attributes of the original identity identifier, the first attribute value comprising a sum of a timestamp and a usage duration of the corresponding device determined according to the device attributes; A second attribute value determination submodule, configured to determine a second attribute value according to the operation attribute of the original identity identifier, wherein the second attribute value is determined based on a triggering frequency of a behavior corresponding to the operation attribute; A weight acquisition submodule, configured to acquire a weight of the product line corresponding to the original identity identifier, wherein the weight represents the importance of the product line corresponding to the original identity identifier; an evaluation value determination submodule, configured to determine an evaluation value based on the first attribute value, the second attribute value, and the weight; and The second abnormality determination submodule is configured to determine the original identity identifier as the abnormal original identity identifier if the evaluation value satisfies a predetermined condition.

7. The device according to claim 6, wherein The original determination module includes: An original identity pair acquisition submodule, configured to acquire a plurality of original identity pairs, wherein each of the plurality of original identity pairs includes two original identities associated with each other; an identity number determination submodule, configured to determine the number of identities associated with each original identity based on the plurality of original identity pairs; and The first abnormality determination submodule is configured to determine the original identity identifier whose number exceeds a quantity threshold as the target original identity identifier, and determine the target original identity identifier and the original identity identifier associated with the target original identity identifier as the abnormal original identity identifier.

8. The device according to claim 7, wherein The original determination module further includes: an overlap determination submodule, configured to determine whether the life cycles of each of the original identity identifiers overlap; and The third abnormality determination submodule is configured to determine an original identity identifier with overlapping life cycles as the abnormal original identity identifier.

9. The device according to claim 8, wherein The original determination module further includes: A frequency determination submodule, configured to determine the frequency of occurrence of each original identity identifier within a first time period; a candidate determination submodule, configured to determine, as a candidate original identity identifier, an original identity identifier whose appearance frequency in the first time period is less than a first frequency threshold; a frequency determination submodule, configured to determine the frequency of occurrence of each candidate original identity identifier within a second time period; and The fourth abnormality determination submodule is configured to determine a candidate original identity identifier whose occurrence frequency in the second time period is less than a second frequency threshold as the abnormal original identity identifier.

10. The device according to claim 6, wherein The extraction module includes: a behavior data acquisition submodule, configured to acquire, for each abnormal original identity identifier, behavior data corresponding to the abnormal original identity identifier, wherein the behavior data includes at least one of the following: click data, access address, and visitor fingerprint information; and The behavior feature determination submodule is used to determine the behavior feature of the abnormal original identity identifier based on the behavior data corresponding to the abnormal original identity identifier.

11. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 5.

12. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 5.

13. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images