Data processing method and apparatus, and electronic device

Abstract

The application provides a data processing method and device, electronic equipment and computer readable storage medium; the method comprises: obtaining interaction data, wherein the interaction data comprises interaction behavior records of a plurality of object identifications for a plurality of traffic identifications; constructing a feature tree based on a feature item in the interaction data; obtaining a frequent feature item combination corresponding to each traffic identification based on the feature tree, wherein the frequency of the interaction behavior records associated with the frequent feature item combination exceeds a frequency threshold; determining the offset index of each frequent feature item combination, and determining the frequent feature item combination corresponding to the offset index that exceeds the offset index threshold as the offset index feature. Through the application, the offset index feature can be accurately identified, thereby providing reliable reference information for the control of the interaction behavior.

Description

TECHNICAL FIELD

[0001] The present application relates to the Internet technology, and particularly relates to a data processing method and device, electronic equipment and computer readable storage medium. BACKGROUND

[0002] With the development of Internet technology, more and more people use information flow products attached to mobile terminals. Various recommended information can be displayed to users through the information flow products. The recommended information includes recommended information that can directly bring click revenue, such as advertisements, and recommended information that cannot directly bring click revenue, such as news. In order to provide recommended information that truly meets the interests of users, a trained recommendation system is needed.

[0003] However, in the related art, the recommendation system is recommended by relying on the interactive behavior between the user and the recommended information. For recommended information that can directly bring click revenue, there may be abnormal interactive behavior. The related art cannot accurately detect abnormal interactive behavior, and too many abnormal interactive behaviors will affect the recommendation effect of the recommendation system. SUMMARY

[0004] The embodiments of the present application provide a data processing method, device, electronic equipment and computer readable storage medium, which can accurately identify the deviation indicator feature, thereby providing reliable reference information for the control of the interactive behavior.

[0005] The technical solutions of the embodiments of the present application are as follows:

[0006] The embodiments of the present application provide a data processing method, comprising:

[0007] Obtain interactive data, wherein the interactive data comprises interactive behavior records of a plurality of object identifiers for a plurality of traffic identifiers;

[0008] Construct a feature tree based on feature items in the interactive data;

[0009] Obtain frequent feature item combinations corresponding to each traffic identifier based on the feature tree, wherein the frequency of the interactive behavior records associated with the frequent feature item combinations exceeds a frequency threshold;

[0010] Determine the deviation indicator of each frequent feature item combination, and determine the frequent feature item combination corresponding to the deviation indicator that exceeds the deviation indicator threshold as a deviation indicator feature.

[0011] The embodiments of the present application provide a data processing device, comprising:

[0012] The obtaining module is configured to obtain interactive data, wherein the interactive data comprises interactive behavior records of a plurality of object identifiers for a plurality of traffic identifiers;

[0013] a constructing module, configured to construct a feature tree based on feature items in the interaction data;

[0014] a frequent feature module, configured to obtain frequent feature item combinations corresponding to each of the traffic identifications based on the feature tree, wherein a frequency of interaction behavior records associated with the frequent feature item combinations exceeds a frequency threshold;

[0015] an offset indicator module, configured to determine an offset indicator of each of the frequent feature item combinations, and determine a frequent feature item combination corresponding to an offset indicator exceeding an offset indicator threshold as an offset indicator feature.

[0016] In the above scheme, each of the interaction behavior records corresponds to an object identification and a traffic identification, and the constructing module is further configured to: for each of the interaction behavior records, perform the following processing: performing feature expansion processing on the interaction behavior record to obtain multiple types of feature data of the interaction behavior record; performing binding processing on the traffic identification of the interaction behavior record and each type of the feature data respectively, and taking a binding processing result corresponding to each type of the feature data as a feature item of the interaction behavior record; and constructing the feature tree based on multiple feature items of each of the interaction behavior records.

[0017] In the above scheme, the constructing module is further configured to: group same feature items in the multiple feature items into feature item sets; obtain a number of feature items in each of the feature item sets, and take a feature item set with a number not less than a number threshold as a reserved feature item set; for each of the interaction behavior records, perform the following processing: taking feature items corresponding to the reserved feature item set in the multiple feature items of the interaction behavior record as reserved feature items; performing descending order sorting processing on the reserved feature items based on the number corresponding to the feature item set to obtain a feature item sequence of the interaction behavior record; and constructing the feature tree based on the feature item sequence of each of the interaction behavior records.

[0018] In the above scheme, the constructing module is further configured to: initialize an empty node as a starting node of a tree structure of the feature tree; and add the feature item sequence of each of the interaction behavior records to the tree structure including the starting node to obtain the feature tree.

[0019] In the above scheme, the construction module is further configured to: for each feature item of the interaction behavior record, perform the following processing: when only the starting node is included in the tree structure, add the feature item sequence as a node of the tree structure into the tree structure, and update the first count of each node in the tree structure; wherein the first feature item in the feature item sequence is connected with the starting node and is a child node of the starting node, and the feature item arranged at the rear is a child node of the adjacent feature item arranged at the front.

[0020] In the above scheme, the construction module is further configured to: for each feature item of the interaction behavior record, perform the following processing: when the tree structure includes nodes other than the starting node, obtain the branch structure of each feature item sequence that has been added in the tree structure; when there is a branch structure with uninterrupted overlapping part with the feature item sequence in the tree structure, and the feature item sequence includes a non-overlapping part, add the non-overlapping part as a node of the tree structure and connect it with the tail of the overlapping part in the branch structure, and update the first count of each node in the tree structure according to the feature item sequence; when there is a branch structure with uninterrupted overlapping part with the feature item sequence in the tree structure, and the feature item sequence does not include a non-overlapping part, update the first count of each node in the tree structure according to the feature item sequence; wherein the non-overlapping part is the part of the feature item sequence except the overlapping part, and the overlapping part is connected with the starting node; when there is no branch structure with uninterrupted overlapping part with the feature item sequence in the tree structure, add the feature item sequence as a node of the tree structure into the tree structure, and update the first count of each node in the tree structure; wherein the first feature item in the feature item sequence is connected with the starting node and is a child node of the starting node, and the feature item arranged at the rear is a child node of the adjacent feature item arranged at the front.

[0021] In the above scheme, the frequent feature module is further configured to: obtain the feature item represented by each node and the first count of each node from the feature tree; sum the first count of the nodes of the same feature item, and sort the nodes corresponding to the feature item in ascending order based on the sum processing result; in turn for each feature item represented by the node, perform the following processing according to the ascending order sorting result: determine the conditional pattern base of the feature item represented by the node, and remove the node from the frequent feature tree; wherein the conditional pattern base includes a plurality of frequent feature items and the second count of each frequent feature item; based on the second count, obtain at least one combination of the frequent feature items from the conditional pattern base.

[0022] In the above scheme, the frequent feature module is further configured to: acquire a tree structure with the node as a bottom node, and take feature items represented by multiple nodes of the tree structure as the frequent feature items; initialize a first count of all nodes in each of the tree structures except the bottom node as zero; and perform the following processing for each of the tree structures: update the first count of other nodes of the tree structure based on the first count of the bottom node; and perform summation processing on the first count of the node corresponding to each of the frequent feature items to obtain a second count of the frequent feature item, and combine the frequent feature item and the second count of the frequent feature item as the conditional pattern base.

[0023] In the above scheme, the frequent feature module is further configured to: sort each of the frequent feature items based on the second count, and take multiple frequent feature items ranked in the front as multiple reserved frequent feature items; and perform the following processing at least once: randomly select any number of frequent feature items from the multiple reserved frequent feature items, and combine the selected frequent feature items and the frequent feature items corresponding to the node as the frequent feature item combination.

[0024] In the above scheme, the offset indicator module is further configured to: perform the following processing for each of the frequent feature item combinations: determine a conditional probability and a marginal probability of each frequent feature item in the frequent feature item combination; and determine the offset indicator of the frequent feature item combination according to the conditional probability and the marginal probability.

[0025] In the above scheme, the offset indicator module is further configured to: determine a first interaction number corresponding to any traffic identifier in the interaction data, and a second interaction number corresponding to the any traffic identifier of the frequent feature item in the interaction data; determine a conditional probability negatively correlated with the first interaction number and positively correlated with the second interaction number; determine a third interaction number corresponding to the frequent feature item in the interaction data, and a fourth interaction number corresponding to all interaction behavior records in the interaction data; and determine a marginal probability positively correlated with the third interaction number and negatively correlated with the fourth interaction number.

[0026] In the above scheme, the offset indicator module is further configured to: perform the following processing for each of the frequent feature items: determine an offset indicator of the frequent feature item positively correlated with a conditional probability of the frequent feature item and negatively correlated with a marginal probability of the frequent feature item; and perform average processing on the offset indicators of multiple frequent feature items to obtain the offset indicator of the frequent feature item combination.

[0027] In the foregoing scheme, the obtaining module is further configured to: receive an interaction request for any one of the traffic identifiers, update the interaction behavior record database based on a new interaction behavior record carried in the interaction request; read interaction behavior records in a preset time period from the updated interaction behavior record database as the interaction data, wherein the preset time period is a time period of a preset time length traced back from the current time; after determining the frequent feature item combination corresponding to the deviation indicator as the deviation indicator feature, the deviation indicator module is further configured to: when the interaction behavior matches the deviation indicator feature, perform any one of the following: shield a response to the interaction request; determine an object identifier implementing the interaction behavior as an cheating identifier, and shield a response to the interaction request and a subsequent interaction request from the cheating identifier.

[0028] An electronic device is provided in an embodiment of the application, and the electronic device comprises:

[0029] A memory is configured to store executable instructions.

[0030] A processor is configured to execute the executable instructions stored in the memory, so as to implement the data processing method provided in the embodiments of the application.

[0031] A computer readable storage medium is provided in an embodiment of the application, and the computer readable storage medium stores executable instructions, so as to cause the processor to execute the data processing method provided in the embodiments of the application when the executable instructions are executed.

[0032] The embodiments of the application have the following beneficial effects:

[0033] The frequent feature item combination corresponding to each traffic identifier is obtained from the interaction data between the traffic account and the object account based on the feature tree, and the frequent feature item combination whose deviation indicator exceeds the deviation indicator threshold is determined as the deviation indicator feature. Since the frequent feature combination is a combination of features with high frequency and appearing in the click behavior, and the high-frequency feature combination conforms to the data distribution of the corresponding deviation indicator scene, the frequent feature combination is used as the deviation indicator feature, so that the recognition accuracy of the corresponding deviation indicator scene can be effectively improved. BRIEF DESCRIPTION OF DRAWINGS

[0034] Figure 1 FIG. 1 is a structural schematic diagram of an interaction cheating detection system provided in an embodiment of the application;

[0035] Figure 2 FIG. 5 is a structural schematic diagram of an electronic device provided in an embodiment of the application;

[0036] Figures 3A-3D FIG. 7 is a flow schematic diagram of a data processing method provided in an embodiment of the application;

[0037] Figure 4is a flow account schematic diagram of the cheating detection method provided by the embodiment of the present application;

[0038] Figures 5A-5C is a schematic diagram of the recommended information provided by the embodiment of the present application;

[0039] Figure 6 is an architecture diagram of the cheating detection system provided by the embodiment of the present application;

[0040] Figure 7 is a click relationship schematic diagram provided by the embodiment of the present application;

[0041] Figure 8 is a feature expansion schematic diagram provided by the embodiment of the present application;

[0042] Figure 9 is a feature item schematic diagram provided by the embodiment of the present application;

[0043] Figure 10 is a frequent pattern tree schematic diagram provided by the embodiment of the present application;

[0044] Figure 11 is a flow chart of the cheating detection method provided by the embodiment of the present application;

[0045] Figures 12A-12E is a tree structure schematic diagram provided by the embodiment of the present application. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical scheme and advantages of the present application more clear, the present application will be further described in detail below with the help of the accompanying drawings, and the described embodiments should not be regarded as limiting the present application, all other embodiments obtained by the person skilled in the art without making creative efforts belong to the protection scope of the present application.

[0047] In the following description, "some embodiments" are related to a subset of all possible embodiments, but it can be understood that "some embodiments" can be the same subset or different subset of all possible embodiments, and can be combined with each other without conflict.

[0048] In the following description, the term "first\second" is only to distinguish similar objects, and does not represent the specific order of the objects, and it can be understood that "first\second" can be interchanged with the specific order or sequence as allowed, so that the embodiments of the present application described here can be implemented in an order other than that illustrated or described here.

[0049] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in the description herein is for describing particular embodiments only and is not intended to be limiting of the application.

[0050] The relevant data collection and processing in the embodiments of the application should be strictly in accordance with the requirements of relevant laws and regulations, obtain the informed consent or separate consent of the personal information subject, and within the scope of authorization of laws and regulations and the personal information subject, carry out subsequent data use and processing.

[0051] Before the embodiments of the application are further described in detail, the terms and phrases involved in the embodiments of the application are explained, and the terms and phrases involved in the embodiments of the application are applicable to the following explanations.

[0052] 1) CPC advertisement, CPC advertisement is the English abbreviation of pay-per-click advertisement, which represents the cost of each advertisement click. In this mode, the advertiser only pays for the user's click on the advertisement, and does not pay for the exposure of the advertisement. For the advertiser, CPC advertisement avoids the risk of only exposure but no click, and is one of the mainstream advertisement charging modes.

[0053] 2) Advertiser, the advertiser refers to a user or service provider who pays for advertising, and the advertiser hopes that each paid advertisement click is a real user's effective click, rather than a cheating click.

[0054] 3) Traffic master, the traffic master refers to a carrier that provides user traffic, usually a medium, a website or software. In the WeChat advertising platform, the traffic master refers to a public number with a certain number of fans. The traffic master can participate in the profit sharing of the advertisement. Under the same advertisement exposure, the higher the click rate, the higher the profit sharing, so the traffic master has a strong motivation to cheat to improve the click rate.

[0055] 4) Advertisement cheating, in the advertisement exposure, click, effect and other links, users have the behavior of brushing advertisement exposure, click, effect for some malicious purposes. This malicious behavior that is not the real intention of the user is called advertisement cheating.

[0056] 5) Advertisement anti-cheating, checking the advertisement exposure, click, effect and other links to determine whether the advertisement exposure, click, effect and other links are normal.

[0057] 6) Automatic machine cheating point advertisement, using automated scripts or software to control dozens or even hundreds of mobile phones through one or more computers to control the cheating behavior of non-normal user clicks on the advertisement.

[0058] The advertisement cheating detection scheme in the related art mainly includes the following two kinds: (1) judging through some result indicators (for example, click volume, click rate), the worse the advertisement effect (conversion rate) is, the higher the possibility of cheating click is, this scheme has low coverage, can only dig out the cheating object with extremely abnormal click volume, cannot identify the object with low click volume or gang cheating, and meanwhile has low accuracy, and in the actual use process, large manual cost is needed for verification; (2) judging whether the user mobile phone is implanted with malicious code and thus controlled by a machine by analyzing the underlying code, the defect is that the malicious sample acquisition is difficult, and the underlying code needs to be translated into the code that can be understood by people through the reverse compilation process, and the manual verification cost is high. In the related art, whether it is cheating is analyzed through the result indicators (click rate, conversion rate), the accuracy and coverage are low, or whether the user is a machine user is judged by analyzing the underlying code, the malicious sample acquisition is difficult, and the manual verification cost is high. In the related art, the interactive behavior with cheating suspicion cannot be accurately detected, and too many interactive behaviors with cheating suspicion will affect the recommendation effect of the recommendation system.

[0059] The embodiment of the application provides a data processing method and device, electronic equipment and computer readable storage medium, which can accurately identify cheating features, thereby providing reliable reference information for interactive cheating detection and control. By identifying cheating features, the credibility of interactive behavior is improved, thereby improving the recommendation efficiency and recommendation accuracy.

[0060] The following describes an exemplary application of the electronic equipment provided by the embodiment of the application. The equipment provided by the embodiment of the application can be implemented as a notebook computer, a tablet computer, a desktop computer, a set-top box, a mobile device (for example, a mobile phone, a portable music player, a personal digital assistant, a dedicated message device, a portable game device) and various types of user terminals, and can also be implemented as a server. In the following, an exemplary application when the electronic equipment is implemented as a server will be described.

[0061] Referring to Figure 1 , Figure 1 is a structural schematic diagram of an interactive cheating detection system provided by the embodiment of the application. The terminal 400 is connected to the server 200 through the network 300, and the network 300 can be a wide area network or a local area network, or a combination of the two.

[0062] In some embodiments, the server 200 receives an interaction request returned by the terminal 400 for any one traffic account, updates the interaction behavior record database 500 based on a new interaction behavior record carried by the interaction request, reads the interaction behavior record in a preset time period from the updated interaction behavior record database as interaction data, obtains a frequent feature item combination corresponding to each traffic account from the interaction data between the traffic account and the object account (user account) based on a feature tree-based data processing manner, and determines a frequent feature item combination with an abnormality degree exceeding an abnormality degree threshold as a cheating feature. When the interaction behavior matches the cheating feature, the server 200 shields the response to the interaction request, and / or, determines the user account implementing the interaction behavior as a cheating account, and shields the response to the interaction request and subsequent interaction requests from the cheating account.

[0063] In some embodiments, the server 200 can be a stand-alone physical server, a server cluster or a distributed system composed of multiple physical servers, a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDNs, and basic cloud computing services such as big data and artificial intelligence platforms. The terminal 400 can be a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited thereto. The terminal and the server can be connected directly or indirectly through wired or wireless communication, which is not limited in the embodiments of the present application.

[0064] Referring to Figure 2 , Figure 2 is a structural schematic diagram of an electronic device provided by the embodiments of the present application, Figure 2 The server 200 shown in Figure 2 includes at least one processor 210, a memory 250, at least one network interface 220, and a user interface 230. The various components in the server 200 are coupled together through a bus system 240. It can be understood that the bus system 240 is used to realize the connection and communication between the components. In addition to the data bus, the bus system 240 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, all kinds of buses are marked as the bus system 240 in

[0065] The processor 210 can be an integrated circuit chip with signal processing capability, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0066] The memory 250 can be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard drives, optical drives, and the like. The memory 250 optionally includes one or more storage devices remotely located from the processor 210.

[0067] The memory 250 includes volatile memory or nonvolatile memory, and can also include both volatile and nonvolatile memory. Nonvolatile memory can be read only memory (ROM), volatile memory can be random access memory (RAM). The memory 250 described in the embodiments of the present application is intended to include any suitable type of memory.

[0068] In some embodiments, the memory 250 is capable of storing data to support various operations, examples of which include programs, modules, and data structures or subsets or supersets thereof, which are exemplarily illustrated below.

[0069] The operating system 251 includes system programs for processing various basic system services and performing hardware-related tasks, such as a framework layer, a core library layer, a driver layer, and the like, for implementing various basic services and processing tasks according to hardware.

[0070] The network communication module 252 is used to reach other computing devices via one or more (wired or wireless) network interfaces 220, exemplary network interfaces 220 including Bluetooth, wireless compatibility certification (WiFi), and universal serial bus (USB), and the like.

[0071] In some embodiments, the device provided by the embodiments of the present application can be realized in software, Figure 2 A data processing device 255 stored in the memory 250 is shown, which can be software in the form of programs and plug-ins, including the following software modules: an acquisition module 2551, a construction module 2552, a frequent feature module 2553, and an offset index module 2554. These modules are logical, and thus can be combined or further split according to the functions implemented.

[0072] The data processing method provided by the embodiments of the present application will be described in conjunction with exemplary applications and implementations of the server provided by the embodiments of the present application.

[0073] Referring to Figure 3A , Figure 3A is a flowchart of the data processing method provided by the embodiments of the present application, which will be described in conjunction with steps 101-104 shown in Figure 3A

[0074] ​In step 101, interaction data is acquired.

[0075] As an example, the interaction data includes interaction behavior records of a plurality of object identifiers for a plurality of traffic identifiers, the object identifier can be an object account, and the traffic identifier can be a traffic account, that is, the interaction data includes interaction behavior records of a plurality of object accounts for a plurality of traffic accounts, the object account is a user account that has interaction behavior with the traffic account, the recommended information click record of the plurality of objects in a certain period of time (the past 7 days or 30 days) is extracted from the interaction behavior record database, and an object-traffic account click relationship graph is generated. See Figure 7 , Figure 7 is a click relationship schematic diagram provided by an embodiment of the application. The click record of the object account for the recommended information includes: (object u1, traffic account a1), (object u1, traffic account a2), (object u2, traffic account a1), (object u2, traffic account a2), (object u3, traffic account a1), and (object u3, traffic account a2). The recommended information can be an information such as an advertisement that directly or indirectly generates a click-for-fee income.

[0076] In some embodiments, the interaction data acquired in step 101 can be realized by the following technical solution: receiving an interaction request for any one traffic account, updating the interaction behavior record database based on the new interaction behavior record carried by the interaction request; and reading the interaction behavior record in a preset time period from the updated interaction behavior record database as the interaction data, wherein the preset time period is a time period of a preset time length traced back from the current time.

[0077] As an example, see Figure 6 , Figure 6 is an architecture diagram of the cheating detection system provided by an embodiment of the application. When the recommended information is displayed to the object account or the object account clicks the recommended information, the client on which the recommendation platform depends reports the behavior data of the click recommended information to the access layer server. The interaction data includes but is not limited to the current time, the object account, the click scene, the network address of the object account, and the traffic account. The access layer server first stores the exposure click log of the object account in the interaction behavior record database, and then requests the real-time computing server to determine whether the recommended information click behavior of the object account at this time belongs to cheating click recommended information. The real-time computing server extracts the interaction behavior record of a plurality of object accounts including the object account in a period of time from the interaction behavior record database, Figure 6 The access layer server and the real-time computing server in Figure 1 and Figure 2 may be integrated into one server (i.e., the server 200 in and

[0078] In some embodiments, after determining the combination of frequent feature items corresponding to the abnormal degree as the deviation indicator feature, when the interactive behavior matches the deviation indicator feature, any one of the following is performed: shielding the response interactive request; determining the object account implementing the interactive behavior as a cheating account, and shielding the response interactive request and subsequent interactive requests from the cheating account.

[0079] As an example, the deviation indicator feature can be a cheating feature, when the interactive behavior matches the cheating feature, the response interactive request is shielded, for example, the cheating feature is the combination of "a1|click coordinate 1" and "a1|click scene 1", when the interactive behavior simultaneously includes "a1|click coordinate 1" and "a1|click scene 1", it indicates that the interactive behavior matches the cheating feature, and the response interactive request is shielded, when the interactive behavior matches the cheating feature, the object account implementing the interactive behavior can also be determined as a cheating account, and the response interactive request and subsequent interactive requests from the cheating account are shielded, for example, the cheating feature is the combination of "a1|click coordinate 1" and "a1|click scene 1", when the interactive behavior simultaneously includes "a1|click coordinate 1" and "a1|click scene 1", it indicates that the interactive behavior matches the cheating feature, and the object account initiating the interactive request is shielded, not only refusing to respond to this interactive request but also refusing to respond to future interactive requests from this object account, shielding can be understood as refusing to respond and can also be understood as not recording it as an interactive behavior.

[0080] As an example, the deviation indicator feature can be a cheating feature, when the interactive behavior matches the cheating feature, the response interactive request is shielded, for example, the cheating feature is the combination of "a1|click coordinate 1" and "a1|click scene 1", when the interactive behavior simultaneously includes "a1|click coordinate 1" and "a1|click scene 1", it indicates that the interactive behavior matches the cheating feature, and the response interactive request is shielded, when the interactive behavior matches the cheating feature, the object account implementing the interactive behavior can also be determined as a cheating account, and the response interactive request and subsequent interactive requests from the cheating account are shielded, for example, the cheating feature is the combination of "a1|click coordinate 1" and "a1|click scene 1", when the interactive behavior simultaneously includes "a1|click coordinate 1" and "a1|click scene 1", it indicates that the interactive behavior matches the cheating feature, and the object account initiating the interactive request is shielded, not only refusing to respond to this interactive request but also refusing to respond to future interactive requests from this object account, shielding can be understood as refusing to respond and can also be understood as not recording it as an interactive behavior. The difference from the above example is that when matching, complete matching is performed, considering the traffic account, so that the cheating behavior or cheating object account can be more accurately determined.

[0081] In step 102, a feature tree is constructed based on the feature items in the interactive data.

[0082] In some embodiments, each interaction behavior record corresponds to an object account and a flow account, see Figure 3B , Figure 3B is a flow diagram of a data processing method provided by an embodiment of the present application. In step 102, constructing a feature tree based on feature items in interaction data can be implemented by performing steps 1021-1023 for each interaction behavior record.

[0083] In step 1021, the interaction behavior record is subjected to feature expansion processing to obtain multiple types of feature data of the interaction behavior record.

[0084] As an example, the features of each interaction behavior record are expanded, see Figure 8 , Figure 8 is a feature expansion diagram provided by an embodiment of the present application. The features obtained after expansion include object features and click behavior features. The object features include: the model of the object account initiating the click behavior, the operating system of the object account initiating the click behavior, the version of the social client of the object account initiating the click behavior. The click behavior features include: the click coordinates of the object account initiating the click behavior, the click scene of the object account initiating the click behavior.

[0085] In step 1022, the flow account of the interaction behavior record is subjected to binding processing with each type of feature data respectively, and the binding processing result corresponding to each type of feature data is taken as a feature item of the interaction behavior record.

[0086] As an example, the flow account of the interaction behavior record is subjected to binding processing with each type of feature data respectively, and the binding processing result corresponding to each type of feature data is taken as a feature item of the interaction behavior record, see Figure 9 , Figure 9 is a feature item diagram provided by an embodiment of the present application. The feature item format is "flow account | feature attribute value", for example, "a1 | model 1". Multiple feature items are combined into a feature item set generated for each flow account, for example, "a1 | model 1", "a1 | operating system 1", "a1 | version of social client", "a1 | click coordinates 1", "a1 | click scene 1".

[0087] In step 1023, a feature tree is constructed based on multiple feature items of each interaction behavior record.

[0088] In some embodiments, the constructing the feature tree based on the plurality of feature items of each interaction behavior record in step 1023 can be implemented by the following technical solutions: combining the same feature items in the plurality of feature items into a feature item set; obtaining the number of feature items in each feature item set, and taking the feature item set with a number not less than a number threshold as a reserved feature item set; performing the following processing for each interaction behavior record: taking the feature items corresponding to the reserved feature item set in the plurality of feature items of the interaction behavior record as reserved feature items; performing descending order sorting processing on the reserved feature items based on the number of the corresponding feature item set to obtain a feature item sequence of the interaction behavior record; and constructing the feature tree based on the feature item sequence of each interaction behavior record.

[0089] As an example, the feature tree can be a frequent pattern tree. Taking five interaction behavior records as an example, the feature items are represented by letters, for example, the interaction behavior record 1 has feature items A, C, E, B, F, and O, the interaction behavior record 2 has feature items A, C, and G, the interaction behavior record 3 has feature items E and I, the interaction behavior record 4 has feature items A, C, E, F, and G, and the interaction behavior record 5 has feature items A, C, E, G, and L. The same feature items in the plurality of feature items are combined into a feature item set, for example, the feature item A in the interaction behavior record 1, the feature item A in the interaction behavior record 2, the feature item A in the interaction behavior record 4, and the feature item A in the interaction behavior record 5 are combined into a feature item set A, and the number of feature items in the feature item set A is 4. The feature item set B composed of the feature item B, the feature item set O composed of the feature item O, the feature item set I composed of the feature item I, and the feature item set L composed of the feature item L each have one feature item, which is less than the number threshold, so the feature item set O, the feature item set I, and the feature item set L are not reserved. For each of the five interaction behavior records, the following processing is performed. Taking the interaction behavior record 1 as an example, the feature items corresponding to the reserved feature item set in the plurality of feature items of the interaction behavior record are taken as reserved feature items, that is, the reserved feature items A, C, E, and F. The descending order sorting processing is performed on the reserved feature items based on the number of the corresponding feature item set to obtain a feature item sequence of the interaction behavior record, and the feature item sequence is A, C, E, and F. The feature tree is constructed based on the feature item sequence of each interaction behavior record.

[0090] In some embodiments, the constructing the feature tree based on the feature item sequence of each interaction behavior record can be implemented by the following technical solutions: initializing an empty node as a starting node of a tree structure of the feature tree; and adding the feature item sequence of each interaction behavior record to the tree structure including the starting node to obtain the feature tree.

[0091] As an example, when the feature tree is initially constructed, there is no data in the feature tree, and therefore a null node is initialized as the starting node of the tree structure of the feature tree. When the feature tree is constructed, the feature item sequence corresponding to each interactive behavior record is read in for insertion into the feature tree. When the feature item sequence of each interactive behavior record is inserted, the sequence is added in order, for example, for the interactive behavior record 1, the feature items A, C, E and F are added in order to the tree structure including the starting node, to obtain the feature tree.

[0092] In some embodiments, the above-mentioned adding of the feature item sequence of each interactive behavior record to the tree structure including the starting node can be implemented by the following technical solutions: for each feature item of each interactive behavior record, the following processing is performed: when the tree structure only includes the starting node, the feature item sequence is added to the tree structure as a node of the tree structure, and the first count of each node in the tree structure is updated; wherein the first feature item in the feature item sequence is connected to the starting node and is a child node of the starting node, and the feature item sorted later in the feature item sequence is a child node of the feature item sorted earlier.

[0093] As an example, the tree structure only includes the starting node, which means that the tree structure only includes the null node, and when the interactive behavior record 1 is added, the feature item sequence A, C, E and F is added to the tree structure as a node of the tree structure, as shown in FIG. 2. Figure 12A , Figure 12A is a tree structure diagram provided by an embodiment of the present application. Since there is no node in the tree structure before the feature item sequence A, C, E and F is added, A, C, E and F are an independent path, and the first count of each node in the tree structure is updated to 1, wherein the first feature item A in the feature item sequence is connected to the starting node null and is a child node of the starting node, and the feature item sorted later in the feature item sequence is a child node of the feature item sorted earlier, that is, the feature item C is a child node of the feature item A, the feature item E is a child node of the feature item C, and the feature item F is a child node of the feature item E.

[0094] In some embodiments, the above adding the feature item sequence of each interaction record into the tree structure including the starting node can be implemented by the following technical solutions: performing the following processing on the feature item of each interaction record: when there is a tree branch structure in the tree structure having uninterrupted overlapping part with the feature item sequence, and the feature item sequence includes non-overlapping part, taking the non-overlapping part as a node of the tree structure, connecting the non-overlapping part with the tail of the overlapping part in the tree branch structure, and updating the first count of each node in the tree structure according to the feature item sequence; when there is a tree branch structure in the tree structure having uninterrupted overlapping part with the feature item sequence, and the feature item sequence does not include non-overlapping part, updating the first count of each node in the tree structure according to the feature item sequence; wherein the non-overlapping part is the part of the feature item sequence except the overlapping part, and the overlapping part is connected with the starting node; when there is no tree branch structure in the tree structure having uninterrupted overlapping part with the feature item sequence, adding the feature item sequence as a node of the tree structure to the tree structure, and updating the first count of each node in the tree structure; wherein the first feature item in the feature item sequence is connected with the starting node and is a child node of the starting node, and the feature item sorted later in the feature item sequence is a child node of the feature item sorted earlier.

[0095] As an example, refer to Figure 12B , Figure 12B is a tree structure diagram provided by the embodiments of the present application, and the tree structure includes nodes other than the starting node, which illustrates that the interaction records have been added to the tree structure. In the case that the interaction record 1 has been added, the interaction record 2 is continuously added, the tree branch structure corresponding to each feature item sequence that has been added in the tree structure is obtained, for example Figure 12A The tree branch structure composed of the node A, the node C, the node E and the node F in the tree structure, and the feature item sequence of the interaction record 2 is A, C, G. When there is a tree branch structure in the tree structure having uninterrupted overlapping part with the feature item sequence, that is, there are overlapping part nodes A and C, the non-overlapping part is taken as a node of the tree structure, and connected with the tail of the overlapping part in the tree branch structure, wherein the non-overlapping part is the part of the feature item sequence except the overlapping part, that is, the non-overlapping part G is taken as a node of the tree structure, and the first count of each node in the tree structure is updated. Since the feature item sequence is A, C, G and Figure 12A The tree structure in the tree structure has a common ancestor node sequence A, C, so only a new node G needs to be added, and the count of the new node G is recorded as 1. At the same time, the count of the node feature item A and the node feature item C is increased to 2.

[0096] As an example, refer to Figure 12C , Figure 12Cis a tree structure diagram provided by an embodiment of the present application, the tree structure includes nodes other than the starting node, and it is illustrated that the interactive behavior record has been added to the tree structure. In the above example, in the case that the interactive behavior record 1 and the interactive behavior record 2 have been added, the interactive behavior record 3 is continuously added, the tree branch structure corresponding to each feature item sequence that has been added in the tree structure is obtained, for example Figure 12B The tree branch structure composed of the node A, the node C, the node E and the node F, and the tree branch structure composed of the node A, the node C and the node G, the feature item sequence of the interactive behavior record 3 is E, when there is no tree branch structure with an uninterrupted overlapping part with the feature item sequence in the tree structure, the feature item sequence is added to the tree structure as a node of the tree structure, and the first count of each node in the tree structure is updated. Obviously Figure 12B There is no overlapping structure of the feature item E in the two tree branch structures in the above example, therefore the first feature item E in the feature item sequence is connected with the starting node, and is a child node of the starting node, the feature item that is sorted later in the feature item sequence is a child node of the feature item that is sorted earlier, the feature item sequence corresponding to the interactive behavior record 3 only includes one feature item E, therefore only the feature item E is connected with the starting node as a node, and the first count of each node in the tree structure is updated. In the updating process Figure 12B The first count of the node A, the node E, the node C, the node G and the node F in the above example is unchanged, Figure 12C The node E is newly added in the above example, and the first count is updated to 1.

[0097] In step 103, the frequent feature item combination corresponding to each traffic account is obtained based on the feature tree.

[0098] As an example, the frequency of the interactive behavior record associated with the frequent feature item combination exceeds the frequency threshold.

[0099] In some embodiments, referring to Figure 3C , Figure 3C is a flowchart of a data processing method provided by an embodiment of the present application, the frequent feature item combination corresponding to each traffic account is obtained based on the feature tree in step 103, which can be implemented by steps 1031-1035, which are described below.

[0100] In step 1031, the feature item represented by each node and the first count of each node are obtained from the feature tree.

[0101] As an example, referring to Figure 12D , Figure 12D is a tree structure diagram provided by an embodiment of the present application, the feature item represented by each node and the first count are (A; 4), (C; 4), (E; 1), (F; 1), (G; 1), (G; 2), (E; 1), (E; 2) and (F; 1) respectively.

[0102] In step 1032, the first count of the nodes corresponding to the same feature item is summed up, and the nodes corresponding to the feature item are sorted in ascending order based on the summing up result.

[0103] As an example, the summing up result corresponding to the feature item A is 4, the summing up result corresponding to the feature item C is 4, the summing up result corresponding to the feature item E is 4, the summing up result corresponding to the feature item F is 2, the summing up result corresponding to the feature item G is 3, and the ascending order sorting result is (F; 2), (G; 3), (E; 4), (C; 4), (A; 4).

[0104] In step 1033, the following processing is performed for each feature item represented by the node in ascending order: determining the conditional pattern base of the feature item represented by the node, and removing the node from the frequent feature tree, and obtaining at least one frequent feature item combination from the conditional pattern base based on the second count.

[0105] As an example, the conditional pattern base includes a plurality of frequent feature items and the second count of each frequent feature item, and the following processing is performed for the node (F; 1) in the tree structure: Figure 12D determining the conditional pattern base of the feature item represented by the node F, and removing the node (F; 1) from the frequent feature tree, and obtaining at least one frequent feature item combination from the conditional pattern base based on the second count.

[0106] In some embodiments, the conditional pattern base of the feature item represented by the node in step 1033 can be determined by the following technical solution: obtaining a tree structure with the node as the bottom layer node, and taking the feature items represented by the plurality of nodes of the tree structure as frequent feature items; initializing the first count of all nodes of each tree structure except the bottom layer node to zero; for each tree structure, the following processing is performed: updating the first count of the other nodes of the tree structure based on the first count of the bottom layer node; summing up the first count of the nodes corresponding to each frequent feature item to obtain the second count of the frequent feature item, and combining the frequent feature item and the second count of the frequent feature item as the conditional pattern base.

[0107] As an example, since F in the tree structure: Figure 12D is a leaf node in two tree structures, the tree structure corresponding to F is obtained first, see Figure 12E , Figure 12E is a tree structure provided by the embodiments of the present application, a tree structure with the node as the bottom layer node is obtained, and the feature items represented by the plurality of nodes of the tree structure are taken as frequent feature items, Figure 12EThat is, the tree structure with node F as the bottom layer node, the feature item A, the feature item C, the feature item E, the feature item F and the feature item G are taken as the frequent feature items, the first count of all nodes in each tree structure except the bottom layer node is initialized to zero, that is, (A; 0), (C; 0), (E; 0), (G; 0) are obtained, for each tree structure, the following processing is performed, the first count of other nodes of the tree structure is updated based on the first count of the bottom layer node, that is, (A; 1), (C; 1), (E; 1), (F; 1) of the left tree structure and (A; 1), (C; 1), (E; 1), (G; 1), (F; 1) of the right tree structure are obtained, the first count of the node corresponding to each frequent feature item is summed to obtain the second count of the frequent feature item, that is, the second count of the frequent feature item A is 2, the second count of the frequent feature item C is 2, the second count of the frequent feature item E is 2, the second count of the frequent feature item G is 1, and the second count of the frequent feature item F is 2, and the frequent feature items and the second counts of the frequent feature items are combined into a conditional pattern base, and the conditional pattern base is (A; 2), (C; 2), (E; 2), (F; 2), (G; 1).

[0108] In some embodiments, the step 1033 of obtaining at least one frequent feature item combination from the conditional pattern base based on the second count can be implemented by the following technical solution: sorting each frequent feature item based on the second count, and taking a plurality of frequent feature items with high ranking as a plurality of reserved frequent feature items; performing at least one of the following processes: randomly selecting any number of frequent feature items from the plurality of reserved frequent feature items, and combining the selected frequent feature items with the frequent feature items corresponding to the nodes to form a frequent feature item combination.

[0109] As an example, at this time, node G is a frequent feature item with low ranking because the second count in the conditional pattern base is lower than the threshold value, so node G is deleted, and a plurality of nodes (A; 2), (C; 2), (E; 2), (F; 2) with high ranking are reserved, any number of frequent feature items are randomly selected from the plurality of reserved frequent feature items, and the selected frequent feature items are combined with the frequent feature items corresponding to the nodes to form a frequent feature item combination, for example, the frequent feature items A and C are selected, and the frequent feature items A and C are combined with the frequent feature item F corresponding to node F to form a frequent feature item combination. Since the selected frequent feature items are combined with the frequent feature items corresponding to the nodes, the selected frequent feature items need to be selected in addition to the frequent feature items corresponding to the nodes.

[0110] In step 104, the offset indicators of each frequent feature item combination are determined, and the frequent feature item combination corresponding to the offset indicator exceeding the offset indicator threshold value is determined as the offset indicator feature.

[0111] As an example, the deviation indicator characterizes a data distribution situation of the frequent feature item combination deviating from a normal data distribution situation.

[0112] In some embodiments, referring to Figure 3D , Figure 3D is a flowchart of a data processing method provided by the embodiments of the present application, and the abnormality degree of each frequent feature item combination is determined in step 104, which can be implemented by performing steps 1041-1042 for each frequent feature item combination, which are described below respectively.

[0113] In step 1041, the conditional probability of each frequent feature item in the frequent feature item combination and the marginal probability are determined.

[0114] In some embodiments, the conditional probability of each frequent feature item in the frequent feature item combination and the marginal probability determined in step 1041 can be implemented by the following technical solutions: determining a first interaction number corresponding to any traffic account in the interaction data and a second interaction number corresponding to any traffic account of the frequent feature item in the interaction data; determining the conditional probability negatively correlated with the first interaction number and positively correlated with the second interaction number; determining a third interaction number corresponding to the frequent feature item in the interaction data and a fourth interaction number corresponding to all interaction behavior records in the interaction data; and determining the marginal probability positively correlated with the third interaction number and negatively correlated with the fourth interaction number.

[0115] As an example, the conditional probability p(f i |a) of the frequent feature is calculated according to formula (1), and the marginal probability p(f i ) of the frequent feature is calculated according to formula (2):

[0116]

[0117] wherein, p(f i |a) is the conditional probability of the frequent feature fi corresponding to the traffic account a, clk a (f i ) is the number of interaction behavior records including the frequent feature fi in the interaction behavior records of the traffic host a (the second interaction number), clk(a) is the number of interaction behavior records of the traffic host a (the first interaction number), p(f i ) is the marginal probability of the frequent feature fi, clk all (f i ) is the number of interaction behavior records with the frequent feature fi in all interaction behavior records (the third interaction number), and clk(all) is the total number of all interaction behavior records (the fourth interaction number).

[0118] In step 1042, the deviation indicator of the frequent feature item combination is determined according to the conditional probability and the marginal probability.

[0119] In some embodiments, the determining of the offset indicator of the frequent feature item combination according to the conditional probability and the marginal probability in step 1042 can be implemented by the following technical solution: performing the following processing for each frequent feature item: determining the offset indicator of the frequent feature item which is positively correlated with the conditional probability of the frequent feature item and negatively correlated with the marginal probability of the frequent feature item; and performing average processing on the offset indicators of the plurality of frequent feature items to obtain the offset indicator of the frequent feature item combination.

[0120] As an example, when the offset indicator is the anomaly degree, the calculation process of the anomaly degree ε of the frequent feature item combination is as shown in formula (3):

[0121]

[0122] Wherein, ε is the anomaly degree ε of the frequent feature item combination, p(f i |a) is the conditional probability of the frequent feature item f corresponding to the traffic account a, p(f i ) is the marginal probability of the frequent feature item fi.

[0123] In the following, an exemplary application of the embodiments of the present application in an actual application scenario will be described.

[0124] In some embodiments, referring to Figure 4 , Figure 4 is a schematic diagram of a traffic account of the cheating detection method provided by the embodiments of the present application. The social application client can provide a recommended platform of the traffic account, for example, a recommended platform A and a recommended platform B. The traffic account logged in the recommended platform can apply for opening the recommended information click payment function to become a traffic master. Referring to Figures 5A-5C , Figures 5A-5C is a schematic diagram of the recommended information provided by the embodiments of the present application. The recommended information can be a cooking advertisement 501A, a game advertisement 501B and a game advertisement 501C. When the object account clicks the recommended information published by the traffic account in the recommended platform, the payment account bound with the traffic account can obtain the income of the recommended information click payment. The greater the click volume of the recommended information is, the more income the payment account bound with the traffic account obtains. Therefore, the traffic account will generate invalid exposure or invalid click through cheating to improve the income. However, the promotion effect of the recommended information is very poor, which will damage the interests of the recommended information provider and affect the promotion effect of the recommended information.

[0125] In some embodiments, based on the behavior difference between normal object accounts and cheating object accounts, it is determined whether an object is a cheating object account. Since a normal object account only initiates a click behavior on the recommended information that interests the object account, the click on the recommended information by the normal object account often has the following characteristics: (1) the time of the click on the recommended information by the normal object account is relatively dispersed: since the recommended information is randomly presented and the object account only clicks on the recommended information that interests the object account, the time interval of the click on the recommended information by the object account is relatively dispersed and does not show regularity or periodicity; (2) the traffic accounts of the recommended information clicked by the normal object account are relatively dispersed: since the recommended information seen by each object account under each traffic account is randomly presented, the click behavior of the object account does not concentrate on certain traffic accounts; (3) the recommended information clicked by the normal object account is relatively dispersed: the normal object account only clicks on the recommended information that interests the object account, and thus does not click on all exposed recommended information, and the clicked recommended information is relatively dispersed, so that the normal object accounts do not have collaborative or team click behavior. However, the cheating object accounts often have a large amount of click behavior or concentrated click behavior on the recommended information of certain traffic accounts, so that the cheating object accounts have the same characteristics, for example, the traffic accounts of the recommended information clicked by two cheating object accounts are the same, the time periods of the click by the two cheating object accounts are consistent, the network addresses of the click by the two cheating object accounts are the same, and the time of staying on the page of the recommended information after the click is extremely short, that is, the cheating object accounts have frequent co-occurrence characteristics.

[0126] In some embodiments, referring to Figure 6 When the recommended information is displayed to the object account or the object account clicks on the recommended information, the client on which the recommended platform depends reports the behavior data of the click on the recommended information to the access layer server. The behavior data includes but is not limited to the current time, the object account, the click scene, the network address of the object account, and the traffic account. The access layer server first stores the exposure and click log of the object account in the interactive behavior record database, and then requests the real-time calculation server to determine whether the click behavior of the recommended information of the object account is a cheating click on the recommended information. The calculation server extracts the click records of a plurality of object accounts including the object account within a period of time from the interactive behavior record database, determines whether the object account belongs to a cheating object account by calculating whether the frequent co-occurrence characteristics exist between the object account and other object accounts under the traffic account, and returns the result.

[0127] In some embodiments, the frequent co-occurrence characteristics appearing on each traffic account are extracted, and it is determined whether the behavior data of the current object account is associated with the frequent co-occurrence characteristics to determine whether the current object account is a cheating object account.

[0128] In some embodiments, first, the recommended information click records of the objects in a period of time (7 days or 30 days in the past) are extracted from the interactive behavior record database to generate a click relationship graph of the object-traffic account, see Figure 7 The click records of the object account for the recommended information include: (object u1, traffic account a1), (object u1, traffic account a2), (object u2, traffic account a1), (object u2, traffic account a2), (object u3, traffic account a1), and (object u3, traffic account a2).

[0129] In some embodiments, then, the features of each click record (interactive behavior record) are expanded, see Figure 8 The features obtained after expansion include object features and click behavior features, the object features include: the model of the object account initiating the click behavior, the operating system of the object account initiating the click behavior, and the version of the social client of the object account initiating the click behavior, and the click behavior features include: the click coordinates of the object account initiating the click behavior and the click scene of the object account initiating the click behavior.

[0130] In some embodiments, then, the traffic account, object features, and click behavior features are used to construct feature items, see Figure 9 The format of the feature item is “traffic account | feature attribute value”, for example, “a1 | model 1”, and a plurality of feature items are combined into a feature item set generated for each traffic account, for example, “a1 | model 1”, “a1 | operating system 1”, “a1 | version of social client”, “a1 | click coordinates 1”, and “a1 | click scene 1”.

[0131] In some embodiments, based on the feature item set, a frequent pattern tree is generated, see Figure 10 , Figure 10 is a schematic diagram of the frequent pattern tree provided by the embodiments of the present application, the starting node of the frequent pattern tree is the null node, the feature items are “a1 | model 1”, “a1 | operating system 1”, “a2 | operating system 2”, and “a2 | version of social client”, and the first count of the feature items “a1 | model 1”, “a1 | operating system 1”, “a2 | operating system 2”, and “a2 | version of social client” is 2.

[0132] In some embodiments, the frequent feature tree is subjected to frequent feature mining processing to obtain frequent features f1, f2, f3, and (f1, f2, f3) represents a frequent feature combination of the object account appearing for the traffic account a. The abnormality degree ε of the frequent feature combination is calculated, and it is determined whether ε is greater than a specified threshold value (usually 0.5). If yes, the object account under the traffic account a that is associated with the frequent feature combination is determined as a cheating object account for attack. The specific calculation process is as follows: the conditional probability of each frequent feature appearing on the traffic account a and the marginal probability of the frequent feature are calculated respectively. The conditional probability p(f i |a) of the frequent feature is calculated according to formula (4), the marginal probability p(f i ) of the frequent feature is calculated according to formula (5), and the calculation process of the abnormality degree ε of the frequent feature combination is shown in formula (6):

[0133]

[0134] wherein, p(f i |a) is the conditional probability of the frequent feature fi for the traffic account a, clk a (f i ) is the number of interaction behavior records including the frequent feature fi in the interaction behavior records of the traffic master a (second interaction times), clk(a) is the number of interaction behavior records of the traffic master a (first interaction times), p(f i ) is the marginal probability of the frequent feature fi, clk all (f i ) is the number of interaction behavior records with the frequent feature fi in all interaction behavior records (third interaction times), and clk(all) is the total number of all interaction behavior records (fourth interaction times).

[0135]

[0136] wherein, ε is the abnormality degree ε of the frequent feature item combination, p(f i |a) is the conditional probability of the frequent feature item fi for the traffic account a, and p(f i ) is the marginal probability of the frequent feature item fi.

[0137] In some embodiments, refer to Figure 11 , Figure 11is a flowchart of the cheating detection method provided by the embodiment of the application. In step 801, click records of an object in a period of time are extracted, and a click relationship graph of the object-traffic account is generated. In step 802, the features of the click records are expanded, including: the model of the object account initiating the click behavior, the operating system of the object account initiating the click behavior, the version of the social client of the object account initiating the click behavior, the click coordinates of the object account initiating the click behavior, and the click scene of the object account initiating the click behavior. In step 803, the traffic account and the above features are used to construct feature items, and a feature item set corresponding to each click record is generated for each traffic account. In step 804, a frequent feature tree is generated for the feature item set using a frequent pattern generation algorithm. In step 805, frequent feature combinations are obtained from the frequent feature tree. In step 806, the frequent feature abnormality degree is calculated for the frequent feature combinations, and it is judged whether the frequent feature abnormality degree is greater than a specified threshold. If the frequent feature abnormality degree is greater than the specified threshold, the object accounts associated with the frequent features under the traffic account corresponding to the frequent feature combination are attacked.

[0138] The embodiment of the application comprehensively uses multi-dimensional features to determine whether the object account is a cheating object account, improves the accuracy and coverage of the recommended information click cheating detection, and automatically mines the cheating object account through the multi-feature co-occurrence mode. The process belongs to unsupervised anomaly detection, and the cheating behavior can be detected without malicious samples. Compared with the code of the cheating object account, the client data of the cheating object account does not need to be obtained, and the manual cost is lower.

[0139] The following continues to illustrate an exemplary structure of the data processing apparatus 255 provided by the embodiment of the application, which is implemented as a software module. In some embodiments, as shown in Figure 2 The software module in the data processing apparatus 255 stored in the memory 250 can include: an acquisition module 2551 configured to acquire interaction data, wherein the interaction data includes interaction behavior records of a plurality of object identifiers for a plurality of traffic identifiers; a construction module 2552 configured to construct a feature tree based on feature items in the interaction data; a frequent feature module 2553 configured to obtain frequent feature item combinations corresponding to each traffic identifier based on the feature tree, wherein the frequency of the interaction behavior records associated with the frequent feature item combinations exceeds a frequency threshold; and an offset index module 2554 configured to determine an offset index of each frequent feature item combination, and determine the frequent feature item combination corresponding to the offset index exceeding an offset index threshold as an offset index feature.

[0140] In some embodiments, each of the interaction behavior records corresponds to an object identifier and a traffic identifier, and the construction module 2552 is further configured to: for each of the interaction behavior records, perform the following processing: performing feature expansion processing on the interaction behavior record to obtain multiple types of feature data of the interaction behavior record; performing binding processing on the traffic identifier of the interaction behavior record and each type of feature data respectively, and taking the binding processing result corresponding to each type of feature data as a feature item of the interaction behavior record; and constructing the feature tree based on the multiple feature items of each of the interaction behavior records.

[0141] In some embodiments, the construction module 2552 is further configured to: combine the same feature items in the multiple feature items into feature item sets; obtain the number of feature items in each feature item set, and take the feature item set whose number is not less than the number threshold as a reserved feature item set; for each of the interaction behavior records, perform the following processing: take the feature items corresponding to the reserved feature item set in the multiple feature items of the interaction behavior record as reserved feature items; perform descending order sorting processing on the reserved feature items based on the number of the corresponding feature item set to obtain a feature item sequence of the interaction behavior record; and construct the feature tree based on the feature item sequence of each of the interaction behavior records.

[0142] In some embodiments, the construction module 2552 is further configured to: initialize an empty node as a starting node of a tree structure of the feature tree; and add the feature item sequence of each of the interaction behavior records to the tree structure including the starting node to obtain the feature tree.

[0143] In some embodiments, the construction module 2552 is further configured to: for each of the feature items of each of the interaction behavior records, perform the following processing: when the tree structure only includes the starting node, add the feature item sequence to the tree structure as a node of the tree structure, and update the first count of each node in the tree structure; wherein the first feature item in the feature item sequence is connected to the starting node and is a child node of the starting node, and the feature item sorted later in the feature item sequence is a child node of the feature item sorted earlier.

[0144] In some embodiments, the constructing module 2552 is further configured to: for each feature item recorded in the interaction behavior, perform the following processing: when there is a node in the tree structure other than the starting node, obtain a branch structure in the tree structure corresponding to each feature item sequence that has been added; when there is a branch structure in the tree structure that has an uninterrupted overlapping part with the feature item sequence, and the feature item sequence includes a non-overlapping part, take the non-overlapping part as a node of the tree structure, connect it to the tail of the overlapping part in the branch structure, and update the first count of each node in the tree structure according to the feature item sequence; when there is a branch structure in the tree structure that has an uninterrupted overlapping part with the feature item sequence, and the feature item sequence does not include a non-overlapping part, update the first count of each node in the tree structure according to the feature item sequence; wherein the non-overlapping part is the part of the feature item sequence other than the overlapping part, and the overlapping part is connected to the starting node; when there is no branch structure in the tree structure that has an uninterrupted overlapping part with the feature item sequence, add the feature item sequence to the tree structure as a node of the tree structure, and update the first count of each node in the tree structure; wherein the first feature item in the feature item sequence is connected to the starting node and is a child node of the starting node, and the feature item sorted later in the feature item sequence is a child node of the feature item sorted immediately before.

[0145] In some embodiments, the frequent feature module 2553 is further configured to: obtain, from the feature tree, the feature item represented by each node and the first count of each node; sum the first counts of the nodes of the same feature item, and sort the nodes corresponding to the feature item in ascending order based on the summing result; and for each feature item represented by each node in turn, perform the following processing: determine the conditional pattern base of the feature item represented by the node, and remove the node from the frequent feature tree; wherein the conditional pattern base includes a plurality of frequent feature items and the second count of each frequent feature item; and obtain at least one frequent feature item combination from the conditional pattern base based on the second count.

[0146] In some embodiments, the frequent feature module 2553 is further configured to: obtain the branch structure with the node as the bottommost node, and take the feature items represented by the nodes of the branch structure as the frequent feature items; initialize the first count of all nodes of each branch structure except the bottommost node to zero; and for each branch structure, perform the following processing: update the first count of the other nodes of the branch structure based on the first count of the bottommost node; sum the first count of the node corresponding to each frequent feature item to obtain the second count of the frequent feature item, and combine the frequent feature item and the second count of the frequent feature item as the conditional pattern base.

[0147] In some embodiments, the frequent feature module 2553 is further configured to: sort each frequent feature item based on the second count, and determine a plurality of reserved frequent feature items from the frequent feature items with the top ranks; and perform at least one of the following: randomly select any number of frequent feature items from the reserved frequent feature items, and combine the selected frequent feature items with the frequent feature items corresponding to the node to form a frequent feature item combination.

[0148] In some embodiments, the offset indicator module 2554 is further configured to: for each frequent feature item combination, determine a conditional probability of each frequent feature item in the frequent feature item combination and a marginal probability; and determine the offset indicator of the frequent feature item combination according to the conditional probability and the marginal probability.

[0149] In some embodiments, the offset indicator module 2554 is further configured to: determine a first interaction number corresponding to any traffic identifier in the interaction data, and a second interaction number corresponding to any traffic identifier of the frequent feature item in the interaction data; determine a conditional probability negatively correlated with the first interaction number and positively correlated with the second interaction number; determine a fourth interaction number corresponding to all interaction behavior records in the data; and determine a marginal probability positively correlated with the third interaction number and negatively correlated with the fourth interaction number.

[0150] In some embodiments, the offset indicator module 2554 is further configured to: for each frequent feature item, determine an offset indicator of the frequent feature item positively correlated with a conditional probability of the frequent feature item and negatively correlated with a marginal probability of the frequent feature item; and average the offset indicators of the plurality of frequent feature items to obtain the offset indicator of the frequent feature item combination.

[0151] In some embodiments, the obtaining module 2551 is further configured to: receive an interaction request for any traffic identifier, and update the interaction behavior record database based on a new interaction behavior record carried by the interaction request; and read interaction behavior records in a preset time period from the updated interaction behavior record database as the interaction data, wherein the preset time period is a time period from the current time back by a preset time length; and after determining the frequent feature item combination corresponding to the offset indicator as the offset indicator feature, the offset indicator module 2554 is further configured to: when the interaction behavior matches the offset indicator feature, perform any one of the following: shield the response to the interaction request; and determine an object identifier performing the interaction behavior as a cheating identifier, and shield the response to the interaction request and subsequent interaction requests from the cheating identifier.

[0152] The embodiment of the present application provides a computer program product or computer program, the computer program product or computer program comprises computer instructions stored in a computer readable storage medium. The processor of the computer equipment reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer equipment executes the data processing method provided by the embodiment of the present application.

[0153] The embodiment of the present application provides a computer readable storage medium storing executable instructions, wherein the executable instructions are stored, when the executable instructions are executed by a processor, the processor executes the data processing method provided by the embodiment of the present application, for example, as Figures 3A-3D The data processing method shown.

[0154] In some embodiments, the computer readable storage medium can be FRAM, ROM, PROM, EPROM, EEPROM, flash memory, magnetic surface memory, optical disc, or CD-ROM and the like memory; it can also be various devices including one or any combination of the above memories.

[0155] In some embodiments, the executable instructions can be in the form of programs, software, software modules, scripts or codes, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and can be deployed in any form, including being deployed as independent programs or being deployed as modules, components, subroutines or other units suitable for use in a computing environment.

[0156] As an example, the executable instructions can correspond to files in a file system, but are not necessarily, can be stored in part of a file storing other programs or data, for example, stored in one or more scripts in a hyper text markup language (HTML, Hyper Text Markup Language) document, stored in a single file dedicated to the program in question, or stored in multiple cooperative files (for example, files storing one or more modules, subroutines or code portions).

[0157] As an example, the executable instructions can be deployed to execute on one computing device, or on multiple computing devices located in one place, or on multiple computing devices distributed in multiple places and interconnected through a communication network.

[0158] To sum up, by the embodiments of the present application, the data processing mode based on the feature tree obtains the frequent feature item combination corresponding to each traffic account from the interaction data between the traffic account and the object account, and determines the frequent feature item combination with the abnormality degree exceeding the abnormality degree threshold as the cheating feature. Since the frequent feature combination belongs to the combination of the features with high frequency and appearing in the click behavior, and the high-frequency feature combination matches the data distribution of the cheating scene, taking the frequent feature combination as the cheating feature can effectively improve the subsequent cheating scene recognition accuracy, thereby improving the recommendation efficiency and recommendation accuracy of the recommendation system.

[0159] The above merely describes the embodiments of the present application, and is not used to limit the protection scope of the present application. Any modification, equivalent replacement and improvement within the spirit and scope of the present application shall be included in the protection scope of the present application.

Claims

1. A data processing method, characterized by, The method comprises: acquiring interaction data, wherein the interaction data comprises a plurality of object-identified interaction behavior records for a plurality of traffic identifications; constructing a feature tree based on feature items in the interaction data; acquiring frequent feature item combinations corresponding to each of the traffic identifications based on the feature tree, wherein the frequency of interaction behavior records associated with the frequent feature item combinations exceeds a frequency threshold; for each of the frequent feature item combinations, performing the following processing: determining a conditional probability that is negatively correlated with a first interaction number corresponding to any traffic identification in the interaction data and positively correlated with a second interaction number corresponding to the frequent feature item and the any traffic identification in the interaction data; determining a marginal probability that is positively correlated with a third interaction number corresponding to the frequent feature item in the interaction data and negatively correlated with a fourth interaction number corresponding to all interaction behavior records in the interaction data; for each of the frequent feature items, performing the following processing: determining a shift indicator of the frequent feature item that is positively correlated with a conditional probability of the frequent feature item and negatively correlated with a marginal probability of the frequent feature item; and averaging the shift indicators of the plurality of frequent feature items to obtain a shift indicator of the frequent feature item combination; determining, as a shift indicator feature, the frequent feature item combination corresponding to the shift indicator that exceeds a shift indicator threshold.

2. The method of claim 1, wherein, Each of the interaction behavior records corresponds to an object identification and a traffic identification. The constructing of the feature tree based on the feature items in the interaction data comprises: for each of the interaction behavior records, performing the following processing: performing feature expansion processing on the interaction behavior record to obtain a plurality of types of feature data of the interaction behavior record; binding the traffic identification of the interaction behavior record with each type of feature data, respectively, and taking the binding processing result corresponding to each type of feature data as a feature item of the interaction behavior record; constructing the feature tree based on the plurality of feature items of each of the interaction behavior records.

3. The method of claim 2, wherein, The constructing of the feature tree based on the plurality of feature items of each of the interaction behavior records comprises: combining the same feature items in the plurality of feature items into feature item sets; acquiring the number of feature items in each of the feature item sets, and taking the feature item set whose number is not less than a number threshold as a reserved feature item set; for each of the interaction behavior records, performing the following processing: taking the feature items of the interaction behavior record corresponding to the reserved feature item set as reserved feature items; performing descending order sorting processing on the reserved feature items based on the number corresponding to the feature item set to obtain a feature item sequence of the interaction behavior record; constructing the feature tree based on the feature item sequence of each of the interaction behavior records.

4. The method of claim 3, wherein, The constructing of the feature tree based on the feature item sequence of each of the interaction behavior records comprises: initializing an empty node as a starting node of a tree structure of the feature tree; adding the feature item sequence of each of the interaction behavior records to the tree structure including the starting node to obtain the feature tree.

5. The method of claim 4, wherein, The adding of the sequence of the feature items of each of the interaction behavior records into the tree structure including the starting node comprises: The following processing is performed for each of the feature items of the interaction behavior records: When only the starting node is included in the tree structure, the sequence of the feature items is added into the tree structure as a node of the tree structure, and the first count of each of the nodes in the tree structure is updated; The first feature item in the sequence of the feature items is connected with the starting node and is a child node of the starting node, and the feature items arranged in the rear are child nodes of the feature items arranged in the front.

6. The method of claim 4, wherein, The adding of the sequence of the feature items of each of the interaction behavior records into the tree structure including the starting node comprises: The following processing is performed for each of the feature items of the interaction behavior records: When the nodes other than the starting node are included in the tree structure, the branch structure corresponding to each of the sequences of the feature items which have been added in the tree structure is acquired; When the branch structure having the uninterrupted overlapping part with the sequence of the feature items exists in the tree structure, and the sequence of the feature items includes the non-overlapping part, the non-overlapping part is added into the tree structure as a node of the tree structure, is connected with the tail of the overlapping part in the branch structure, and the first count of each of the nodes in the tree structure is updated according to the sequence of the feature items; When the branch structure having the uninterrupted overlapping part with the sequence of the feature items exists in the tree structure, and the sequence of the feature items does not include the non-overlapping part, the first count of each of the nodes in the tree structure is updated according to the sequence of the feature items; The non-overlapping part is the part of the sequence of the feature items except the overlapping part, and the overlapping part is connected with the starting node; When the branch structure having the uninterrupted overlapping part with the sequence of the feature items does not exist in the tree structure, the sequence of the feature items is added into the tree structure as a node of the tree structure, and the first count of each of the nodes in the tree structure is updated; The first feature item in the sequence of the feature items is connected with the starting node and is a child node of the starting node, and the feature items arranged in the rear are child nodes of the feature items arranged in the front.

7. The method of claim 1, wherein, The acquiring of the frequent feature item combination corresponding to each of the flow identifiers based on the feature tree comprises: The feature item represented by each node and the first count of each of the nodes are acquired from the feature tree; The first counts of the nodes of the same feature item are summed, and the nodes corresponding to the feature item are sorted in ascending order based on the summing result; The following processing is performed for each of the feature items represented by the nodes in the ascending order: The conditional pattern base of the feature item represented by the node is determined, and the node is removed from the frequent feature tree; The conditional pattern base includes a plurality of frequent feature items and the second count of each of the frequent feature items; At least one of the frequent feature item combinations is acquired from the conditional pattern base based on the second count.

8. The method of claim 7, wherein, The determining the conditional pattern base of the feature item represented by the node includes: Obtaining a tree structure with the node as the bottom layer node, and taking the feature items represented by the nodes of the tree structure as the frequent feature items; Initializing the first count of all nodes in each of the tree structures except the bottom layer node to zero; For each of the tree structures, performing the following processing: updating the first count of the other nodes of the tree structure based on the first count of the bottom layer node; Summing the first count of the node corresponding to each of the frequent feature items to obtain the second count of the frequent feature item, and combining the frequent feature item and the second count of the frequent feature item as the conditional pattern base.

9. The method of claim 7, wherein, The obtaining at least one frequent feature item combination from the conditional pattern base based on the second count includes: Sorting each of the frequent feature items based on the second count, and taking the multiple frequent feature items with high ranking as the reserved frequent feature items; Performing at least one of the following processing: Randomly selecting any number of frequent feature items from the multiple reserved frequent feature items, and combining the selected frequent feature items with the frequent feature items corresponding to the node as the frequent feature item combination.

10. A data processing apparatus, characterized by, It includes: An acquisition module is configured to acquire interaction data, wherein the interaction data includes interaction behavior records of multiple object identifiers for multiple traffic identifiers; A construction module is configured to construct a feature tree based on feature items in the interaction data; A frequent feature module is configured to obtain, based on the feature tree, frequent feature item combinations corresponding to each of the traffic identifiers, wherein a frequency of interaction behavior records associated with the frequent feature item combination exceeds a frequency threshold; An offset indicator module is configured to, for each of the frequent feature item combinations, perform the following processing: determine a conditional probability negatively related to a first interaction number corresponding to any traffic identifier in the interaction data and positively related to a second interaction number corresponding to the any traffic identifier in the interaction data and corresponding to the frequent feature item; and determine a marginal probability positively related to a third interaction number corresponding to the frequent feature item in the interaction data and negatively related to a fourth interaction number corresponding to all interaction behavior records in the interaction data; For each of the frequent feature items, the following processing is performed: determining an offset indicator of the frequent feature item positively related to the conditional probability of the frequent feature item and negatively related to the marginal probability of the frequent feature item; performing average processing on the offset indicators of the multiple frequent feature items to obtain an offset indicator of the frequent feature item combination; and determining the frequent feature item combination corresponding to the offset indicator exceeding an offset indicator threshold as an offset indicator feature.

11. The apparatus of claim 10, wherein, The construction module is further configured to: The following processing is performed for each of the interaction behavior records: feature augmentation processing is performed on the interaction behavior records to obtain multiple types of feature data of the interaction behavior records; flow identification of the interaction behavior records is bound to each type of feature data respectively, and the binding processing result corresponding to each type of feature data is taken as a feature item of the interaction behavior records; and the feature tree is constructed based on the multiple feature items of each of the interaction behavior records.

12. The apparatus of claim 11, wherein, The construction module is further configured to: combine the same feature items in the multiple feature items into a feature item set, obtain the number of feature items in each of the feature item sets, and take the feature item set with a number not less than a number threshold as a reserved feature item set; for each of the interaction behavior records, the following processing is performed: the feature items corresponding to the reserved feature item set in the multiple feature items of the interaction behavior record are taken as reserved feature items; perform descending order sorting processing on the reserved feature items based on the number corresponding to the feature item set to obtain a feature item sequence of the interaction behavior record; construct the feature tree based on the feature item sequence of each of the interaction behavior records.

13. The apparatus of claim 12, wherein, The construction module is further configured to: initialize an empty node as a starting node of a tree structure of the feature tree; and add the feature item sequence of each of the interaction behavior records to the tree structure including the starting node to obtain the feature tree.

14. The apparatus of claim 13, wherein, The construction module is further configured to: for each of the feature items of the interaction behavior records, the following processing is performed: when the tree structure only includes the starting node, the feature item sequence is added to the tree structure as a node of the tree structure, and the first count of each of the nodes in the tree structure is updated; wherein the first feature item in the feature item sequence is connected with the starting node and is a child node of the starting node, and the feature item sorted later in the feature item sequence is a child node of the feature item sorted earlier.

15. The apparatus of claim 13, wherein, The construction module is further configured to: The following processing is performed on each feature item recorded in the interaction behavior: when a node other than the starting node is included in the tree structure, a branch structure corresponding to each feature item sequence that has been added in the tree structure is obtained; when there is a branch structure in the tree structure that has uninterrupted overlapping parts with the feature item sequence, and the feature item sequence includes non-overlapping parts, the non-overlapping parts are connected to the tail of the overlapping parts in the branch structure as nodes of the tree structure, and the first count of each node in the tree structure is updated according to the feature item sequence; when there is a branch structure in the tree structure that has uninterrupted overlapping parts with the feature item sequence, and the feature item sequence does not include non-overlapping parts, the first count of each node in the tree structure is updated according to the feature item sequence; wherein the non-overlapping parts are parts of the feature item sequence other than the overlapping parts, and the overlapping parts are connected to the starting node; when there is no branch structure in the tree structure that has uninterrupted overlapping parts with the feature item sequence, the feature item sequence is added to the tree structure as a node of the tree structure, and the first count of each node in the tree structure is updated; wherein the first feature item in the feature item sequence is connected to the starting node and is a child node of the starting node, and the feature item that is sorted later in the feature item sequence is a child node of the feature item that is sorted earlier.

16. The apparatus of claim 10, wherein, The frequent feature module is further configured to: obtain the feature item represented by each node and the first count of each node from the feature tree; sum the first counts of the nodes representing the same feature item, and sort the nodes corresponding to the feature item in ascending order based on the summing result; and sequentially perform the following processing on the feature item represented by each node according to the ascending order sorting result: determine the conditional pattern base of the feature item represented by the node, and remove the node from the frequent feature tree; wherein the conditional pattern base includes a plurality of frequent feature items and the second count of each frequent feature item; and obtain at least one combination of frequent feature items from the conditional pattern base based on the second count.

17. The apparatus of claim 16, wherein, The frequent feature module is further configured to: obtain the tree branch structure with the node as the bottommost node, and take the feature items represented by the nodes of the tree branch structure as the frequent feature items; initialize the first count of all nodes of each tree branch structure except the bottommost node to zero; and perform the following processing on each tree branch structure: update the first count of the other nodes of the tree branch structure based on the first count of the bottommost node; sum the first count of the node corresponding to each frequent feature item to obtain the second count of the frequent feature item, and combine the frequent feature item and the second count of the frequent feature item as the conditional pattern base.

18. An electronic device, comprising: comprise: a memory configured to store executable instructions; A processor configured to implement the data processing method of any one of claims 1 to 9 when executing executable instructions stored in the memory.

19. A computer-readable storage medium, characterized in that, A memory storing executable instructions for implementing the data processing method of any one of claims 1 to 9 when executed by a processor.

20. A computer program product comprising computer instructions, characterized in that, The computer instructions, when executed by a processor, implement the data processing method of any one of claims 1 to 9.

Images