A method, apparatus, medium, and computer device for identifying abnormal users

Abstract

This invention provides a method for identifying abnormal users, comprising: encoding various behavioral events of a target user on a live streaming platform to obtain a behavioral encoding sequence; converting the behavioral encoding sequence into an initial sequence vector matrix; determining a risk sequence vector matrix of the initial sequence vector matrix; determining a target sequence representation matrix based on the position offset vector matrix and time offset vector matrix of the initial sequence vector matrix and the risk sequence vector matrix; and performing anomaly identification on the target user based on the target sequence representation matrix, a preset normal label sequence representation matrix, and a suspected label sequence representation matrix. Thus, by first encoding and vectorizing the behavioral events to form the initial sequence vector matrix, and then adding risk labels to the risk sequence vector matrix, the method simultaneously considers the normal label sequence representation matrix, the suspected label sequence representation matrix, and the behavioral event occurrence patterns of abnormal users during anomaly identification, thereby further improving identification accuracy.

Description

Technical Field

[0001] This invention belongs to the field of risk control technology for live streaming platforms, and particularly relates to a method, device, medium, and computer equipment for identifying abnormal users. Background Technology

[0002] Live streaming platforms are frequently attacked by cybercriminals (black market supply chains). These cybercriminals often use automated scripts to operate on multiple devices, resulting in many anomalies in the user path. For example, after logging in, users may all enter the same live streaming room and follow the same streamer.

[0003] Typically, identifying anomalous users involves using Markov processes to calculate the transition probabilities of each behavior along a user's path. A very low transition probability indicates that the user is suspicious. However, this method only considers anomalous patterns of temporally adjacent behaviors and cannot evaluate the anomalousness of the entire user path, thus reducing the accuracy of anomalous user identification. Summary of the Invention

[0004] To address the problems existing in the prior art, embodiments of the present invention provide a method, apparatus, medium, and computer equipment for identifying abnormal users, thereby solving the technical problem that the identification accuracy cannot be guaranteed when identifying abnormal users on live streaming platforms in the prior art.

[0005] A first aspect of the present invention provides a method for identifying abnormal users, the method comprising:

[0006] Obtain the target user's various behavioral events on the live streaming platform, encode each behavioral event, and obtain a behavioral encoding sequence;

[0007] Convert the behavior encoding sequence into an initial sequence vector matrix;

[0008] Determine the risk sequence vector matrix of the initial sequence vector matrix;

[0009] Determine the position offset vector matrix and time offset vector matrix of the risk sequence vector matrix;

[0010] A target sequence representation matrix is ​​determined based on the initial sequence vector matrix, the position offset vector matrix, and the time offset vector matrix; the target sequence representation matrix carries the risk label of the target user and the correlation between each behavioral event;

[0011] The target user is identified as abnormal based on the target sequence representation matrix, the preset normal label sequence representation matrix, and the suspected label sequence representation matrix.

[0012] Optionally, converting the behavior-encoded sequence into an initial sequence vector matrix includes:

[0013] According to the first optimal solution function and the second optimal solution function v c =s c Q determines the matrix representing all events;

[0014] Based on the event ID of each behavior event in the target user behavior encoding sequence, the corresponding event representation vector is extracted from the full event representation matrix to obtain the initial sequence vector matrix;

[0015] Wherein, F is the optimal value of the first optimal solution function, and D... p The set of behavioral events in the target user behavior encoding sequence; where a and c are any two different behavioral events in the set of behavioral events; where D n The set of events in the encoded sequence of all user actions; the v a v is the event representation vector corresponding to behavior event a. c v is the event representation vector corresponding to behavior event c; c T For v c The transpose vector; the s c Let F be the original event vector, Q be the full event representation matrix, and Q be the full event representation matrix when F is minimized; e is an exponential function.

[0016] Optionally, determining the risk sequence vector matrix of the initial sequence vector matrix includes:

[0017] Based on the third optimal solution function P=∑(avg(qW) Q )-y) 2 Determine the risk sequence vector matrix W Q The risk vector matrix is ​​the vector matrix corresponding to the minimum P value; where,

[0018] P is the optimal value of the third optimal boundary function, q is the initial sequence vector matrix, and y is the risk label of the initial sequence vector matrix.

[0019] Optionally, determining the position offset vector matrix of the risk sequence vector matrix includes:

[0020] According to the formula PE p,2i =sin(p1 / 10000) 2i / d Determine the first position offset corresponding to the event representation vector with an even position number in the risk sequence vector matrix;

[0021] According to the formula PE p,2i+1 =cos(p1 / 10000)2i / d Determine the second position offset corresponding to the event representation vector with an odd position number in the risk sequence vector matrix;

[0022] According to formula V Q =W Q +PE determines the position offset vector matrix V of the risk sequence vector matrix. Q Wherein, p1 is the position number of the event representation vector in the risk sequence vector matrix, and W... Q The risk sequence vector matrix is ​​defined as follows, where d is the sequence representation dimension of the behavior encoding sequence; the PE p,2i PE is the offset of the first position. p,2i+1 The offset of the second position is i = p1 / 2 when p1 is even and i = (p1-1) / 2 when p1 is odd.

[0023] Optionally, determining the time offset vector matrix of the risk sequence vector matrix includes:

[0024] According to the formula Determine the time offset TE of each event representation vector;

[0025] According to formula K Q =W Q +TE determines the time offset vector matrix K of the risk sequence vector matrix. Q Wherein, h is the interval between the occurrence time of the behavior event corresponding to the current event representation vector and the occurrence time of the behavior event corresponding to the next event representation vector; W Q Let be the risk sequence vector matrix.

[0026] Optionally, determining the target sequence representation matrix based on the initial sequence vector matrix, the position offset vector matrix, and the time offset vector matrix includes:

[0027] Based on formula Determine the target sequence representation matrix A; where S is the sigmoid function, q is the initial sequence vector matrix, and W... Q Let V be the risk sequence vector matrix. Q The position offset vector matrix of the risk sequence vector matrix, K Q d is the time offset vector matrix of the risk sequence vector matrix, and d is the sequence representation dimension of the behavior encoding sequence.

[0028] Optionally, the step of identifying anomalies in the target user based on the target sequence representation matrix, a preset normal label sequence representation matrix, and a suspected label sequence representation matrix includes:

[0029] According to the formula Determine the risk score (A) of the target user;

[0030] If the risk score is determined to exceed the risk threshold, the target user is determined to be an abnormal user; wherein, A is the target sequence representation matrix, W is the set of normal label sequence representation matrices, B is the set of suspicious label sequence representation matrices, s1 is any sequence in the set of suspicious label sequence representation matrices, and s2 is any sequence in the set of normal label sequence representation matrices.

[0031] A second aspect of the present invention also provides an apparatus for identifying abnormal users, the apparatus comprising:

[0032] An encoding unit is used to obtain various behavioral events of the target user on the live streaming platform, encode each behavioral event, and obtain a behavioral encoding sequence.

[0033] A conversion unit is used to convert the behavior-encoded sequence into an initial sequence vector matrix;

[0034] A determining unit is configured to: determine the risk sequence vector matrix of the initial sequence vector matrix; determine the position offset vector matrix and time offset vector matrix of the risk sequence vector matrix; and determine the target sequence representation matrix based on the initial sequence vector matrix, the position offset matrix, and the time offset matrix; the target sequence representation matrix carries the risk label of the target user and the correlation between each of the behavioral events;

[0035] The identification unit is used to identify the target user as abnormal based on the target sequence representation matrix, the preset normal label sequence representation matrix, and the suspect label sequence representation matrix.

[0036] A third aspect of the invention also provides a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements any of the methods described in the first aspect.

[0037] A fourth aspect of the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any one of the first aspects.

[0038] This invention provides a method for identifying abnormal users. The method involves obtaining various behavioral events of a target user on a live streaming platform, encoding these events to obtain a behavioral encoding sequence, converting the behavioral encoding sequence into an initial sequence vector matrix, determining a risk sequence vector matrix within the initial sequence vector matrix, determining the position offset vector matrix and time offset vector matrix of the risk sequence vector matrix, determining a target sequence representation matrix based on the initial sequence vector matrix, the position offset vector matrix, and the time offset vector matrix, and carrying risk tags for the target user and the correlation between each behavioral event in the target sequence representation matrix. The method then identifies the target user as an anomaly based on the target sequence representation matrix, a preset normal tag sequence representation matrix, and a suspicious tag sequence representation matrix. Thus, by first encoding the behavioral events and then matching each behavioral event with the correlation between them... The relationships are vectorized to form an initial sequence vector matrix. Converting this initial sequence vector into a risk sequence vector matrix is ​​equivalent to adding risk labels to the risk sequence vector matrix, laying the foundation for subsequent anomaly identification. Furthermore, since abnormal user actions tend to follow certain patterns (e.g., regular behavior events, short operation times, or early occurrences), the target sequence representation matrix is ​​finally determined based on the positional and temporal offset vector matrices of the risk sequence vector matrix. Anomaly identification is then performed based on this target sequence representation matrix, improving accuracy. Since both normal and suspicious label sequence representation matrices are considered in anomaly identification, the similarity between the target user and normal users, as well as the similarity between the target user and abnormal users, is taken into account simultaneously, further enhancing identification accuracy. Attached Figure Description

[0039] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0040] Figure 1 This is a schematic flowchart of a method for identifying abnormal users provided in an embodiment of the present invention;

[0041] Figure 2 This is a schematic diagram of the device structure for identifying abnormal users provided in an embodiment of the present invention;

[0042] Figure 3 This is a schematic diagram of a computer media structure for identifying abnormal users provided in an embodiment of the present invention;

[0043] Figure 4 This is a schematic diagram of a computer device structure for identifying abnormal users, provided in an embodiment of the present invention. Detailed Implementation

[0044] In order to solve the technical problem that the accuracy of identification cannot be guaranteed when identifying abnormal users on live streaming platforms in the prior art, the present invention provides a method, apparatus, medium and computer equipment for identifying abnormal users.

[0045] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0046] This embodiment provides a method for identifying abnormal users, such as... Figure 1 As shown, the method includes:

[0047] S110, obtain each behavioral event of the target user on the live streaming platform, encode each behavioral event, and obtain a behavioral encoding sequence;

[0048] Users can generate various types of behavioral events on live streaming platforms, such as registration, login, and reward claiming. This embodiment encodes each behavioral event to obtain a behavioral coding sequence, which lays the foundation for the subsequent modeling process.

[0049] For example, the registration behavior event is coded as 01, and the login behavior event is coded as 02; and in order to better distinguish the same behavior events of different users and improve the recognition accuracy, the auxiliary information can also be coded.

[0050] Additional information may include: client type, the live stream room to which each behavioral event points, and the information source of each behavioral event. Client type may include: Android, iOS, and web; if no live stream room is specified, the corresponding encoding value can be 0 or other preset values, without restriction.

[0051] In practical applications, since users may have repeated behavioral events within a preset time period, the user's various behaviors are first spliced ​​and deduplicated based on the time of occurrence of the behavioral events (from morning to night). Then, the deduplicated behavioral events are ID-encoded and converted into behavioral code sequences.

[0052] For example, if a user registers via the instant messaging software QQ on an Android client within a preset event period, the registration event is concatenated as 01_Android_0_QQ, and then encoded starting from 0, for example, 123. Therefore, the corresponding code for the registration event is 123.

[0053] Alternatively, if the ID code corresponding to a user's behavior event is 112,114,321,4, then the behavior encoding sequence can be 112_114_321_4; in this way, each behavior event in the behavior encoding sequence corresponds to a unique encoded ID.

[0054] This step converts user behavior events within a preset time period into behavior coding sequences, and mathematically represents the behavior events. The behavior coding sequence contains a set of deduplicated behavior events, which facilitates the modeling process in subsequent steps.

[0055] S111, convert the behavior encoding sequence into an initial sequence vector matrix;

[0056] For the target user, after obtaining the target user's behavior encoding sequence, each behavior event in the behavior encoding sequence is vectorized to convert the behavior encoding sequence into an initial sequence vector matrix.

[0057] In this embodiment, converting the behavior-encoded sequence into an initial sequence vector matrix includes:

[0058] According to the first optimal solution function and the second optimal solution function v c =s c Q determines the matrix representing all events;

[0059] Based on the encoded ID of each behavior event in the target user behavior encoded sequence, the corresponding event representation vector is extracted from the full event representation matrix to obtain the initial sequence vector matrix;

[0060] Where F is the optimal value of the first optimal solution function, and D p D represents the set of behavioral events in the target user's behavior encoding sequence; a and c are any two distinct behavioral events in the set of behavioral events; n The set of events in the sequence of all user actions; v a Let v be the event representation vector corresponding to behavior event a. c v is the event representation vector corresponding to behavior event c. c T Let v be the event representation vector corresponding to the behavior event c. c The transpose of s c Let F be the original vector of the behavioral event c, where Q is the full event representation matrix, and Q is the full event representation matrix corresponding to the minimum value of F; e is an exponential function.

[0061] Among them, s c The ID code can be generated by a one-hot transform, s cIt is a sparse vector. For example, if the code for behavior event c is 100, then in the original vector, the dimension of 100 is set to 1, and the other dimensions are 0. The dimension of the initial vector is 1*M, where M is the maximum event code + 1, and the maximum event code is the maximum code ID among all code IDs.

[0062] Specifically, the method for solving the above optimal function is as follows:

[0063] First, the event representation vector is randomly initialized. Taking behavior event c as an example, the initial value of the event representation vector of event c is denoted as...

[0064] The following formula is used for iterative updates:

[0065]

[0066] After M iterations, the optimal event representation vector is finally obtained, where M is the maximum number of iterations, and the value of M is determined based on the convergence of F (that is, after each iteration, the vector after the iteration is substituted into the above formula). In the process, it is determined whether the F-value tends to converge. If F converges, it means that the vector obtained after M iterations is the optimal event representation vector. δ is the event representation vector of event c in the k-th iteration, where k is less than or equal to M; δ is the first learning rate, which is a constant, typically ranging from 0.001 to 0.01, preferably 0.005.

[0067] Assuming that the optimal event representation vector can be obtained after M iterations, then the final event representation vector for event c is v. c M That is, the final v c v c It is a dense vector.

[0068] The principle behind the above formula is as follows: Each code in the behavior encoding sequence undergoes a one-hot transformation, and the vector representation of the specific event (event representation vector) is obtained by multiplying it by the full event representation matrix. This transforms sparse vectors into dense vectors, facilitating computation between them. The inner product of the event representation vectors directly reflects the correlation between them; similar behavior events (closely correlated) have smaller inner products, while dissimilar behavior events (weakly correlated) have larger inner products. In this embodiment, behavior event pairs (two different behavior events in the same sequence) within the same target user's behavior encoding sequence are similar; therefore, if... The smaller the value, the more accurate the information reflected by the event representation vectors in the total event representation matrix Q; similarly, the larger the dot product of the vectors corresponding to dissimilar behavioral events, the more accurate the information. The smaller the value, the more accurate the information reflected by the event representation vector in the total event representation matrix Q. Therefore, the optimal value F of the overall optimization function should be as small as possible.

[0069] After determining the full event representation matrix Q, the corresponding event representation vectors are extracted from the full event representation matrix using the encoded IDs of each behavior event in the target user behavior encoding sequence, thus obtaining the initial sequence vector matrix.

[0070] In this step, the behavior encoding sequence is converted into an initial sequence vector matrix. By determining the relationship between different behavior events of the same user and the relationship between different user behavior events in the behavior encoding sequence, the behavior events are converted into corresponding event representation vectors.

[0071] Since the encoded sequence is essentially a sparse matrix with very high dimensionality, directly using this sparse high-dimensional matrix for subsequent calculations would require enormous storage space due to its high dimensionality. Converting it to an initial sequence vector matrix, which is a dense matrix, reduces the dimensionality, improves computation speed, and reduces the storage space required for parameters.

[0072] S112, Determine the risk sequence vector matrix of the initial sequence vector matrix;

[0073] The ultimate goal of this embodiment is to identify risks in the behavioral encoding sequences of target users. Therefore, after determining the initial sequence vector matrix of the target user, a risk sequence vector matrix is ​​determined from the initial sequence vector matrix. Thus, the risk sequence vector matrix is ​​essentially a vector matrix with risk labels added.

[0074] Specifically, determining the risk sequence vector matrix of the initial sequence vector matrix includes:

[0075] Based on the third optimal solution function P=∑(avg(qW) Q )-y) 2 Determine the risk sequence vector matrix W Q The risk vector matrix is ​​the vector matrix corresponding to the minimum P value; where,

[0076] P is the optimal value of the third optimal boundary function, q is the initial sequence vector matrix with a dimension of sq*k, sq is the length of the behavior encoding sequence, and y is the risk label of the initial sequence vector matrix.

[0077] W Q The dimension is k*d, where d is the sequence representation dimension of the behavior encoding sequence and k is the behavior event representation dimension.

[0078] If y = 1, it indicates that the behavior encoding sequence is an abnormal sequence; if y = 0, it indicates that the behavior encoding sequence is a normal sequence.

[0079] The principle behind the above formula is as follows: multiplying any sequence vector matrix by another matrix is ​​equivalent to performing a linear transformation on the original matrix. If we want this transformation to include the risk label information of the sequence, the closer the mean of the transformed matrix elements is to the label value, the better the learning. Therefore, the formula uses the difference of squares formula to measure this. Obviously, the smaller the P value, the better the learning. Q Better.

[0080] The solution process for the third optimal solution function mentioned above is as follows:

[0081] First, the risk sequence matrix is ​​randomly initialized, with the initial value denoted as (W). Q ) 0

[0082] Then, the following formula is used for iteration:

[0083] (W Q ) k+1 =(W Q ) k -2λ(avg(q(W Q )k)-y)q

[0084] After M iterations, the optimal risk sequence matrix is ​​finally obtained, where M is the maximum number of iterations. The value of M is determined based on the convergence of P (that is, after each iteration, the vector after each iteration is substituted into the above formula P = ∑(avg(qW)). Q )-y) 2 In the process, it is determined whether the value of P converges. If P converges, it means that the vector obtained after this iteration is the optimal event representation vector. Here, q is the initial sequence vector matrix, (W... Q ) k is the risk sequence matrix of the k-th iteration, and λ is the second learning rate, which is a constant, typically ranging from 0.001 to 0.01, preferably 0.005;

[0085] Assuming that the optimal risk sequence matrix can be obtained after M iterations, then the final risk sequence vector matrix of the initial sequence vector matrix is ​​(W Q ) M That is, the final W Q .

[0086] This step involves linearly transforming the initial sequence vector matrix to add risk labels to the risk sequence vector matrix, laying the foundation for subsequent anomaly identification and ensuring identification accuracy.

[0087] S113, determine the position offset vector matrix and time offset vector matrix of the risk sequence vector matrix;

[0088] In practical applications, abnormal users (such as hackers) often generate behavioral events very early in the process to save costs. Therefore, these events tend to appear earlier in the behavior encoding sequence; for example, the behavior of collecting fish balls in bulk. Thus, user location information is crucial for abnormal behavior identification. In this embodiment, after determining the risk sequence vector matrix, it is also necessary to determine the position offset vector matrix of the risk sequence vector matrix.

[0089] Determine the position offset vector matrix of the risk sequence vector matrix, including:

[0090] According to the formula PE p,2i =sin(p1 / 10000) 2i / d Determine the first position offset PE corresponding to the event representation vector with an even position number in the risk sequence vector matrix. p,2i ;

[0091] According to the formula PE p,2i+1 =cos(p1 / 10000) 2i / d Determine the second position offset PE corresponding to the event representation vector with an odd position number in the risk sequence vector matrix. p,2i+1 ;

[0092] According to formula V Q =W Q +PE determines the position offset vector matrix V of the risk sequence vector matrix. Q Where p1 is the position number of the event representation vector in the risk sequence vector matrix, and the minimum value of p1 is 0; W Q Let be the risk sequence vector matrix, and d be the sequence representation dimension of the behavior encoding sequence. The sequence representation dimension can be understood as how many dimensions of a vector are needed to represent the encoding sequence; PE p,2i PE is the first position offset. p,2i+1 The offset for the second position is i = p1 / 2 when p1 is even and i = (p1-1) / 2 when p1 is odd. i is an intermediate variable.

[0093] For example, suppose:

[0094]

[0095]

[0096] So

[0097] The principle behind the above formula is as follows: when determining the location information of the target user, the location information offset is taken into account, and the two cases of odd and even location numbers are distinguished. For different cases, different functions (sine function or cosine function) are used to determine the corresponding location offset, so that each dimension contains a certain location information but the location information is not completely the same. The determination of the location offset in high-dimensional space is more accurate, thereby improving the accuracy of subsequent identification of abnormal users.

[0098] Similarly, since abnormal user actions tend to follow certain patterns, the resulting behavioral events also exhibit certain patterns. For example, the behavioral events may be relatively regular or the operation time may be short. Therefore, it is also necessary to determine the time offset vector matrix of the risk sequence vector matrix.

[0099] Specifically, determining the time offset vector matrix of the risk sequence vector matrix includes:

[0100] According to the formula Determine the time offset TE of each event representation vector;

[0101] According to formula K Q =W Q +TE determines the time offset vector matrix K of the risk sequence vector matrix. Q Where h is the time interval between the occurrence time of the behavior event corresponding to the current event representation vector and the occurrence time of the behavior event corresponding to the next event representation vector; W Q It is a risk sequence vector matrix.

[0102] The principle behind this formula is that the time interval between behavioral events is another key factor in identifying risky behavior. The intervals between black market behavioral events often follow a pattern, such as being relatively uniform or unusually short. Therefore, this embodiment encodes the interval duration using a sine function. When the interval duration h is 0, the time offset is 0; one period of the sine function is one day (24 hours).

[0103] For example, suppose:

[0104]

[0105] If the first behavioral event occurs at an interval of 0.1 hours and the second behavioral event occurs at an interval of 0.05 hours, then:

[0106]

[0107]

[0108] This step is based on the patterns of black market user behavior events and fully considers the positional and temporal offsets of the risk sequence vector matrix. It determines the positional and temporal offset vector matrices of the risk sequence vector matrix to improve the accuracy of subsequent abnormal user identification.

[0109] S114, determine the target sequence representation matrix based on the initial sequence vector matrix, the position offset vector matrix, and the time offset vector matrix; the target sequence representation matrix carries the risk label of the target user and the correlation between each of the behavioral events;

[0110] Then, the target sequence representation matrix is ​​determined based on the initial sequence vector matrix, the position offset vector matrix, and the time offset vector matrix; the target sequence representation matrix carries the risk label of the target user and the correlation between each behavioral event.

[0111] Specifically, it can be based on the formula Determine the target sequence representation matrix A; where S is the sigmoid function, q is the initial sequence vector matrix, and W... Q Let V be the risk sequence vector matrix. Q Let K be the position offset vector matrix of the risk sequence vector matrix. Q d is the time offset vector matrix of the risk sequence vector matrix, and d is the sequence representation dimension of the behavior encoding sequence.

[0112] For example, assuming the target user's behavior encoding sequence is (0, 1, 2, 3), the determined initial sequence vector matrix q is:

[0113] The determined risk vector matrix is ​​as follows:

[0114] The determined position offset vector matrix is ​​as follows:

[0115] The determined event offset vector matrix is ​​as follows:

[0116] Substituting into the formula above in this step, the final target sequence representation matrix A is determined as follows:

[0117] The principle behind the formula in this step is that multiplying the initial sequence vector matrix and the risk sequence vector matrix generates a new sequence vector matrix qW. Q The newly generated sequence vector matrix contains risk label information; therefore, it can be viewed as a vector representation that ignores position and time information. Similarly, qK Q It is a vector representation considering positional offset, and qW QPerforming a dot product determines the correlation between the event vectors. Since qW Q and qK Q The dot product result might be very large. Since the sigmoid function will be used to calculate the dot product result subsequently, if the dot product result is very large, the value of the sigmoid function will tend to 1, causing the results calculated from different paths to be very similar and lacking in distinguishability. To ensure the accuracy of the recognition result, the dot product result is divided by... This can offset the effect.

[0118] The event representation vector in the sequence representation matrix in this step carries the risk label of the target user and the correlation between various behavioral events; it also carries the target user's location offset and time offset, integrating multiple risk (anomaly) identification factors. Therefore, when using the sequence representation matrix to identify anomaly users in the future, the identification accuracy can be ensured.

[0119] S115, perform anomaly identification on the target user based on the target sequence representation matrix, the preset normal label sequence representation matrix, and the suspected label sequence representation matrix.

[0120] Once the target sequence representation matrix is ​​determined, anomaly identification of the target user is performed based on the target sequence representation matrix, the preset normal label sequence representation matrix, and the suspect label sequence representation matrix.

[0121] Specifically, according to the formula Determine the risk score (A) of the target user;

[0122] If the risk score exceeds the risk threshold, the target user is identified as an abnormal user. Here, s1 is any sequence in the set of suspected label sequence representation matrices, s2 is any sequence in the set of normal label sequence representation matrices, A is the target sequence representation matrix (the sequence representation matrix of the target user), W is the set of normal label sequence representation matrices with size |W|, and B is the set of suspected label sequence representation matrices with size |B|.

[0123] The principle behind the above formula is as follows: What is determined is the first average similarity between the target sequence representation matrix and other suspected label sequence representation matrices. The higher the first average similarity, the closer the target user's sequence representation matrix is ​​to the suspected sequence, and the greater the suspicion level of the target user. What is determined is the second average similarity between the target sequence representation matrix and other normal label sequence representation matrices. The higher the second average similarity, the closer the target user's sequence representation matrix is ​​to the normal sequence, and the less suspicious the target user is.

[0124] In this step, the similarity between the target sequence representation matrix, the normal label sequence representation matrix, and the suspect label sequence representation matrix is ​​compared. Based on the risk score, it is determined whether the target user is an abnormal user. Since the event representation vector in the sequence representation matrix carries the target user's risk label and the correlation between various behavioral events, as well as the target user's position offset and time offset, it integrates multiple risk (anomaly) identification factors. In addition, when performing anomaly identification, the average similarity between the sequence representation matrix and the suspect label sequence representation matrix, and the average similarity between the sequence representation matrix and the normal label sequence representation matrix are also considered to ensure the comprehensiveness of anomaly identification and thus ensure identification accuracy.

[0125] Based on the same inventive concept as the foregoing embodiments, the present invention also provides a device for identifying abnormal users, such as... Figure 2 As shown, the device includes:

[0126] Encoding unit 21 is used to obtain various behavioral events of the target user on the live streaming platform, encode each behavioral event, and obtain a behavioral encoding sequence;

[0127] The conversion unit 22 is used to convert the behavior encoding sequence into an initial sequence vector matrix;

[0128] The determining unit 23 is used to determine the risk sequence vector matrix of the initial sequence vector matrix; determine the position offset vector matrix and time offset vector matrix of the risk sequence vector matrix; and determine the target sequence representation matrix based on the initial sequence vector matrix, the position offset matrix, and the time offset matrix; the target sequence representation matrix carries the risk label of the target user and the correlation between each of the behavioral events;

[0129] The identification unit 24 is used to identify the target user as abnormal based on the target sequence representation matrix, the preset normal label sequence representation matrix and the suspect label sequence representation matrix.

[0130] Since the apparatus described in the embodiments of this invention is an apparatus used to implement the methods of the embodiments of this invention, those skilled in the art can understand the specific structure and variations of the apparatus based on the methods described in the embodiments of this invention, and therefore will not be described in detail here. All apparatuses used in the methods of the embodiments of this invention fall within the scope of protection of this invention.

[0131] Based on the same inventive concept as the foregoing embodiments, this embodiment of the invention also provides a computer device, such as... Figure 3 As shown, the system includes a memory 310, a processor 320, and a computer program 311 stored in the memory 310 and executable on the processor 320. When the processor 320 executes the computer program 311, it performs the following steps:

[0132] Obtain the target user's various behavioral events on the live streaming platform, encode each behavioral event, and obtain a behavioral encoding sequence;

[0133] Convert the behavior encoding sequence into an initial sequence vector matrix;

[0134] Determine the risk sequence vector matrix of the initial sequence vector matrix;

[0135] Determine the position offset vector matrix and time offset vector matrix of the risk sequence vector matrix;

[0136] A target sequence representation matrix is ​​determined based on the initial sequence vector matrix, the position offset vector matrix, and the time offset vector matrix; the target sequence representation matrix carries the risk label of the target user and the correlation between each behavioral event;

[0137] The target user is identified as abnormal based on the target sequence representation matrix, the preset normal label sequence representation matrix, and the suspected label sequence representation matrix.

[0138] In specific implementation, when the processor 320 executes the computer program 311, it can implement any of the above embodiments.

[0139] Since the computer device described in this embodiment is the device used to implement the method for identifying abnormal users in the foregoing embodiments of the present invention, those skilled in the art can understand the specific implementation methods and various variations of the computer device in this embodiment based on the method described in the foregoing embodiments of the present invention. Therefore, how the server implements the method in the embodiments of the present invention will not be described in detail here. Any device used by those skilled in the art to implement the method in the embodiments of the present invention falls within the scope of protection of the present invention.

[0140] Based on the same inventive concept as the foregoing embodiments, this embodiment provides a computer-readable storage medium 400, such as... Figure 4 As shown, a computer program 411 is stored thereon, which, when executed by a processor, performs the following steps:

[0141] Obtain the target user's various behavioral events on the live streaming platform, encode each behavioral event, and obtain a behavioral encoding sequence;

[0142] Convert the behavior encoding sequence into an initial sequence vector matrix;

[0143] Determine the risk sequence vector matrix of the initial sequence vector matrix;

[0144] Determine the position offset vector matrix and time offset vector matrix of the risk sequence vector matrix;

[0145] A target sequence representation matrix is ​​determined based on the initial sequence vector matrix, the position offset vector matrix, and the time offset vector matrix; the target sequence representation matrix carries the risk label of the target user and the correlation between each behavioral event;

[0146] The target user is identified as abnormal based on the target sequence representation matrix, the preset normal label sequence representation matrix, and the suspected label sequence representation matrix.

[0147] In practice, when the computer program 411 is executed by the processor, it can implement any of the above embodiments.

[0148] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0149] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0150] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0151] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0152] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0153] The beneficial effects of the method, apparatus, medium, and computer equipment for identifying abnormal users provided in the embodiments of the present invention are at least as follows:

[0154] This invention provides a method for identifying abnormal users. The method involves obtaining various behavioral events of a target user on a live streaming platform, encoding each behavioral event to obtain a behavioral encoding sequence, converting the behavioral encoding sequence into an initial sequence vector matrix, determining a risk sequence vector matrix within the initial sequence vector matrix, determining a position offset vector matrix and a time offset vector matrix within the risk sequence vector matrix, and determining a target sequence representation matrix based on the initial sequence vector matrix, the position offset vector matrix, and the time offset vector matrix. The target sequence representation matrix carries the risk label of the target user and the correlation between each behavioral event. The method then identifies the target user as abnormal based on the target sequence representation matrix, a preset normal label sequence representation matrix, and a suspicious label sequence representation matrix. Thus, by first encoding the behavioral events and then encoding each behavioral event and the correlation between them... Quantization is performed to form an initial sequence vector matrix. Converting this initial sequence vector into a risk sequence vector matrix is ​​equivalent to adding risk labels to the risk sequence vector matrix, laying the foundation for subsequent anomaly identification. Furthermore, since abnormal user actions tend to follow certain patterns (e.g., regular behavior events, short operation times, or early occurrences), the target sequence representation matrix is ​​finally determined based on the positional offset vector matrix and time offset vector matrix of the risk sequence vector matrix. Anomaly identification is then performed based on this target sequence representation matrix, improving identification accuracy. Because both normal and suspicious label sequence representation matrices are considered in anomaly identification, the similarity between the target user and normal users, as well as the similarity between the target user and abnormal users, is taken into account simultaneously. This comprehensive consideration of various risk identification factors further enhances identification accuracy.

[0155] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for identifying anomalous users, the method comprising: The method includes: Obtain the target user's various behavioral events on the live streaming platform, encode each behavioral event, and obtain a behavioral encoding sequence; Convert the behavior encoding sequence into an initial sequence vector matrix; Determine the risk sequence vector matrix of the initial sequence vector matrix; Determine the position offset vector matrix and time offset vector matrix of the risk sequence vector matrix; A target sequence representation matrix is ​​determined based on the initial sequence vector matrix, the position offset vector matrix, and the time offset vector matrix; the target sequence representation matrix carries the risk label of the target user and the correlation between each behavioral event; The target user is identified as abnormal based on the target sequence representation matrix, the preset normal label sequence representation matrix, and the suspected label sequence representation matrix; The step of determining the risk sequence vector matrix of the initial sequence vector matrix includes: based on a third optimal solution function determining the risk sequence vector matrix ; the risk sequence vector matrix is when P the vector matrix corresponding to the minimum value; wherein, The P The optimal value of the third optimal boundary function is... q The initial sequence vector matrix, the y The risk label for the initial sequence vector matrix; Determining the position offset vector matrix of the risk sequence vector matrix includes: According to the formula Determine the first position offset corresponding to the event representation vector with an even position number in the risk sequence vector matrix; According to the formula Determine the second position offset corresponding to the event representation vector with an odd position number in the risk sequence vector matrix; According to the formula Determine the position offset vector matrix of the risk sequence vector matrix ; wherein, the The position number of the event representation vector in the risk sequence vector matrix, the The risk sequence vector matrix, the d The sequence representation dimension of the encoded sequence of the behavior; This is the offset of the first position. For the second position offset, when When it is even, i= / 2; when When it is an odd number, i= ( - 1) / 2; The step of determining the time offset vector matrix of the risk sequence vector matrix includes: According to the formula Determine the time offset of each event representation vector. TE ; According to the formula Determine the time offset vector matrix of the risk sequence vector matrix ; wherein, the h The interval between the occurrence time of the behavior event corresponding to the current event representation vector and the occurrence time of the behavior event corresponding to the next event representation vector; Let be the risk sequence vector matrix.

2. The method as described in claim 1, characterized in that, The step of converting the behavior-encoded sequence into an initial sequence vector matrix includes: According to the first optimal solution function and the second optimal solution function Determine the total event representation matrix; Based on the event ID of each behavior event in the target user behavior encoding sequence, the corresponding event representation vector is extracted from the full event representation matrix to obtain the initial sequence vector matrix; Among them, the F The optimal value of the first optimal solution function, the D p The set of behavioral events in the target user behavior encoding sequence; a and c For any two distinct behavioral events in the set of behavioral events; D n The set of events in the sequence of all user actions; v a For behavioral events a The corresponding event representation vector, the v c For behavioral events c The corresponding event representation vector; For the v c The transpose vector; s c The original vector of the event, the Q Let be the total event representation matrix, and the Q For when F The full event representation matrix corresponding to the minimum value; the e It is an exponential function.

3. The method as described in claim 1, characterized in that, The step of determining the target sequence representation matrix based on the initial sequence vector matrix, the position offset vector matrix, and the time offset vector matrix includes: Based on formula Determine the target sequence representation matrix A Where S is the sigmoid function, the... q The initial sequence vector matrix, the The risk sequence vector matrix, the The position offset vector matrix of the risk sequence vector matrix, the The time offset vector matrix of the risk sequence vector matrix, the d The sequence representation dimension for encoding the behavior sequence.

4. The method as described in claim 1, characterized in that, The step of identifying anomalies in the target user based on the target sequence representation matrix, the preset normal label sequence representation matrix, and the suspected label sequence representation matrix includes: According to the formula Determine the risk score of the target user. score ( A ); If the risk score exceeds the risk threshold, the target user is determined to be an abnormal user; wherein, A is the target sequence representation matrix, W is the set of normal label sequence representation matrices, and B is the set of suspicious label sequence representation matrices. s 1 represents any sequence in the set of suspected tag sequence representation matrices. s 2 represents any sequence in the set of normal label sequence representation matrices. It is the first average similarity between the target sequence representation matrix and other suspected label sequence representation matrices. It is the second average similarity between the target sequence representation matrix and other normal label sequence representation matrices.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method described in any one of claims 1 to 4.

Images