Interception Method, Device, Electronic Device and Storage Medium for Internet Black Production Behaviors

Abstract

The present application relates to a method, device, electronic device and storage medium for intercepting cyber black production behaviors. The method includes: obtaining a first behavior feature group in a first scenario; in the case where a first behavior feature of a cyber black production behavior is included in the first behavior feature group, intercepting the first behavior feature, and forming a sinking label from the first behavior feature in the first behavior feature group and a second behavior feature associated with the first behavior feature; the sinking label is used to indicate the behavior feature to be intercepted; obtaining a second behavior feature group in a second scenario; in the case where the first behavior feature and / or the second behavior feature is included in the second behavior feature group, intercepting the first behavior feature and / or the second behavior feature, and forming a sinking label from a third behavior feature associated with the first behavior feature in the second behavior feature group, and / or forming a sinking label from a fourth behavior feature associated with the second behavior feature, so as to intercept cyber black production behaviors in multiple scenarios.

Description

Technical Field

[0001] The present application relates to the technical field of big data analysis, and particularly relates to an interception method, device, electronic device and storage medium for cyber black production behavior. Background Art

[0002] Cyber black production refers to illegal activities that use the Internet as a medium and network technology as the main means, posing potential threats to the security of computer information systems, the management order of the network space, and even national security and social and political stability. In the early days, cyber black production usually committed evil deeds through receiving code platform accounts or cheating through machine scripts. However, with the development of Internet technology and the long-term offensive and defensive confrontation with cyber black production, cyber black production has gradually evolved from the early single method to today's multi-scenario cheating methods, thus having better concealment.

[0003] Currently, the existing interception means for cyber black production behavior intercept the cyber black production behavior after identifying it through methods such as frequency identification, tampering identification, evil model identification, and real-person cheating identification in a single scenario. However, these means target relatively single scenarios and have many loopholes in intercepting today's multi-scenario cyber black production behavior, enabling cyber black production gangs to bypass risk control detection and causing losses to the corporate brand image and user economy.

[0004] Therefore, how to effectively intercept today's multi-scenario cyber black production behavior has become an urgent technical problem to be solved. Summary of the Invention

[0005] The present application provides an interception method, device, electronic device and storage medium for cyber black production behavior to solve the technical problem that the existing interception means for cyber black production behavior target relatively single scenarios and cannot effectively identify today's multi-scenario cyber black production behavior.

[0006] In a first aspect, the present application provides an interception method for cyber black production behavior, and the method includes:

[0007] Obtain a first behavior feature group in a first scenario;

[0008] In the case that the first behavior feature group includes a first behavior feature of cyber black production behavior, intercept the first behavior feature, and form a sinking label from the first behavior feature in the first behavior feature group and a second behavior feature associated with the first behavior feature; the sinking label is used to indicate the behavior feature to be intercepted;

[0009] Obtain a second behavior feature group in a second scenario;

[0010] In the case where the second behavior feature group includes the first behavior feature and / or the second behavior feature, intercept the first behavior feature and / or the second behavior feature, and form a sinking label for the third behavior feature associated with the first behavior feature and / or the fourth behavior feature associated with the second behavior feature in the second behavior feature group.

[0011] Optionally, the obtaining of the first behavior feature group in the first scenario includes: obtaining the first behavior feature group in the first scenario based on the log data corresponding to the first scenario;

[0012] The obtaining of the second behavior feature group in the second scenario includes: obtaining the second behavior feature group in the second scenario based on the log data corresponding to the second scenario.

[0013] Optionally, after intercepting the first behavior feature and / or the second behavior feature, and forming a sinking label for the third behavior feature associated with the first behavior feature and / or the fourth behavior feature associated with the second behavior feature in the second behavior feature group, the method further includes:

[0014] Constructing a behavior portrait of the network black production behavior based on the sinking label, where the behavior portrait of the network black production behavior is used to identify the network black production behavior in other scenarios except the first scenario and the second scenario.

[0015] Optionally, after constructing the behavior portrait of the network black production behavior based on the sinking label, the method further includes:

[0016] Updating the behavior portrait of the network black production behavior when sinking labels in other scenarios except the first scenario and the second scenario are obtained.

[0017] Optionally, both the first scenario and the second scenario include at least one scenario, and at least one scenario included in the first scenario is different from at least one scenario included in the second scenario.

[0018] Optionally, the first scenario and the second scenario include at least one of the following scenarios: login scenario, user acquisition scenario, membership scenario, payment scenario, and interaction scenario.

[0019] In a second aspect, the present application further provides an interception device for network black production behavior, and the device includes:

[0020] A first acquisition module, configured to acquire a first behavior feature group in a first scenario;

[0021] The first interception module is configured to intercept the first behavior feature when the first behavior feature group includes the first behavior feature of the online black production behavior, and form a sinking label for the first behavior feature and the second behavior feature associated with the first behavior feature in the first behavior feature group; the sinking label is used to indicate the behavior feature to be intercepted.

[0022] The second acquisition module is configured to acquire a second behavior feature group in a second scenario.

[0023] The second interception module is configured to intercept the first behavior feature and / or the second behavior feature when the second behavior feature group includes the first behavior feature and / or the second behavior feature, and form a sinking label for the third behavior feature associated with the first behavior feature in the second behavior feature group, and / or form a sinking label for the fourth behavior feature associated with the second behavior feature.

[0024] In a third aspect, the present application further provides an electronic device, including a processor, a communication interface, a memory, and a communication bus. Among them, the processor, the communication interface, and the memory complete mutual communication through the communication bus;

[0025] The memory is used to store a computer program;

[0026] The processor is configured to implement the steps of the method for intercepting online black production behavior according to any one of the embodiments in the first aspect when executing the program stored on the memory.

[0027] In a fourth aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored, and the computer program implements the steps of the method for intercepting online black production behavior according to any one of the embodiments in the first aspect when executed by a processor.

[0028] The above technical solutions provided by the embodiments of the present application have the following advantages compared with the prior art:

[0029] In the embodiments of the present application, by obtaining a first behavior feature group in a first scenario; when the first behavior feature group includes a first behavior feature of a cyber black production behavior, intercepting the first behavior feature, and forming a sinking label from the first behavior feature in the first behavior feature group and a second behavior feature associated with the first behavior feature; the sinking label is used to indicate the behavior feature to be intercepted; obtaining a second behavior feature group in a second scenario; when the second behavior feature group includes the first behavior feature and / or the second behavior feature, intercepting the first behavior feature and / or the second behavior feature, and forming a sinking label from a third behavior feature associated with the first behavior feature in the second behavior feature group, and / or forming a sinking label from a fourth behavior feature associated with the second behavior feature. By the above method, when there is a cyber black production behavior in the first scenario, a sinking label can be formed from the first behavior feature corresponding to the cyber black production behavior in the first scenario and the second behavior feature associated with the first behavior feature. When analyzing the cyber black production behavior in the second scenario subsequently, the cyber black production behavior can be identified and intercepted based on the first behavior feature and / or the second behavior feature, and a sinking label is formed from the behavior feature associated with the first behavior feature and / or the second behavior feature in the second scenario. In this way, by cycling, sinking labels in multiple scenarios can be obtained, and based on the sinking labels, the cyber black production behavior in other scenarios can be intercepted, thereby expanding the interception range of the cyber black production behavior and achieving effective interception of the cyber black production behavior in multiple scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings herein are incorporated into the specification and constitute a part of this specification, showing embodiments consistent with the present invention and, together with the specification, are used to explain the principles of the present invention.

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, for those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0032] Figure 1 It is a schematic flowchart of a method for intercepting cyber black production behavior provided by an embodiment of the present application;

[0033] Figure 2 It is a schematic diagram of the behavior link of a cyber black production member provided by an embodiment of the present application;

[0034] Figure 3 It is a schematic structural diagram of a device for intercepting cyber black production behavior provided by an embodiment of the present application;

[0035] Figure 4 A schematic structural diagram of an electronic device provided by an embodiment of the present application. Detailed implementation manners

[0036] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application. Apparently, the described embodiments are some but not all of the embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application without creative efforts shall fall within the protection scope of the present application.

[0037] See Figure 1 , Figure 1 A flowchart of an interception method for online black production behavior provided by an embodiment of the present application. As Figure 1 shown, the interception method for online black production behavior may include the following steps:

[0038] Step 101, obtain a first behavior feature group in a first scenario;

[0039] Specifically, the above-mentioned first scenario may refer to one scenario or multiple scenarios. For example, the above-mentioned first scenario may refer to a login scenario, or multiple scenarios such as a login scenario and a user acquisition scenario. Here, the login scenario refers to the scenario of logging in to a certain application through a login account and a login device, and the user acquisition scenario refers to the scenario of participating in an activity of attracting new users in a certain application (in an application, there are often activities of giving coupons or points for attracting new users).

[0040] The above-mentioned first behavior feature group includes multiple behavior features. For example, when the first scenario is a login scenario, the first behavior feature group may include, but is not limited to, behavior features such as the device identifier used for login, the account identifier used for login, and the login time; when the first scenario is a login scenario and a user acquisition scenario, the first behavior feature group may include, but is not limited to, behavior features such as the device identifier used for login, the account identifier used for login, the login time, and the network IP (abbreviation for Internet Protocol) address used.

[0041] Step 102, in the case that the first behavior feature group includes a first behavior feature of online black production behavior, intercept the first behavior feature, and form a sinking label with the first behavior feature in the first behavior feature group and a second behavior feature associated with the first behavior feature; the sinking label is used to indicate the behavior feature to be intercepted;

[0042] In this step, when the first behavior feature in the first behavior feature group includes a network black production behavior, the first behavior feature can be intercepted, thereby intercepting the network black production behavior corresponding to the first behavior feature, and sinking the first behavior feature and the second behavior feature associated with the first behavior feature in the first behavior feature group to form a sinking label, which is convenient for identifying new behavior features of network black production behavior in subsequent other scenarios, and then intercepting new network black production behaviors. Among them, sinking the first behavior feature and the second behavior feature is a process of precipitating and accumulating behavior features related to network black production behavior, so that the sunk behavior features are saved to the background of the corresponding application or the preset storage space of the electronic device. This sinking label is different from general descriptive labels and is mainly used to instruct the application or the electronic device to intercept the network black production behavior corresponding to the behavior features in the sinking label.

[0043] Step 103: Obtain the second behavior feature group in the second scenario;

[0044] Specifically, the above-mentioned second scenario can refer to a scenario different from the above-mentioned first scenario, or multiple scenarios. For example, assuming that the above-mentioned first scenario is the login scenario, the second scenario can be one or more of the new user acquisition scenario, membership scenario, payment scenario, and interaction scenario. Here, the login scenario refers to the scenario of logging in to a certain application through a login account and a login device. The new user acquisition scenario refers to the scenario of participating in the activity of attracting new users in a certain application (in the application, there are often activities of giving coupons or points for attracting new users). The membership scenario refers to the scenario of handling membership and enjoying membership benefits in a certain application. The payment scenario refers to the scenario of payment and transaction in a certain application. The interaction scenario refers to the scenario of participating in the interaction of activities or services in a certain application, such as participating in group buying activities, preferential activities, uploading videos, etc.

[0045] The above-mentioned second behavior feature group includes multiple behavior features. For example, when the second scenario is the membership scenario, the second behavior feature group may include, but is not limited to: the account identifier used for login, the membership joining time, the network IP address used, etc. When the second scenario is the payment scenario, the second behavior feature group may include, but is not limited to: the account identifier used for login, the device identifier used for login, the device identifier used for payment, the payment time, the network IP address used, etc.

[0046] Step 104: In the case where the first behavior feature and / or the second behavior feature is included in the second behavior feature group, intercept the first behavior feature and / or the second behavior feature, and form a sinking label for the third behavior feature associated with the first behavior feature in the second behavior feature group, and / or form a sinking label for the fourth behavior feature associated with the second behavior feature.

[0047] In this step, when the second behavior feature group includes at least one of the first behavior feature and the second behavior feature, the first behavior feature and / or the second behavior feature can be intercepted, so as to intercept the network black production behavior corresponding to the first behavior feature and / or the second behavior feature, and sink the third behavior feature associated with the first behavior feature and / or the fourth behavior feature associated with the second behavior feature in the second behavior feature group to form a sinking label, which is convenient for identifying new behavior features of network black production behavior in subsequent other scenarios, and then intercepting new network black production behavior. Among them, sinking the third behavior feature and the fourth behavior feature is a process of precipitating and accumulating behavior features related to network black production behavior, so that the sinking behavior features are saved to the background of the corresponding application program or the preset storage space of the electronic device. In this way, the sinking label includes the first behavior feature, the second behavior feature, the third behavior feature and the fourth behavior feature, and can intercept the network black production behavior corresponding to the first behavior feature, the second behavior feature, the third behavior feature and the fourth behavior feature.

[0048] It should be noted that the above step 101 and step 103 can be carried out simultaneously or successively. For example, step 101 is executed first and then step 103; or step 103 is executed first and then step 101. The present application does not make specific limitations. Of course, after executing step 104, the third behavior feature group in other remaining scenarios can also be obtained. When the third behavior feature group includes the first behavior feature, the second behavior feature, the third behavior feature and / or the fourth behavior feature, the first behavior feature, the second behavior feature, the third behavior feature and / or the fourth behavior feature are intercepted, and other behavior features associated with the first behavior feature, the second behavior feature, the third behavior feature and / or the fourth behavior feature are formed into a sinking label, and so on in a loop until all scenarios are traversed.

[0049] In this embodiment, when there is a network black production behavior in the first scenario, the first behavior feature corresponding to the network black production behavior in the first scenario and the second behavior feature associated with the first behavior feature can be formed into a sinking label. When analyzing the network black production behavior in the second scenario subsequently, the network black production behavior can be identified and intercepted based on the first behavior feature and / or the second behavior feature, and the behavior features associated with the first behavior feature and / or the second behavior feature in the second scenario are formed into a sinking label, and so on in a loop. Multiple sinking labels in multiple scenarios can be obtained, and the network black production behavior in other scenarios can be intercepted based on the sinking labels, so as to expand the interception range of network black production behavior and effectively intercept network black production behavior in multiple scenarios.

[0050] Further, step 101 above, obtaining the first behavior feature group in the first scenario, includes: obtaining the first behavior feature group in the first scenario based on the log data corresponding to the first scenario;

[0051] The above step 103, obtaining the second behavior feature group in the second scenario, includes: obtaining the second behavior feature group in the second scenario based on the log data corresponding to the second scenario.

[0052] In one embodiment, when obtaining the behavior feature groups in different scenarios, the log data in different scenarios can be obtained first, and then data analysis can be performed based on the obtained log data to obtain multiple behavior features in different scenarios, forming a behavior feature group. Specifically, each behavior feature in the behavior feature group can be obtained in different or the same way. When each behavior feature is obtained in a different way, a corresponding neural network model can be preset for each behavior feature for predictive analysis. Here, the neural network model can be trained based on the behavior feature sample data and behavior feature labels corresponding to a certain network black production behavior. Among them, network black production behaviors can include, but are not limited to: behaviors of tampering with device information, aggregating network IP addresses, web page cheating, and wool pulling behaviors, etc. In this way, it is convenient to obtain the behavior features of different network black production behaviors in different scenarios.

[0053] Further, after the above step 104, intercepting the first behavior feature and / or the second behavior feature, and forming a sinking label for the third behavior feature associated with the first behavior feature and / or the fourth behavior feature associated with the second behavior feature in the second behavior feature group, the method further includes:

[0054] Based on the sinking label, construct a behavior portrait of network black production behaviors, where the behavior portrait of network black production behaviors is used to identify network black production behaviors in other scenarios except the first scenario and the second scenario.

[0055] In one embodiment, after sinking the behavior features of network black production behaviors in the first scenario and the second scenario, and other behavior features associated with the behavior features of network black production behaviors, a behavior portrait of network black production behaviors can also be constructed based on the sinking label. Here, the behavior portrait of network black production behaviors can be understood as a set of behavior features of network black production behaviors, which can objectively reflect the behavior features of network black production behaviors. In this way, according to the behavior portrait of network black production behaviors, a risk control strategy can be configured to identify network black production behaviors in other scenarios except the first scenario and the second scenario, achieving the purpose of intercepting network black production behaviors in multiple scenarios.

[0056] Further, after constructing the behavior portrait of the network black production behavior based on the sinking tags in the above steps, the method further includes:

[0057] When sinking tags in other scenarios except the first scenario and the second scenario are obtained, update the behavior portrait of the network black production behavior.

[0058] In one embodiment, after constructing the behavior portrait of the network black production behavior, the behavior portrait of the network black production behavior can be updated based on the new sinking behavior features, so as to continuously improve the behavior portrait and make the identification and interception methods of the network black production behavior in other scenarios more accurate.

[0059] Further, both the first scenario and the second scenario include at least one scenario, and the at least one scenario included in the first scenario is different from the at least one scenario included in the second scenario.

[0060] In one embodiment, the first scenario and the second scenario may each refer to a single scenario or multiple scenarios respectively, but the first scenario and the second scenario are different. For the sake of simplicity, an example is given where both the first scenario and the second scenario are single scenarios. For example, assume the first scenario is the login scenario and the second scenario is the user acquisition scenario. Then, the login logs corresponding to the login scenario can be obtained. If it is analyzed and found that there are a large number of new device identifiers logging in to a certain application within a period of time in the login logs, by analyzing the data sources of these device identifiers, it is found that the web pages initiated by these device identifiers are all the same, and this web page belongs to the server-side page and can be accessed by abnormal users. At this time, the first behavioral feature A can be obtained as the device identifier whose login request comes from the server-side page. By comparing the device identifiers of the entire scenario with the sunken device identifiers, if there are matching device identifiers between the two, the behaviors corresponding to the matching device identifiers will be intercepted. Also, the account identifiers of the device identifiers that have used the server-side page can be recorded simultaneously as the second behavioral feature B. Through the system background, the sunken first behavioral feature A and the second behavioral feature B are applied to the entire scenario to facilitate the defense of the entire scenario and the tracking of the behavior chain of the black production gang. In the user acquisition scenario, the user acquisition logs corresponding to the user acquisition scenario can be obtained. When the account identifier in the second behavioral feature B appears in the user acquisition logs, but the device identifier corresponding to this account identifier has changed, it indicates that the members of the online black production have replaced the new device. At this time, the flow direction of the members of the online black production can be discovered through the account identifier in the second behavioral feature B, and it is found that the network IP addresses using these account identifiers have an aggregation feature and are used by abnormal users. At this time, the network IP addresses can be recorded as the fourth behavioral feature C. After detecting in multiple scenarios, the first behavioral feature A, the second behavioral feature B, and the fourth behavioral feature C are recorded and applied to each behavioral process that the members of the online black production will reach through the system background to intercept the problematic behaviors and ensure the normal user experience and the company's interests.

[0061] In this embodiment, by using the sunken tags, the problematic users are recorded, and through continuous cycling of the data logs, various dimensions with problems are recorded to expand the identification scope of the online black production behaviors and prevent the members of the online black production from bypassing the detection by changing information and causing more losses. Compared with the previous method that could only perform single-point defense, if the members of the online black production change information, they will bypass the detection in the short term, which is likely to cause losses to the company's assets.

[0062] Further, the first scenario and the second scenario include at least one of the following scenarios: login scenario, user acquisition scenario, membership scenario, payment scenario, and interaction scenario.

[0063] In one embodiment, the first scenario and the second scenario include one or more of scenarios such as a login scenario, a user acquisition scenario, a membership scenario, a payment scenario, and an interaction scenario, and the first scenario and the second scenario are different. As an alternative embodiment, the login scenario can be used as the first scenario, and the user acquisition scenario, the membership scenario, the payment scenario, and the interaction scenario can be used as the second scenario. Alternatively, the login scenario, the user acquisition scenario, and the membership scenario can be used as the first scenario, and the payment scenario and the interaction scenario can be used as the second scenario, etc. The present application does not make specific limitations. In this way, when obtaining the first behavior feature group in the first scenario and the second behavior feature group in the second scenario, the behavior features in scenarios such as the login scenario, the user acquisition scenario, the membership scenario, the payment scenario, and the interaction scenario can be obtained, which facilitates intercepting online black production behaviors in scenarios such as the login scenario, the user acquisition scenario, the membership scenario, the payment scenario, and the interaction scenario.

[0064] In practical applications, scenario analysis can be combined with the behavior link of online black production members. The behavior link of the online black production members is as Figure 2 shown. At this time, the method for intercepting the online black production behavior is:

[0065] When members of the online black production industry are in the login scenario, the first set of behavioral characteristics can be analyzed and obtained from the log data of the login scenario, including the first behavioral characteristic A and the second behavioral characteristic B associated with the first behavioral characteristic A. At this time, the first behavioral characteristic A can be intercepted, and it is considered that the associated second behavioral characteristic B may have problems. Using system tools (such as a list library or a feature statistics platform, etc.), the first behavioral characteristic A and the second behavioral characteristic B are respectively recorded in the log and form a sinking label for subsequent use; when members of the online black production industry break through the login scenario defense and enter the user acquisition scenario, the second set of behavioral characteristics can be analyzed and obtained from the log data of the user acquisition scenario, including the second behavioral characteristic B and the third behavioral characteristic C (not including the first behavioral characteristic A). The risk control strategy will intercept the sinking second behavioral characteristic B, record the second behavioral characteristic B and the possibly problematic third behavioral characteristic C in the log, and form a sinking label; when members of the online black production industry transfer to the membership scenario, the third set of behavioral characteristics can be analyzed and obtained from the log data of the membership scenario, including the third behavioral characteristic C and the fourth behavioral characteristic D (not including the first behavioral characteristic A and the second behavioral characteristic B). The risk control strategy will intercept the sinking third behavioral characteristic C, record the third behavioral characteristic C and the possibly problematic fourth behavioral characteristic D in the log, and form a sinking label. Finally, multiple sinking labels A, B, C, D, etc. are used to mark the black production gang. And so on, the fourth behavioral characteristic D in the payment scenario and the interaction scenario can also be intercepted, and the fourth behavioral characteristic D and the possibly problematic fifth behavioral characteristic E, etc. are recorded in the log and form a sinking label. Finally, based on multiple sinking labels A, B, C, D, and E, etc., a behavioral portrait of the online black production behavior is constructed, configured as a risk control strategy, and real-time risk prevention and interception are carried out in the full-scenario business. In this way, by using sinking labels to prevent risks in the full business scenario, the online black production behavior can be effectively intercepted, and the interception effect is remarkable.

[0066] In addition, the embodiment of the present application also provides an interception device for online black production behavior, see Figure 3 , Figure 3 which is a schematic structural diagram of an interception device for online black production behavior provided by the embodiment of the present application. As Figure 3 shown, the interception device 300 for online black production behavior includes:

[0067] A first acquisition module 301, configured to acquire a first set of behavioral characteristics in a first scenario;

[0068] A first interception module 302, configured to intercept a first behavioral characteristic in the case that the first set of behavioral characteristics includes the first behavioral characteristic of the online black production behavior, and form a sinking label for the first behavioral characteristic and the second behavioral characteristic associated with the first behavioral characteristic in the first set of behavioral characteristics; the sinking label is used to indicate the behavioral characteristics to be intercepted;

[0069] A second acquisition module 303, configured to acquire a second behavior feature group in a second scenario;

[0070] A second interception module 304, configured to intercept the first behavior feature and / or the second behavior feature when the second behavior feature group includes the first behavior feature and / or the second behavior feature, and form a sinking label for the third behavior feature associated with the first behavior feature in the second behavior feature group, and / or form a sinking label for the fourth behavior feature associated with the second behavior feature.

[0071] Optionally, the first acquisition module 301 is specifically configured to: acquire a first behavior feature group in the first scenario based on the log data corresponding to the first scenario;

[0072] The second acquisition module 303 is specifically configured to: acquire a second behavior feature group in the second scenario based on the log data corresponding to the second scenario.

[0073] Optionally, the interception device 300 for network black production behavior further includes:

[0074] A construction module, configured to construct a behavior portrait of network black production behavior based on the sinking label, wherein the behavior portrait of network black production behavior is used to identify network black production behavior in other scenarios except the first scenario and the second scenario.

[0075] Optionally, the interception device 300 for network black production behavior further includes:

[0076] An update module, configured to update the behavior portrait of network black production behavior when sinking labels in other scenarios except the first scenario and the second scenario are acquired.

[0077] Optionally, both the first scenario and the second scenario include at least one scenario, and the at least one scenario included in the first scenario is different from the at least one scenario included in the second scenario.

[0078] Optionally, the first scenario and the second scenario include at least one of the following scenarios: login scenario, user acquisition scenario, membership scenario, payment scenario, and interaction scenario.

[0079] It should be noted that the interception device 300 for network black production behavior can implement any embodiment of the above network black production behavior interception method, and can achieve the same technical effect, which will not be elaborated here one by one.

[0080] Such as Figure 4As shown in the figure, an embodiment of the present application further provides an electronic device, including a processor 411, a communication interface 412, a memory 413, and a communication bus 414. Among them, the processor 411, the communication interface 412, and the memory 413 complete communication with each other through the communication bus 414;

[0081] The memory 413 is used to store computer programs;

[0082] In an embodiment of the present application, when the processor 411 is used to execute the program stored on the memory 413, it implements the interception method for network black production behaviors provided by any one of the foregoing method embodiments, including:

[0083] Obtain a first behavior feature group in a first scenario;

[0084] In the case that the first behavior feature group includes a first behavior feature of a network black production behavior, intercept the first behavior feature, and form a sinking label from the first behavior feature in the first behavior feature group and a second behavior feature associated with the first behavior feature; the sinking label is used to indicate the behavior feature to be intercepted;

[0085] Obtain a second behavior feature group in a second scenario;

[0086] In the case that the second behavior feature group includes the first behavior feature and / or the second behavior feature, intercept the first behavior feature and / or the second behavior feature, and form a sinking label from a third behavior feature associated with the first behavior feature in the second behavior feature group, and / or form a sinking label from a fourth behavior feature associated with the second behavior feature.

[0087] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the steps of the interception method for network black production behaviors provided by any one of the foregoing method embodiments.

[0088] It should be noted that in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "including", "comprising" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not expressly listed, or elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "including a..." does not exclude the existence of additional identical elements in the process, method, article or device including the element.

[0089] The above are only specific embodiments of the present invention, enabling those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be obvious to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to these embodiments shown herein, but rather to the broadest scope consistent with the principles and novel features claimed herein.

Claims

1. An interception method for cyber black production behavior, characterized in that The method includes: Obtain a first behavior feature group in a first scenario; When the first behavior feature group includes a first behavior feature of cyber black production behavior, intercept the first behavior feature, and form a sinking label with the first behavior feature in the first behavior feature group and a second behavior feature associated with the first behavior feature; the sinking label is used to indicate the behavior feature to be intercepted; Obtain a second behavior feature group in a second scenario, where the second scenario refers to one or more scenarios different from the first scenario; When the second behavior feature group includes the first behavior feature and the second behavior feature, intercept the first behavior feature and the second behavior feature, and form a sinking label with a third behavior feature associated with the first behavior feature in the second behavior feature group, and / or form a sinking label with a fourth behavior feature associated with the second behavior feature.

2. The method according to claim 1, wherein The obtaining of the first behavior feature group in the first scenario includes: based on the log data corresponding to the first scenario, obtain the first behavior feature group in the first scenario; The obtaining of the second behavior feature group in the second scenario includes: based on the log data corresponding to the second scenario, obtain the second behavior feature group in the second scenario.

3. The method according to claim 1, characterized in that After intercepting the first behavior feature and / or the second behavior feature, and forming a sinking label with a third behavior feature associated with the first behavior feature in the second behavior feature group, and / or forming a sinking label with a fourth behavior feature associated with the second behavior feature, the method further includes: Based on the sinking label, construct a behavior portrait of cyber black production behavior, where the behavior portrait of cyber black production behavior is used to identify cyber black production behavior in other scenarios except the first scenario and the second scenario.

4. The method according to claim 3, characterized in that, After constructing the behavior portrait of cyber black production behavior based on the sinking label, the method further includes: When sinking labels in other scenarios except the first scenario and the second scenario are obtained, update the behavior portrait of cyber black production behavior.

5. The method according to any one of claims 1-4, characterized in that, Both the first scenario and the second scenario include at least one scenario, and at least one scenario included in the first scenario is different from at least one scenario included in the second scenario.

6. The method according to any one of claims 5, characterized in that, The first scenario and the second scenario include at least one of the following scenarios: login scenario, user acquisition scenario, membership scenario, payment scenario, and interaction scenario.

7. An interception device for online black production behavior, characterized in that, The device includes: A first acquisition module, configured to obtain a first behavior feature group in a first scenario; A first interception module, configured to intercept the first behavior feature when the first behavior feature group includes a first behavior feature of cyber black production behavior, and form a sinking label with the first behavior feature in the first behavior feature group and a second behavior feature associated with the first behavior feature; the sinking label is used to indicate the behavior feature to be intercepted; A second acquisition module, configured to obtain a second behavior feature group in a second scenario, where the second scenario refers to one or more scenarios different from the first scenario; The second interception module is configured to intercept the first behavior feature and the second behavior feature when the first behavior feature and the second behavior feature are included in the second behavior feature group, and form a sinking label for the third behavior feature associated with the first behavior feature and / or the fourth behavior feature associated with the second behavior feature in the second behavior feature group.

8. The device according to claim 7, characterized in that The first acquisition module is specifically configured to: acquire a first behavior feature group in the first scenario based on the log data corresponding to the first scenario; The second acquisition module is specifically configured to: acquire a second behavior feature group in the second scenario based on the log data corresponding to the second scenario.

9. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus. Among them, the processor, the communication interface, and the memory complete mutual communication through the communication bus; The memory is used to store a computer program; When the processor is configured to execute the program stored on the memory, it implements the steps of the method for intercepting network black production behaviors according to any one of claims 1-6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the method for intercepting network black production behaviors according to any one of claims 1-6.

Images