Abnormal account identification method and device, electronic device and storage medium

Abstract

The present application provides a method and device for identifying abnormal accounts, an electronic device, and a storage medium, and belongs to the field of artificial intelligence technology. The method includes: constructing an initial heterogeneous graph based on access scenario data, basic account information, behavioral feature data, and access frequency data; calculating the node suspicion of the initial graph nodes to obtain the initial node suspicion, and calculating the edge suspicion of the initial access behavior sequence to obtain the edge suspicion; constructing an initial account search tree and an initial scenario search tree based on the initial node suspicion; pruning the initial heterogeneous graph based on the initial account search tree and the initial scenario search tree to obtain an intermediate heterogeneous graph, and scoring the abnormality of the intermediate heterogeneous graph to obtain an average suspicion; screening out a target heterogeneous graph from the intermediate heterogeneous graph based on the average suspicion; scoring the risk of the target heterogeneous graph to obtain a risk score; and identifying abnormal accounts from the target heterogeneous graph based on the risk score. The present application can improve the accuracy of identifying abnormal accounts.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a method and device for identifying abnormal accounts, an electronic device, and a storage medium. Background Art

[0002] Most current methods for identifying abnormal accounts are based on anomaly analysis of the characteristics of each account itself to determine whether the account is an abnormal account. This method often has the problem of low recognition accuracy. Therefore, how to improve the accuracy of identifying abnormal accounts has become a technical problem that needs to be solved urgently. Summary of the Invention

[0003] The main purpose of the embodiments of the present application is to propose a method and device for identifying abnormal accounts, an electronic device and a storage medium, aiming to improve the accuracy of identifying abnormal accounts.

[0004] To achieve the above objectives, a first aspect of an embodiment of the present application provides a method for identifying abnormal accounts, the method comprising:

[0005] Obtain target access data and basic account information of a target account, wherein the target access data includes behavioral feature data, access scenario data, and access frequency data of the target account;

[0006] Determining an initial graph node based on the access scenario data and the basic account information, determining an initial access behavior sequence based on the behavior feature data and the access frequency data, and constructing an initial heterogeneous graph based on the initial access behavior sequence and the initial graph nodes; wherein the initial graph node includes an initial account node and an initial scenario node, the initial access behavior sequence includes at least two initial account behavior features, and each initial account behavior feature connects two adjacent initial graph nodes;

[0007] Performing node suspicion calculation on the initial graph node to obtain an initial node suspicion, and performing edge suspicion calculation on the initial access behavior sequence to obtain an edge suspicion, wherein the initial node suspicion includes a first suspicion of the initial account node and a second suspicion of the initial scenario node;

[0008] constructing an initial account search tree based on the first suspicion level and the initial account node, and constructing an initial scenario search tree based on the second suspicion level and the initial scenario node;

[0009] Pruning the initial heterogeneous graph based on the initial account search tree and the initial scenario search tree to obtain an intermediate heterogeneous graph, and performing anomaly scoring on the intermediate heterogeneous graph to obtain an average suspicion degree;

[0010] Identify the intermediate heterogeneous graph according to the average suspiciousness to obtain a target heterogeneous graph;

[0011] Performing a risk score on the target heterogeneous graph based on a preset risk scoring model to obtain a risk score; wherein the risk score is used to characterize the risk level of the initial account node;

[0012] Abnormal accounts are screened out from the target heterogeneous graph according to the risk scores.

[0013] In some embodiments, performing node suspicion calculation on the initial graph nodes to obtain initial node suspicion, and performing edge suspicion calculation on the initial access behavior sequence to obtain edge suspicion, includes:

[0014] Obtaining the number of features of the initial account behavior features;

[0015] Calculating edge suspicion based on a preset formula and the number of features to obtain an edge suspicion for each of the initial account behavior features;

[0016] According to the connection relationship between the initial account behavior feature and the initial graph node, the edge suspicions of all initial account behavior features connected to the initial graph node are summed to obtain the initial node suspicion of the initial graph node.

[0017] In some embodiments, constructing an initial account search tree based on the first suspicion level and the initial account node, and constructing an initial scenario search tree based on the second suspicion level and the initial scenario node, includes:

[0018] Based on the initial account node, construct an initial account binary tree, and based on the initial scenario node, construct an initial scenario binary tree;

[0019] Based on the first suspicion level, adjusting the node positions of the initial account binary tree to obtain the initial account search tree, wherein the initial account search tree includes an account root node and account leaf nodes;

[0020] Based on the magnitude of the second suspiciousness, the node positions of the initial scene binary tree are adjusted to obtain the initial scene search tree, where the initial scene search tree includes a scene root node and scene leaf nodes.

[0021] In some embodiments, the initial account search tree includes an account root node and an account leaf node, the initial scenario search tree includes a scenario root node and a scenario leaf node, and the pruning of the initial heterogeneous graph based on the initial account search tree and the initial scenario search tree to obtain an intermediate heterogeneous graph, and performing anomaly scoring on the intermediate heterogeneous graph to obtain an average suspicion degree includes:

[0022] Extracting the account root node and the scenario root node, wherein the account root node is the initial account node with the smallest first suspiciousness in the initial account search tree, and the scenario root node is the initial scenario node with the smallest second suspiciousness in the initial scenario search tree;

[0023] Eliminate the account root node and the scenario root node from the initial heterogeneous graph to obtain the intermediate heterogeneous graph;

[0024] Obtaining the number of graph nodes of the intermediate heterogeneous graph;

[0025] Calculating a first suspicious total value of the intermediate isomeric graph based on an initial account node of the intermediate isomeric graph, and calculating a second suspicious total value of the intermediate isomeric graph based on an initial scene node of the intermediate isomeric graph;

[0026] An abnormality score is performed on the intermediate heterogeneous graph according to the preset formula, the number of graph nodes, the first total suspicious value, and the second total suspicious value to obtain the average suspicious degree.

[0027] In some embodiments, the risk scoring model includes a feature extraction layer and a plurality of preset candidate scoring templates. The risk scoring of the target heterogeneous graph based on the preset risk scoring model to obtain a risk score includes:

[0028] Extracting node features from the target heterogeneous graph based on the feature extraction layer to obtain target account features;

[0029] The target account characteristics are risk-scored based on the candidate scoring template to obtain a risk score for each of the initial account nodes.

[0030] In some embodiments, performing risk scoring on the target account characteristics based on the scoring template to obtain a risk score for each of the initial account nodes includes:

[0031] extracting at least two of the candidate scoring templates as target scoring templates;

[0032] Performing a risk score on the target account characteristics based on the target scoring template to obtain a template score;

[0033] The template score is weighted according to a preset weight parameter to obtain the risk score.

[0034] In some embodiments, identifying abnormal accounts from the target heterogeneous graph according to the risk scores includes:

[0035] Comparing the risk score with a preset risk threshold;

[0036] Selecting an initial account node in the target heterogeneous graph whose risk score is greater than the risk threshold as the target account node;

[0037] The target account corresponding to the target account node is regarded as an abnormal account.

[0038] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application provides an abnormal account identification device, the device comprising:

[0039] A data acquisition module, configured to acquire target access data and basic account information of a target account, wherein the target access data includes behavioral feature data, access scenario data, and access frequency data of the target account;

[0040] A graph construction module is configured to determine an initial graph node based on the access scenario data and the basic account information, determine an initial access behavior sequence based on the behavior feature data and the access frequency data, and construct an initial heterogeneous graph based on the initial access behavior sequence and the initial graph nodes; wherein the initial graph node includes an initial account node and an initial scenario node, the initial access behavior sequence includes at least two initial account behavior features, and each initial account behavior feature connects two adjacent initial graph nodes;

[0041] a calculation module configured to perform node suspicion calculation on the initial graph nodes to obtain an initial node suspicion, and perform edge suspicion calculation on the initial access behavior sequence to obtain an edge suspicion, wherein the initial node suspicion includes a first suspicion of the initial account node and a second suspicion of the initial scenario node;

[0042] a search tree construction module, configured to construct an initial account search tree based on the first suspicion level and the initial account node, and to construct an initial scenario search tree based on the second suspicion level and the initial scenario node;

[0043] a heterogeneous graph processing module, configured to prune the initial heterogeneous graph based on the initial account search tree and the initial scenario search tree to obtain an intermediate heterogeneous graph, and perform an anomaly score on the intermediate heterogeneous graph to obtain an average suspicion degree;

[0044] a heterogeneous graph screening module, configured to screen the intermediate heterogeneous graph according to the average suspiciousness to obtain a target heterogeneous graph;

[0045] A scoring module, configured to perform risk scoring on the target heterogeneous graph based on a preset risk scoring model to obtain a risk score; wherein the risk score is used to characterize the risk level of the initial account node;

[0046] An account identification module is used to identify abnormal accounts from the target heterogeneous graph according to the risk score.

[0047] To achieve the above-mentioned purpose, the third aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in the first aspect is implemented.

[0048] To achieve the above-mentioned purpose, the fourth aspect of the embodiments of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the method described in the first aspect.

[0049] The abnormal account identification method, abnormal account identification device, electronic device and storage medium proposed in this application determine the initial graph node through the target account's access scenario data and basic account information, determine the initial access behavior sequence through the target account's behavioral feature data and access frequency data, and construct an initial heterogeneous graph based on the initial access behavior sequence and the initial graph node. The initial graph node includes an initial account node and an initial scenario node, which can display the target access data of the target account in the form of a heterogeneous graph and clearly reflect the correlation between the target account's behavioral features and the access scenario. Furthermore, the node suspicion degree of the initial graph node is calculated to obtain the initial node suspicion degree, and the edge suspicion degree is calculated to obtain the edge suspicion degree of the initial access behavior sequence. An initial account search tree is constructed based on the first suspicion degree and the initial account node, and an initial scenario search tree is constructed based on the second suspicion degree and the initial scenario node. This can more clearly reflect the size of the suspicion degree of each initial account node, and identify the node with the lowest suspicion degree from the initial account search tree and the initial scenario search tree, thereby improving the analysis efficiency and accuracy of the node suspicion degree. Furthermore, the initial heterogeneous graph is pruned based on the initial account search tree and the initial scenario search tree to obtain an intermediate heterogeneous graph. The intermediate heterogeneous graph is then scored for anomalies to obtain an average degree of suspicion. The intermediate heterogeneous graph is then screened based on the average degree of suspicion to obtain a target heterogeneous graph. This method facilitates the pruning of the initial heterogeneous graph, resulting in multiple intermediate heterogeneous graphs and the corresponding average degree of suspicion for each intermediate heterogeneous graph. This allows the presence of abnormal accounts in the intermediate heterogeneous graph to be determined based on the magnitude of the average degree of suspicion, facilitating the identification of abnormal accounts from a group perspective and improving the accuracy of abnormal accounts. Finally, the target heterogeneous graph is risk-scored based on a preset risk scoring model to obtain a risk score, and abnormal accounts are identified from the target heterogeneous graph based on the risk score. This method can more accurately reflect the degree of risk of each target account through the risk score, significantly improving the accuracy of abnormal account identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 This is a flowchart of the abnormal account identification method provided by an embodiment of the present application;

[0051] Figure 2 yes Figure 1 Flowchart of step S103 in FIG.

[0052] Figure 3 yes Figure 1 Flowchart of step S104 in FIG.

[0053] Figure 4 yes Figure 1 Flowchart of step S105 in FIG.

[0054] Figure 5 yes Figure 1 Flowchart of step S107 in FIG.

[0055] Figure 6 yes Figure 5 Flowchart of step S502 in FIG.

[0056] Figure 7 yes Figure 1 Flowchart of step S108 in FIG.

[0057] Figure 8 This is a schematic diagram of the structure of the abnormal account identification device provided in an embodiment of the present application;

[0058] Figure 9 This is a schematic diagram of the hardware structure of the electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0060] It should be noted that although the device schematics illustrate functional module divisions and the flowcharts illustrate logical sequences, in certain circumstances, the steps shown or described may be performed in a sequence that differs from the module divisions in the device or the sequence in the flowcharts. The terms "first," "second," and so on, in the specification, claims, and drawings, are used to distinguish similar items and are not necessarily used to describe a specific sequence or precedence.

[0061] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0062] First, let’s analyze some of the terms used in this application:

[0063] Artificial intelligence (AI) is a new technical discipline that studies and develops theories, methods, technologies, and application systems for simulating, extending, and expanding human intelligence. A branch of computer science, AI seeks to understand the essence of intelligence and create new intelligent machines that can respond in a manner similar to human intelligence. Research in this field includes robotics, speech recognition, image recognition, natural language processing, and expert systems. AI can simulate the information processes of human consciousness and thinking. It also encompasses the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, to perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results.

[0064] Natural Language Processing (NLP): NLP uses computers to process, understand, and apply human languages (such as Chinese and English). It is a branch of artificial intelligence and an interdisciplinary field between computer science and linguistics, often referred to as computational linguistics. Natural language processing encompasses grammatical analysis, semantic analysis, and discourse comprehension. Natural language processing is commonly used in technical fields such as machine translation, handwritten and printed character recognition, speech recognition and text-to-speech conversion, information intent identification, information extraction and filtering, text classification and clustering, public opinion analysis, and opinion mining. It encompasses data mining, machine learning, knowledge acquisition, knowledge engineering, artificial intelligence research related to language processing, and linguistics research related to language computing.

[0065] Information Extraction (NER) is a text processing technology that extracts specified types of entity, relationship, event, and other factual information from natural language text and generates structured data output. Information extraction is a technology that extracts specific information from text data. Text data is composed of specific units, such as sentences, paragraphs, and chapters. Text information is composed of small specific units, such as characters, words, phrases, sentences, paragraphs, or a combination of these specific units. Extracting noun phrases, names, and place names from text data is all text information extraction. Of course, the information extracted by text information extraction technology can be of various types.

[0066] Binary tree: It is an important type of tree structure. The data structures abstracted from many practical problems are often in the form of binary trees. Even general trees can be easily converted into binary trees. The storage structure and algorithm of binary trees are relatively simple. The characteristic of a binary tree is that each node can have at most two subtrees, and they are divided into left and right. A binary tree is a set of n finite elements. The set is either empty or consists of an element called the root and two non-intersecting binary trees called the left subtree and the right subtree. It is an ordered tree. When the set is empty, the binary tree is called an empty binary tree. In a binary tree, an element is also called a node.

[0067] Most current methods for identifying abnormal accounts are based on anomaly analysis of the characteristics of each account itself to determine whether the account is an abnormal account. This method often has the problem of low recognition accuracy. Therefore, how to improve the accuracy of identifying abnormal accounts has become a technical problem that needs to be solved urgently.

[0068] Based on this, the embodiments of the present application provide an abnormal account identification method, an abnormal account identification device, an electronic device and a storage medium, aiming to improve the accuracy of abnormal account identification.

[0069] The abnormal account identification method, abnormal account identification device, electronic device and storage medium provided in the embodiments of the present application are specifically illustrated through the following embodiments. First, the abnormal account identification method in the embodiments of the present application is described.

[0070] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results.

[0071] Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interaction systems, and mechatronics. AI software technologies primarily encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0072] The abnormal account identification method provided in the embodiment of the present application relates to the field of artificial intelligence technology. The abnormal account identification method provided in the embodiment of the present application can be applied in a terminal, can also be applied in a server side, and can also be software running in a terminal or a server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or can be configured as a server cluster or a distributed system composed of multiple physical servers, or can be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the abnormal account identification method, etc., but is not limited to the above forms.

[0073] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and the like. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments in which tasks are performed by remote processing devices connected via a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0074] It should be noted that in each specific embodiment of the present application, when it comes to the need to perform relevant processing based on data related to the user's identity or characteristics, such as user information, user behavior data, user voice data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of such data will comply with the relevant laws, regulations, and standards of the relevant countries and regions. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0075] Figure 1 This is an optional flowchart of the abnormal account identification method provided in the embodiment of the present application. Figure 1 The method may include but is not limited to steps S101 to S108.

[0076] Step S101: Acquire target access data and basic account information of a target account, wherein the target access data includes behavioral feature data, access scenario data, and access frequency data of the target account;

[0077] Step S102: Determine an initial graph node based on the access scenario data and basic account information, determine an initial access behavior sequence based on the behavior feature data and access frequency data, and construct an initial heterogeneous graph based on the initial access behavior sequence and the initial graph nodes; wherein the initial graph node includes an initial account node and an initial scenario node, and the initial access behavior sequence includes at least two initial account behavior features, each of which connects two adjacent initial graph nodes;

[0078] Step S103: Calculate the node suspicion of the initial graph node to obtain the initial node suspicion, and calculate the edge suspicion of the initial access behavior sequence to obtain the edge suspicion. The initial node suspicion includes a first suspicion of the initial account node and a second suspicion of the initial scenario node.

[0079] Step S104: constructing an initial account search tree based on the first suspicion level and the initial account node, and constructing an initial scenario search tree based on the second suspicion level and the initial scenario node;

[0080] Step S105: Pruning the initial heterogeneous graph based on the initial account search tree and the initial scenario search tree to obtain an intermediate heterogeneous graph, and performing an abnormality score on the intermediate heterogeneous graph to obtain an average suspicion degree;

[0081] Step S106, screening the intermediate heterogeneous graphs according to the average suspiciousness to obtain a target heterogeneous graph;

[0082] Step S107: Perform risk scoring on the target heterogeneous graph based on a preset risk scoring model to obtain a risk score; wherein the risk score is used to represent the risk level of the initial account node;

[0083] Step S108: Identify abnormal accounts from the target heterogeneous graph based on the risk scores.

[0084] In the embodiment of the present application, steps S101 to S108 are shown, wherein the initial graph node is determined by the target account's access scenario data and basic account information, the initial access behavior sequence is determined by the target account's behavioral feature data and access frequency data, and an initial heterogeneous graph is constructed based on the initial access behavior sequence and the initial graph node. The initial graph node includes an initial account node and an initial scenario node, which can display the target access data of the target account in the form of a heterogeneous graph and clearly reflect the correlation between the target account's behavioral features and the access scenario. The initial node suspicion is obtained by calculating the node suspicion of the initial graph node, and the edge suspicion is obtained by calculating the edge suspicion of the initial access behavior sequence. An initial account search tree is constructed based on the first suspicion and the initial account node, and an initial scenario search tree is constructed based on the second suspicion and the initial scenario node. This can more clearly reflect the size of the suspicion of each initial account node, and identify the node with the lowest suspicion from the initial account search tree and the initial scenario search tree, thereby improving the efficiency and accuracy of the node suspicion analysis. By pruning the initial heterogeneous graph based on the initial account search tree and the initial scenario search tree to obtain an intermediate heterogeneous graph, the intermediate heterogeneous graph is scored for anomalies to obtain an average suspicion, and the intermediate heterogeneous graph is screened based on the average suspicion to obtain a target heterogeneous graph. This method can conveniently implement the pruning operation on the initial heterogeneous graph, obtain multiple intermediate heterogeneous graphs and the average suspicion corresponding to each intermediate heterogeneous graph, and determine the presence of abnormal accounts in the intermediate heterogeneous graph based on the average suspicion. This facilitates the identification of abnormal accounts from a group perspective and improves the accuracy of abnormal account identification. By scoring the target heterogeneous graph based on a preset risk scoring model to obtain a risk score, and screening abnormal accounts from the target heterogeneous graph based on the risk score, this method can more accurately reflect the degree of risk of each target account through the risk score, and can significantly improve the accuracy of abnormal account identification.

[0085] In step S101 of some embodiments, the target access data and basic account information of the target account can be obtained directly from the log information of the target platform backend, or by crawling the preset data source through a web crawler to obtain the target access data and basic account information of the target account. Among them, the target access data includes the historical behavior data of the target account, and the historical behavior data includes behavior feature data, access scenario data, and access frequency data. The target account is an account registered on the target platform or target client, etc. The basic account information includes the name, contact information, registration device information, etc. of the registrant, and the behavior feature data includes the browsing, clicking, purchasing, and collection behaviors of the target account on the target platform or target client, etc. The access scenario data includes the scenario pages of various business fields within the target platform or target client, etc. For example, the access scenario is a product marketing activity or product promotion activity, etc. The access frequency data includes the browsing time, access time, number of visits, number of interactions, etc. of the target account in different access scenarios.

[0086] In step S102 of some embodiments, the initial graph nodes are determined based on the access scenario data and the basic account information, the initial access behavior sequence is determined based on the behavioral feature data and the access frequency data, and the initial heterogeneous graph is constructed based on the initial access behavior sequence and the initial graph nodes. When constructing the initial heterogeneous graph, the access scenario data and the basic account information are used as the initial graph nodes of the initial heterogeneous graph, the behavioral feature data are used as the edges of the initial heterogeneous graph, and the access frequency data are used as the weights of the initial heterogeneous graph. The initial graph nodes include the initial account nodes and the initial scenario nodes. The initial access behavior sequence includes at least two initial account behavior features, which are obtained based on the behavioral feature data, and each initial account behavior feature connects two adjacent initial graph nodes. This method can display the target access data and basic account information of the target account in the form of a heterogeneous graph, and can clearly reflect the correlation between the behavioral features of the target account and the access scenario.

[0087] Furthermore, the initial graph node set S = [P, Q] of the initial heterogeneous graph is defined, where P represents the initial account node set and Q represents the initial scenario node set. Then the current initial graph node set S = [P1, P2, P3, …, Pm, Q1, Q2, Q3, …, Qn], where m and n are integers greater than 0.

[0088] For example, the basic account information includes account A, account B, scenario C, and scenario D. Based on the behavioral feature data, it is found that account A has a purchase behavior in scenario C, account B has a browsing behavior in scenario C, and account B has a purchase behavior in scenario D. The initial graph nodes of the initial heterogeneous graph include: initial account node A, initial account node B, initial scenario node C, and initial scenario node D. The initial access behavior sequence of the initial heterogeneous graph includes: the purchase behavior characteristics between account A and scenario C, the purchase behavior characteristics between account B and scenario D, and the browsing behavior characteristics between account B and scenario C. That is, there is a connection between the initial account node A and the initial scenario node C, and the initial account node B is connected to the initial scenario node C and the initial scenario node D respectively.

[0089] See also Figure 2 In some embodiments, step S103 may include but is not limited to steps S201 to S203:

[0090] Step S201, obtaining the feature quantity of the initial account behavior feature;

[0091] Step S202: Calculate the edge suspicion level based on a preset formula and the number of features to obtain the edge suspicion level of each initial account behavior feature;

[0092] Step S203 : Based on the connection relationship between the initial account behavior feature and the initial graph node, the edge suspicions of all initial account behavior features connected to the initial graph node are summed to obtain the initial node suspicion of the initial graph node.

[0093] In step S201 of some embodiments, since an edge in an initial heterogeneous graph can only connect to two different types of initial graph nodes, one end connected to the initial account node and the other end connected to the initial scenario node, when calculating the edge suspicion of a certain initial account behavior feature T, the initial account node Pi connected to the initial account behavior feature T is first determined. Then, a statistical function such as a sum function is used to calculate the number of edges connected to the initial account node Pi. The edges connected to the initial account node Pi are queried, and the number of edges is accumulated until all edges connected to the initial account nodes are queried. The number of edges connected to the initial account node Pi is obtained, and this number is used as the feature number of the initial account feature T, where i is an integer greater than 0 and less than or equal to m.

[0094] In step S202 of some embodiments, when calculating the edge suspicion based on a preset formula and the number of features to obtain the edge suspicion of each initial account behavior feature, the preset formula can be expressed as shown in formula (1):

[0095]

[0096] Where y is the edge suspicion of the initial account behavior feature, and x is the number of features (i.e., the number of edges). Based on this formula and the above process, the edge suspicion of all initial account behavior features in the initial heterogeneous graph can be calculated more conveniently.

[0097] In step S203 of some embodiments, based on the initial account behavior characteristics and the connection relationship between the initial graph nodes, the edges connected to each initial graph node are determined, and the edge suspicions of these edges connected to the initial graph node are summed to obtain the initial node suspicion of the initial graph node. Summing the edge suspicions of all edges connected to a particular initial account node yields a first suspicion of the initial account node; summing the edge suspicions of all edges connected to a particular initial scenario node yields a second suspicion of the initial scenario node.

[0098] For example, the edges connected to the initial scenario node Q2 include the first edge (i.e., the first initial account behavior feature), the second edge (i.e., the second initial account behavior feature), and the third edge (i.e., the third initial account behavior feature). The edge suspicions of the first edge, the second edge, and the third edge are calculated to be 0.1, 0.7, and 0.23, respectively. Then the second suspicion of the initial scenario node Q2 is 0.1+0.7+0.23=1.03.

[0099] Through the above steps S201 to S203, the suspicion level of each initial graph node and each initial account behavior feature can be calculated more conveniently, so that the abnormal situation of each target account can be preliminarily determined based on the size of the suspicion level, which is conducive to improving the accuracy of identifying abnormal accounts.

[0100] See also Figure 3 In some embodiments, step S104 may include but is not limited to steps S301 to S303:

[0101] Step S301: construct an initial account binary tree based on the initial account node, and construct an initial scenario binary tree based on the initial scenario node;

[0102] Step S302: Based on the first suspiciousness level, adjust the node positions of the initial account binary tree to obtain an initial account search tree, which includes an account root node and account leaf nodes.

[0103] Step S303: Based on the second suspiciousness, the node positions of the initial scene binary tree are adjusted to obtain an initial scene search tree. The initial scene search tree includes a scene root node and scene leaf nodes.

[0104] In step S301 of some embodiments, all initial account nodes of the initial heterogeneous graph are included in the same set, and an initial account binary tree is constructed according to the order of elements of the initial account node set, that is, the first element of the initial account node set is used as the root node of the initial account binary tree (i.e., the first level of the initial account binary tree), the second element is used as the tree node of the left subtree, the third element is used as the tree node of the right subtree (i.e., the second level of the initial account binary tree), the fourth element and the fifth element are used as leaf nodes of the left subtree, the sixth element and the seventh element are used as leaf nodes of the right subtree (i.e., the third level of the initial account binary tree), the eighth element, the ninth element, the tenth element, and the eleventh element are used as leaf nodes of the left subtree (i.e., the fourth level of the initial account binary tree), and so on, until all elements of the initial account node set are added to the initial account binary tree.

[0105] Similarly, all the initial scene nodes of the initial heterogeneous graph are included in the same set, and an initial scene binary tree is constructed according to the order of the elements of the initial scene node set, that is, the first element of the initial scene node set is used as the root node of the initial scene binary tree (that is, the first level of the initial scene binary tree), and the second element is used as the tree node of the left subtree, and the third element is used as the tree node of the right subtree (that is, the second level of the initial scene binary tree), the fourth element and the fifth element are used as leaf nodes of the left subtree, the sixth element and the seventh element are used as leaf nodes of the right subtree (that is, the third level of the initial scene binary tree), the eighth element, the ninth element, the tenth element, and the eleventh element are used as leaf nodes of the left subtree (that is, the fourth level of the initial scene binary tree), and so on, until all elements of the initial scene node set are added to the initial scene binary tree.

[0106] In step S302 of some embodiments, when adjusting the node positions of the initial account binary tree based on the size of the first suspicion, starting from the first non-leaf node, the adjustment is performed from left to right and from bottom to top, and the leaf nodes or non-leaf nodes with smaller first suspicion are adjusted upward, so that the initial scenario node with the smallest first suspicion becomes the root node, and the initial account search tree is obtained.

[0107] For example, a set of initial account nodes is [(P1,7), (P2,5), (P3,8), (P4,2), (P5,15), (P6,10)(P7,4)]. Taking (P1,7) as an example, P1 refers to the first initial account node (i.e., the first element), and 7 refers to the first suspicion level of the first initial account node. The initial binary tree generated based on this set of initial account nodes is: the root node is (P1,7); the tree node of the left subtree is (P2,5); the tree node of the right subtree is (P3,8); the leaf nodes of the left subtree are (P4,2) and (P5,15); and the leaf nodes of the right subtree are (P6,10)(P7,4).

[0108] From left to right and bottom to top, find the first non-leaf node (P2,5). Perform a first-level suspicion comparison on the first non-leaf node and the nodes below it. This comparison is performed on (P2,5), (P4,2), and (P5,15). If 2 < 5 < 15, the smallest value is (P4,2). Swap (P2,5) and (P4,2). (P4,2) becomes the new node of the left subtree. Similarly, find the second non-leaf node (P3,8). Perform a first-level suspicion comparison on the second non-leaf node and the nodes below it. This comparison is performed on (P3,8), (P6,10), and (P7,4). If 4 < 8 < 10, the smallest value is (P7,4). Swap (P3,8) and (P7,4). (P7,4) becomes the new node of the right subtree. Similarly, find the third non-leaf node (P1,7) and perform a first suspicion comparison on the third non-leaf node and the nodes below it. That is, compare the first suspicion of (P1,7), (P4,2), and (P7,4). 2<4<7, and the smallest one is (P4,2). Then swap the positions of (P1,7) and (P4,2). At this time, (P4,2) becomes the new root node.

[0109] In step S303 of some embodiments, when adjusting the node positions of the initial scene binary tree based on the size of the second suspicion, starting from the first non-leaf node, the adjustment is performed from left to right and from bottom to top, and the leaf nodes or non-leaf nodes with smaller second suspicion are adjusted upward, so that the initial scene node with the smallest second suspicion becomes the root node, and the initial scene search tree is obtained.

[0110] Through the above steps S301 to 3203, the node suspicion analysis of the initial account node and the initial scenario node can be performed in the form of a binary tree, which can more clearly reflect the suspicion level of each initial account node and identify the node with the lowest suspicion from the initial account search tree and the initial scenario search tree, thereby improving the analysis efficiency and accuracy of the node suspicion.

[0111] See also Figure 4 In some embodiments, the initial account search tree includes an account root node and an account leaf node, and the initial scenario search tree includes a scenario root node and a scenario leaf node. Step S105 may include, but is not limited to, steps S401 to S405:

[0112] Step S401: extracting an account root node and a scenario root node, wherein the account root node is the initial account node with the lowest first suspiciousness in the initial account search tree, and the scenario root node is the initial scenario node with the lowest second suspiciousness in the initial scenario search tree;

[0113] Step S402: Remove the account root node and the scenario root node from the initial heterogeneous graph to obtain an intermediate heterogeneous graph;

[0114] Step S403, obtaining the number of graph nodes of the intermediate heterogeneous graph;

[0115] Step S404, based on the initial account node of the intermediate heterogeneous graph, calculating the first suspicious total value of the intermediate heterogeneous graph, and based on the initial scene node of the intermediate heterogeneous graph, calculating the second suspicious total value of the intermediate heterogeneous graph;

[0116] Step S405 , performing anomaly scoring on the intermediate heterogeneous graph according to a preset formula, the number of graph nodes, the first suspicious total value, and the second suspicious total value to obtain an average suspicious degree.

[0117] In step S401 of some embodiments, an account root node is extracted from the initial account search tree, and a scene root node is extracted from the initial scene search tree, wherein the account root node is the initial account node with the smallest first suspiciousness in the initial account search tree, and the scene root node is the initial scene node with the smallest second suspiciousness in the initial scene search tree.

[0118] In step S402 of some embodiments, the account root node and the scenario root node are removed from the initial heterogeneous graph, and the initial account behavior features related to the account root node and the scenario root node are removed. The graph is reconstructed based on the remaining initial account nodes, initial scene nodes, and initial account behavior features to obtain an intermediate heterogeneous graph K1 after the first pruning, that is, the remaining initial account nodes and initial scene nodes are used as graph nodes of the reconstructed intermediate heterogeneous graph K1, and the initial account behavior features between the remaining initial account nodes and the initial scene nodes are used as edges of the intermediate heterogeneous graph K1.

[0119] In step S403 of some embodiments, the number of graph nodes of the intermediate heterogeneous graph K1 can be calculated using statistical functions such as the sum function. For example, the total number of nodes |P| of the initial account nodes in the intermediate heterogeneous graph is first counted using the sum function, and then the total number of nodes |Q| of the initial scene nodes in the intermediate heterogeneous graph is counted using the sum function. Finally, the number of graph nodes |S| = |P| + |Q| of the intermediate heterogeneous graph is obtained.

[0120] In step S404 of some embodiments, the first suspicions of the remaining initial account nodes in the intermediate heterogeneous graph K1 are first added to obtain a first suspicious total value F(P), wherein the first suspicion of the remaining initial account nodes here is the suspicion calculated according to the above-mentioned step S103; similarly, the second suspicions of the remaining initial scene nodes in the intermediate heterogeneous graph K1 are added to obtain a second suspicious total value F(Q), wherein the second suspicion of the remaining initial scene nodes here is the suspicion calculated according to the above-mentioned step S103.

[0121] In step S405 of some embodiments, the intermediate heterogeneous graph is scored for abnormality based on a preset formula, the number of graph nodes, the first total suspicious value, and the second total suspicious value. The calculation process of obtaining the average suspiciousness G(S) can be expressed as shown in formula (2):

[0122]

[0123] Where G(S) is the average suspicion of the current intermediate heterogeneous graph, |S| is the total number of graph nodes in the current intermediate heterogeneous graph, |P| is the total number of initial account nodes in the current intermediate heterogeneous graph, |Q| is the total number of initial scene nodes in the current intermediate heterogeneous graph, F(P) is the first suspicious total value of the initial account nodes in the current intermediate heterogeneous graph, F(Q) is the second suspicious total value of the initial scene nodes in the current intermediate heterogeneous graph, and F(S) is the total suspicious value of the nodes in the current intermediate heterogeneous graph.

[0124] Similarly, after calculating the average suspicion of the intermediate heterogeneous graph K1, refer to the above step S103 to recalculate the edge suspicion of the initial account behavior feature and the node suspicion of the initial graph node in the intermediate heterogeneous graph, and then, based on the calculated new node suspicion (including the new first suspicion and the new second suspicion), refer to the above steps S301 to S303 to construct the initial account search tree and initial scenario search tree corresponding to the intermediate heterogeneous graph K1, and obtain the new account root node and the new scenario root node, and then refer to the above steps S401 to S403. In step S405, the intermediate heterogeneous graph K1 is pruned to obtain a new intermediate heterogeneous graph K2 and the average suspicion corresponding to the intermediate heterogeneous graph K2. The aforementioned process is repeated to continue to construct a search tree and prune the intermediate heterogeneous graph K2 to obtain the intermediate heterogeneous graph K3 and the average suspicion corresponding to the intermediate heterogeneous graph K3, and so on. After the intermediate heterogeneous graph Kj is pruned (i.e., after removing the account root node and the scene root node in the intermediate heterogeneous graph Kj, j is an integer greater than 0), there are no remaining initial account nodes and initial scene nodes, and pruning is stopped.

[0125] Through the above steps S401 to S405, the pruning operation of the initial heterogeneous graph can be implemented more conveniently, and multiple intermediate heterogeneous graphs and the average suspicion corresponding to each intermediate heterogeneous graph can be obtained, so that the existence of abnormal accounts in each intermediate heterogeneous graph can be determined according to the size of the average suspicion, which is conducive to identifying abnormal accounts from a group perspective and improving the accuracy of abnormal accounts.

[0126] In step S106 of some embodiments, the average suspicion of the intermediate heterogeneous graph obtained after each pruning is compared. The larger the average suspicion, the more abnormal accounts exist in the intermediate heterogeneous graph. The intermediate heterogeneous graph is then screened according to the average suspicion, and the intermediate heterogeneous graph with the largest average suspicion is selected to obtain the target heterogeneous graph.

[0127] See also Figure 5 In some embodiments, the risk scoring model includes a feature extraction layer and a plurality of preset candidate scoring templates. Step S107 may include but is not limited to steps S501 to S502:

[0128] Step S501: extract node features from the target heterogeneous graph based on the feature extraction layer to obtain target account features;

[0129] Step S502 : Perform risk scoring on the target account characteristics based on the candidate scoring template to obtain a risk score for each initial account node.

[0130] In step S501 of some embodiments, the risk scoring model can be constructed based on a commonly used deep learning model. For example, the risk scoring model can be a convolutional neural network model, a recurrent neural network model, etc., but is not limited thereto. The risk scoring model includes a feature extraction layer and multiple preset candidate scoring templates. The feature extraction layer is used to extract node feature information in the target heterogeneous graph. The candidate scoring templates can be constructed based on expert experience. For example, the candidate scoring templates may set different scoring rules for different account behaviors. When a certain account behavior feature matches the rule, a corresponding score is generated. For example, the candidate template includes scores set for different browsing times. If the browsing time is less than 10 minutes, the score is 5 points. If the browsing time is between 10 minutes and 60 minutes, the score is 10 points. The candidate template also includes scores set for whether there is purchase behavior. If there is purchase behavior, the score is 20 points, if there is no purchase behavior, the score is 5 points, and so on. The candidate scoring templates can be set according to different dimensions, that is, the candidate templates can include behavior time scoring templates, behavior frequency scoring templates, behavior type scoring templates, etc. The total score of the candidate scoring templates can be set to 100 points.

[0131] Among them, when extracting node features of the target heterogeneous graph based on the feature extraction layer, a named entity recognition algorithm can be used to extract the entity features corresponding to each initial account node in the target heterogeneous graph to obtain the target account features, which include the registration time, registration type, account access behavior characteristics, etc. of the target account.

[0132] In step S502 of some embodiments, when risk scoring is performed on target account features based on candidate scoring templates, at least two candidate scoring templates can be extracted as target scoring templates, and risk scores are performed on the target account features based on the selected target scoring templates to obtain multiple template scores. These template scores are then weighted according to the weight ratios of different target scoring templates to obtain a risk score for each initial account node in the target heterogeneous graph. The risk score can characterize the risk level of each initial account node.

[0133] Through the above steps S501 to S502, it is possible to more conveniently extract features from each initial account node in the target heterogeneous graph, obtain more important account behavior feature information, and directly perform risk scoring based on the preset candidate scoring template, which can greatly improve the efficiency of risk scoring. At the same time, the candidate scoring template is set based on expert experience and can have good objectivity and rationality, which is conducive to improving the accuracy of risk scoring. Therefore, the risk score can more accurately reflect the degree of risk of each target account, which is conducive to the identification of abnormal accounts.

[0134] See also Figure 6In some embodiments, step S502 includes but is not limited to steps S601 to S603:

[0135] Step S601: extract at least two candidate scoring templates as target scoring templates;

[0136] Step S602: Perform risk scoring on the target account characteristics based on the target scoring template to obtain a template score;

[0137] Step S603: Perform weighted calculation on the template scores according to preset weight parameters to obtain a risk score.

[0138] In step S601 of some embodiments, in order to improve both scoring efficiency and scoring accuracy, some candidate scoring templates may be extracted from multiple candidate scoring templates to perform risk scoring on target account features. For example, at least two candidate scoring templates may be extracted as target scoring templates.

[0139] In step S602 of some embodiments, when risk scoring the target account characteristics based on the target scoring template, each reference account characteristic in the target scoring template is compared with the target account characteristic. If there is an account characteristic that is identical to the target account characteristic, the score corresponding to the reference account characteristic is added to the risk score of the target account characteristic, and the scores of all reference account characteristics corresponding to the target account characteristic are accumulated to obtain the template score. For example, the target scoring template includes a behavior scoring template and a time scoring template. The behavior scoring template includes click behavior (10 points), purchase behavior (20 points), and favorite behavior (15 points). If the target account characteristics include clicking and favorited item A in a certain scenario, the template score corresponding to the behavior scoring template is 10 + 15 = 25 points.

[0140] In step S603 of some embodiments, since different template scores have different importance for the identification of abnormal accounts, different weight parameters can be preset for different candidate scoring templates. After obtaining the template score of each target scoring template, the template score is weightedly calculated to obtain the risk score of the initial account node of the target heterogeneous graph.

[0141] Through steps S601 to S603, the candidate scoring templates can be screened and the one that meets the current needs can be selected as the target scoring template. The target scoring template can be used to directly perform risk scoring, which can greatly improve the efficiency of risk scoring. At the same time, since all candidate scoring templates are set based on expert experience and have different weight ratios, the risk scoring process can be made more objective and reasonable, which is conducive to improving the accuracy of risk scoring.

[0142] See also Figure 7In some embodiments, step S108 may include but is not limited to steps S701 to S703:

[0143] Step S701, comparing the risk score with a preset risk threshold;

[0144] Step S702: Select an initial account node in the target heterogeneous graph whose risk score is greater than a risk threshold as a target account node;

[0145] Step S703: The target account corresponding to the target account node is regarded as an abnormal account.

[0146] In some embodiments, in step S701, the risk threshold can be set based on actual conditions, for example, 0.5. The risk score is compared with the preset risk threshold. If the risk score exceeds the risk threshold, it indicates that the initial account node is likely to be abnormal. If the risk score is less than the risk threshold, it indicates that the initial account node is normal.

[0147] In steps S702 and S703 of some embodiments, by comparing the risk score with a preset risk threshold, if the risk score exceeds the risk threshold, it indicates that there is a high possibility that the initial account node is abnormal. Therefore, the initial account node with a risk score greater than the risk threshold in the target heterogeneous graph is selected as the target account node, and the target account corresponding to the target account node is selected as the abnormal account.

[0148] Through the above steps S701 to S703, based on the comparison between the risk score and the risk threshold, the initial account nodes with a greater possibility of abnormality can be screened out as target account nodes, and the target accounts corresponding to these target account nodes can be identified, thereby determining the abnormal accounts among all target accounts, thereby improving the accuracy of identifying abnormal accounts.

[0149] The abnormal account identification method of the embodiment of the present application determines the initial graph node through the target account's access scenario data and basic account information, determines the initial access behavior sequence through the target account's behavioral feature data and access frequency data, and constructs an initial heterogeneous graph based on the initial access behavior sequence and the initial graph node. The initial graph node includes the initial account node and the initial scenario node, which can display the target access data of the target account in the form of a heterogeneous graph and clearly reflect the correlation between the target account's behavioral features and the access scenario. The initial node suspicion is obtained by performing node suspicion calculation on the initial graph node, and the edge suspicion is obtained by performing edge suspicion calculation on the initial access behavior sequence. An initial account search tree is constructed based on the first suspicion and the initial account node, and an initial scenario search tree is constructed based on the second suspicion and the initial scenario node. This can more clearly reflect the size of the suspicion of each initial account node, and identify the node with the lowest suspicion from the initial account search tree and the initial scenario search tree, thereby improving the analysis efficiency and accuracy of the node suspicion. By pruning the initial heterogeneous graph based on the initial account search tree and the initial scenario search tree to obtain an intermediate heterogeneous graph, the intermediate heterogeneous graph is scored for anomalies to obtain an average suspicion, and the intermediate heterogeneous graph is screened based on the average suspicion to obtain a target heterogeneous graph. This method can conveniently implement the pruning operation on the initial heterogeneous graph, obtain multiple intermediate heterogeneous graphs and the average suspicion corresponding to each intermediate heterogeneous graph, and determine the presence of abnormal accounts in the intermediate heterogeneous graph based on the average suspicion. This facilitates the identification of abnormal accounts from a group perspective and improves the accuracy of abnormal account identification. By scoring the target heterogeneous graph based on a preset risk scoring model to obtain a risk score, and screening abnormal accounts from the target heterogeneous graph based on the risk score, this method can more accurately reflect the degree of risk of each target account through the risk score, and can significantly improve the accuracy of abnormal account identification.

[0150] See also Figure 8 The present application also provides an abnormal account identification device that can implement the above abnormal account identification method. The device includes:

[0151] The data acquisition module 801 is used to acquire target access data and basic account information of a target account, wherein the target access data includes behavioral feature data, access scenario data, and access frequency data of the target account;

[0152] Graph construction module 802, configured to determine initial graph nodes based on access scenario data and basic account information, determine initial access behavior sequences based on behavior feature data and access frequency data, and construct an initial heterogeneous graph based on the initial access behavior sequences and initial graph nodes; wherein the initial graph nodes include initial account nodes and initial scenario nodes, and the initial access behavior sequences include at least two initial account behavior features, each of which connects two adjacent initial graph nodes;

[0153] A calculation module 803 is configured to calculate the node suspicion degree of the initial graph node to obtain the initial node suspicion degree, and to calculate the edge suspicion degree of the initial access behavior sequence to obtain the edge suspicion degree. The initial node suspicion degree includes a first suspicion degree of the initial account node and a second suspicion degree of the initial scenario node.

[0154] A search tree construction module 804 is configured to construct an initial account search tree based on the first suspicion level and the initial account node, and to construct an initial scenario search tree based on the second suspicion level and the initial scenario node;

[0155] The heterogeneous graph processing module 805 is used to prune the initial heterogeneous graph based on the initial account search tree and the initial scenario search tree to obtain an intermediate heterogeneous graph, and perform an abnormality score on the intermediate heterogeneous graph to obtain an average suspicion degree;

[0156] A heterogeneous graph screening module 806 is used to screen the intermediate heterogeneous graphs according to the average suspiciousness to obtain a target heterogeneous graph;

[0157] Scoring module 807 is used to perform risk scoring on the target heterogeneous graph based on a preset risk scoring model to obtain a risk score; wherein the risk score is used to represent the risk level of the initial account node;

[0158] The account identification module 808 is used to identify abnormal accounts from the target heterogeneous graph according to the risk scores.

[0159] The specific implementation of the abnormal account identification device is basically the same as the specific embodiment of the abnormal account identification method described above, and will not be repeated here.

[0160] The present application also provides an electronic device comprising: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for enabling communication between the processor and the memory. When the program is executed by the processor, the above-described abnormal account identification method is implemented. The electronic device can be any intelligent terminal, including a tablet computer and an in-vehicle computer.

[0161] See also Figure 9 , Figure 9 The hardware structure of an electronic device according to another embodiment is shown. The electronic device includes:

[0162] The processor 901 may be implemented using a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is configured to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0163] The memory 902 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 902 and is called by the processor 901 to execute the abnormal account identification method of the embodiments of this application;

[0164] Input / output interface 903, used to implement information input and output;

[0165] Communication interface 904, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, Wi-Fi, Bluetooth, etc.);

[0166] Bus 905 , which transmits information between various components of the device (e.g., processor 901 , memory 902 , input / output interface 903 , and communication interface 904 );

[0167] The processor 901 , the memory 902 , the input / output interface 903 and the communication interface 904 are connected to each other in communication within the device via a bus 905 .

[0168] An embodiment of the present application also provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the above-mentioned abnormal account identification method.

[0169] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0170] The abnormal account identification method, abnormal account identification device, electronic device and computer-readable storage medium provided in the embodiments of the present application determine the initial graph node through the access scenario data and basic account information of the target account, determine the initial access behavior sequence through the behavioral feature data and access frequency data of the target account, and construct an initial heterogeneous graph based on the initial access behavior sequence and the initial graph node. The initial graph node includes the initial account node and the initial scenario node, which can display the target access data of the target account in the form of a heterogeneous graph and clearly reflect the correlation between the behavioral features and access scenarios of the target account. The initial node suspicion is obtained by calculating the node suspicion of the initial graph node, and the edge suspicion is calculated for the initial access behavior sequence to obtain the edge suspicion. The initial account search tree is constructed based on the first suspicion and the initial account node, and the initial scenario search tree is constructed based on the second suspicion and the initial scenario node. The suspiciousness of each initial account node can be more clearly reflected, and the node with the lowest suspicion can be identified from the initial account search tree and the initial scenario search tree, thereby improving the analysis efficiency and accuracy of the node suspicion. By pruning the initial heterogeneous graph based on the initial account search tree and the initial scenario search tree to obtain an intermediate heterogeneous graph, the intermediate heterogeneous graph is scored for anomalies to obtain an average suspicion, and the intermediate heterogeneous graph is screened based on the average suspicion to obtain a target heterogeneous graph. This method can conveniently implement the pruning operation on the initial heterogeneous graph, obtain multiple intermediate heterogeneous graphs and the average suspicion corresponding to each intermediate heterogeneous graph, and determine the presence of abnormal accounts in the intermediate heterogeneous graph based on the average suspicion. This facilitates the identification of abnormal accounts from a group perspective and improves the accuracy of abnormal account identification. By scoring the target heterogeneous graph based on a preset risk scoring model to obtain a risk score, and screening abnormal accounts from the target heterogeneous graph based on the risk score, this method can more accurately reflect the degree of risk of each target account through the risk score, and can significantly improve the accuracy of abnormal account identification.

[0171] The embodiments described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0172] It will be understood by those skilled in the art that Figure 1-7 The technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than those shown in the figures, or a combination of certain steps, or different steps.

[0173] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0174] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0175] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0176] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0177] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the above-mentioned units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0178] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0179] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0180] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store programs.

[0181] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention should be within the scope of the present invention.

Claims

1. A method for identifying abnormal accounts, characterized in that: The method comprises: Obtain target access data and basic account information of a target account, wherein the target access data includes behavioral feature data, access scenario data, and access frequency data of the target account; Determining an initial graph node based on the access scenario data and the basic account information, determining an initial access behavior sequence based on the behavior feature data and the access frequency data, and constructing an initial heterogeneous graph based on the initial access behavior sequence and the initial graph nodes; wherein the initial graph node includes an initial account node and an initial scenario node, the initial access behavior sequence includes at least two initial account behavior features, and each initial account behavior feature connects two adjacent initial graph nodes; Performing node suspicion calculation on the initial graph node to obtain an initial node suspicion, and performing edge suspicion calculation on the initial access behavior sequence to obtain an edge suspicion, wherein the initial node suspicion includes a first suspicion of the initial account node and a second suspicion of the initial scenario node; constructing an initial account search tree based on the first suspicion level and the initial account node, and constructing an initial scenario search tree based on the second suspicion level and the initial scenario node; Pruning the initial heterogeneous graph based on the initial account search tree and the initial scenario search tree to obtain an intermediate heterogeneous graph, and performing anomaly scoring on the intermediate heterogeneous graph to obtain an average suspicion degree; The intermediate heterogeneous graph is screened according to the average suspicion to obtain a target heterogeneous graph; the target heterogeneous graph is risk-scored based on a preset risk scoring model to obtain a risk score; wherein the risk score is used to represent the risk level of the initial account node; identifying abnormal accounts from the target heterogeneous graph according to the risk scores; The constructing an initial account search tree based on the first suspicion level and the initial account node, and constructing an initial scenario search tree based on the second suspicion level and the initial scenario node, includes: Based on the initial graph nodes, an initial binary tree is constructed, and based on the suspiciousness of the initial nodes, node positions of the initial binary tree are adjusted to obtain an initial search tree, wherein the initial search tree includes a root node and leaf nodes, and the initial search tree includes an initial account search tree and an initial scenario search tree; The initial account search tree includes an account root node and an account leaf node, the initial scenario search tree includes a scenario root node and a scenario leaf node, the initial heterogeneous graph is pruned based on the initial account search tree and the initial scenario search tree to obtain an intermediate heterogeneous graph, and the intermediate heterogeneous graph is scored for abnormality to obtain an average suspicion degree, including: Extracting the account root node and the scenario root node, wherein the account root node is the initial account node with the smallest first suspiciousness in the initial account search tree, and the scenario root node is the initial scenario node with the smallest second suspiciousness in the initial scenario search tree; Eliminate the account root node and the scenario root node from the initial heterogeneous graph to obtain the intermediate heterogeneous graph; obtain the number of graph nodes in the intermediate heterogeneous graph; Based on the initial account node of the intermediate heterogeneous graph, a first suspicious total value of the intermediate heterogeneous graph is calculated, and based on the initial scene node of the intermediate heterogeneous graph, a second suspicious total value of the intermediate heterogeneous graph is calculated; and the intermediate heterogeneous graph is scored for abnormality according to a preset formula, the number of graph nodes, the first suspicious total value, and the second suspicious total value to obtain the average suspicious degree.

2. The abnormal account identification method according to claim 1, characterized in that: The performing node suspicion calculation on the initial graph nodes to obtain the initial node suspicion, and performing edge suspicion calculation on the initial access behavior sequence to obtain the edge suspicion, includes: Obtaining the number of features of the initial account behavior features; Calculating edge suspicion based on a preset formula and the number of features to obtain an edge suspicion for each of the initial account behavior features; According to the connection relationship between the initial account behavior feature and the initial graph node, the edge suspicions of all initial account behavior features connected to the initial graph node are summed to obtain the initial node suspicion of the initial graph node.

3. The abnormal account identification method according to claim 2, characterized in that: The constructing an initial account search tree based on the first suspicion level and the initial account node, and constructing an initial scenario search tree based on the second suspicion level and the initial scenario node, includes: Based on the initial account node, construct an initial account binary tree, and based on the initial scenario node, construct an initial scenario binary tree; Based on the first suspicion level, adjusting the node positions of the initial account binary tree to obtain the initial account search tree, wherein the initial account search tree includes an account root node and account leaf nodes; Based on the magnitude of the second suspiciousness, the node positions of the initial scene binary tree are adjusted to obtain the initial scene search tree, where the initial scene search tree includes a scene root node and scene leaf nodes.

4. The abnormal account identification method according to claim 1, characterized in that: The risk scoring model includes a feature extraction layer and a plurality of preset candidate scoring templates. The risk scoring of the target heterogeneous graph based on the preset risk scoring model to obtain a risk score includes: Extracting node features from the target heterogeneous graph based on the feature extraction layer to obtain target account features; The target account characteristics are risk-scored based on the candidate scoring template to obtain a risk score for each of the initial account nodes.

5. The abnormal account identification method according to claim 4, characterized in that: The step of performing risk scoring on the target account characteristics based on the scoring template to obtain a risk score for each of the initial account nodes includes: extracting at least two of the candidate scoring templates as target scoring templates; Performing a risk score on the target account characteristics based on the target scoring template to obtain a template score; The template score is weighted according to a preset weight parameter to obtain the risk score.

6. The abnormal account identification method according to any one of claims 1 to 5, characterized in that: The identifying abnormal accounts from the target heterogeneous graph according to the risk scores includes: Comparing the risk score with a preset risk threshold; Selecting an initial account node in the target heterogeneous graph whose risk score is greater than the risk threshold as the target account node; The target account corresponding to the target account node is regarded as an abnormal account.

7. An abnormal account identification device, characterized in that: The device comprises: A data acquisition module, configured to acquire target access data and basic account information of a target account, wherein the target access data includes behavioral feature data, access scenario data, and access frequency data of the target account; A graph construction module is configured to determine an initial graph node based on the access scenario data and the basic account information, determine an initial access behavior sequence based on the behavior feature data and the access frequency data, and construct an initial heterogeneous graph based on the initial access behavior sequence and the initial graph nodes; wherein the initial graph node includes an initial account node and an initial scenario node, the initial access behavior sequence includes at least two initial account behavior features, and each initial account behavior feature connects two adjacent initial graph nodes; a calculation module configured to perform node suspicion calculation on the initial graph nodes to obtain an initial node suspicion, and perform edge suspicion calculation on the initial access behavior sequence to obtain an edge suspicion, wherein the initial node suspicion includes a first suspicion of the initial account node and a second suspicion of the initial scenario node; a search tree construction module, configured to construct an initial account search tree based on the first suspicion level and the initial account node, and to construct an initial scenario search tree based on the second suspicion level and the initial scenario node; a heterogeneous graph processing module, configured to prune the initial heterogeneous graph based on the initial account search tree and the initial scenario search tree to obtain an intermediate heterogeneous graph, and perform an anomaly score on the intermediate heterogeneous graph to obtain an average suspicion degree; a heterogeneous graph screening module, configured to screen the intermediate heterogeneous graph according to the average suspiciousness to obtain a target heterogeneous graph; A scoring module, configured to perform risk scoring on the target heterogeneous graph based on a preset risk scoring model to obtain a risk score; wherein the risk score is used to characterize the risk level of the initial account node; An account identification module, configured to identify abnormal accounts from the target heterogeneous graph according to the risk score; The constructing an initial account search tree based on the first suspicion level and the initial account node, and constructing an initial scenario search tree based on the second suspicion level and the initial scenario node, includes: Based on the initial graph nodes, an initial binary tree is constructed, and based on the suspiciousness of the initial nodes, node positions of the initial binary tree are adjusted to obtain an initial search tree, wherein the initial search tree includes a root node and leaf nodes, and the initial search tree includes an initial account search tree and an initial scenario search tree; The initial account search tree includes an account root node and an account leaf node, the initial scenario search tree includes a scenario root node and a scenario leaf node, the initial heterogeneous graph is pruned based on the initial account search tree and the initial scenario search tree to obtain an intermediate heterogeneous graph, and the intermediate heterogeneous graph is scored for abnormality to obtain an average suspicion degree, including: Extracting the account root node and the scenario root node, wherein the account root node is the initial account node with the smallest first suspiciousness in the initial account search tree, and the scenario root node is the initial scenario node with the smallest second suspiciousness in the initial scenario search tree; Eliminate the account root node and the scenario root node from the initial heterogeneous graph to obtain the intermediate heterogeneous graph; obtain the number of graph nodes in the intermediate heterogeneous graph; Based on the initial account node of the intermediate heterogeneous graph, a first suspicious total value of the intermediate heterogeneous graph is calculated, and based on the initial scene node of the intermediate heterogeneous graph, a second suspicious total value of the intermediate heterogeneous graph is calculated; and the intermediate heterogeneous graph is scored for abnormality according to a preset formula, the number of graph nodes, the first suspicious total value, and the second suspicious total value to obtain the average suspicious degree.

8. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the abnormal account identification method according to any one of claims 1 to 6 when executing the computer program.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the abnormal account identification method according to any one of claims 1 to 6 is implemented.

Images