Abnormal user identification method and device, electronic device, and storage medium

Abstract

The application provides an abnormal user identification method and device, electronic equipment and storage medium, and belongs to the technical field of artificial intelligence. The method comprises the following steps: acquiring current problem data of a target user; traversing a preset problem database, matching the current problem data with reference problem data in the problem database, and obtaining target problem data; performing vectorization processing on the target problem data to obtain a target problem feature vector; performing similarity calculation on the target problem feature vector, a first aggregated behavior feature and a second aggregated behavior feature respectively to obtain a first behavior similarity value, a second behavior similarity value and a third behavior similarity value; performing abnormal identification on the target user according to the first behavior similarity value, the second behavior similarity value and the third behavior similarity value to obtain target identification data, and the target identification data is used to represent whether the target user is an abnormal user. The application can improve the identification accuracy of abnormal users.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to an abnormal user identification method and apparatus, electronic device and storage medium. Background Technology

[0002] In the field of cybersecurity, identifying whether a user's access behavior meets the requirements is particularly important. Most methods for identifying abnormal users rely on changes in CPU and memory usage to determine whether a user's access behavior is abnormal. This approach carries a significant risk of misjudgment and affects the accuracy of identifying abnormal users. Therefore, how to improve the accuracy of identifying abnormal users has become an urgent technical problem to be solved. Summary of the Invention

[0003] The main objective of this application is to provide an abnormal user identification method, apparatus, electronic device, and storage medium, aiming to improve the accuracy of abnormal user identification.

[0004] To achieve the above objectives, a first aspect of this application proposes an abnormal user identification method, the method comprising:

[0005] Obtain the current behavior data of the target user, including the target user's current question data;

[0006] Traverse the preset problem database, match the current problem data with the reference problem data in the problem database, and obtain the target problem data;

[0007] The target problem data is vectorized to obtain the target problem feature vector;

[0008] The similarity between the target problem feature vector and the pre-acquired first aggregated behavior feature is calculated to obtain the first behavior similarity value, wherein the first aggregated behavior feature is used to characterize the clustering characteristics of the historical behavior of all users;

[0009] The similarity between the target problem feature vector and the pre-acquired second aggregated behavior features is calculated to obtain the second behavior similarity value, wherein the second aggregated behavior features are used to characterize the clustering characteristics of the target user's historical behavior;

[0010] A similarity calculation is performed on the first aggregation behavior feature and the second aggregation behavior feature to obtain a third similarity value;

[0011] Based on the first behavior similarity value, the second behavior similarity value, and the third behavior similarity value, the target user is identified as an anomaly to obtain target identification data, which is used to characterize whether the target user is an abnormal user.

[0012] In some embodiments, the step of traversing a preset problem database and matching the current problem data with reference problem data in the problem database to obtain target problem data includes:

[0013] The current problem data is vectorized to obtain the current problem feature vector, and the reference problem data is vectorized to obtain the reference problem feature vector;

[0014] A similarity calculation is performed on the current problem feature vector and each of the reference problem feature vectors to obtain a problem similarity value;

[0015] The reference problem data is filtered based on the problem similarity value to obtain the target problem data.

[0016] In some embodiments, before performing similarity calculations on the target problem feature vector and pre-acquired first aggregation behavior features to obtain a first behavior similarity value, the method further includes obtaining the first aggregation behavior features, specifically including:

[0017] Obtain the first historical behavior data of all the users;

[0018] The first aggregated behavioral features are obtained by clustering the first historical behavioral data using a clustering algorithm based on kernel density estimation.

[0019] In some embodiments, before performing similarity calculations on the target problem feature vector and pre-acquired second aggregated behavior features to obtain a second behavior similarity value, the method further includes obtaining the second aggregated behavior features, specifically including:

[0020] Obtain the second historical behavior data of the target user;

[0021] The second historical behavior data is clustered using a clustering algorithm based on kernel density estimation to obtain the second aggregated behavior features.

[0022] In some embodiments, the target identification data includes identifying the target user as an abnormal user, and the method of identifying the target user as an abnormal user based on the first behavior similarity value, the second behavior similarity value, and the third behavior similarity value to obtain target identification data includes:

[0023] The third row is compared with the similarity value and a preset first threshold;

[0024] If the similarity value of the third row is greater than or equal to the first threshold, then the similarity value of the second row is compared with the preset second threshold;

[0025] If the similarity value of the second behavior is less than the second threshold, then the similarity value of the first behavior is compared with a preset third threshold;

[0026] If the similarity value of the first behavior is less than the third threshold, then the target user is determined to be an abnormal user.

[0027] In some embodiments, the target identification data includes the fact that the target user is an abnormal user. The step of identifying the target user as an abnormal user based on the first behavior similarity value, the second behavior similarity value, and the third behavior similarity value to obtain the target identification data includes:

[0028] The third row is compared with the similarity value and a preset first threshold;

[0029] If the similarity value of the third behavior is less than the first threshold, then the target user is determined to be an abnormal user.

[0030] In some embodiments, the target identification data includes the target user being an abnormal user. After obtaining the target identification data by performing anomaly identification on the target user based on the first behavior similarity value, the second behavior similarity value, and the third behavior similarity value, the method further includes:

[0031] If the target identification data indicates that the target user is an abnormal user, then within a preset time period, the access frequency of the target user is controlled within a preset range, and the access behavior status of the target user within the time period is detected.

[0032] If the access behavior is abnormal, the target user's access rights will be revoked.

[0033] To achieve the above objectives, a second aspect of this application provides an abnormal user identification device, the device comprising:

[0034] The behavior data acquisition module is used to acquire the current behavior data of the target user, including the target user's current question data.

[0035] The matching module is used to traverse a preset problem database and match the current problem data with reference problem data in the problem database to obtain the target problem data.

[0036] The vectorization module is used to perform vectorization processing on the target problem data to obtain the target problem feature vector;

[0037] The first similarity value calculation module is used to calculate the similarity between the target problem feature vector and the pre-acquired first aggregated behavior features to obtain the first behavior similarity value. The first aggregated behavior features are used to characterize the clustering characteristics of the historical behavior of all users.

[0038] The second similarity value calculation module is used to calculate the similarity between the target problem feature vector and the pre-acquired second aggregated behavior features to obtain a second behavior similarity value. The second aggregated behavior features are used to characterize the clustering characteristics of the target user's historical behavior.

[0039] The third similarity value calculation module is used to perform similarity calculation on the first aggregation behavior feature and the second aggregation behavior feature to obtain a third similarity value;

[0040] An anomaly identification module is used to identify the target user as an anomaly based on the first behavior similarity value, the second behavior similarity value, and the third behavior similarity value, and to obtain target identification data, which is used to characterize whether the target user is an anomaly user.

[0041] To achieve the above objectives, a third aspect of the present application provides an electronic device, the electronic device including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method described in the first aspect.

[0042] To achieve the above objectives, a fourth aspect of the present application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in the first aspect.

[0043] The abnormal user identification method, device, electronic device, and storage medium proposed in this application acquire the current behavior data of the target user, including the target user's current question data; and traverse a preset question database, matching the current question data with reference question data in the question database to obtain target question data. This allows for text adjustment of the current question data without altering its basic question content, resulting in target question data that meets the requirements. Further, the target question data is vectorized to obtain a target question feature vector. A similarity calculation is performed between the target question feature vector and a pre-acquired first aggregated behavior feature to obtain a first-row similarity value, which reflects the difference between the current question data and the historical behavior of all users. A similarity calculation is also performed between the target question feature vector and a pre-acquired second aggregated behavior feature to obtain a second-row similarity value, which reflects the difference between the current question data and the target user's historical behavior. Simultaneously, a similarity calculation is performed between the first and second aggregated behavior features to obtain a third-row similarity value, which reflects the difference between the target user's historical behavior and the historical behavior of all users. Finally, based on the similarity values ​​of the first, second, and third rows, anomaly identification of target users is performed. This method can determine whether the target user's current behavior is consistent with the behavior of all users, i.e., anomaly identification is performed from an overall perspective, and it can also determine whether the target user's current behavior is consistent with its own historical behavior, i.e., anomaly identification is performed from the perspective of the individual target user. This makes the target identification data used to characterize whether a target user is an anomaly user more accurate and reasonable, thereby improving the accuracy of anomaly user identification. Attached Figure Description

[0044] Figure 1 This is a flowchart of the abnormal user identification method provided in the embodiments of this application;

[0045] Figure 2 yes Figure 1 The flowchart of step S102 in the document;

[0046] Figure 3 This is another flowchart of the abnormal user identification method provided in the embodiments of this application;

[0047] Figure 4 This is another flowchart of the abnormal user identification method provided in the embodiments of this application;

[0048] Figure 5 yes Figure 1 The flowchart of step S107 in the process;

[0049] Figure 6yes Figure 1 Another flowchart of step S107 in the process;

[0050] Figure 7 This is another flowchart of the abnormal user identification method provided in the embodiments of this application;

[0051] Figure 8 This is a schematic diagram of the abnormal user identification device provided in the embodiments of this application;

[0052] Figure 9 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0054] It should be noted that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, and the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0055] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0056] First, let's analyze some of the terms used in this application:

[0057] Artificial intelligence (AI) is a new branch of computer science that studies, develops, and applies theories, methods, technologies, and systems to simulate, extend, and expand human intelligence. It aims to understand the essence of intelligence and produce intelligent machines that can react in a way similar to human intelligence. Research in this field includes robotics, speech recognition, image recognition, natural language processing, and expert systems. AI can simulate the information processes of human consciousness and thought. Furthermore, AI utilizes digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceiving the environment, acquiring knowledge, and using that knowledge to achieve optimal results.

[0058] Natural Language Processing (NLP): NLP uses computers to process, understand, and utilize human language (such as Chinese and English). NLP is a branch of artificial intelligence and an interdisciplinary field of computer science and linguistics, often referred to as computational linguistics. NLP includes syntactic analysis, semantic analysis, and discourse understanding. It is commonly used in machine translation, handwritten and printed character recognition, speech recognition and text-to-speech conversion, intent recognition, information extraction and filtering, text classification and clustering, sentiment analysis, and opinion mining. It involves data mining, machine learning, knowledge acquisition, knowledge engineering, artificial intelligence research, and linguistic research related to language computation.

[0059] Information Extraction (NER) is a text processing technique that extracts factual information such as entities, relationships, and events from natural language text and outputs it as structured data. Information extraction is a technique for extracting specific information from text data. Text data is composed of specific units, such as sentences, paragraphs, and chapters. Text information is composed of smaller, specific units, such as characters, words, phrases, sentences, paragraphs, or combinations of these units. Extracting noun phrases, names of people, and place names from text data is an example of text information extraction. Of course, text information extraction techniques can extract information of various types.

[0060] Clustering is a typical form of unsupervised learning, an analytical process that groups a collection of physical or abstract objects into multiple classes composed of similar objects. It involves partitioning a dataset into different classes or clusters according to a specific criterion (such as distance), maximizing the similarity of data objects within the same cluster while maximizing the dissimilarity of data objects outside the same cluster. Clustering can be used as a standalone process to find the inherent distribution structure of data, or it can serve as a precursor to other learning tasks.

[0061] Cluster: A subset of a class. Maximize similarity within a cluster; minimize similarity between clusters.

[0062] In the field of cybersecurity, identifying whether a user's access behavior meets the requirements is particularly important. Most methods for identifying abnormal users rely on changes in CPU and memory usage to determine whether a user's access behavior is abnormal. This approach carries a significant risk of misjudgment and affects the accuracy of identifying abnormal users. Therefore, how to improve the accuracy of identifying abnormal users has become an urgent technical problem to be solved.

[0063] Based on this, embodiments of this application provide an abnormal user identification method, an abnormal user identification device, an electronic device, and a computer-readable storage medium, aiming to improve the accuracy of abnormal user identification.

[0064] The abnormal user identification method, abnormal user identification device, electronic device, and computer-readable storage medium provided in this application are specifically described through the following embodiments. First, the abnormal user identification method in this application embodiment is described.

[0065] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0066] Foundational technologies for artificial intelligence generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies mainly encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0067] The abnormal user identification method provided in this application relates to the field of artificial intelligence technology. This method can be applied to a terminal, a server, or software running on either a terminal or a server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, etc.; the server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application implementing the abnormal user identification method, but is not limited to the above forms.

[0068] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0069] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards of the relevant countries and regions. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirects to confirmation pages. Only after obtaining the user's separate permission or consent is the necessary user-related data for the proper functioning of the embodiments of this application obtained.

[0070] Figure 1 This is an optional flowchart of the abnormal user identification method provided in the embodiments of this application. Figure 1 The method may include, but is not limited to, steps S101 to S107.

[0071] Step S101: Obtain the target user's current behavior data, which includes the target user's current question data;

[0072] Step S102: Traverse the preset problem database, match the current problem data with the reference problem data in the problem database, and obtain the target problem data;

[0073] Step S103: Vectorize the target problem data to obtain the target problem feature vector;

[0074] Step S104: Calculate the similarity between the target problem feature vector and the pre-acquired first aggregated behavior feature to obtain the first behavior similarity value. The first aggregated behavior feature is used to characterize the clustering features of the historical behavior of all users.

[0075] Step S105: Calculate the similarity between the target problem feature vector and the pre-acquired second aggregated behavior features to obtain the second behavior similarity value. The second aggregated behavior features are used to characterize the clustering features of the target user's historical behavior.

[0076] Step S106: Calculate the similarity between the first aggregation behavior feature and the second aggregation behavior feature to obtain the similarity value of the third behavior;

[0077] Step S107: Based on the similarity values ​​of the first row, the second row, and the third row, perform anomaly identification on the target user to obtain target identification data. The target identification data is used to characterize whether the target user is an abnormal user.

[0078] Steps S101 to S107 of this embodiment involve acquiring the target user's current behavior data, including the target user's current question data; traversing a preset question database and matching the current question data with reference question data in the database to obtain target question data. This allows for text adjustment of the current question data without altering its basic question content, resulting in target question data that meets the requirements. Further, the target question data is vectorized to obtain a target question feature vector. A similarity calculation is performed between the target question feature vector and a pre-acquired first aggregated behavior feature to obtain a first-row similarity value, which reflects the difference between the current question data and the historical behavior of all users. A similarity calculation is also performed between the target question feature vector and a pre-acquired second aggregated behavior feature to obtain a second-row similarity value, which reflects the difference between the current question data and the target user's historical behavior. Simultaneously, a similarity calculation is performed between the first and second aggregated behavior features to obtain a third-row similarity value, which reflects the difference between the target user's historical behavior and the historical behavior of all users. Finally, based on the similarity values ​​of the first, second, and third rows, anomaly identification of target users is performed. This method can determine whether the target user's current behavior is consistent with the behavior of all users, i.e., anomaly identification is performed from an overall perspective, and it can also determine whether the target user's current behavior is consistent with its own historical behavior, i.e., anomaly identification is performed from the perspective of the individual target user. This makes the target identification data used to characterize whether a target user is an anomaly user more accurate and reasonable, thereby improving the accuracy of anomaly user identification.

[0079] In step S101 of some embodiments, a web crawler can be written, and after setting up a data source, data can be crawled in a targeted manner to obtain the current behavior data of the target user. Alternatively, the current behavior data of the target user can be obtained through other means, not limited to these. The target user can be one or more users recorded in the backend database of an accessible information platform. The data source includes website resources used by the target user, social media platforms, etc. The current behavior data includes the current question data entered or clicked by the target user, such as customer service inquiries, product information queries, or other types of questions.

[0080] Please see Figure 2 In some embodiments, step S102 may include, but is not limited to, steps S201 to S203:

[0081] Step S201: Vectorize the current problem data to obtain the current problem feature vector, and vectorize the reference problem data to obtain the reference problem feature vector;

[0082] Step S202: Calculate the similarity between the current problem feature vector and each reference problem feature vector to obtain the problem similarity value;

[0083] Step S203: Filter the reference problem data based on the problem similarity value to obtain the target problem data.

[0084] In step S201 of some embodiments, the current problem data can be vectorized using a BERT model or a Wordtovec model, mapping the current problem data to a preset vector space, thus converting the current problem data from text form to vector form and obtaining the current problem feature vector. Similarly, reference problem data in a preset problem database can be vectorized using a BERT model or a Wordtovec model, mapping the reference problem data to a vector space of the same dimension, thus converting the reference problem data from text form to vector form and obtaining the reference problem feature vector.

[0085] In step S202 of some embodiments, the similarity between the current problem feature vector and each reference problem feature vector can be calculated using a cosine similarity algorithm, Euclidean distance, or Pearson correlation coefficient method to obtain a problem similarity value. Specifically, when using the cosine similarity algorithm to calculate the similarity value between the current problem feature vector and the reference problem feature vector, assuming the current problem feature vector is A and a certain reference problem feature vector is B, the problem similarity value between the current problem feature vector and the reference problem feature vector is calculated according to the formula of the cosine similarity algorithm (as shown in Formula 1).

[0086]

[0087] Here, T refers to the transpose of the feature vector A of the current problem.

[0088] In step S203 of some embodiments, the problem similarity value can be used to characterize the degree of similarity between the current problem data and each reference problem data. The larger the problem similarity value, the closer the problem content of the reference problem data is to the problem content of the current problem data. Therefore, the reference problem data can be filtered according to the problem similarity value, and the reference problem data with the largest problem similarity value can be selected as the target problem data. The problem content of the target problem data is equivalent to the problem content of the current problem data.

[0089] Through the above steps S201 to S203, reference problem data that is closest to the problem content of the current problem data can be easily selected. This allows for text adjustment of the current problem data without changing its basic problem content, resulting in target problem data that meets the requirements. Using this target problem data for anomaly identification can improve the reliability and rationality of the data, thereby improving the accuracy of anomaly identification.

[0090] In step S103 of some embodiments, the target question data can be vectorized using a BERT model or a Wordtovec model, mapping the target question data to a preset vector space. This converts the target question data from text to vector form, resulting in a target question feature vector. The target question feature vector can be represented as a sentence vector. The feature dimension of the preset vector space can be set according to actual conditions and is not limited. For example, setting the feature dimension to 300 will result in a 300-dimensional target question feature vector. This method enables model-based vectorization of the target question data, improving the efficiency and accuracy of data conversion.

[0091] Please see Figure 3 In some embodiments, prior to step S104, the abnormal user identification method includes obtaining a first aggregated behavioral feature, which may include, but is not limited to, steps S301 to S302:

[0092] Step S301: Obtain the first historical behavior data of all users;

[0093] Step S302: Cluster the first historical behavior data using a clustering algorithm based on kernel density estimation to obtain the first aggregated behavior features.

[0094] In step S301 of some embodiments, a web crawler can be written, and after setting up a data source, data can be crawled in a targeted manner to obtain the first historical behavior data of all users. Alternatively, the first historical behavior data of all users can be obtained through other means, not limited to these. Here, "all users" can refer to all users recorded in the backend database of an accessible information platform. The data source includes website resources used by all users, social media platforms, etc. The first historical behavior data includes the question data of each user's historical input or clicks, including customer service inquiries, product information queries, or other types of questions.

[0095] In step S302 of some embodiments, all core data in the first historical behavior data are determined according to a clustering algorithm based on kernel density estimation and preset domain parameters. The core data are placed in the same set P, and the core data may include question data that is relatively close to a preset question type. Then, an arbitrary core data point is selected from the set P as an initial point, and the first historical behavior data with achievable density from this core data point are identified to generate a data cluster, forming the first cluster C1. The core data contained in this cluster are removed from set P. Further, the same operation is performed on the core data in the updated set P, repeating the aforementioned process until all core data in set P has been selected, and set P is empty, at which point the aforementioned operation stops. Finally, feature extraction is performed on the formed multiple data clusters to obtain a first aggregated behavior feature, which is used to characterize the clustering features of the historical behavior of all users.

[0096] Through the above steps S301 to S302, the clustering characteristics used to characterize the historical behavior of all users can be obtained relatively easily, namely the first clustering behavior characteristics. The first clustering behavior characteristics reflect the angle of entry and problem focus preferences of all users in their past access behavior. Based on historical behavior data, behavior analysis of all users can be carried out, thereby improving the accuracy of user analysis.

[0097] In step S104 of some embodiments, the similarity between the target question feature vector and the pre-acquired first aggregated behavior feature can be calculated using a cosine similarity algorithm, Euclidean distance, or Pearson correlation coefficient method to obtain a first-row similarity value. The first aggregated behavior feature is used to characterize the clustering features of all users' historical behaviors. Specifically, when using the cosine similarity algorithm to calculate the similarity value between the target question feature vector and the first aggregated behavior feature, assuming the target question feature vector is u and the first aggregated behavior feature is v, the first-row similarity value between the target question feature vector and the first aggregated behavior feature is calculated according to the formula of the cosine similarity algorithm (as shown in Formula 2).

[0098]

[0099] Here, T refers to the transpose of the feature vector u of the target problem.

[0100] Step S104 above allows for the convenient calculation of the first-behavior similarity value between the target question feature vector and the first aggregated behavior feature. This first-behavior similarity value clearly reflects the difference between the target user's current question data and the historical question data submitted by all users. Specifically, a larger first-behavior similarity value indicates a smaller difference between the target user's current question data and the historical questions submitted by all users, suggesting that the target user's current behavior data conforms to normal access behavior. Conversely, a smaller first-behavior similarity value indicates a greater difference between the target user's current question data and the historical questions submitted by all users, suggesting that the target user's current behavior data does not conform to normal access behavior and that the current behavior data is more likely to be abnormal. Therefore, the first-behavior similarity value can initially reflect the possibility of anomalies in the target user's current behavior data, improving the accuracy of anomaly identification.

[0101] Please see Figure 4 In some embodiments, prior to step S105, the abnormal user identification method includes obtaining a second aggregated behavioral feature, which may include, but is not limited to, steps S401 to S402:

[0102] Step S401: Obtain the second historical behavior data of the target user;

[0103] Step S402: Cluster the second historical behavior data using a clustering algorithm based on kernel density estimation to obtain the second aggregated behavior features.

[0104] In step S401 of some embodiments, a web crawler can be written, and after setting up a data source, data can be crawled in a targeted manner to obtain the second historical behavior data of the target user. Alternatively, the second historical behavior data of the target user can be obtained through other means, not limited to these. The target user can be one or more users recorded in the backend database of an accessible information platform. The data source includes website resources used by the target user, social media platforms, etc. The second historical behavior data includes the target user's historical input or clicked question data, including customer service inquiries, product information queries, or other types of questions.

[0105] In step S402 of some embodiments, all core data in the second historical behavior data are determined according to a clustering algorithm based on kernel density estimation and preset domain parameters. The core data are placed in the same set Q, and the core data may include question data that is close to a preset question type. Then, an arbitrary core data point is selected from the set Q as an initial point, and second historical behavior data with achievable density from this core data point are identified to generate a data cluster, forming the first cluster D1. The core data contained in this cluster are removed from set Q. Further, the same operation is performed on the core data in the updated set Q, repeating the aforementioned process until all core data in set Q has been selected, and set P is empty, at which point the aforementioned operation stops. Finally, feature extraction is performed on the formed multiple data clusters to obtain second aggregated behavior features, which are used to characterize the clustering features of the target user's historical behavior.

[0106] Through the above steps S401 to S402, the clustering characteristics used to characterize the historical behavior of target users can be obtained relatively easily, namely the second clustering behavior characteristics. The second clustering behavior characteristics reflect the angle of entry and problem focus preferences of target users in their past access behavior. Based on historical behavior data, behavioral analysis of target users can be carried out, thereby improving the accuracy of user analysis.

[0107] In step S105 of some embodiments, the similarity between the target question feature vector and the pre-acquired second aggregated behavioral features can be calculated using methods such as cosine similarity algorithm, Euclidean distance, or Pearson correlation coefficient method to obtain a second behavioral similarity value. The second aggregated behavioral features are used to characterize the clustering features of the target user's historical behavior. Specifically, when using the cosine similarity algorithm to calculate the similarity value between the target question feature vector and the second aggregated behavioral features, assuming the target question feature vector is u and the second aggregated behavioral feature is w, the second behavioral similarity value between the target question feature vector and the second aggregated behavioral feature is calculated according to the formula of the cosine similarity algorithm (as shown in Formula 3).

[0108]

[0109] Here, T refers to the transpose of the feature vector u of the target problem.

[0110] Step S105 above allows for the convenient calculation of the target question feature vector and the second behavior similarity value of the second aggregated behavior feature. This second behavior similarity value clearly reflects the difference between the target user's current question data and the question data raised in historical or past access behaviors. Specifically, a larger second behavior similarity value indicates a smaller difference between the target user's current question data and the questions raised in historical or past access behaviors, suggesting that the target user's current behavior data conforms to normal access behavior. Conversely, a smaller second behavior similarity value indicates a larger difference between the target user's current question data and the historical questions raised in historical or past access behaviors, suggesting that the target user's current behavior data does not conform to normal access behavior and that the current behavior data is more likely to be abnormal. Therefore, the second behavior similarity value can initially reflect the possibility of anomalies in the target user's current behavior data, improving the accuracy of anomaly identification.

[0111] In step S106 of some embodiments, the similarity between the first aggregated behavioral feature and the second aggregated behavioral feature can be calculated using a cosine similarity algorithm, Euclidean distance, or Pearson correlation coefficient method to obtain a third-order similarity value. The first aggregated behavioral feature is used to characterize the clustering characteristics of the historical behaviors of all users, and the second aggregated behavioral feature is used to characterize the clustering characteristics of the historical behaviors of the target user. Specifically, when using the cosine similarity algorithm to calculate the similarity value between the first aggregated behavioral feature and the second aggregated behavioral feature, assuming the first aggregated behavioral feature is v and the second aggregated behavioral feature is w, the third-order similarity value between the target problem feature vector and the second aggregated behavioral feature is calculated according to the formula of the cosine similarity algorithm (as shown in Formula 4).

[0112]

[0113] Where T refers to the transpose of the first aggregation behavior feature v.

[0114] Step S106 above allows for the convenient calculation of the third behavior similarity value between the first and second aggregated behavior features. This third behavior similarity value clearly reflects the difference between the question data raised by the target user in past access behaviors and the question data raised by all users in past access behaviors. Specifically, a larger third behavior similarity value indicates a smaller difference between the question data raised by the target user in past access behaviors and the question data raised by all users in past access behaviors, suggesting that the target user's question data conforms to normal access behavior. Conversely, a smaller second behavior similarity value indicates a larger difference between the question data raised by the target user in past access behaviors and the question data raised by all users in past access behaviors, suggesting that the target user's question data does not conform to normal access behavior, and that the target user is more likely to be abnormal. Therefore, the third behavior similarity value can initially reflect the possibility of the target user being abnormal, improving the accuracy of anomaly identification.

[0115] Please see Figure 5 In some embodiments, the target identification data includes whether the target user is an abnormal user, and step S107 may include, but is not limited to, steps S501 to S504:

[0116] Step S501: Compare the similarity value of the third row with the preset first threshold;

[0117] Step S502: If the similarity value of the third row is greater than or equal to the first threshold, then compare the similarity value of the second row with the preset second threshold.

[0118] Step S503: If the similarity value of the second row is less than the second threshold, then compare the similarity value of the first row with the preset third threshold.

[0119] Step S504: If the similarity value of the first row is less than the third threshold, then the target user is determined to be an abnormal user.

[0120] In step S501 of some embodiments, the preset first threshold can be set according to actual business needs without restriction. For example, the first threshold is 0.8 or 0.5. By comparing the similarity value of the third row with the first threshold, this relationship can reflect whether the degree of difference between the question data raised by the target user in past access behaviors and the question data raised by all users in past access behaviors meets the access requirements.

[0121] In step S502 of some embodiments, when the similarity value of the third behavior is greater than or equal to the first threshold, it indicates that the difference between the question data raised by the target user in past access behaviors and the question data raised by all users in past access behaviors is small, the questioning angle of the target user is basically consistent with the questioning angle of most users, and the historical access behavior of the target user meets the access requirements. Therefore, it is necessary to further identify anomalies in the current behavior data of the target user (i.e., the question raised by the target user now), that is, to compare the second behavior similarity value with a preset second threshold. The preset second threshold can be set according to actual business needs and is not limited. For example, the second threshold is 0.9 or 0.6. By comparing the magnitude of the second behavior similarity value and the second threshold, it is possible to reflect whether the difference between the current question data raised by the target user and the historical questions raised in historical access behaviors meets the access requirements.

[0122] Furthermore, if the similarity value of the second behavior is greater than or equal to the second threshold, then the difference between the current question data raised by the target user and the historical questions raised in the past access behavior is not significant, and the current access behavior of the target user meets the access requirements. At this time, the target identification data indicates that the target user is a normal user.

[0123] In step S503 of some embodiments, if the similarity value of the second behavior is greater than or equal to the second threshold, then the difference between the current problem data raised by the target user and the historical problems raised in historical access or past access behaviors is large. It is necessary to further compare the similarity between the current problem data of the target user and the problems raised by all users in past access behaviors, i.e., compare the similarity value of the first behavior with a preset third threshold. The preset third threshold can be set according to actual business needs and is not limited; for example, the third threshold is 0.9 or 0.6. Comparing the magnitude of the similarity value of the first behavior with the third threshold can reflect whether the degree of difference between the current problem data raised by the target user and the problem data raised by all users in past access behaviors meets the access requirements.

[0124] In step S504 of some embodiments, if the similarity value of the first behavior is less than or equal to the third threshold, it indicates that the current question data of the target user is significantly different from the question data raised by all users in their past access behaviors, the current questioning angle of the target user is significantly different from the angle of most users, and the current access behavior of the target user does not meet the access requirements. In this case, the target identification data indicates that the target user is an abnormal user. By identifying the target user as an abnormal user, it is convenient to further monitor the access behavior and change the permissions of the target user.

[0125] Furthermore, if the similarity value of the first row is greater than or equal to the third threshold, it indicates that the difference between the target user's current question data and the question data raised by all users in their past access behaviors is small, the target user's current questioning angle is basically consistent with the questioning angle of most users, the target user's current question data can be regarded as an extension of the target user's points of interest, and the target user's current access behavior meets the access requirements. At this time, the target identification data indicates that the target user is a normal user.

[0126] Through the above steps S501 to S504, anomaly identification can be performed based on the degree of difference between the target user's current access data and the target user's historical access data, as well as the historical access data of all users. This can determine whether the target user's current behavior is consistent with the access behavior of all users, i.e., anomaly identification is performed from an overall perspective, and whether the target user's current behavior is consistent with its own historical behavior, i.e., anomaly identification is performed from the perspective of the individual target user. This can make the target identification data have good accuracy and rationality.

[0127] Please see Figure 6 In some embodiments, the target identification data includes whether the target user is an abnormal user, and step S107 also includes, but is not limited to, steps S601 to S602:

[0128] Step S601: Compare the similarity value of the third row with the preset first threshold;

[0129] Step S602: If the similarity value of the third row is less than the first threshold, then the target user is determined to be an abnormal user.

[0130] In step S601 of some embodiments, the preset first threshold can be set according to actual business needs without restriction. For example, the first threshold is 0.8 or 0.5. By comparing the similarity value of the third row with the first threshold, this relationship can reflect whether the degree of difference between the question data raised by the target user in past access behaviors and the question data raised by all users in past access behaviors meets the access requirements.

[0131] In step S602 of some embodiments, when the similarity value of the third behavior is less than the first threshold, it indicates that the question data raised by the target user in the past access behavior is significantly different from the question data raised by all users in the past access behavior. The target user's historical questioning angle is very different from the questioning angle of most users. The target user's past access behavior does not meet the access requirements. Then the target identification data indicates that the target user is an abnormal user. By identifying the target user as an abnormal user, it is convenient to further monitor the access behavior and change the permissions of the target user.

[0132] Through the above steps S601 to S602, the possibility of the target user being abnormal can be initially reflected based on the similarity value of the third line. According to the relationship between the similarity value of the third line and the preset first threshold, the target user who does not meet the access requirements is identified as an abnormal user. That is, the target user whose similarity value of the third line is less than the first threshold is identified as an abnormal user, thereby improving the accuracy of abnormal user identification.

[0133] Please see Figure 7 After step S107 in some embodiments, the abnormal user identification method may also include, but is not limited to, steps S701 to S702:

[0134] Step S701: If the target identification data indicates that the target user is an abnormal user, then within a preset time period, the access frequency of the target user is controlled within a preset range, and the access behavior status of the target user within the time period is detected.

[0135] Step S702: If the access behavior status is abnormal, then cancel the target user's access permissions.

[0136] In step S701 of some embodiments, to improve information security, if the target identification data indicates that the target user is an abnormal user, further monitoring of the target user's access behavior or permission changes are required. Specifically, within a preset time period, the target user's access frequency is controlled within a preset range. The preset time period can be a week or a month, etc., without limitation, and the preset range can be 10 times or other values. This method can reduce the number of times abnormal users access the target platform or website, improving the security of network information access. Simultaneously, in controlling the target user's access frequency, it is also necessary to detect the target user's access behavior status, identifying whether each access behavior of the target user within this time period complies with access requirements. This detection process is basically the same as steps S101 to S107 described above, and will not be repeated here.

[0137] In step S702 of some embodiments, if the access behavior status is not abnormal, it indicates that the abnormal behavior of the target user is accidental. Therefore, the abnormal label on the target user is removed, the user is reclassified as a normal user, and access restrictions are restored, including removing restrictions on the target user's access frequency. When the access behavior status is abnormal, meaning that the target user's access behavior is abnormal at least once within a certain time period, it is considered that the target user has a significant impact on the security of the network information of the target platform or target website. Therefore, the target user's access permissions are revoked, thereby improving the security of network information.

[0138] Through the above steps S701 to S702, it is relatively convenient to perform flow control on abnormal users, control their access frequency within a preset time period, and promptly modify their access permissions to the target platform or target website, thereby improving the accuracy and rationality of flow control, and also improving the security of network information access.

[0139] The abnormal user identification method of this application embodiment acquires the current behavior data of the target user, including the target user's current question data; and traverses a preset question database, matching the current question data with reference question data in the question database to obtain target question data. This method can adjust the text of the current question data without changing its basic question content to obtain target question data that meets the requirements. Further, the target question data is vectorized to obtain a target question feature vector. The similarity of the target question feature vector with a pre-acquired first aggregated behavior feature is calculated to obtain a first-row similarity value, which reflects the difference between the current question data and the historical behavior of all users. The similarity of the target question feature vector with a pre-acquired second aggregated behavior feature is calculated to obtain a second-row similarity value, which reflects the difference between the current question data and the target user's historical behavior. Simultaneously, the similarity of the first and second aggregated behavior features is calculated to obtain a third-row similarity value, which reflects the difference between the target user's historical behavior and the historical behavior of all users. Finally, based on the similarity values ​​of the first, second, and third rows, anomaly identification of target users is performed. This method can determine whether the target user's current behavior is consistent with the behavior of all users (i.e., anomaly identification from an overall perspective) or whether the target user's current behavior is consistent with its own historical behavior (i.e., anomaly identification from the perspective of the individual target user). This ensures that the target identification data used to characterize whether a target user is an anomaly has good accuracy and rationality, thereby improving the accuracy of anomaly user identification. It also enables control over the access permissions and access frequency of anomaly users, thus improving the security of network information.

[0140] Please see Figure 8 This application also provides an abnormal user identification device, which can implement the above-described abnormal user identification method. The device includes:

[0141] The behavior data acquisition module 801 is used to acquire the current behavior data of the target user, which includes the target user's current question data.

[0142] The matching module 802 is used to traverse the preset problem database, match the current problem data with the reference problem data in the problem database, and obtain the target problem data;

[0143] The vectorization module 803 is used to vectorize the target problem data to obtain the target problem feature vector;

[0144] The first similarity value calculation module 804 is used to calculate the similarity between the target problem feature vector and the pre-acquired first aggregated behavior features to obtain the first behavior similarity value. The first aggregated behavior features are used to characterize the clustering characteristics of the historical behavior of all users.

[0145] The second similarity value calculation module 805 is used to calculate the similarity between the target problem feature vector and the pre-acquired second aggregated behavior features to obtain the second behavior similarity value. The second aggregated behavior features are used to characterize the clustering characteristics of the target user's historical behavior.

[0146] The third similarity value calculation module 806 is used to perform similarity calculation on the first aggregation behavior feature and the second aggregation behavior feature to obtain the third similarity value;

[0147] The anomaly identification module 807 is used to identify anomalies in the target user based on the similarity values ​​of the first row, the second row, and the third row, and to obtain target identification data. The target identification data is used to characterize whether the target user is an abnormal user.

[0148] In some embodiments, the matching module 802 includes:

[0149] The vectorization unit is used to vectorize the current problem data to obtain the current problem feature vector, and to vectorize the reference problem data to obtain the reference problem feature vector.

[0150] The calculation unit is used to perform similarity calculations on the feature vector of the current problem and the feature vector of each reference problem to obtain the problem similarity value;

[0151] The filtering unit is used to filter reference question data based on question similarity values ​​to obtain target question data.

[0152] In some embodiments, the abnormal user identification device includes a first behavioral feature acquisition module, specifically including:

[0153] The first acquisition unit is used to acquire the first historical behavior data of all users;

[0154] The first clustering unit is used to cluster the first historical behavior data using a clustering algorithm based on kernel density estimation to obtain the first aggregated behavior features.

[0155] In some embodiments, the abnormal user identification device includes a second behavioral feature acquisition module, specifically including:

[0156] The second acquisition unit is used to acquire the second historical behavior data of the target user;

[0157] The second clustering unit is used to cluster the second historical behavior data using a clustering algorithm based on kernel density estimation to obtain the second aggregated behavior features.

[0158] In some embodiments, the anomaly detection module 807 includes:

[0159] The first comparison unit is used to compare the similarity value of the third row with the preset first threshold.

[0160] The first judgment unit is used to compare the similarity value of the second row with the preset second threshold if the similarity value of the third row is greater than or equal to the first threshold.

[0161] The second judgment unit is used to compare the similarity value of the first row with a preset third threshold if the similarity value of the second row is less than the second threshold.

[0162] The third judgment unit is used to determine that the target user is an abnormal user if the similarity value of the first row is less than the third threshold.

[0163] In some embodiments, the anomaly detection module 807 further includes:

[0164] The second comparison unit is used to compare the similarity value of the third row with the preset first threshold.

[0165] The fourth judgment unit is used to determine that the target user is an abnormal user if the similarity value of the third row is less than the first threshold.

[0166] In some embodiments, the abnormal user identification device includes a monitoring module, specifically comprising:

[0167] The monitoring unit is used to control the target user's access frequency within a preset range and detect the target user's access behavior status within the preset time period if the target identification data indicates that the target user is an abnormal user.

[0168] The permission cancellation unit is used to revoke the access permissions of a target user if the access behavior status is abnormal.

[0169] The specific implementation of this abnormal user identification device is basically the same as the specific implementation of the abnormal user identification method described above, and will not be repeated here.

[0170] This application also provides an electronic device, which includes: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for communication between the processor and the memory. When the program is executed by the processor, it implements the aforementioned abnormal user identification method. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0171] Please see Figure 9 , Figure 9 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes:

[0172] The processor 901 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0173] The memory 902 can be implemented as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 902 and is called and executed by the processor 901 using the abnormal user identification method of the embodiments of this application.

[0174] The 903 input / output interface is used to implement information input and output.

[0175] The communication interface 904 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0176] Bus 905 transmits information between various components of the device (e.g., processor 901, memory 902, input / output interface 903, and communication interface 904);

[0177] The processor 901, memory 902, input / output interface 903, and communication interface 904 are connected to each other within the device via bus 905.

[0178] This application also provides a computer-readable storage medium that stores one or more programs, which can be executed by one or more processors to implement the above-described abnormal user identification method.

[0179] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0180] The abnormal user identification method, device, electronic device, and computer-readable storage medium provided in this application embodiment acquire the current behavior data of the target user, including the target user's current question data; and traverse a preset question database, matching the current question data with reference question data in the question database to obtain target question data. This allows for text adjustment of the current question data without altering its basic question content, resulting in target question data that meets the requirements. Further, the target question data is vectorized to obtain a target question feature vector. A similarity calculation is performed between the target question feature vector and a pre-acquired first aggregated behavior feature to obtain a first-row similarity value, which reflects the difference between the current question data and the historical behavior of all users. A similarity calculation is also performed between the target question feature vector and a pre-acquired second aggregated behavior feature to obtain a second-row similarity value, which reflects the difference between the current question data and the target user's historical behavior. Simultaneously, a similarity calculation is performed between the first and second aggregated behavior features to obtain a third-row similarity value, which reflects the difference between the target user's historical behavior and the historical behavior of all users. Finally, based on the similarity values ​​of the first, second, and third rows, anomaly identification of target users is performed. This method can determine whether the target user's current behavior is consistent with the behavior of all users (i.e., anomaly identification from an overall perspective) or whether the target user's current behavior is consistent with its own historical behavior (i.e., anomaly identification from the perspective of the individual target user). This ensures that the target identification data used to characterize whether a target user is an anomaly has good accuracy and rationality, thereby improving the accuracy of anomaly user identification. It also enables control over the access permissions and access frequency of anomaly users, thus improving the security of network information.

[0181] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0182] It will be understood by those skilled in the art that Figure 1-7 The technical solutions shown do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0183] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0184] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0185] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0186] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0187] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0188] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0189] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0190] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0191] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. An abnormal user identification method characterized by comprising: The method comprises: obtaining current behavior data of a target user, the current behavior data comprising current question data input or clicked by the target user; traversing a preset question database, and performing matching processing on the current question data and reference question data in the question database to obtain target question data; performing vectorization processing on the target question data to obtain a target question feature vector; performing similarity calculation on the target question feature vector and a first aggregated behavior feature obtained in advance to obtain a first behavior similarity value, wherein the first aggregated behavior feature is used to represent clustering characteristics of historical behaviors of all users, the first aggregated behavior feature is obtained by clustering first historical behavior data of all users, the first historical behavior data comprises question data input or clicked by each user in history, and the first behavior similarity value is used to indicate difference between the current question data of the target user and historical question data proposed by all users; performing similarity calculation on the target question feature vector and a second aggregated behavior feature obtained in advance to obtain a second behavior similarity value, wherein the second aggregated behavior feature is used to represent clustering characteristics of historical behaviors of the target user, the second aggregated behavior feature is obtained by clustering second historical behavior data of the target user, the second historical behavior data comprises question data input or clicked by the target user in history, and the second behavior similarity value is used to indicate difference between the current question data of the target user and question data proposed by the target user in historical access or past access behaviors; performing similarity calculation on the first aggregated behavior feature and the second aggregated behavior feature to obtain a third behavior similarity value; performing abnormality identification on the target user according to the first behavior similarity value, the second behavior similarity value, and the third behavior similarity value to obtain target identification data, wherein the target identification data is used to represent whether the target user is an abnormal user.

2. The abnormal user identification method of claim 1, wherein The method comprises: performing vectorization processing on the current question data to obtain a current question feature vector, and performing vectorization processing on the reference question data to obtain a reference question feature vector; performing similarity calculation on the current question feature vector and each reference question feature vector to obtain a question similarity value; performing screening processing on the reference question data according to the question similarity value to obtain the target question data. 3.The abnormal user identification method of claim 1, wherein, Before the similarity calculation on the target question feature vector and the first aggregated behavior feature obtained in advance to obtain the first behavior similarity value, the method further comprises obtaining the first aggregated behavior feature, and specifically comprises: obtaining the first historical behavior data of all users; performing clustering processing on the first historical behavior data by using a clustering algorithm based on kernel density estimation to obtain the first aggregated behavior feature.

4. The abnormal user identification method of claim 1, wherein, Before the similarity calculation of the target problem feature vector and the pre-acquired second aggregated behavior feature, the method further comprises acquiring the second aggregated behavior feature, specifically comprising: acquiring second historical behavior data of the target user; performing clustering processing on the second historical behavior data through a clustering algorithm based on kernel density estimation to obtain the second aggregated behavior feature.

5. The abnormal user recognizing method according to claim 1, characterized in that, The target recognition data includes that the target user is an abnormal user, and the abnormal identification of the target user according to the first behavior similarity value, the second behavior similarity value and the third behavior similarity value to obtain target recognition data comprises: comparing the third behavior similarity value with a preset first threshold value; if the third behavior similarity value is greater than or equal to the first threshold value, comparing the second behavior similarity value with a preset second threshold value; if the second behavior similarity value is less than the second threshold value, comparing the first behavior similarity value with a preset third threshold value; if the first behavior similarity value is less than the third threshold value, determining that the target user is an abnormal user.

6. The abnormal user identification method of claim 1, wherein, The target recognition data includes that the target user is an abnormal user, and the abnormal identification of the target user according to the first behavior similarity value, the second behavior similarity value and the third behavior similarity value to obtain target recognition data comprises: comparing the third behavior similarity value with a preset first threshold value; if the third behavior similarity value is less than the first threshold value, determining that the target user is an abnormal user.

7. The abnormal user identification method according to any one of claims 1 to 6, characterized by, The target recognition data includes that the target user is an abnormal user, and after the abnormal identification of the target user according to the first behavior similarity value, the second behavior similarity value and the third behavior similarity value to obtain target recognition data, the method further comprises: if the target recognition data is that the target user is an abnormal user, controlling the access frequency of the target user to be within a preset range within a preset time period, and detecting the access behavior state of the target user within the time period; if the access behavior state is abnormal, canceling the access permission of the target user.

8. An abnormal user identifying apparatus characterized by comprising: The device comprises: a behavior data acquisition module configured to acquire current behavior data of a target user, the current behavior data comprising current question data input or clicked by the target user; a matching module configured to traverse a preset question database, match the current question data with reference question data in the question database, and obtain target question data; a vectorization module configured to perform vectorization processing on the target question data to obtain a target question feature vector; The first similarity value calculation module is configured to calculate the similarity between the target problem feature vector and a first aggregated behavior feature to obtain a first behavior similarity value, the first aggregated behavior feature is used to represent the clustering characteristics of the historical behaviors of all users, the first aggregated behavior feature is obtained by clustering the first historical behavior data of all users, the first historical behavior data includes the historical input or click problem data of each user, and the first behavior similarity value is used to indicate the difference between the current problem data of the target user and the historical problem data proposed by all users. The second similarity value calculation module is configured to calculate the similarity between the target problem feature vector and a second aggregated behavior feature to obtain a second behavior similarity value, the second aggregated behavior feature is used to represent the clustering characteristics of the historical behaviors of the target user, the second aggregated behavior feature is obtained by clustering the second historical behavior data of the target user, the second historical behavior data includes the historical input or click problem data of the target user, and the second behavior similarity value is used to indicate the difference between the current problem data of the target user and the problem data proposed by the target user in the historical access or past access behaviors. The third similarity value calculation module is configured to calculate the similarity between the first aggregated behavior feature and the second aggregated behavior feature to obtain a third behavior similarity value. The anomaly identification module is configured to identify the target user according to the first behavior similarity value, the second behavior similarity value, and the third behavior similarity value to obtain target identification data, and the target identification data is used to represent whether the target user is an abnormal user.

9. An electronic device, comprising: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the anomaly user identification method of any one of claims 1-7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 9. The computer program is executed by the processor to implement the anomaly user identification method of any one of claims 1-7.

Images