Model training method, malicious user detection method, device and terminal equipment

Abstract

The application is suitable for the technical field of Internet, and provides a model training method, a malicious user detection method, a device and a terminal equipment, comprising: determining graph data, the graph data is constructed according to user data of a client, determining a first expression according to the graph data, the expression form of the first expression is different from the expression form of the graph data, sending the first expression to a server, receiving a second expression sent by the server, the second expression is obtained by the server according to the first expression of at least two clients, training a first initial model according to the second expression to obtain a target model, wherein the first initial model is used for detecting malicious users. The application can improve the detection accuracy of malicious users.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of deep learning, and particularly relates to a model training method, a malicious user detection method, a device, a terminal device and a computer readable storage medium. BACKGROUND

[0002] With the development of Internet technology, people's daily life is almost inseparable from online social networks, and the use rate of social websites ranks first among the tens of billions of websites on the Internet. At the same time, social websites attract various attackers due to their huge users and data. In online social network platforms, users who publish and spread false information such as fraud, hype, rumors, and malicious behaviors are called malicious users, and detecting these malicious users is of great significance to maintaining the social network environment.

[0003] At present, the method of machine learning is usually used for malicious user detection, but since the user data involves user privacy, it is usually difficult to obtain a large amount of user data to train the model, so that the detection accuracy of the model is not high. SUMMARY

[0004] The model training method, the malicious user detection method, the device and the terminal device provided by the embodiments of the present application can improve the detection accuracy of malicious users.

[0005] In a first aspect, the embodiments of the present application provide a model training method applied to a client, comprising:

[0006] determining graph data, wherein the graph data is constructed according to user data of the client;

[0007] determining a first expression according to the graph data, wherein an expression form of the first expression is different from an expression form of the graph data;

[0008] sending the first expression to a server;

[0009] receiving a second expression sent by the server, wherein the second expression is obtained by the server according to the first expression of at least two clients;

[0010] training a first initial model according to the second expression to obtain a target model, wherein the first initial model is used for detecting malicious users.

[0011] In a second aspect, the embodiments of the present application provide a model training method applied to a server, comprising:

[0012] determining graph data, wherein the graph data is constructed according to user data of the client;

[0013] determine a first expression according to the graph data, an expression form of the first expression being different from an expression form of the graph data;

[0014] send the first expression to a server;

[0015] receive a second expression sent by the server, the second expression being obtained by the server according to the first expressions of at least two of the clients;

[0016] train a first initial model according to the second expression to obtain a target model, wherein the first initial model is used to detect malicious users.

[0017] In a third aspect, an embodiment of the present application provides a malicious user detection method, comprising:

[0018] obtain user data of a to-be-detected user;

[0019] determine a corresponding target model according to a client corresponding to the to-be-detected user;

[0020] input the user data into the target model for detection to obtain a detection result output by the target model, the detection result being used to indicate whether the to-be-detected user is a malicious user, and the target model being trained according to the model training method in the first aspect or the model training method in the second aspect.

[0021] In a fourth aspect, an embodiment of the present application provides a model training apparatus applied to a client, comprising:

[0022] a graph data obtaining module configured to determine graph data, the graph data being obtained according to user data of the client;

[0023] a first expression obtaining module configured to determine a first expression according to the graph data, an expression form of the first expression being different from an expression form of the graph data;

[0024] a first sending module configured to send the first expression to a server;

[0025] a first receiving module configured to receive a second expression sent by the server, the second expression being obtained by the server according to the first expressions of at least two of the clients;

[0026] a training module configured to train a first initial model according to the second expression to obtain a target model, wherein the first initial model is used to detect malicious users.

[0027] In a fifth aspect, an embodiment of the present application provides a model training apparatus applied to a server, comprising:

[0028] The second receiving module is configured to receive first expressions sent by at least two clients;

[0029] The second expression obtaining module is configured to determine second expressions according to the first expressions of the at least two clients.

[0030] The second sending module is configured to send the second expressions to the at least two clients.

[0031] In a sixth aspect, an embodiment of the present application provides a malicious user detection device, comprising:

[0032] The user data obtaining module is configured to obtain user data of a to-be-detected user.

[0033] The target model obtaining module is configured to determine a corresponding target model according to a client corresponding to the to-be-detected user.

[0034] The detection module is configured to input the user data into the target model for detection to obtain a detection result output by the target model, the detection result being used to indicate whether the to-be-detected user is a malicious user, and the target model being trained according to the model training method in the first aspect.

[0035] In a seventh aspect, an embodiment of the present application provides a terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor executes steps of the model training method in the first aspect or the model training method in the second aspect or the malicious user detection method in the third aspect.

[0036] In an eighth aspect, an embodiment of the present application provides a computer readable storage medium, the computer readable storage medium storing a computer program, and the computer program is executed by a processor to implement steps of the model training method in the first aspect or the model training method in the second aspect or the malicious user detection method in the third aspect.

[0037] In a ninth aspect, an embodiment of the present application provides a computer program product, when the computer program product is executed on a terminal device, the terminal device executes the model training method in the first aspect or the model training method in the second aspect or the malicious user detection method in the third aspect.

[0038] Compared with the prior art, the embodiment of the present application has the beneficial effects that:

[0039] In the embodiments of this application, since the user data of different clients is usually different, that is, the graph data and the first expression corresponding to different clients are also different, therefore, when the client trains the first initial model corresponding thereto according to the second expression obtained according to at least two first expressions, it is actually trained based on the user data of at least two clients, thereby increasing the training data of the first initial model of the client, and further improving the accuracy of the obtained target model. At the same time, since the expression form of the first expression and the second expression is different from the expression form of the graph data, therefore, the second expression is determined according to the first expression, and the training of the model is performed by using the second expression, which is equivalent to training the model by using the user data of at least two clients without directly exposing the original user data of each client, thereby protecting the privacy and security of the user data. BRIEF DESCRIPTION OF DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the embodiments of this application, the drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows.

[0041] Figure 1 is a flowchart of a model training method provided by an embodiment of this application;

[0042] Figure 2 is a flowchart of another model training method provided by an embodiment of this application;

[0043] Figure 3 is a structural diagram of a mapping table provided by an embodiment of this application;

[0044] Figure 4 is a flowchart of a malicious user detection method provided by an embodiment of this application;

[0045] Figure 5 is a structural diagram of a model training device provided by an embodiment of this application;

[0046] Figure 6 is a structural diagram of another model training device provided by an embodiment of this application;

[0047] Figure 7 is a structural diagram of a malicious user detection device provided by an embodiment of this application;

[0048] Figure 8 is a structural diagram of a terminal device provided by an embodiment of this application. DETAILED DESCRIPTION

[0049] In the following description, for purposes of explanation and not limitation, specific details are set forth such as particular architectures, techniques, etc. in order to provide a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application can be practiced in other embodiments that depart from these specific details. In other instances, detailed descriptions of well-known methods, devices, circuits, and

[0050] It should be understood that the term "comprises" when used in this specification and the appended claims, specifies the presence of stated features, integers, steps, operations, elements, and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0051] It should also be understood that the term "and / or" when used in this specification and the appended claims, means any one or more of the associated listed items can be present, and includes multiples of any associated listed item.

[0052] In addition, in the description of the application and the appended claims, the terms "first", "second", and the like, are used only to distinguish different features, and do not imply or suggest relative importance.

[0053] Reference in the specification to "one embodiment" or "some embodiments" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. The appearances of the phrase "in one embodiment" or "in some embodiments" in various places in the specification are not necessarily all referring to the same embodiment, although it can. The terms "comprises", "comprising", "including", "including", "having" and their conjugates mean "including but not limited to" and indicate that the listed features are among the

[0054] Example I:

[0055] Figure 1 A flowchart of a model training method applied to a client is shown, and the details are as follows:

[0056] Step S101, determine the graph data, the above-mentioned graph data is constructed according to the user data of the client.

[0057] The client refers to a program providing local service for a user, and usually includes a web browser, a client software, and a mobile client (such as a mobile phone client, i.e., a software executable on a mobile phone terminal), etc. The client described in the embodiments of the present application can be a communication software, a social software, a shopping software, a management system, and various application programs. Since some applications provide software executable on different terminals, for example, qq (an instant messaging network tool) can usually be executed on a PC (i.e., a personal computer such as a notebook computer and the like), a mobile terminal (such as a mobile phone, a vehicle-mounted computer, and the like), and a web browser, i.e., a user of the same application can log in to different clients (such as WeChat, a user can log in to an account on two clients of a notebook computer and a mobile phone at the same time), and user data of the same application is usually intercommunicated, therefore, in some embodiments, different clients refer to different applications (such as qq and WeChat).

[0058] The user data includes a unique identifier of the user (i.e., a user identifier) and user information, wherein the user identifier can be an identity card number, a payment account number, or other identifiers that can uniquely identify the user, and the user information includes one or more of gender, age, location, mobile phone number, payment account number, login device, registered device, and the like. For example, assuming that each identity card number can only register one account on client A, and the identity card number is a mandatory item when the user registers on client A, the user data of the client can take the identity card number of the user as the user identifier, and take the age, gender, hometown, email, address, hobby, education, and login device information of the user as the user information in the user data of client A. Since malicious users usually register / log in to multiple accounts with a single device, they have the feature of device aggregation, therefore, in order to improve the detection effect of malicious users, the user information at least includes a unique identifier code (such as an IMEI international mobile equipment identifier, a UDID unique device identifier code, and the like) of the registered device and / or the login device of the user. Since malicious users have the feature of behavior aggregation (i.e., batch accounts have the same batch behavior), therefore, in some embodiments, the user data further includes a behavior record of the user within a preset time period (such as within the past week, within each month).

[0059] It should be noted that in the user data of each client, the user identifier can include one or more identifiers that can uniquely identify the user, such as an ID card number and a mobile phone number, both of which can uniquely identify the user. When the user identifier includes both the ID card number and the mobile phone number, using any one of the user identifiers (ID card number or mobile phone number) can uniquely determine the corresponding user, so as to better find the overlapping users in different clients (for example, assuming that the user identifier corresponding to user A in client A is an ID card number, and the user identifier corresponding to user A in client B is a mobile phone number, then the user identifiers can be used to determine that the users corresponding to client A and client B are both user A).

[0060] Specifically, since the graph data can reflect the association relationship between users, malicious users tend to register multiple accounts, and there is device aggregation (i.e., multiple accounts share the same device), so there is usually some association between different user data (such as multiple accounts registered through the same IP, the same device logged in, etc.), therefore, in the embodiments of the present application, for each client, the user data of the client is obtained, the user is taken as a node of the graph data (i.e., the node of the graph data is in a one-to-one correspondence with the user), and the user data corresponding to the user is taken as the attribute of the corresponding node, and the edges of the graph data are constructed according to the association relationship between different users (such as the same bound mobile phone number, the same bound payment account, etc.), so as to obtain the graph data reflecting the association relationship between users, so that subsequent training of the model based on the graph data can be combined with the association relationship between users for detection, thereby improving the detection accuracy of malicious users. Optionally, before constructing the graph data of the client, the association relationship between the user data of each user can be obtained through data mining (such as association rule mining).

[0061] Optionally, the graph data can be constructed according to the data of the users who have registered in the client by a certain date (such as December 31, 2022). Since malicious users usually have the behavior of frequently registering multiple accounts, and their malicious behavior has certain regularity, in order to improve the detection accuracy of newly registered malicious users and reduce the impact of malicious users, the graph data can also be constructed according to the data of the users who have registered in the client within a predetermined time period (such as every month). The selection of user data for constructing the graph data can be determined by the user according to the actual application scenario, which is not limited here.

[0062] Optionally, in order to protect sensitive information in the user data (such as the user's ID card information), the user data is desensitized before the graph data is constructed according to the user data of the client. Since the user data (i.e. the graph data) of the client needs to be sent to the server for processing in the subsequent model training process, in the embodiment of the application, the user data is desensitized in a static desensitization manner, so as to isolate the desensitized user data from the client, so as to send the graph data constructed based on the desensitized user data to the server, while ensuring the security of the user data.

[0063] In the embodiment of the application, since there is usually a certain correlation between malicious users, the user is taken as a node, and the obtained correlation between users is taken as the data of the edge of the graph data, so as to construct the graph data corresponding to the user data of the client, thereby intuitively and clearly showing the correlation between different users, so as to better detect malicious users in the subsequent model training process.

[0064] In step S102, a first expression is determined according to the graph data, and the expression form of the first expression is different from the expression form of the graph data.

[0065] Specifically, since the graph data is constructed from the user data of the client, the nodes and edges thereof show the correlation between the user data of different users, and therefore, in the embodiment of the application, before the user data of different clients is aggregated, the client performs corresponding processing (such as feature extraction) on the obtained graph data, and converts the graph data into a first expression (such as a feature vector, a feature map, etc.) different from the expression form thereof, so that when the client sends the first expression to the server, the server obtains the processed user data, and the user data is not directly exposed to the server, thereby ensuring the security of the user data.

[0066] Optionally, since embedding encodes objects with low-dimensional vectors while retaining their meanings, and has the property that objects corresponding to vectors with similar distances have similar meanings, in some embodiments, the graph data of the client is subjected to feature extraction processing, and is converted into an expression form of embedding (i.e. the first expression is embedding), so that when the first expressions of at least two clients are aggregated, the potential relationship between the graph data (user data) of different clients revealed by embedding can be combined for aggregation, thereby enabling the server to better aggregate the first expressions of at least two clients, and further improving the accuracy of the second expression obtained by aggregation.

[0067] The above-mentioned embedding refers to the embedding feature, which is the mathematical vector expression of an object (such as text, video, etc.) after corresponding processing. This mathematical vector is the embedding.

[0068] In this embodiment of the application, the graph data is converted into a first expression with a different representation, so that the first expression sent to the server is the processed user data, thereby ensuring that the client's user data is not directly exposed to the server and thus ensuring the security of the client's user data.

[0069] Step S103: Send the first expression to the server.

[0070] Specifically, in order to obtain more user data for model training while ensuring the privacy and security of user data from each client, at least two clients send the obtained first expression to the server. The server then aggregates the first expressions (i.e., user data) from different clients, enabling the server to obtain a second expression containing user data from different clients. This second expression is then sent to the corresponding clients, allowing each client to use the user data from different clients for model training.

[0071] Step S104: Receive the second expression sent by the server, which is obtained by the server based on the first expression from at least two clients.

[0072] Specifically, since user data is private data, it is usually difficult for a single client to obtain a large amount of user data to train a model. Different clients often have the same users, meaning that the user data of different clients often contains the same data. Therefore, in this embodiment, the client receives a second expression sent by the server based on the first expression of at least two clients, which makes the client equivalent to obtaining the user data (i.e., graph data) of at least two clients. At the same time, since the representation of the first expression is different from the representation of the graph data, the representation of the second expression obtained based on the first expression is also different from the representation of the graph data. Therefore, the second expression obtained by the client is processed user data, which allows the client to obtain more user data while protecting the security of the user data of the corresponding client.

[0073] Optionally, the second expression sent by the server and received by the client can be obtained according to the first expressions of at least two clients including the client, or can be obtained according to the first expressions of at least two other clients, which is not limited here. For example, assuming that the second expression A is obtained according to the first expressions of the client 1, the client 2 and the client 3, the second expression B is obtained according to the first expressions of the client 2 and the client 3, and the client 1 receives the second expression sent by the server, at this time, the second expression received by the client 1 can be the second expression A including the user data of the client 1, or can be the second expression B not including the user data of the client 1.

[0074] In the embodiments of the present application, since the received second expression is obtained according to the first expressions of at least two clients, the client can obtain more user data than a single client, thereby improving the effect of subsequent model training. Meanwhile, the expression form of the second expression obtained by the client is different from the expression form of the graph data, so that the client obtains not the original graph data (user data), thereby improving the security of the user data.

[0075] In step S105, the first initial model is trained according to the above-mentioned second expression, and a target model is obtained.

[0076] The above-mentioned first initial model is used to detect malicious users.

[0077] Specifically, after receiving the second expression sent by the server and containing the user data of different clients, the second expression is used as training data to train the first initial model, so as to obtain a target model that can be used to detect malicious users and meets the user requirements (such as the accuracy of 98%).

[0078] In the embodiments of the present application, since the second expression is obtained from the user data of at least two clients and contains more user data than a single client, when the client trains the model by using the second expression, the user data of at least two clients is actually used for training, thereby increasing the training data of the first initial model and further improving the accuracy of the obtained target model. Meanwhile, since the second expression obtained according to the first expression is used for training, and the expression form of the first expression is different from the expression form of the graph data, the user data of at least two clients can be used for model training without directly exposing the corresponding user data, thereby ensuring the privacy data of the user.

[0079] In some embodiments, before the above-mentioned step S103, the method further includes:

[0080] Sending the user identifier to the server.

[0081] The user identification includes one or more of an ID number, a payment account number, a mobile phone number, and other information that can uniquely identify a user.

[0082] Specifically, since the server needs to aggregate the received first expressions of at least two clients to expand the data amount of the user data contained in the second expression, and the users of different clients can overlap, in order to better aggregate, the client sends the user identification in the user data to the server before sending the first expression to the server, so that the server can align the users of different clients according to the user identification that uniquely identifies the user, and find all users that overlap in different clients.

[0083] Optionally, since the first expression received by the server is processed data in a form different from the expression form of the graph data, in order to facilitate subsequent aggregation of the first expression, in the embodiment of the application, the client converts the user identification into the same form as the expression form of the first expression, and then sends the converted user identification to the server, so that the server can aggregate different first expressions according to the user identification.

[0084] In some embodiments, the step S105 includes:

[0085] Step A: training the first initial model according to the second expression to obtain a second initial model.

[0086] The first initial model is a model for detecting malicious users that is constructed in advance, and the first initial model corresponding to each client is the same.

[0087] Step B: sending the first model parameter to the server, the first model parameter being a model parameter of the second initial model.

[0088] Step C: receiving the second model parameter sent by the server, the second model parameter being obtained by the server according to the first model parameter of at least two clients.

[0089] Step D: updating the second initial model according to the second model parameter to obtain an updated second initial model, and taking the updated second initial model as a new first initial model.

[0090] Step E: repeating the steps of steps A to D until the new first initial model meets the requirements, and taking the new first initial model that meets the requirements as the target model.

[0091] Optionally, since the user data of each client is different, i.e., the user features of each client are different, in order to improve the detection accuracy of malicious users of each client, before training the first initial model (the first initial model constructed and not trained) according to the second expression, part of the user data of the client can be obtained, the obtained user data is labeled (such as labeling the user as a malicious user or a normal user), and the labeled user data is obtained. The labeled user data is used to preliminarily train the first initial model constructed to obtain a first initial model preliminarily trained, and then the second expression is used to train the first initial model after training. On the basis of training the user data of the local client, more user data of different clients (the user data of the local client and the user data of other clients) is used for training, so that the first initial model improves the diversity of the training data (user data) on the basis of the local user features, thereby improving the detection accuracy of the target model finally obtained. Wherein, each client obtains its own user data to preliminarily train its first initial model, i.e., each client obtains the local user data to preliminarily train its first initial model, and the model parameters of the first initial model preliminarily trained by each client are usually different.

[0092] Specifically, in the process of training the model using the second expression as the training data, the first initial model is trained using the second expression, and the second initial model is obtained after one round of training. The model parameters (first model parameters) of the obtained second initial model are sent to the server. After obtaining the first model parameters corresponding to each client, the server aggregates the first model parameters of at least two clients to obtain second model parameters, and sends the aggregated second model parameters to the corresponding client (i.e., the client that sends the first model parameters to the server). The client receives the second model parameters sent by the server, updates the model parameters (i.e., the first model parameters) of the second initial model obtained by training using the second model parameters, and obtains an updated second initial model. After obtaining the updated second initial model, the updated second initial model is used as a new first initial model, and the step of training the first initial model is repeated until the second initial model is updated according to the second model parameters to obtain an updated second initial model. Until the new first initial model (i.e., the updated second initial model) obtained satisfies the user's requirements (such as the accuracy reaching 0.98), the new first initial model satisfying the user's requirements is used as a target model, and a trained target model satisfying the user's requirements is finally obtained.

[0093] In the embodiments of the present application, the first initial model is trained by using the local user data of the client, and then the second expression containing the local user data and the user data of other clients is used for training, so that the first initial model of each client can increase the user features of other clients on the basis of retaining the local user features, improve the data amount and diversity of the training data, and thus improve the generalization ability and detection accuracy of the target model finally obtained.

[0094] In some embodiments, the first initial model includes a multi-layer perception network, and the step A includes:

[0095] A1, taking the second expression as the input of the multi-layer perception network to obtain the classification result output by the multi-layer perception network.

[0096] A2, determining the error of the multi-layer perception network according to the classification result, and updating the multi-layer perception network by a back propagation algorithm according to the error until a multi-layer perception network meeting the requirements is obtained.

[0097] A3, determining the second initial model according to the multi-layer perception network meeting the requirements.

[0098] The multi-layer perception network is also called artificial neural network, and generally includes an input layer, one or more hidden layers and an output layer, and is used to solve classification problems.

[0099] Specifically, since the first expression is the feature obtained after processing the graph data, that is, the second expression aggregated according to the at least two first expressions is equivalent to the feature data obtained after the feature extraction processing, in the embodiment of the present application, the input layer of the multi-layer perception network transmits the second expression into the hidden layer, classifies the user data contained in the second expression through the sigmoid activation function sigmoid, obtains the classification result of the multi-layer perception, and calculates the loss function of the multi-layer perception network according to the output classification result and the local labeled user data (user data with real classification labels, such as malicious users and ordinary users) of the client, that is, the error between the output classification result and the real result, and then updates the weight matrix and / or bias term of the multi-layer perception network through the back propagation algorithm, continuously adjusts the parameters in the multi-layer perception network until the multi-layer perception network meets the requirements (such as loss function convergence, error less than a preset threshold, etc.), and takes the multi-layer perception network meeting the requirements as the second initial model. Since the second expression input into the multi-layer perception network in the embodiment of the present application is the feature data obtained after processing, the first initial model / second initial model can only include the multi-layer perception network for classification. In actual application, when the finally obtained first initial model meeting the requirements is used as a target model for malicious user detection, the user data to be detected is first processed to obtain its corresponding feature data, and then classified through the target model to output the corresponding detection result.

[0100] The above introduces the model training method applied to the client, and the following explains the model training method applied to the server. The server here is the server in communication with the client.

[0101] Figure 2 A flowchart of a model training method applied to a server is shown, and the details are as follows:

[0102] Step S201, receiving the first expression sent by at least two clients.

[0103] Specifically, since the user data of the client relates to the privacy of the user, it is usually difficult to obtain a large amount of user data for training of the model, so that the effect of the finally obtained model is not satisfactory, and malicious users usually tend to register in multiple clients to perform malicious behaviors, therefore, in order to obtain more user data of a single client and improve the effect of the model, in the embodiment of the present application, the server receives the first expression sent by at least two clients. In some embodiments, since there are cases where multiple clients belong to the same application (such as multiple clients corresponding to WeChat, such as mobile clients (such as mobile phones that need to install WeChat software) and web browsers), and the user data of the same application is intercommunicated, that is, the user data possessed by these clients is actually the same, therefore, the client described in the embodiment of the present application is a client of a different application (that is, equivalent to a different application, since different clients of the same application correspond to the same application server, the application server can also be regarded as a client in the embodiment of the present application), so as to ensure that more user data of a single client (application) can be obtained, thereby increasing the training data for subsequent model training.

[0104] In step S202, the second expression is determined according to the first expression of the at least two clients.

[0105] Specifically, since the user data relates to privacy, it is usually difficult for a client to obtain a large amount of user data, and the user data of different clients has certain similarity, aggregation of the user data of different clients can obtain more user data of a single client, increase the amount of data and the diversity of data, therefore, in the embodiment of the present application, after the server receives the first expression sent by at least two clients, the server determines the same user (i.e. target user) existing in the at least two clients, and aggregates the data of the target user in the corresponding client of the target user in the aggregation process, that is, the associated data of the target user in each corresponding client (i.e. the user data of the target user in the corresponding client of the target user and the association relationship between the target user and other users in the client) is aggregated as the relationship data of the target user, so as to obtain the second expression containing the user data of the at least two clients. For example, it is assumed that the target user M4 corresponds to the client A and the client B, wherein the target user in the client A corresponds to the user A1, and has an association relationship with the user A2, the target user in the client B corresponds to the user B1, and has an association relationship with the user B5, when the user data of the target user M4 is aggregated, the user data of the user A1 and the user data of the user B1 are taken as the user data of the target user M4, and the target user M4 has an association relationship with the user A2 and the user B5, that is, in the generated second expression, the user A2, the user B5 and the user M4 (i.e. the target user M4) are included, wherein the user data of the user M4 includes the user data of the user A1 and the user B1, and has an association relationship with the user data of the user A2 and the user B5.

[0106] In the embodiment of the present application, since malicious users tend to register in multiple clients, the same users exist in different clients, and the probability of these same users being malicious users is usually large. Therefore, in the embodiment of the present application, the first expression is aggregated according to the same users existing in at least two clients, the user data corresponding to the same users in different clients can be aggregated together to obtain more user data of the same users, so that subsequent training according to the second expression obtained by aggregation can better detect malicious users existing in different clients, thereby improving the detection accuracy.

[0107] In step 203, the second expression is sent to the at least two clients.

[0108] Optionally, the server encrypts the obtained second expression before sending it to the corresponding at least two clients, that is, the server sends the encrypted second expression to the corresponding at least two clients, and the client decrypts the encrypted second expression by using the corresponding decryption method after receiving the encrypted second expression sent by the server, so that encrypted data (i.e., encrypted user data) is transmitted in the data transmission process to protect the user data from being illegally stolen.

[0109] In the embodiment of the present application, since the server receives the first expression of at least two clients, aggregates the first expression to obtain the second expression, and sends the second expression to the corresponding at least two clients, the client can obtain the user data of at least one other client, thereby expanding the data amount and diversity of the user data. At the same time, since the expression form of the first expression and the expression form of the graph data are different, the expression form of the obtained second expression is also different from the graph data, so that the user data is not exposed to the server and other clients, thereby effectively protecting the security of the user data.

[0110] In some embodiments, before step S201, the method further includes:

[0111] receiving an environment creation request sent by a first client, wherein the first client is any client, the environment creation request includes an identifier of at least one second client, and the second client is a client specified by the first client.

[0112] creating a trusted training environment according to the environment creation request.

[0113] generating environment credentials of the first client and the second client respectively according to the trusted training environment, and sending each environment credential to the corresponding first client and second client, wherein the environment credentials and the clients are in a one-to-one correspondence.

[0114] Specifically, since the server and the client usually perform data processing in an open environment, the open environment is more vulnerable to data theft, destruction and other attacks. Therefore, in the embodiments of the present application, a trusted training environment is created according to the needs of the client for the client and the server to perform data processing and model training. First, if the server receives an environment creation request sent by any one client (first client), the environment creation request contains the identification of at least one second client, indicating that the first client allows the client to jointly create a trusted training environment for data processing and model training. The server creates a trusted training environment according to the environment creation request, generates and saves the environment credentials of the first client and each second client according to the created trusted training environment, and sends each environment credential to the corresponding client (first client and second client), that is, sends the environment credential corresponding to the first client to the first client, and sends the environment credential corresponding to each second client to each second client. Wherein, the environment credential of each client and the client are in one-to-one correspondence, that is, the environment credential of each client is unique, for example, the environment credential contains the identification of the client and a randomly generated unique verification password.

[0115] Optionally, after receiving the environment creation request of the first client, the server first determines whether the environment creation request sent by the first client meets the requirements (such as whether the number of second clients meets the requirements, etc.), and if it is determined that the preset requirements are met, the corresponding trusted training environment is created based on the environment creation request through the environment creation request. Wherein, whether the environment creation request meets the requirements can be determined by artificial judgment, smart contract and the like.

[0116] In the embodiments of the present application, since the server creates a corresponding trusted training environment according to the environment creation request of any client (first client), the first client and the second client specified by the first client can perform private computation of data in a secure and trusted environment when performing user data processing, model training and other operations, effectively ensuring the security of user data.

[0117] In some embodiments, before the above step S201, it further includes:

[0118] Receiving the environment credential sent by the client.

[0119] Verifying the received environment credential.

[0120] Correspondingly, the above step S201 includes:

[0121] Receiving the first expression sent by at least two target clients, wherein the target client is the client corresponding to the verified environment credential.

[0122] Specifically, in order to better ensure the security of user data, the server receives the environment credential sent by each client (a third client) before receiving the first expression sent by at least two clients, wherein the third client can be the first client, the second client or other clients (such as a client of an accessible trusted training environment with environment credentials added by the server at any time after creation, a client of a fake environment credential, etc.), that is, the server can receive the environment credentials sent by the first client, the second client and any other client. After receiving the environment credential, the server verifies the received environment credential according to the saved environment credential (including the environment credential of the first client and the second client, and also including the environment credential added at any time after the creation of the trusted training environment), if the received environment credential of the third client is the same as the saved environment credential, it is determined that the third client passes the verification, and the client is taken as a target client, and is allowed to perform data processing such as graph data construction, first expression conversion and model training in the created trusted training environment. Correspondingly, when the server receives the first expression of at least two clients, it receives the first expression sent by at least two target clients.

[0123] Optionally, since the trusted training environment is mainly used to provide a secure, trusted and isolated data processing environment for the client, it is usually agreed that the client sends the environment credential to the server before performing data processing (such as graph data construction, first expression conversion, model training, etc.), so that the client that passes the verification can perform data processing in the created trusted training environment, so as to avoid exposure of user data of the client. However, it should be noted that the client can also send the environment credential to the server after completing the data processing such as graph data construction and first expression conversion, that is, the server verifies the environment credential sent by the client before receiving the first expression sent by the client, so as to ensure that the first expression of the client that passes the verification (target client) is received.

[0124] In the embodiments of the present application, since the received environment credential sent by the client is verified first, when the first expression sent by the client is received, it can be ensured that only the first expression of the target client corresponding to the environment credential that passes the verification is received, so as to ensure the security of user data in the model training process.

[0125] In some embodiments, before the above step S201, the method further comprises:

[0126] Receiving a user identifier sent by each client.

[0127] Constructing a mapping table according to the user identifier of each client, wherein the mapping table is used to indicate the association relationship between the user data of each client.

[0128] Specifically, since each first expression received by the server is independent, and there may be overlapping users in each client, i.e., there are same part of data in each first expression, in order to better aggregate each first expression, before determining the second expression, the server first determines the users with the same user identifier in each client according to the user identifier sent by each client, i.e., the users with the same user identifier are regarded as the same user (target user), and saves the correspondence between the target user and the corresponding client (target client) of the target user, to obtain a mapping table containing the correspondence between the target user and the target client, which is used to indicate the association relationship between the user data of each client. For example, assuming that there are client A, client B and client C, client A has user A1 and user A2, client B has user B1, and client C has user C1 and C2, the result of user alignment of the server according to the user unique identifier sent by client A, client B and client C is that the user unique identifiers of user A1, user B1 and user C2 are the same, then it is determined that user A1, user B1 and user C2 are the same user (denoted as M1), i.e., user A1 of client A, user B1 of client B and user C2 of client C are actually the same user M1, and client A, client B and client C are the target clients corresponding to user M, and the mapping relationship of target user 1 is obtained as shown in the following table. Figure 3

[0129] Optionally, since different clients may use different identifiers as user identifiers, and the user identifier includes one or more identifiers that can uniquely identify the user, when determining the target user according to the user identifier of each client, the user with the same identifier in the user identifier of each client is regarded as the target user (the same user), which can find the target user in each client to the greatest extent, so as to better aggregate each first expression to obtain the second expression subsequently. For example, assuming that the user identifier of client A includes an ID card number and a mobile phone number, and the user identifier of client B includes an ID card number and a payment account number, when performing user alignment of client A and client B, the ID card number of user A1 of client A is the same as the ID card number of user B1 of client B, then it is determined that user A1 of client A and user B1 of client B are the same user, which is recorded as target user M1.

[0130] In the embodiment of the application, since the mapping table is constructed according to the same users in different clients, it can indicate the association relationship between the users (user data) in different clients, so that the user data of different clients can be quickly and accurately aggregated according to the mapping table when aggregating the user data of at least two clients subsequently.

[0131] ​Figure 4 A flowchart of a malicious user detection method provided by an embodiment of the present application is shown, and is described as follows.

[0132] In step S401, user data of a to-be-detected user is obtained.

[0133] In step S402, a target model corresponding to a client to which the to-be-detected user belongs is determined, and the target model is trained according to the model training method applied to the client or the model training method applied to the server.

[0134] In step S403, the user data is input into the target model for detection, and a detection result output by the target model is obtained, where the detection result is used to indicate whether the to-be-detected user is a malicious user.

[0135] Optionally, the detection result includes a probability that the to-be-detected user is a malicious user and / or a risk level (such as low, medium, and high) of the to-be-detected user, and the risk level is determined according to a pre-set level threshold. For example, the detection result includes a probability that the to-be-detected user is a malicious user and a risk level of the to-be-detected user, and it is assumed that a probability less than 0.5 is a low-risk user, a probability of 0.5-0.8 is a medium-risk user, and a probability greater than 0.8 is a high-risk user. A to-be-detected user with a probability greater than 0.95 is determined as a malicious user. If the target model detects that the to-be-detected user X is a malicious user with a probability of 0.9, the output detection result indicates that the to-be-detected user X is a non-malicious user, and the risk level is high.

[0136] In the embodiment of the present application, since the user data of different clients usually differs, and the target model is trained according to the user data of at least two clients, that is, the user data features of at least one other client are used for training in addition to the training based on the local user data features, the diversity of the user data is expanded while the amount of training data is increased, and the accuracy of the obtained target model is higher. Therefore, the to-be-detected user is detected according to the target model of the client to which the to-be-detected user belongs, and whether the to-be-detected user is a malicious user can be more accurately determined.

[0137] It should be understood that the sequence of the steps in the above embodiments does not mean the execution sequence, and the execution sequence of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0138] Embodiment Two:

[0139] According to the model training method described in the above embodiments, Figure 5A structural block diagram of a model training apparatus applied to a client is shown, and only parts related to the embodiments of the present application are shown for ease of illustration.

[0140] With reference to Figure 5 The apparatus comprises a graph data obtaining module 51, a first expression obtaining module 52, a first sending module 53, a first receiving module 54, and a training module 55. Wherein:

[0141] The graph data obtaining module 51 is configured to determine graph data, which is constructed according to user data of the client.

[0142] The first expression obtaining module 52 is configured to determine a first expression according to the graph data, wherein the expression form of the first expression is different from that of the graph data.

[0143] The first sending module 53 is configured to send the first expression to a server.

[0144] The first receiving module 54 is configured to receive a second expression sent by the server, wherein the second expression is obtained by the server according to the first expression of at least two clients.

[0145] The training module 55 is configured to train a first initial model according to the second expression to obtain a target model, wherein the first initial model is used to detect malicious users.

[0146] In the embodiments of the present application, since the second expression is obtained from the user data of at least two clients, it contains more user data than a single client, and therefore, when the client trains the model using the second expression, it actually trains using the user data of at least two clients, thereby increasing the training data of the first initial model and further improving the accuracy of the obtained target model. At the same time, since the second expression obtained from the first expression is used for training, and the expression form of the first expression is different from that of the graph data, at least two client user data can be used for model training without directly exposing the corresponding user data, thereby ensuring the privacy of the user.

[0147] In some embodiments, the model training apparatus further comprises:

[0148] An identifier sending module is configured to send a user identifier to a server.

[0149] In some embodiments, the training module 55 comprises:

[0150] A first initial model training unit is configured to train the first initial model according to the second expression to obtain a second initial model.

[0151] The first sending unit is configured to send first model parameters to the server, wherein the first model parameters are model parameters of the second initial model.

[0152] The first receiving unit is configured to receive second model parameters sent by the server, wherein the second model parameters are obtained by the server according to the first model parameters of at least two clients.

[0153] The updating unit is configured to update the second initial model according to the second model parameters, to obtain an updated second initial model, and to take the updated second initial model as a new first initial model.

[0154] The circulating unit is configured to repeat the steps of steps A to D until a new first initial model meets a requirement, and to take the new first initial model meeting the requirement as the target model.

[0155] In some embodiments, the first training module 55 further includes:

[0156] The classification unit is configured to take the second expression as an input of the multi-layer perception network, to obtain a classification result output by the multi-layer perception network.

[0157] The error updating unit is configured to determine an error of the multi-layer perception network according to the classification result, and to update the multi-layer perception network through a back propagation algorithm according to the error until a multi-layer perception network meeting a requirement is obtained.

[0158] The second initial model obtaining unit is configured to determine a second initial model according to the multi-layer perception network meeting the requirement.

[0159] Figure 6 A structure block diagram of a model training device applied to a server is shown, and only parts related to the embodiments of the present application are shown for the convenience of description.

[0160] With reference to Figure 6 The device includes a second receiving module 61, a second expression obtaining module 62, and a second sending module 63. Wherein:

[0161] The second receiving module 61 is configured to receive first expressions sent by at least two clients.

[0162] The second expression obtaining module 62 is configured to determine a second expression according to the first expressions of the at least two clients.

[0163] The second sending module 63 is configured to send the second expression to the at least two clients.

[0164] In the embodiments of the present application, the server receives the first expression of at least two clients, and sends the second expression obtained by aggregating the first expression to the corresponding at least two clients, so that the client can obtain the user data of at least one other client, thereby expanding the data amount and diversity of the user data. In addition, the second expression obtained has a different form from the form of the graph data, so that the user data is not exposed to the server and other clients, thereby effectively ensuring the security of the user data.

[0165] In some embodiments, the model training apparatus further includes:

[0166] The request receiving module is configured to receive an environment creation request sent by a first client, wherein the first client is any one of the clients, and the environment creation request includes the identity of at least one second client, and the second client is a client specified by the first client.

[0167] The environment creating module is configured to create a trusted training environment according to the environment creation request.

[0168] The credential sending module is configured to generate environment credentials of the first client and the second client respectively according to the trusted training environment, and send each environment credential to the corresponding first client and second client, wherein the environment credentials and the clients are in a one-to-one correspondence.

[0169] In some embodiments, the model training apparatus further includes:

[0170] The credential receiving module is configured to receive the environment credentials sent by the client.

[0171] The credential verification apparatus is configured to verify the received environment credentials.

[0172] Correspondingly, the second receiving module includes:

[0173] The target receiving module is configured to receive the environment credentials sent by at least two target clients, wherein the target client is a client corresponding to the verified environment credential.

[0174] In some embodiments, the model training apparatus further includes:

[0175] The user identity receiving module is configured to receive the user identity sent by each client.

[0176] The mapping table obtaining module is configured to construct a mapping table according to the user identity of each client, wherein the mapping table is used to indicate the association relationship between the user data of each client.

[0177] Figure 7 A structural block diagram of the malicious user detection apparatus provided by the embodiment of the present application is shown. For ease of illustration, only parts related to the embodiment of the present application are shown.

[0178] With reference to Figure 7 The apparatus comprises a user data acquisition module 71, a target model acquisition module 72 and a detection module 73. Wherein:

[0179] The user data acquisition module 71 is configured to acquire user data of a user to be detected.

[0180] The target model acquisition module 72 is configured to determine a corresponding target model according to a client corresponding to the user to be detected.

[0181] The detection module 73 is configured to input the user data into the target model for detection, and obtain a detection result output by the target model, wherein the detection result is used to indicate whether the user to be detected is a malicious user, and the target model is trained according to the model training method described in the above embodiment.

[0182] In the embodiment of the present application, since the user data of different clients usually differs, and the target model is trained according to the user data of at least two clients, i.e., on the basis of training based on local user data features, at least one other client's data features are used for training, which can expand the diversity of user data while increasing the amount of training data, so that the accuracy of the obtained target model is higher. Therefore, according to the target model of the client corresponding to the user to be detected, the user to be detected is detected, which can more accurately determine whether the user to be detected is a malicious user.

[0183] It should be noted that the information interaction, execution process and the like between the above apparatus / units are based on the same concept as the method embodiments of the present application, and the specific functions and the technical effects brought by the same can be referred to the method embodiments part, which will not be described herein.

[0184] Embodiment three

[0185] Figure 8 A structural schematic diagram of a terminal device provided by an embodiment of the present application is shown. As shown in the figure, the terminal device 8 of this embodiment comprises at least one processor 80 (only one processor is shown in the figure), a memory 81 and a computer program 82 stored in the memory 81 and executable on the at least one processor 80, wherein the processor 80 implements the steps in any of the method embodiments described above when executing the computer program 82. Figure 8 Figure 8

[0186] ​​The terminal device 8 can be a desktop computer, a notebook computer, a palm computer, a cloud server, and the like. The terminal device can include, but is not limited to, a processor 80, a memory 81. Those skilled in the art can understand that Figure 8 The terminal device 8 is only an example and is not limited to the terminal device 8, and can include more or less components than shown, or combine certain components, or different components, for example, can also include an input / output device, a network access device, and the like.

[0187] The processor 80 can be a central processing unit (CPU), and can also be other general-purpose processors, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, and the like. The general-purpose processor can be a microprocessor or can also be any conventional processor.

[0188] The memory 81 can be an internal storage unit of the terminal device 8 in some embodiments, for example, a hard disk or a memory of the terminal device 8. The memory 81 can also be an external storage device of the terminal device 8 in other embodiments, for example, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, and the like. Further, the memory 81 can include both the internal storage unit and the external storage device of the terminal device 8. The memory 81 is used to store an operating system, an application program, a boot loader, data, and other programs, for example, program codes of the computer program, and the like. The memory 81 can also be used to temporarily store data that has been output or will be output.

[0189] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above functional units and modules is exemplified, and in actual application, the above functions can be completed by different functional units and modules according to needs, that is, the internal structure of the apparatus is divided into different functional units or modules to complete all or part of the above described functions. Each functional unit or module in the embodiment can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit. In addition, the specific name of each functional unit or module is only for convenient distinction, and does not limit the protection scope of the present application. The specific working process of the unit or module in the system can refer to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0190] The embodiments of the present application further provide a network device, comprising at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the processor implements the steps in any of the above method embodiments when executing the computer program.

[0191] The embodiments of the present application further provide a computer readable storage medium, which stores a computer program, wherein the computer program is executable by a processor to implement the steps in any of the above method embodiments.

[0192] The embodiments of the present application provide a computer program product, which, when running on a terminal device, enables the terminal device to implement the steps in any of the above method embodiments.

[0193] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the present application can implement all or part of the processes in the above-mentioned embodiment methods through a computer program to instruct relevant hardware to complete, and the computer program can be stored in a computer readable storage medium. When the computer program is executed by a processor, the steps of each method embodiment described above can be implemented. The computer program includes computer program code, which can be in the form of source code, object code, executable files or some intermediate forms. The computer readable medium at least includes any entity or device capable of carrying the computer program code to the photographing device / terminal equipment, recording medium, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal and software distribution medium. For example, U disk, mobile hard disk, magnetic disk or optical disk, etc. In some jurisdictions, according to legislation and patent practice, the computer readable medium can not be an electrical carrier signal and a telecommunication signal.

[0194] In the above embodiments, the description of each embodiment has its own focus, and the parts not described or recorded in detail in a certain embodiment can be referred to the relevant description of other embodiments.

[0195] Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in connection with the embodiments disclosed herein can be realized by electronic hardware, or a combination of computer software and electronic hardware. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0196] In the embodiments provided by the present application, it should be understood that the disclosed apparatus / network device and method can be implemented in other ways. For example, the above-described apparatus / network device embodiments are merely schematic, for example, the division of the modules or units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the shown or discussed each other can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0197] The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may also be distributed to multiple network units. Part or all of the units can be selected to achieve the purpose of the embodiment scheme according to actual needs.

[0198] The above embodiments are only used to illustrate the technical solutions of the present application, but not limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can still be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A model training method, characterized in that, Applied to a client, comprising: determining graph data, the graph data is constructed according to the data of the user registered in the client within a preset time period; convert the graph data into a mathematical vector expression form to obtain a first expression, the expression form of the first expression is different from that of the graph data; send the first expression to the server, so that the server aggregates the first expressions of different clients after receiving the first expressions sent by at least two clients to obtain a second expression, and sends the second expression to the corresponding client, different clients are different applications; receive the second expression sent by the server, the second expression is obtained by the server according to the first expression of at least two clients; train a first initial model according to the second expression to obtain a target model, wherein the first initial model is used to detect malicious users; wherein the determination of the graph data comprises: obtaining the data of the user registered in the client within the preset time period, taking the user as the node of the graph data, taking the user data corresponding to the user as the attribute of the corresponding node, constructing the edge of the graph data according to the existing association relationship between different users to obtain the graph data. 2.The model training method of claim 1, wherein, The second expression is used to train a first initial model to obtain a target model, comprising: step A: training the first initial model according to the second expression to obtain a second initial model; step B: send the first model parameter to the server, the first model parameter is the model parameter of the second initial model; step C: receive the second model parameter sent by the server, the second model parameter is obtained by the server according to the first model parameter of at least two clients; step D: update the second initial model according to the second model parameter to obtain the updated second initial model, and take the updated second initial model as the new first initial model; step E: repeat the steps of steps A to D until the new first initial model meets the requirements, and take the new first initial model meeting the requirements as the target model. 3.The model training method of claim 2, wherein, The first initial model includes a multi-layer perception network, and the second expression is used to train a first initial model to obtain a second initial model, comprising: taking the second expression as the input of the multi-layer perception network to obtain the classification result output by the multi-layer perception network; determine the error of the multi-layer perception network according to the classification result, and update the multi-layer perception network through the back propagation algorithm according to the error until the multi-layer perception network meeting the requirements is obtained; determine the second initial model according to the multi-layer perception network meeting the requirements.

4. A model training method, comprising: Applied to a server communicating with the client of claim 1, comprising: receive the first expression sent by at least two clients, the first expression is obtained according to the method of claim 1; aggregating the first expressions of different clients to obtain a second expression, the different clients being different applications; sending the second expression to the at least two clients, so that the clients train a first initial model according to the second expression to obtain a target model, the first initial model being used to detect malicious users. 5.The model training method of claim 4, wherein, Before the receiving of the first expressions sent by the at least two clients, the method further comprises: receiving an environment creation request sent by a first client, wherein the first client is any one of the clients, the environment creation request comprises an identifier of at least one second client, the second client being a client specified by the first client; creating a trusted training environment according to the environment creation request; generating environment credentials of the first client and the second client respectively according to the trusted training environment, and sending each of the environment credentials to the corresponding first client and second client, the environment credentials being in one-to-one correspondence with the clients. 6.The model training method of claim 5, wherein, Before the receiving of the first expressions sent by the at least two clients, the method further comprises: receiving environment credentials sent by the clients; verifying the received environment credentials; the receiving of the first expressions sent by the at least two clients comprises: receiving the first expressions sent by at least two target clients, wherein the target client is a client corresponding to the environment credential that passes the verification. 7.The model training method of claim 4, wherein, Before the aggregating of the first expressions of different clients to obtain a second expression, the method further comprises: receiving user identifiers sent by each of the clients; constructing a mapping table according to the user identifiers of each of the clients, the mapping table being used to indicate an association relationship between user data of each of the clients; the aggregating of the first expressions of different clients to obtain a second expression comprises: aggregating the first expressions of the at least two clients according to the mapping table to obtain the second expression.

8. A malicious user detection method characterized by, comprises: obtaining user data of a to-be-detected user; determining a corresponding target model according to a client corresponding to the to-be-detected user; inputting the user data into the target model for detection to obtain a detection result output by the target model, the detection result being used to indicate whether the to-be-detected user is a malicious user, the target model being trained according to the model training method in any one of claims 1 to 3 or the model training method in any one of claims 4 to 7. 9.A model training apparatus applied to a client, characterized in that, comprises: a graph data obtaining module, configured to determine graph data, the graph data being constructed according to data of users registered at the client within a preset time period; a first expression obtaining module, configured to convert the graph data into an expression form of a mathematical vector to obtain a first expression, the expression form of the first expression being different from that of the graph data; The first sending module is used to send the first expression to the server, so that after the server receives the first expressions sent by at least two clients, it aggregates the first expressions from different clients to obtain a second expression, and sends the second expression to the corresponding clients, where the different clients are different applications. A first receiving module is configured to receive a second expression sent by the server, wherein the second expression is obtained by the server based on the first expressions from at least two of the clients; The training module is used to train the first initial model based on the second expression to obtain the target model, wherein the first initial model is used to detect malicious users; Specifically, the graph data acquisition module is used to: acquire data of users who registered on the client within the preset time period, use users as nodes of graph data, use user data corresponding to users as attributes of corresponding nodes, construct edges of graph data based on the relationships between different users, and obtain the graph data. 10.A model training apparatus applied to a server in communication with the client of claim 9, characterized in that, include: The second receiving module is configured to receive a first expression sent by at least two clients, the first expression being obtained by the apparatus according to claim 9; The second expression acquisition module is used to aggregate the first expressions of different clients based on the first expressions of the at least two clients to obtain the second expression, wherein the different clients are different applications; The second sending module is used to send the second expression to the at least two clients, so that the clients can train the first initial model based on the second expression to obtain the target model, wherein the first initial model is used to detect malicious users.

11. A malicious user detection apparatus characterized by comprising: include: The user data acquisition module is used to acquire user data of the user to be detected. The target model acquisition module is used to determine the corresponding target model based on the client corresponding to the user to be detected; The detection module is used to input the user data into the target model for detection and obtain the detection result output by the target model. The detection result is used to indicate whether the user to be detected is a malicious user. The target model is trained according to the model training method of any one of claims 1 to 3.

12. A terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the model training method as described in any one of claims 1 to 3, or the model training method as described in any one of claims 4 to 7, or the malicious user detection method as described in claim 8.

13. A computer-readable storage medium, the computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the model training method as described in any one of claims 1 to 3, or the model training method as described in any one of claims 4 to 7, or the malicious user detection method as described in claim 8.

Images