Abnormal user detection method, device, equipment and computer storage medium

Abstract

Embodiments of the present invention relate to the field of computer data processing technology and disclose a method, apparatus, device, and computer storage medium for detecting abnormal users. The method comprises: obtaining interaction behavior data between multiple users; determining interaction attribute characteristics of each user based on the interaction behavior data; determining interaction timing characteristics of each user based on the interaction behavior data; and determining abnormal users from the multiple users based on the interaction attribute characteristics and interaction timing characteristics. Through the above-described methods, embodiments of the present invention improve the accuracy of abnormal user detection.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer data processing technology, and in particular to an abnormal user detection method, apparatus, device, and computer storage medium. Background Art

[0002] With the development and popularization of the internet, social applications with various content have attracted a large number of users, and a large number of users interact with each other in these social applications. However, users with abnormal interactive behavior may cause a poor user experience for other normal users, thus requiring the detection of abnormal users. During the implementation of the present invention, the inventors discovered that the existing abnormal user detection methods suffer from low accuracy. Summary of the Invention

[0003] In view of the above problems, embodiments of the present invention provide an abnormal user detection method, apparatus, device, and computer storage medium to solve the problem of low accuracy of abnormal user detection in the prior art.

[0004] According to one aspect of an embodiment of the present invention, a method for detecting abnormal users is provided, the method comprising:

[0005] Obtain interactive behavior data between multiple users;

[0006] Determining the interaction attribute characteristics of each of the users according to the interaction behavior data;

[0007] Determining the interaction time sequence characteristics of each of the users according to the interaction behavior data;

[0008] An abnormal user is determined from the multiple users according to the interaction attribute feature and the interaction time sequence feature.

[0009] In an optional manner, the method further includes: constructing a user network based on the interaction behavior data;

[0010] Performing a random walk in the user network according to a random walk algorithm to obtain neighbor users corresponding to each of the users;

[0011] The interaction attribute characteristics of each user are determined respectively according to the interaction behavior data of the neighbor users and the interaction behavior data of the user.

[0012] In an optional manner, the user network is a bipartite graph; each user corresponds to a node in the bipartite graph; each user corresponds to a neighbor user sequence; the neighbor user sequence includes multiple neighbor users obtained in a wandering order. The method further includes:

[0013] According to the primitives, random walks are performed in the user network to obtain the neighbor user sequences corresponding to each user; wherein, the primitives are defined as M={u i ,u j ,u s ,e i ,e j};u i 、u j and u s are the source node, target node and intermediate node included in the primitive respectively; e i for u i with u j Directed edges between j for u s with u j There is at least one directed edge between the source node and the intermediate node and the target node respectively; the neighbor user sequence is determined according to the wandering probability;

[0014]

[0015] Among them, P(n j |n i ) is the node n in the user network i To node n j The walking probability of W ij For the primitive M ij The weight of M s is the set of primitives; M+u n To include user u n The set of primitives; u j For node n j The corresponding user.

[0016] In an optional method, the method further includes: performing feature extraction on the interaction behavior data of the neighbor user and the interaction behavior data of the user, respectively, to obtain initial neighbor attribute features and initial user attribute features;

[0017] Performing attention mechanism processing on the initial neighbor attribute features according to attention weights to obtain processed neighbor attribute features; the attention weights are determined according to primitives matched by the connection relationship between the neighbor users and the user;

[0018] The processed neighbor attribute features and the initial user attribute features are aggregated to obtain interaction attribute features of each of the users.

[0019] In an optional method, the method further includes: determining a receiving user sequence corresponding to the first user and a sending user sequence corresponding to the second user according to the interaction behavior data; the first user and the second user are any two different users among the multiple users;

[0020] Position-encoding the receiving user sequence according to the time at which the receiving behavior occurs to obtain a behavior time series feature of the first user;

[0021] Position-encode the sending user sequence according to the time at which the sending behavior occurs to obtain a behavior time series feature of the second user;

[0022] The behavioral time series features of the first user and the behavioral time series features of the second user are processed by a collaborative attention mechanism to obtain interaction time series features of the first user and the second user respectively.

[0023] In an optional method, the method further includes: determining a correlation matrix between the first user and the second user based on the behavior time series characteristics;

[0024] Determining the behavior influence weights corresponding to the first user and the second user respectively according to the association matrix;

[0025] The behavior time series features of the first user and the behavior time series features of the second user are processed separately according to the behavior influence weight to obtain interaction time series features of the first user and the second user.

[0026] In an optional method, the method further includes: performing feature concatenation on the interaction attribute features and the interaction time sequence features corresponding to the first user and the second user to obtain a comprehensive interaction feature between the first user and the second user;

[0027] Inputting the comprehensive interaction features into a preset neural network model to obtain an abnormal probability of interaction between the first user and the second user;

[0028] The abnormal user is determined from the multiple users according to the interaction abnormality probability.

[0029] According to another aspect of an embodiment of the present invention, there is provided an abnormal user detection device, comprising:

[0030] An acquisition module is used to obtain interaction behavior data between multiple users;

[0031] A first determining module, configured to determine the interaction attribute characteristics of each of the users based on the interaction behavior data;

[0032] A second determining module is configured to determine the interaction time sequence characteristics of each of the users according to the interaction behavior data;

[0033] A third determining module is configured to determine abnormal users from the multiple users based on the interaction attribute characteristics and the interaction time sequence characteristics.

[0034] According to another aspect of an embodiment of the present invention, there is provided an abnormal user detection device, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform the operation of the abnormal user detection method as described above.

[0035] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, wherein the storage medium stores at least one executable instruction, and the executable instruction enables an abnormal user detection device to perform the operations of the abnormal user detection method described below.

[0036] The embodiment of the present invention obtains interactive behavior data between multiple users; determines the interactive attribute characteristics of each user based on the interactive behavior data, wherein the interactive attribute characteristics are used to reflect the user's personal interactive interests; determines the interactive timing characteristics of each user based on the interactive behavior data, wherein the interactive timing characteristics reflect the association between the interactive behavior and time between users and are used to characterize the interactive behavior pattern of users; and finally determines abnormal users from the multiple users based on the interactive attribute characteristics and the interactive timing characteristics. Different from the solution adopted in the prior art that only considers the interactive attributes of users to determine abnormal users, which leads to the problem of low efficiency in abnormal user detection, the implementation of this application combines the structural information, content information and timing information contained in the interactive network corresponding to the user to determine abnormal users from the interactive network, which can improve the accuracy of abnormal user detection.

[0037] The above description is only an overview of the technical solutions of the embodiments of the present invention. In order to more clearly understand the technical means of the embodiments of the present invention, they can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the embodiments of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are specifically listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The accompanying drawings are only used to illustrate the embodiments and are not to be considered as limiting the present invention. In addition, the same reference symbols are used to represent the same components throughout the drawings. In the drawings:

[0039] Figure 1 A schematic diagram showing a flow chart of an abnormal user detection method provided by an embodiment of the present invention is shown;

[0040] Figure 2 A schematic diagram of the primitives of the abnormal user detection method provided by an embodiment of the present invention is shown;

[0041] Figure 3 A schematic diagram showing a random walk of the abnormal user detection method provided by an embodiment of the present invention is shown;

[0042] Figure 4 A schematic diagram showing a flow chart of another abnormal user detection method provided by an embodiment of the present invention;

[0043] Figure 5 A schematic diagram showing the structure of an abnormal user detection device provided by an embodiment of the present invention is shown;

[0044] Figure 6 A schematic structural diagram of an abnormal user detection device provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0045] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0046] Figure 1 The flowchart of the abnormal user detection method provided by the embodiment of the present invention is shown, and the method is executed by a computer processing device. The computer processing device may include a mobile phone, a laptop computer, etc. Figure 1 As shown, the method includes the following steps:

[0047] Step 10: Obtain interaction behavior data between multiple users.

[0048] In one embodiment of the present invention, users may be users in the same application environment, where the application may be an application that enables two-way interaction, such as a social networking application. Interaction behavior data may include data corresponding to various preset interaction behaviors between users, such as sending messages, liking posts, and visiting homepages, including behavior time, behavior subject, behavior target, and behavior content.

[0049] Step 20: Determine the interaction attribute characteristics of each of the users based on the interaction behavior data.

[0050] In one embodiment of the present invention, the interaction attribute feature is used to characterize the user's interaction interest and can be determined based on the user's interaction content and interaction relationship, wherein the interaction content and interaction relationship can correspond to the graph structure information and graph content information of the user network formed by the users.

[0051] In another embodiment of the present invention, a user network corresponding to the user can be constructed based on the interaction behavior data, and graph analysis can be performed on the user network to obtain graph structure information and graph content information. The graph analysis method can include word vector model, graph convolution, etc.

[0052] Therefore, in one embodiment of the present invention, step 20 further includes:

[0053] Step 201: Construct a user network based on the interaction behavior data.

[0054] In one embodiment of the present invention, the user network is a bipartite graph; each user corresponds to a node in the bipartite graph. Whether a connection exists between the nodes corresponding to the users is determined based on whether there is interaction between the two users in the interaction behavior data. The direction and number of connections between the nodes corresponding to the users are determined based on the initiator and recipient of the interaction.

[0055] If user A initiates an interaction with user B, there is a connection from the node corresponding to user A to the node corresponding to B. Conversely, if B also initiates an interaction with A, the connection between the node corresponding to user A and the node corresponding to B is a bidirectional connection.

[0056] Step 202: Perform random walks in the user network according to a random walk algorithm to obtain neighbor users corresponding to each of the users.

[0057] In one embodiment of the present invention, the random walk algorithm may determine users within a preset distance range from the user as the user's corresponding neighbor users, wherein the preset range may be two hops or the like.

[0058] In another embodiment of the present invention, considering that neighbor users determined based on distance cannot well reflect the user's interactive interests, in order to make the neighbors obtained by wandering better reflect the attribute characteristics of each user, multiple primitives can be designed based on the one-way and two-way information of interactions between users, and wandering in the user network based on the primitives reflecting different interaction modes can obtain the user's neighbor users.

[0059] Therefore, in yet another embodiment of the present invention, step 202 further includes:

[0060] Step 2021: Randomly walk in the user network according to the primitives to obtain a neighbor user sequence corresponding to each of the users.

[0061] In one embodiment of the present invention, a primitive is used to represent an interaction mode between users. The primitive may include at least three nodes, corresponding to three users respectively. The primitive may be defined as M={u i ,u j ,us ,e i ,e j}; where u i 、u j and u s are the source node, target node and intermediate node included in the primitive respectively; e i for u i with u j Directed edges between j for u s with u j There is at least one directed edge between the source node and the intermediate node and the target node.

[0062] In yet another embodiment of the present invention, a primitive may include Figure 2 There are 7 types as shown. Figure 2 As shown, there is at least one unidirectional connection between any two of the three nodes.

[0063] In another embodiment of the present invention, each user corresponds to a neighbor user sequence, and the neighbor user sequence includes multiple neighbor users obtained according to the wandering order. The neighbor user sequence is determined according to the wandering probability;

[0064]

[0065] In the above formula, P(n j |n i ) is the node n in the user network i Walk to node n j The wandering probability of W ij For the primitive M ij The weight of M s is the set of primitives; M+u n To include user u n The set of primitives; u j For node n j Compared to randomly selecting neighbors, this primitive-based approach improves the model's convolution capabilities and interpretability. This primitive-based approach can select valuable neighboring users for users in anomaly detection systems, thereby reducing the loss of abnormal user features during the convolution process.

[0066] In another embodiment of the present invention, in order to improve the reliability of the neighbors obtained by wandering, an offset weight b can be added to the wandering process of each node. The offset weight b is used to control the association relationship between the current node to be wandered and the previous node. For example, refer to Figure 3 , the current path has traveled to N iAt the node, the previous node in the wandering path is N i-1 Nodes n3, n3, and n3 are nodes in the user network. If you walk to n3 according to the next node in the primitive walking path, the weight corresponding to node n3 is W i3 =W i3 +b, instead of the default weight W i3 , because node n3 is not only connected to the current node, but also has a primitive relationship with the previous node. The proposed walking strategy is used to sample a series of neighboring nodes that are connected to the given node based on primitives. Thus, the neighbor user sequence corresponding to user S is {N1, N2, ..., N i}.

[0067] Step 203: Determine the interaction attribute characteristics of each user according to the interaction behavior data of the neighbor users and the interaction behavior data of the user.

[0068] In one embodiment of the present invention, feature extraction can be performed on the interaction behavior data of neighbor users to obtain initial user attribute features and initial neighbor user attribute features. The initial neighbor attributes are then embedded into the initial user attribute features to obtain interaction attribute features for each user. A word vector model can be used for feature extraction, and a convolutional structure can be used for feature embedding.

[0069] Therefore, in yet another embodiment of the present invention, step 203 further includes:

[0070] Step 2031: performing feature extraction on the interaction behavior data of the neighbor users and the interaction behavior data of the user, respectively, to obtain initial neighbor attribute features and initial user attribute features.

[0071] In one embodiment of the present invention, feature extraction can be performed based on a preset word vector model. The word vector model can be a skip-gram model. A high-dimensional feature representation is learned for each user through the word vector model. Specifically, the feature representation can be obtained by maximizing the probability of neighbor nodes occurring in the wandering path:

[0072]

[0073] Where w is the size of the window of context nodes retrieved in the neighbor user sequence, φ is the distance between user u i Embedded into a d-dimensional vector space mapping function, n i is the i-th neighbor user.

[0074] In one embodiment of the present invention, based on the negative sampling strategy, the loss function of the word vector model can be written as follows:

[0075]

[0076] Among them, N(u i )' is user u i The negative sampling set, σ() is the activation function.

[0077] Step 2032: Perform attention mechanism processing on the initial neighbor attribute features according to the attention weight to obtain processed neighbor attribute features; the attention weight is determined according to the primitive matched by the connection relationship between the neighbor user and the user.

[0078] In one embodiment of the present invention, considering that the weights of neighbors selected by different primitives are different, in order to distinguish the importance of neighbors selected by different primitives, the initial neighbor attribute features can be processed by attention mechanism according to the weights corresponding to the primitives. Specifically, for each neighbor user u i ∈N(u), the neighbor attribute features are processed as follows:

[0079]

[0080]

[0081] Among them, σ() is the tanh activation function, W1 T and is the parameter of the neural network model, b1 and b2 are the offset parameters. The hidden layer features of all neighbors are processed by the attention layer to obtain the processed neighbor attribute features

[0082] as well as,

[0083]

[0084] in, is the parameter of the neural network model, b3 is the offset parameter; α l For neighbor user u l The corresponding attention weights.

[0085] Step 2033: Aggregate the processed neighbor attribute features and the initial user attribute features to obtain interaction attribute features of each user.

[0086] In one embodiment of the present invention, a convolutional structure can be used to combine the neighbor feature embeddings into the own embedding. The convolutional structure can include a fully connected layer and a batch normalization layer, where the processing formulas of each layer are as follows:

[0087]

[0088]

[0089] Among them, σ2() is the ReLU activation function, γ and β are pre-trained parameters of the convolutional structure.

[0090] Step 30: Determine the interaction timing characteristics of each of the users based on the interaction behavior data.

[0091] In one embodiment of the present invention, the interaction time series feature is used to represent the time series information of the user's interaction based on the interaction attribute feature, that is, the interaction behavior pattern represented by the interaction attribute.

[0092] Considering that the interactive behavior involves at least two users, namely the sender of the behavior and the receiver of the behavior, in one embodiment of the present invention, two users form a user pair, and for the two users in the user pair, the user timing of the receiving behavior corresponding to one user and the user timing of the sending behavior corresponding to the other user are determined respectively.

[0093] In one embodiment of the present invention, step 30 further includes step 301: determining a receiving user sequence corresponding to the first user and a sending user sequence corresponding to the second user according to the interaction behavior data.

[0094] In one embodiment of the present invention, the first user and the second user are any two different users among the plurality of users, such as user u and user d respectively. i and u j .

[0095] For user u i , the users who will have interactive behaviors are arranged in the order of the time when the behaviors occurred, and the user u i The corresponding receiving user sequence S i ={u1,u2,…,u N For user u i Target user u j , sort the users who have interactive behaviors according to the time sequence of the interactive behaviors, and get user u j The corresponding sending user sequence R j ={u1,u2,…,u N}.

[0096] In another embodiment of the present invention, the interactive behavior data can be encoded using a Transformer encoder model to obtain S i and R j .

[0097] Step 302: Position-encode the receiving user sequence according to the time of occurrence of the receiving behavior to obtain the behavior time sequence feature of the first user.

[0098] Considering that the existing Transformer model does not have a convolutional module and a recursive neural network module, the existing Transformer encoder model itself does not have the timing information of the learning input behavior sequence, and therefore the timing information of the user interaction behavior will be lost. Therefore, in order to combine the timing information, in another embodiment of the present invention, the occurrence time of the receiving or sending behavior corresponding to each user in the sending user sequence and the receiving user sequence can be first position-encoded to obtain the corresponding behavior timing characteristics.

[0099] Therefore, in another embodiment of the present invention, the Transformer encoder model includes a first sublayer and a second sublayer, wherein the first sublayer is an attention mechanism processing model, and the second sublayer is a fully connected forward propagation neural network layer at the position level, which is used to realize position encoding.

[0100] In another embodiment of the present invention, the number of encoder layers in the Transformer model can be 6 layers, and the user u i Behavior sequence S i ={u1,u2,…,u N After the processing output of the second sub-layer, user u is obtained i The behavioral temporal characteristics are expressed as H j ={h1,h2,…,h n}.

[0101] Step 303: Position-encode the sending user sequence according to the time of occurrence of the sending behavior to obtain the behavior time sequence feature of the second user.

[0102] In one embodiment of the present invention, the encoding method of the second user's behavior time series characteristics is similar to the aforementioned step 302 and will not be repeated here.

[0103] Step 304: Perform collaborative attention mechanism processing on the behavioral timing features of the first user and the behavioral timing features of the second user to obtain interaction timing features of the first user and the second user respectively.

[0104] In one embodiment of the present invention, the influence weights of each user's behavior on different target users are different. Therefore, a collaborative attention network can be used to mine the mutual influence relationship between the behaviors of two users.

[0105] In one embodiment of the present invention, the time-series behavioral features of a first user and a second user can be processed using a collaborative attention mechanism to obtain a correlation matrix between the first and second user's behaviors. The correlation matrix is ​​used to characterize the different effects of a user's historical behavior on the current interaction. Using this correlation matrix, attention scores for behaviors at different moments can be obtained. The hidden layer representations of the behavioral features are then weighted and summed to obtain the behavioral time-series features corresponding to the user and target user, respectively.

[0106] Therefore, in another embodiment of the present invention, step 304 further includes: step 3401: determining a correlation matrix between the first user and the second user according to the behavior time series characteristics.

[0107] In one embodiment of the present invention, user u i The behavior sequence features after behavior sequence modeling through the Transformer layer are H i ={h1,h2,…,h n}, target user u j The behavior sequence features after behavior sequence modeling through the Transformer layer are H j ={h1,h2,…,h n}, use H i and H j As the input of the collaborative attention network, the correlation matrix C between two users is calculated as follows:

[0108]

[0109] Among them, W (1) are pre-trained parameters, and H j They are user u i and user u j Corresponding behavioral temporal characteristics.

[0110] Step 3402: Determine the behavior influence weights corresponding to the first user and the second user respectively according to the association matrix.

[0111] In one embodiment of the present invention, after calculating the association matrix, the behavior influence weights corresponding to the first user and the second user can be calculated using the association matrix according to the following formula:

[0112] e i =tanh(W (2) H i +W (3) H j C)

[0113] e j=tanh(W (4) H j +W (5) H i C)

[0114] a i =softmax(e i )

[0115] a j =softmax(e j )

[0116] Among them, W (2) 、W (3) 、W (4) and W (5) is the parameter obtained by training, a i and a j They are user u i and user u j The behavior of the behavior sequence affects the weight, and softmax() is the activation function.

[0117] Step 3403: Process the behavior time series features of the first user and the behavior time series features of the second user respectively according to the behavior influence weight to obtain interaction time series features of the first user and the second user.

[0118] In one embodiment of the present invention, based on the behavior influence weight of the user behavior sequence, the behavior of each moment in the behavior time series feature of the first user and the behavior time series feature of the second user are weighted and summed to obtain the interaction time series feature H of the first user. i 'Interaction time series feature H' with the second user j , where the processing formula can be as follows:

[0119]

[0120]

[0121] Step 40: Determine abnormal users from the multiple users based on the interaction attribute characteristics and the interaction time sequence characteristics.

[0122] In one embodiment of the present invention, Figure 4 As shown in Figure 1, interaction attribute features and interaction time series features are aggregated to obtain the graph structure and content information with time series information between all users. Classification prediction is then performed based on this graph feature information to identify user pairs with abnormal interaction behavior. This classification prediction can be performed using a pre-set neural network model.

[0123] Therefore, in one embodiment of the present invention, step 40 further includes: step 401: feature-connecting the interaction attribute features and the interaction timing features corresponding to the first user and the second user to obtain a comprehensive interaction feature between the first user and the second user.

[0124] In one embodiment of the present invention, the interaction attribute feature and the interaction time sequence feature are connected to obtain a comprehensive interaction feature corresponding to a user pair consisting of the first user and the second user.

[0125] Step 402: Input the comprehensive interaction features into a preset neural network model to obtain an abnormal probability of interaction between the first user and the second user.

[0126] In one embodiment of the present invention, the neural network model may be a multi-layer perceptron, which includes two fully connected layers and a random dropout layer. The introduction of the random dropout layer can reduce the overfitting rate of the neural network model and improve the accuracy of abnormal user detection.

[0127] μ i =σ2(W1 T Z+b1)

[0128] μ i '=Dropout(μ i )

[0129]

[0130] Among them, Z is the comprehensive interaction feature, σ2 is the activation function, μ′ i is the output of the random dropout layer, D sets the probability of random dropout to 0.5, and y represents the probability of abnormality of this interaction predicted by the model, y∈[0,1].

[0131] In another embodiment of the present invention, a cross-entropy loss function can also be used to optimize the neural network model. The cross-entropy loss function can calculate the distance between the true sample label and the predicted probability. In the cross-entropy loss function, the closer the model's prediction is to the distribution of the true label y, the smaller the loss function; the farther the prediction is from the true label, the larger the loss function, and the greater the "penalty" for the current model. At the same time, the increase in this loss function is nonlinear, so it will make the model's prediction closer to the distribution of the true value. The formula of the cross-entropy loss function is as follows:

[0132]

[0133] in, is the true value, y is the predicted value, y represents the user u i and u jThe probability of abnormal interaction between .

[0134] Step 403: Determine the abnormal user from the multiple users according to the interaction abnormality probability.

[0135] In one embodiment of the present invention, a user pair whose interaction abnormality probability is greater than a preset threshold may be determined as an abnormal user pair, and a user among the abnormal users may be determined as an abnormal user.

[0136] In yet another embodiment of the present invention, the abnormal interaction probabilities between any two of the multiple users may be compared, and two users whose probability is greater than the average value may be determined as abnormal users.

[0137] The abnormal user detection method of the embodiment of the present invention obtains interaction behavior data between multiple users; determines the interaction attribute characteristics of each of the users based on the interaction behavior data, wherein the interaction attribute characteristics are used to reflect the user's personal interaction interests; determines the interaction timing characteristics of each of the users based on the interaction behavior data, wherein the interaction timing characteristics reflect the correlation between the interaction behavior between users and time, and are used to characterize the user's interaction behavior pattern; finally, determines abnormal users from the multiple users based on the interaction attribute characteristics and the interaction timing characteristics, thereby distinguishing from the solution adopted in the prior art that only considers the user's interaction attributes to determine abnormal users, which causes the problem of low efficiency in abnormal user detection. The abnormal user detection method of the embodiment of the present application combines the structural information, content information and timing information contained in the user's corresponding interaction network to determine abnormal users from the interaction network, which can improve the accuracy of abnormal user detection.

[0138] Figure 5 FIG. 1 shows a schematic diagram of the structure of an abnormal user detection device provided by an embodiment of the present invention. Figure 5 As shown, the apparatus 500 includes: an acquisition module 501, a first determination module 502, a second determination module 503, and a third determination module 504. The acquisition module 501 is configured to acquire interaction behavior data between multiple users;

[0139] A first determining module 502 is configured to determine the interaction attribute characteristics of each user based on the interaction behavior data;

[0140] A second determining module 503 is configured to determine the interaction time sequence characteristics of each user according to the interaction behavior data;

[0141] The third determining module 504 is configured to determine abnormal users from the multiple users based on the interaction attribute characteristics and the interaction time sequence characteristics.

[0142] In an optional manner, the first determining module 502 is further configured to: construct a user network based on the interaction behavior data;

[0143] Performing a random walk in the user network according to a random walk algorithm to obtain neighbor users corresponding to each of the users;

[0144] The interaction attribute characteristics of each user are determined respectively according to the interaction behavior data of the neighbor users and the interaction behavior data of the user.

[0145] In an optional manner, the user network is a bipartite graph; each user corresponds to a node in the bipartite graph; each user corresponds to a neighbor user sequence; the neighbor user sequence includes multiple neighbor users obtained in a wandering order; the first determination module 502 is further configured to:

[0146] According to the primitives, random walks are performed in the user network to obtain the neighbor user sequences corresponding to each user; wherein, the primitives are defined as M={u i ,u j ,u s ,e i ,e j};u i 、u j and u s are the source node, target node and intermediate node included in the primitive respectively; e i for u i with u j Directed edges between j for u s with u j There is at least one directed edge between the source node and the intermediate node and the target node respectively; the neighbor user sequence is determined according to the wandering probability;

[0147]

[0148] Among them, P(n j |n i ) is the node n in the user network i To node n j The walking probability of W ij For the primitive M ij The weight of M s is the set of primitives; M+u n To include user u n The set of primitives; u j For node n j The corresponding user.

[0149] In an optional manner, the second determining module 503 is further configured to: perform feature extraction on the interaction behavior data of the neighbor user and the interaction behavior data of the user, respectively, to obtain initial neighbor attribute features and initial user attribute features;

[0150] Performing attention mechanism processing on the initial neighbor attribute features according to attention weights to obtain processed neighbor attribute features; the attention weights are determined according to primitives matched by the connection relationship between the neighbor users and the user;

[0151] The processed neighbor attribute features and the initial user attribute features are aggregated to obtain interaction attribute features of each of the users.

[0152] In an optional manner, the second determining module 503 is further configured to: determine a receiving user sequence corresponding to the first user and a sending user sequence corresponding to the second user according to the interaction behavior data; the first user and the second user are any two different users among the multiple users;

[0153] Position-encoding the receiving user sequence according to the time at which the receiving behavior occurs to obtain a behavior time series feature of the first user;

[0154] Position-encode the sending user sequence according to the time at which the sending behavior occurs to obtain a behavior time series feature of the second user;

[0155] The behavioral time series features of the first user and the behavioral time series features of the second user are processed by a collaborative attention mechanism to obtain interaction time series features of the first user and the second user respectively.

[0156] In an optional manner, the second determining module 503 is further configured to:

[0157] determining a correlation matrix between the first user and the second user according to the behavior time series characteristics;

[0158] Determining the behavior influence weights corresponding to the first user and the second user respectively according to the association matrix;

[0159] The behavior time series features of the first user and the behavior time series features of the second user are processed separately according to the behavior influence weight to obtain interaction time series features of the first user and the second user.

[0160] In an optional manner, the third determining module 504 is further configured to:

[0161] Performing feature concatenation on the interaction attribute features and the interaction time series features corresponding to the first user and the second user to obtain a comprehensive interaction feature between the first user and the second user;

[0162] Inputting the comprehensive interaction features into a preset neural network model to obtain an abnormal probability of interaction between the first user and the second user;

[0163] The abnormal user is determined from the multiple users according to the interaction abnormality probability.

[0164] The abnormal user detection device of an embodiment of the present invention obtains interaction behavior data between multiple users; determines the interaction attribute characteristics of each user based on the interaction behavior data, wherein the interaction attribute characteristics are used to reflect the user's personal interaction interests; determines the interaction timing characteristics of each user based on the interaction behavior data, wherein the interaction timing characteristics reflect the relationship between the interaction behavior between users and time, and are used to characterize the user's interaction behavior pattern; finally, determines abnormal users from the multiple users based on the interaction attribute characteristics and the interaction timing characteristics.

[0165] This is different from the solution adopted in the prior art that only considers the user's interactive attributes to determine abnormal users, which leads to the problem of low efficiency in abnormal user detection. The abnormal user detection device provided in the embodiment of the present application combines the structural information, content information and timing information contained in the user's corresponding interactive network to determine abnormal users from the interactive network, which can improve the accuracy of abnormal user detection.

[0166] Figure 6 The diagram shows the structure of an abnormal user detection device provided by an embodiment of the present invention. The specific embodiment of the present invention does not limit the specific implementation of the abnormal user detection device.

[0167] like Figure 6 As shown, the abnormal user detection device may include: a processor (processor) 602 , a communication interface (Communications Interface) 604 , a memory (memory) 606 , and a communication bus 608 .

[0168] Processor 602, communication interface 604, and memory 606 communicate with each other via communication bus 608. Communication interface 604 is used to communicate with other devices, such as clients or other server network elements. Processor 602 is used to execute program 610, which may specifically perform the steps described in the above-mentioned embodiment of the abnormal user detection method.

[0169] Specifically, the program 610 may include program code including computer-executable instructions.

[0170] Processor 602 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement an embodiment of the present invention. The one or more processors included in the abnormal user detection device may be processors of the same type, such as one or more CPUs, or may be processors of different types, such as one or more CPUs and one or more ASICs.

[0171] The memory 606 is used to store the program 610. The memory 606 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0172] Program 610 may be specifically called by processor 602 to enable the abnormal user detection device to perform the following operations:

[0173] Obtain interactive behavior data between multiple users;

[0174] Determining the interaction attribute characteristics of each of the users according to the interaction behavior data;

[0175] Determining the interaction time sequence characteristics of each of the users according to the interaction behavior data;

[0176] An abnormal user is determined from the multiple users according to the interaction attribute feature and the interaction time sequence feature.

[0177] In an optional manner, the program 610 is called by the processor 602 to enable the abnormal user detection device to perform the following operations:

[0178] Building a user network based on the interaction behavior data;

[0179] Performing a random walk in the user network according to a random walk algorithm to obtain neighbor users corresponding to each of the users;

[0180] The interaction attribute characteristics of each user are determined respectively according to the interaction behavior data of the neighbor users and the interaction behavior data of the user.

[0181] In an optional manner, the user network is a bipartite graph; each user corresponds to a node in the bipartite graph; each user corresponds to a neighbor user sequence; the neighbor user sequence includes multiple neighbor users obtained in a wandering order. The program 610 is called by the processor 602 to cause the abnormal user detection device to perform the following operations:

[0182] According to the primitives, random walks are performed in the user network to obtain the neighbor user sequences corresponding to each user; wherein, the primitives are defined as M={u i ,u j ,u s ,e i ,e j};u i 、u j and u s are the source node, target node and intermediate node included in the primitive respectively; e i for u i with u j Directed edges between j for u s with u j There is at least one directed edge between the source node and the intermediate node and the target node respectively; the neighbor user sequence is determined according to the wandering probability;

[0183]

[0184] Among them, P(n j |n i ) is the node n in the user network i To node n j The walking probability of W ij For the primitive M ij The weight of M s is the set of primitives; M+u n To include user u n The set of primitives; u j For node n j The corresponding user.

[0185] In an optional manner, the program 610 is called by the processor 602 to enable the abnormal user detection device to perform the following operations:

[0186] Performing feature extraction on the interaction behavior data of the neighbor users and the interaction behavior data of the user to obtain initial neighbor attribute features and initial user attribute features;

[0187] Performing attention mechanism processing on the initial neighbor attribute features according to attention weights to obtain processed neighbor attribute features; the attention weights are determined according to primitives matched by the connection relationship between the neighbor users and the user;

[0188] The processed neighbor attribute features and the initial user attribute features are aggregated to obtain interaction attribute features of each of the users.

[0189] In an optional manner, the program 610 is called by the processor 602 to enable the abnormal user detection device to perform the following operations:

[0190] Determining a receiving user sequence corresponding to a first user and a sending user sequence corresponding to a second user according to the interaction behavior data; the first user and the second user are any two different users among the plurality of users;

[0191] Position-encoding the receiving user sequence according to the time at which the receiving behavior occurs to obtain a behavior time series feature of the first user;

[0192] Position-encode the sending user sequence according to the time at which the sending behavior occurs to obtain a behavior time series feature of the second user;

[0193] The behavioral time series features of the first user and the behavioral time series features of the second user are processed by a collaborative attention mechanism to obtain interaction time series features of the first user and the second user respectively.

[0194] In an optional manner, the program 610 is called by the processor 602 to enable the abnormal user detection device to perform the following operations:

[0195] determining a correlation matrix between the first user and the second user according to the behavior time series characteristics;

[0196] Determining the behavior influence weights corresponding to the first user and the second user respectively according to the association matrix;

[0197] The behavior time series features of the first user and the behavior time series features of the second user are processed separately according to the behavior influence weight to obtain interaction time series features of the first user and the second user.

[0198] In an optional manner, the program 610 is called by the processor 602 to enable the abnormal user detection device to perform the following operations:

[0199] Performing feature concatenation on the interaction attribute features and the interaction time series features corresponding to the first user and the second user to obtain a comprehensive interaction feature between the first user and the second user;

[0200] Inputting the comprehensive interaction features into a preset neural network model to obtain an abnormal probability of interaction between the first user and the second user;

[0201] The abnormal user is determined from the multiple users according to the interaction abnormality probability.

[0202] The abnormal user detection device of an embodiment of the present invention obtains interaction behavior data between multiple users; determines the interaction attribute characteristics of each user based on the interaction behavior data, wherein the interaction attribute characteristics are used to reflect the user's personal interaction interests; determines the interaction timing characteristics of each user based on the interaction behavior data, wherein the interaction timing characteristics reflect the relationship between the interaction behavior between users and time, and are used to characterize the user's interaction behavior pattern; finally, determines abnormal users from the multiple users based on the interaction attribute characteristics and the interaction timing characteristics.

[0203] This is different from the solution adopted in the prior art that only considers the user's interactive attributes to determine abnormal users, which leads to the problem of low efficiency in abnormal user detection. The abnormal user detection device provided in the embodiment of the present application combines the structural information, content information and timing information contained in the user's corresponding interactive network to determine abnormal users from the interactive network, which can improve the accuracy of abnormal user detection.

[0204] An embodiment of the present invention provides a computer-readable storage medium storing at least one executable instruction. When the executable instruction is executed on an abnormal user detection device, the abnormal user detection device executes the abnormal user detection method in any of the above method embodiments.

[0205] The executable instructions may be specifically used to enable the abnormal user detection device to perform the following operations:

[0206] Obtain interactive behavior data between multiple users;

[0207] Determining the interaction attribute characteristics of each of the users according to the interaction behavior data;

[0208] Determining the interaction time sequence characteristics of each of the users according to the interaction behavior data;

[0209] An abnormal user is determined from the multiple users according to the interaction attribute feature and the interaction time sequence feature.

[0210] In an optional manner, the executable instructions cause the abnormal user detection device to perform the following operations: construct a user network based on the interactive behavior data;

[0211] Performing a random walk in the user network according to a random walk algorithm to obtain neighbor users corresponding to each of the users;

[0212] The interaction attribute characteristics of each user are determined respectively according to the interaction behavior data of the neighbor users and the interaction behavior data of the user.

[0213] In an optional manner, the user network is a bipartite graph; each user corresponds to a node in the bipartite graph; each user corresponds to a neighbor user sequence; the neighbor user sequence includes multiple neighbor users obtained in a wandering order; and the executable instructions cause the abnormal user detection device to perform the following operations:

[0214] According to the primitives, random walks are performed in the user network to obtain the neighbor user sequences corresponding to each user; wherein, the primitives are defined as M={u i ,u j ,u s ,e i ,e j};u i 、u j and u s are the source node, target node and intermediate node included in the primitive respectively; e i for u i with u j Directed edges between j for u s with u j There is at least one directed edge between the source node and the intermediate node and the target node respectively; the neighbor user sequence is determined according to the wandering probability;

[0215]

[0216] Among them, P(n j |n i ) is the node n in the user network i To node n j The walking probability of W ij For the primitive M ij The weight of M s is the set of primitives; M+u n To include user u n The set of primitives; u j For node n j The corresponding user.

[0217] In an optional manner, the executable instruction causes the abnormal user detection device to perform the following operations:

[0218] Performing feature extraction on the interaction behavior data of the neighbor users and the interaction behavior data of the user to obtain initial neighbor attribute features and initial user attribute features;

[0219] Performing attention mechanism processing on the initial neighbor attribute features according to attention weights to obtain processed neighbor attribute features; the attention weights are determined according to primitives matched by the connection relationship between the neighbor users and the user;

[0220] The processed neighbor attribute features and the initial user attribute features are aggregated to obtain interaction attribute features of each of the users.

[0221] In an optional manner, the executable instruction causes the abnormal user detection device to perform the following operations:

[0222] Determining a receiving user sequence corresponding to a first user and a sending user sequence corresponding to a second user according to the interaction behavior data; the first user and the second user are any two different users among the plurality of users;

[0223] Position-encoding the receiving user sequence according to the time at which the receiving behavior occurs to obtain a behavior time series feature of the first user;

[0224] Position-encode the sending user sequence according to the time at which the sending behavior occurs to obtain a behavior time series feature of the second user;

[0225] The behavioral time series features of the first user and the behavioral time series features of the second user are processed by a collaborative attention mechanism to obtain interaction time series features of the first user and the second user respectively.

[0226] In an optional manner, the executable instruction causes the abnormal user detection device to perform the following operations:

[0227] determining a correlation matrix between the first user and the second user according to the behavior time series characteristics;

[0228] Determining the behavior influence weights corresponding to the first user and the second user respectively according to the association matrix;

[0229] The behavior time series features of the first user and the behavior time series features of the second user are processed separately according to the behavior influence weight to obtain interaction time series features of the first user and the second user.

[0230] In an optional manner, the executable instruction causes the abnormal user detection device to perform the following operations:

[0231] Performing feature concatenation on the interaction attribute features and the interaction time series features corresponding to the first user and the second user to obtain a comprehensive interaction feature between the first user and the second user;

[0232] Inputting the comprehensive interaction features into a preset neural network model to obtain an abnormal probability of interaction between the first user and the second user;

[0233] The abnormal user is determined from the multiple users according to the interaction abnormality probability.

[0234] The computer storage medium of an embodiment of the present invention obtains interaction behavior data between multiple users; determines interaction attribute characteristics of each user based on the interaction behavior data, wherein the interaction attribute characteristics are used to reflect the user's personal interaction interests; determines interaction timing characteristics of each user based on the interaction behavior data, wherein the interaction timing characteristics reflect the relationship between the interaction behavior between users and time, and are used to characterize the user's interaction behavior pattern; and finally determines abnormal users from the multiple users based on the interaction attribute characteristics and the interaction timing characteristics.

[0235] This is different from the solution adopted in the prior art that only considers the user's interactive attributes to determine abnormal users, which leads to the problem of low efficiency in abnormal user detection. The computer storage medium provided in the embodiment of the present application combines the structural information, content information and timing information contained in the interactive network corresponding to the user to determine abnormal users from the interactive network, which can improve the accuracy of abnormal user detection.

[0236] An embodiment of the present invention provides an abnormal user detection device for executing the above abnormal user detection method.

[0237] An embodiment of the present invention provides a computer program, which can be called by a processor to enable an abnormal user detection device to execute the abnormal user detection method in any of the above method embodiments.

[0238] An embodiment of the present invention provides a computer program product, which includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed on a computer, the computer executes the abnormal user detection method in any of the above method embodiments.

[0239] The algorithm or demonstration provided herein are not inherently relevant to any particular computer, virtual system or other equipment. Various general-purpose systems may also be used together with the teachings based on this. According to the above description, it is apparent that the structure required for constructing this type of system. In addition, the embodiment of the present invention is not directed to any specific programming language yet. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the above description of specific languages ​​is for the purpose of disclosing the best mode of the present invention.

[0240] In the description provided herein, numerous specific details are described. However, it is understood that embodiments of the present invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of this description.

[0241] Similarly, it should be understood that in order to streamline the present invention and facilitate understanding of one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the embodiments of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this method of disclosure should not be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim.

[0242] Those skilled in the art will appreciate that the modules in the devices in the embodiments can be adaptively changed and set in one or more devices different from the embodiments. The modules or units or components in the embodiments can be combined into one module or unit or component, and can be divided into multiple sub-modules or sub-units or sub-components. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed so far can be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) can be replaced by an alternative feature that provides the same, equivalent or similar purpose.

[0243] It should be noted that the above embodiments illustrate rather than limit the invention, and that alternative embodiments may be devised by a person skilled in the art without departing from the scope of the appended claims. In the claims, any reference signs placed between brackets should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising several different elements and by means of appropriately programmed computers. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names. The steps in the above embodiments should not be understood as limiting the order of execution unless otherwise specified.

Claims

1. A method for detecting abnormal users, characterized in that: The method comprises: Obtain interactive behavior data between multiple users; Determining the interaction attribute characteristics of each user based on the interaction behavior data; wherein, a user network is constructed based on the interaction behavior data; performing a random walk in the user network according to a random walk algorithm to obtain neighbor users corresponding to each user; and determining the interaction attribute characteristics of each user based on the interaction behavior data of the neighbor users and the interaction behavior data of the user; Determine the interaction time series characteristics of each of the users according to the interaction behavior data; wherein, determine the receiving user sequence corresponding to the first user and the sending user sequence of the second user according to the interaction behavior data; the first user and the second user are any two different users among the multiple users; position-encode the receiving user sequence according to the time when the receiving behavior occurs to obtain the behavior time series characteristics of the first user; position-encode the sending user sequence according to the time when the sending behavior occurs to obtain the behavior time series characteristics of the second user; perform collaborative attention mechanism processing on the behavior time series characteristics of the first user and the behavior time series characteristics of the second user to obtain the interaction time series characteristics of the first user and the second user respectively; An abnormal user is determined from the multiple users based on the interaction attribute characteristics and the interaction timing characteristics; wherein, the interaction attribute characteristics and the interaction timing characteristics corresponding to the first user and the second user are feature-connected to obtain a comprehensive interaction feature between the first user and the second user; the comprehensive interaction feature is input into a preset neural network model to obtain an interaction anomaly probability between the first user and the second user; and the abnormal user is determined from the multiple users based on the interaction anomaly probability.

2. The method according to claim 1, characterized in that The user network is a bipartite graph; each user corresponds to a node in the bipartite graph; each user corresponds to a neighbor user sequence; the neighbor user sequence includes multiple neighbor users obtained in a wandering order; The performing random walk in the user network according to the random walk algorithm to obtain neighbor users corresponding to each of the users includes: According to the primitives, random walks are performed in the user network to obtain the neighbor user sequences corresponding to each user; wherein the primitives are defined as ; 、 as well as are respectively the source node, the target node and the intermediate node included in the primitive; for and Directed edges between for and There is at least one directed edge between the source node and the intermediate node and the target node respectively; the neighbor user sequence is determined according to the wandering probability; ； in, For nodes in the user network To Node The walking probability of Primitive The weight of is a set of said primitives; To include users A collection of primitives; For nodes The corresponding user.

3. The method according to claim 2, characterized in that The determining of the interaction attribute characteristics of each user based on the interaction behavior data of the neighbor users and the interaction behavior data of the user includes: Extracting features from the interaction behavior data of the neighbor users and the interaction behavior data of the user to obtain initial neighbor attribute features and initial user attribute features; Performing attention mechanism processing on the initial neighbor attribute features according to attention weights to obtain processed neighbor attribute features; the attention weights are determined according to primitives matched by the connection relationship between the neighbor users and the user; The processed neighbor attribute features and the initial user attribute features are aggregated to obtain interaction attribute features of each of the users.

4. The method according to claim 1, wherein The performing collaborative attention mechanism processing on the behavior time series features of the first user and the behavior time series features of the second user to obtain interaction time series features of the first user and the second user respectively includes: determining a correlation matrix between the first user and the second user according to the behavior time series characteristics; Determining the behavior influence weights corresponding to the first user and the second user respectively according to the association matrix; The behavior time series features of the first user and the behavior time series features of the second user are processed separately according to the behavior influence weight to obtain interaction time series features of the first user and the second user.

5. An abnormal user detection device, characterized in that: The device comprises: An acquisition module is used to obtain interaction behavior data between multiple users; a first determining module configured to determine the interaction attribute characteristics of each user based on the interaction behavior data; wherein a user network is constructed based on the interaction behavior data; a random walk is performed in the user network based on a random walk algorithm to obtain neighboring users corresponding to each user; and interaction attribute characteristics of each user are determined based on the interaction behavior data of the neighboring users and the interaction behavior data of the user; a second determination module, configured to determine the interaction timing characteristics of each of the users based on the interaction behavior data; wherein a receiving user sequence corresponding to a first user and a sending user sequence corresponding to a second user are determined based on the interaction behavior data; the first user and the second user are any two different users among the plurality of users; position-encoding the receiving user sequence based on the time of occurrence of the receiving behavior to obtain the behavior timing characteristics of the first user; position-encoding the sending user sequence based on the time of occurrence of the sending behavior to obtain the behavior timing characteristics of the second user; and performing collaborative attention mechanism processing on the behavior timing characteristics of the first user and the behavior timing characteristics of the second user to obtain interaction timing characteristics of the first user and the second user, respectively; A third determination module is used to determine an abnormal user from the multiple users based on the interaction attribute characteristics and the interaction timing characteristics; wherein, the interaction attribute characteristics and the interaction timing characteristics corresponding to the first user and the second user are feature-connected to obtain a comprehensive interaction feature between the first user and the second user; the comprehensive interaction feature is input into a preset neural network model to obtain an interaction anomaly probability between the first user and the second user; and the abnormal user is determined from the multiple users based on the interaction anomaly probability.

6. An abnormal user detection device, characterized in that: include: A processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform the operation of the abnormal user detection method according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that The storage medium stores at least one executable instruction. When the executable instruction is executed on the abnormal user detection device, the abnormal user detection device performs the operation of the abnormal user detection method according to any one of claims 1 to 4.

Images