Abnormal account identification method and device, electronic device and storage medium

Abstract

The present application provides a method and device, electronic device, and storage medium for identifying abnormal accounts, belonging to the field of artificial intelligence technology. The method includes: screening original accounts based on a preset algorithm and account location information to obtain a target account; obtaining basic account information, behavioral feature data, and access scenario data of the target account; constructing an initial heterogeneous graph based on the access scenario data, basic account information, and behavioral feature data; the initial heterogeneous graph includes initial account nodes and initial account behavioral features; calculating the suspicion of the initial graph nodes and initial account behavioral features to obtain initial node suspicion and edge suspicion; pruning and scoring the initial heterogeneous graph based on the initial node suspicion to obtain a target heterogeneous graph; scoring the target heterogeneous graph based on a risk assessment model to obtain risk assessment data; and identifying abnormal accounts from the target heterogeneous graph based on the risk assessment data, thereby improving the accuracy of abnormal account identification.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a method and device for identifying abnormal accounts, an electronic device, and a storage medium. Background Art

[0002] Most current methods for identifying abnormal accounts are based on anomaly analysis of the characteristics of each account itself to determine whether the account is an abnormal account. This method often has the problem of low recognition accuracy. Therefore, how to improve the accuracy of identifying abnormal accounts has become a technical problem that needs to be solved urgently. Summary of the Invention

[0003] The main purpose of the embodiments of the present application is to propose a method and device for identifying abnormal accounts, an electronic device and a storage medium, aiming to improve the accuracy of identifying abnormal accounts.

[0004] To achieve the above objectives, a first aspect of an embodiment of the present application provides a method for identifying abnormal accounts, the method comprising:

[0005] Obtaining the account location information of the original account, and performing account screening on the original account based on a preset algorithm and the account location information to obtain a target account;

[0006] Obtaining target access data and basic account information of the target account, wherein the target access data includes behavioral feature data and access scenario data of the target account;

[0007] Determining an initial graph node based on the access scenario data and the basic account information, determining an initial access behavior sequence based on the behavior feature data, and constructing an initial heterogeneous graph based on the initial access behavior sequence and the initial graph nodes; wherein the initial graph node includes an initial account node, the initial access behavior sequence includes at least two initial account behavior features, and each initial account behavior feature connects two adjacent initial graph nodes;

[0008] Performing node suspicion calculation on the initial graph nodes to obtain initial node suspicion, and performing edge suspicion calculation on the initial access behavior sequence to obtain edge suspicion;

[0009] Pruning the initial heterogeneous graph based on the initial node suspicion to obtain an intermediate heterogeneous graph, and performing anomaly scoring on the intermediate heterogeneous graph to obtain an average suspicion;

[0010] Screening the intermediate heterogeneous graph according to the average suspiciousness to obtain a target heterogeneous graph;

[0011] Performing a risk score on the target heterogeneous graph based on a preset risk scoring model to obtain risk assessment data; wherein the risk assessment data is used to characterize the risk level of the initial account node in the target heterogeneous graph;

[0012] Abnormal accounts are identified from the target heterogeneous graph based on the risk assessment data.

[0013] In some embodiments, obtaining the account location information of the original account and performing account screening on the original account based on a preset algorithm and the account location information to obtain the target account includes:

[0014] Obtain the account location information of the original account;

[0015] encoding the account location information of each original account based on a preset algorithm to obtain location code data of each original account;

[0016] classifying the original accounts based on the position code data to obtain multiple candidate account sets;

[0017] Counting the number of original accounts in each candidate account set to obtain the total number of accounts in each candidate account set;

[0018] The candidate account set is screened based on the total number of accounts to obtain a target account set, and the original account of the target account set is used as the target account.

[0019] In some embodiments, encoding the account location information of each original account based on a preset algorithm to obtain location code data of each original account includes:

[0020] Extracting the longitude and latitude data from the account location information;

[0021] Converting the longitude data into a first coded data according to a preset comparison table, and converting the latitude data into a second coded data according to a preset comparison table;

[0022] Merging the first coded data and the second coded data to obtain coded merged data;

[0023] Performing code conversion on the coded merged data based on a preset algorithm to obtain the position coded data;

[0024] The first encoded data, the second encoded data and the encoded combined data are binary data, and the position encoded data is character string data.

[0025] In some embodiments, performing node suspicion calculation on the initial graph nodes to obtain initial node suspicion, and performing edge suspicion calculation on the initial access behavior sequence to obtain edge suspicion, includes:

[0026] Obtaining the number of features of the initial account behavior features;

[0027] Calculating edge suspicion based on a preset formula and the number of features to obtain an edge suspicion for each of the initial account behavior features;

[0028] According to the connection relationship between the initial account behavior feature and the initial graph node, the edge suspicion degrees of all initial account behavior features connected to the initial graph node are summed to obtain the initial node suspicion degree.

[0029] In some embodiments, pruning the initial heterogeneous graph based on the initial node suspicion to obtain an intermediate heterogeneous graph, and performing anomaly scoring on the intermediate heterogeneous graph to obtain an average suspicion, includes:

[0030] Screening out intermediate graph nodes from the initial graph nodes according to the initial node suspicion, wherein the intermediate graph node is the initial graph node with the smallest initial node suspicion;

[0031] Eliminate the intermediate graph nodes from the initial heterogeneous graph to obtain the intermediate heterogeneous graph;

[0032] Obtaining the number of graph nodes of the intermediate heterogeneous graph;

[0033] Calculating a node suspicion score of the intermediate heterogeneous graph based on the initial graph nodes of the intermediate heterogeneous graph;

[0034] The intermediate heterogeneous graph is scored for abnormality according to a preset formula, the number of graph nodes, and the node suspicion score to obtain the average suspicion degree.

[0035] In some embodiments, the risk scoring model includes a feature extraction layer and a plurality of preset candidate scoring templates. The risk scoring of the target heterogeneous graph based on the preset risk scoring model to obtain risk assessment data includes:

[0036] Extracting node features from the target heterogeneous graph based on the feature extraction layer to obtain target account features;

[0037] The target account characteristics are risk-scored based on the candidate scoring template to obtain risk assessment data for each of the initial account nodes.

[0038] In some embodiments, identifying abnormal accounts from the target heterogeneous graph based on the risk assessment data includes:

[0039] Comparing the risk assessment data with a preset risk threshold;

[0040] Selecting an initial account node whose risk assessment data is greater than the risk threshold from the target heterogeneous graph as a target account node;

[0041] The target account corresponding to the target account node is used as the abnormal account.

[0042] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application provides an abnormal account identification device, the device comprising:

[0043] an original account screening module, configured to obtain the account location information of the original account, and screen the original account based on a preset algorithm and the account location information to obtain a target account;

[0044] An account information acquisition module, configured to acquire target access data and basic account information of the target account, wherein the target access data includes behavioral feature data and access scenario data of the target account;

[0045] a heterogeneous graph construction module, configured to determine an initial graph node based on the access scenario data and the basic account information, determine an initial access behavior sequence based on the behavior feature data, and construct an initial heterogeneous graph based on the initial access behavior sequence and the initial graph nodes; wherein the initial graph node includes an initial account node, the initial access behavior sequence includes at least two initial account behavior features, and each initial account behavior feature connects two adjacent initial graph nodes;

[0046] a suspicion degree calculation module, configured to perform node suspicion degree calculation on the initial graph nodes to obtain initial node suspicion degrees, and perform edge suspicion degree calculation on the initial access behavior sequence to obtain edge suspicion degrees;

[0047] a heterogeneous graph scoring module, configured to prune the initial heterogeneous graph based on the initial node suspicion to obtain an intermediate heterogeneous graph, and perform anomaly scoring on the intermediate heterogeneous graph to obtain an average suspicion;

[0048] a heterogeneous graph screening module, configured to screen the intermediate heterogeneous graph according to the average suspiciousness to obtain a target heterogeneous graph;

[0049] A risk scoring module, configured to perform risk scoring on the target heterogeneous graph based on a preset risk scoring model to obtain risk assessment data; wherein the risk assessment data is used to characterize the risk level of the initial account node in the target heterogeneous graph;

[0050] An abnormal account identification module is used to identify abnormal accounts from the target heterogeneous graph based on the risk assessment data.

[0051] To achieve the above-mentioned purpose, the third aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in the first aspect is implemented.

[0052] To achieve the above-mentioned purpose, the fourth aspect of the embodiments of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the method described in the first aspect.

[0053] The abnormal account identification method, abnormal account identification device, electronic device and storage medium proposed in this application obtain the account location information of the original account and screen the original account based on a preset algorithm and the account location information to obtain the target account. This method can fully utilize the clustering characteristics of abnormal accounts to screen out a target account set that may contain more abnormal accounts. Furthermore, the target access data and basic account information of the target account are obtained, and the target access data includes the behavioral feature data and access scenario data of the target account; the initial graph node is determined based on the access scenario data and the basic account information, the initial access behavior sequence is determined based on the behavioral feature data, and an initial heterogeneous graph is constructed based on the initial access behavior sequence and the initial graph node. The target access data of the target account can be displayed in the form of a heterogeneous graph, which can clearly reflect the correlation between the behavioral features of the target account and the access scenario. Furthermore, the node suspicion of the initial graph nodes is calculated to obtain the initial node suspicion, and the edge suspicion is calculated for the initial access behavior sequence to obtain the edge suspicion. Based on the initial node suspicion, the initial heterogeneous graph is pruned to obtain an intermediate heterogeneous graph, and the intermediate heterogeneous graph is scored for anomalies to obtain an average suspicion. The intermediate heterogeneous graph is then screened based on the average suspicion to obtain a target heterogeneous graph. This method facilitates the pruning of the initial heterogeneous graph, resulting in multiple intermediate heterogeneous graphs and the corresponding average suspicion for each intermediate heterogeneous graph. This allows the presence of abnormal accounts in the intermediate heterogeneous graph to be determined based on the average suspicion, facilitating the identification of abnormal accounts from a population perspective. Finally, the target heterogeneous graph is risk-scored based on a preset risk scoring model to obtain risk assessment data, and abnormal accounts are identified from the target heterogeneous graph based on the risk assessment data. This approach can more accurately reflect the degree of risk of each target account through the risk assessment data, significantly improving the accuracy of abnormal account identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1This is a flowchart of the abnormal account identification method provided by an embodiment of the present application;

[0055] Figure 2 yes Figure 1 Flowchart of step S101 in FIG.

[0056] Figure 3 yes Figure 2 Flowchart of step S202 in FIG.

[0057] Figure 4 yes Figure 1 Flowchart of step S104 in FIG.

[0058] Figure 5 yes Figure 1 Flowchart of step S105 in FIG.

[0059] Figure 6 yes Figure 1 Flowchart of step S107 in FIG.

[0060] Figure 7 yes Figure 1 Flowchart of step S108 in FIG.

[0061] Figure 8 This is a schematic diagram of the structure of the abnormal account identification device provided in an embodiment of the present application;

[0062] Figure 9 This is a schematic diagram of the hardware structure of the electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0064] It should be noted that although the device schematics illustrate functional module divisions and the flowcharts illustrate logical sequences, in certain circumstances, the steps shown or described may be performed in a sequence that differs from the module divisions in the device or the sequence in the flowcharts. The terms "first," "second," and so on, in the specification, claims, and drawings, are used to distinguish similar items and are not necessarily used to describe a specific sequence or precedence.

[0065] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0066] First, let’s analyze some of the terms used in this application:

[0067] Artificial intelligence (AI) is a new technical discipline that studies and develops theories, methods, technologies, and application systems for simulating, extending, and expanding human intelligence. A branch of computer science, AI seeks to understand the essence of intelligence and create new intelligent machines that can respond in a manner similar to human intelligence. Research in this field includes robotics, speech recognition, image recognition, natural language processing, and expert systems. AI can simulate the information processes of human consciousness and thinking. It also encompasses the theories, methods, technologies, and application systems that use digital computers or digital computer-controlled machines to simulate, extend, and expand human intelligence, to perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results.

[0068] Natural Language Processing (NLP): NLP uses computers to process, understand, and apply human languages ​​(such as Chinese and English). It is a branch of artificial intelligence and an interdisciplinary field between computer science and linguistics, often referred to as computational linguistics. Natural language processing encompasses grammatical analysis, semantic analysis, and discourse comprehension. Natural language processing is commonly used in technical fields such as machine translation, handwritten and printed character recognition, speech recognition and text-to-speech conversion, information intent identification, information extraction and filtering, text classification and clustering, public opinion analysis, and opinion mining. It encompasses data mining, machine learning, knowledge acquisition, knowledge engineering, artificial intelligence research related to language processing, and linguistics research related to language computing.

[0069] Information Extraction (NER) is a text processing technology that extracts specified types of factual information, such as entities, relationships, and events, from natural language text and outputs them as structured data. Information extraction is a technique for extracting specific information from text data. Text data is composed of specific units, such as sentences, paragraphs, and chapters. Text information is composed of small, specific units, such as characters, words, phrases, sentences, paragraphs, or combinations of these specific units. Extracting noun phrases, names, and place names from text data is all text information extraction. Of course, the information extracted by text information extraction technology can be of various types.

[0070] Most current methods for identifying abnormal accounts are based on anomaly analysis of the characteristics of each account itself to determine whether the account is an abnormal account. This method often has the problem of low recognition accuracy. Therefore, how to improve the accuracy of identifying abnormal accounts has become a technical problem that needs to be solved urgently.

[0071] Based on this, the embodiments of the present application provide an abnormal account identification method, an abnormal account identification device, an electronic device and a storage medium, aiming to improve the accuracy of abnormal account identification.

[0072] The abnormal account identification method, abnormal account identification device, electronic device and storage medium provided in the embodiments of the present application are specifically illustrated through the following embodiments. First, the abnormal account identification method in the embodiments of the present application is described.

[0073] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results.

[0074] Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interaction systems, and mechatronics. AI software technologies primarily encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0075] The abnormal account identification method provided in the embodiment of the present application relates to the field of artificial intelligence technology. The abnormal account identification method provided in the embodiment of the present application can be applied in a terminal, can also be applied in a server side, and can also be software running in a terminal or a server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or can be configured as a server cluster or a distributed system composed of multiple physical servers, or can be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the abnormal account identification method, etc., but is not limited to the above forms.

[0076] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and the like. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments in which tasks are performed by remote processing devices connected via a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0077] It should be noted that in each specific embodiment of the present application, when it comes to the need to perform relevant processing based on data related to the user's identity or characteristics, such as user information, user behavior data, user voice data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of such data will comply with the relevant laws, regulations, and standards of the relevant countries and regions. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0078] Figure 1 This is an optional flowchart of the abnormal account identification method provided in the embodiment of the present application. Figure 1 The method may include but is not limited to steps S101 to S108.

[0079] Step S101: obtaining the account location information of the original account, and screening the original account based on a preset algorithm and the account location information to obtain a target account;

[0080] Step S102: Acquire target access data and basic account information of the target account, wherein the target access data includes behavioral feature data and access scenario data of the target account;

[0081] Step S103: Determine an initial graph node based on the access scenario data and basic account information, determine an initial access behavior sequence based on the behavior feature data, and construct an initial heterogeneous graph based on the initial access behavior sequence and the initial graph nodes; wherein the initial graph node includes an initial account node, the initial access behavior sequence includes at least two initial account behavior features, and each initial account behavior feature connects two adjacent initial graph nodes;

[0082] Step S104: Calculate the node suspicion of the initial graph nodes to obtain the initial node suspicion, and calculate the edge suspicion of the initial access behavior sequence to obtain the edge suspicion;

[0083] Step S105: pruning the initial heterogeneous graph based on the initial node suspicion to obtain an intermediate heterogeneous graph, and performing an abnormality score on the intermediate heterogeneous graph to obtain an average suspicion;

[0084] Step S106, screening the intermediate heterogeneous graphs according to the average suspiciousness to obtain a target heterogeneous graph;

[0085] Step S107: performing risk scoring on the target heterogeneous graph based on a preset risk scoring model to obtain risk assessment data; wherein the risk assessment data is used to characterize the risk level of the initial account node in the target heterogeneous graph;

[0086] Step S108: identifying abnormal accounts from the target heterogeneous graph based on the risk assessment data.

[0087] In the embodiment of the present application, steps S101 to S108 are performed to obtain the target account by obtaining the account location information of the original account and filtering the original account based on the preset algorithm and the account location information. This can fully utilize the clustering characteristics of abnormal accounts to filter out a target account set that may contain more abnormal accounts. Furthermore, the target access data and basic account information of the target account are obtained, and the target access data includes the behavioral feature data and access scenario data of the target account; the initial graph node is determined based on the access scenario data and the basic account information, the initial access behavior sequence is determined based on the behavioral feature data, and an initial heterogeneous graph is constructed based on the initial access behavior sequence and the initial graph node. The target access data of the target account can be displayed in the form of a heterogeneous graph, which can clearly reflect the correlation between the behavioral features of the target account and the access scenario. Furthermore, the node suspicion of the initial graph nodes is calculated to obtain the initial node suspicion, and the edge suspicion is calculated for the initial access behavior sequence to obtain the edge suspicion. Based on the initial node suspicion, the initial heterogeneous graph is pruned to obtain an intermediate heterogeneous graph, and the intermediate heterogeneous graph is scored for anomalies to obtain an average suspicion. The intermediate heterogeneous graph is then screened based on the average suspicion to obtain a target heterogeneous graph. This method facilitates the pruning of the initial heterogeneous graph, resulting in multiple intermediate heterogeneous graphs and the corresponding average suspicion for each intermediate heterogeneous graph. This allows the presence of abnormal accounts in the intermediate heterogeneous graph to be determined based on the average suspicion, facilitating the identification of abnormal accounts from a population perspective. Finally, the target heterogeneous graph is risk-scored based on a preset risk scoring model to obtain risk assessment data, and abnormal accounts are identified from the target heterogeneous graph based on the risk assessment data. This approach can more accurately reflect the degree of risk of each target account through the risk assessment data, significantly improving the accuracy of abnormal account identification.

[0088] See also Figure 2 In some embodiments, step S101 may include but is not limited to steps S201 to S205:

[0089] Step S201, obtaining the account location information of the original account;

[0090] Step S202: encoding the account location information of each original account based on a preset algorithm to obtain location code data of each original account;

[0091] Step S203: classify the original accounts based on the position code data to obtain multiple candidate account sets;

[0092] Step S204: Count the number of original accounts in each candidate account set to obtain the total number of accounts in each candidate account set;

[0093] Step S205 : Screen the candidate account set based on the total number of accounts to obtain a target account set, and use the original account of the target account set as the target account.

[0094] In step S201 of some embodiments, the account location information of the original account can be obtained directly from the log data of the target platform backend, or the account location information of the original account can be obtained by crawling data from a preset data source through a web crawler, wherein the account location information includes the original account's registered device information, IP information, latitude and longitude data of the account location, etc.

[0095] In step S202 of some embodiments, in order to divide a large number of original accounts into regions based on geographical areas, the latitude and longitude data in the account location information can be first converted into location coding data based on a preset algorithm, so that the original accounts in the same area can be identified based on the location coding data, thereby realizing the regional division of the original accounts, wherein the preset algorithms include Base32 encoding, binary encoding algorithm, etc.

[0096] In step S203 of some embodiments, since the location coding data of each original account is unique, the original accounts belonging to the same coding interval can be divided into one category based on the location coding data, so as to classify the original accounts based on the geographical location and obtain multiple candidate account sets. For example, the original accounts whose location coding data falls in the coding interval corresponding to the city P are classified into one category, which is recorded as the candidate account set M1, and the original accounts whose location coding data falls in the coding interval corresponding to the city Q are classified into one category, which is recorded as the candidate account set M2.

[0097] In step S204 of some embodiments, a sum function or the like can be used to count the original accounts in each candidate account set to determine the total number of accounts in each candidate account set. For example, the total number of accounts in candidate account set M1 is 30, the total number of accounts in candidate account set M2 is 50, and the total number of accounts in candidate account set M3 is 44.

[0098] In step S205 of some embodiments, considering the clustering characteristics of abnormal accounts, when screening candidate account sets based on the total number of accounts, one or more candidate account sets with a relatively large number of accounts may be selected as the target account set. For example, when there are 100 candidate account sets, the top five candidate account sets with the largest number of accounts may be selected as the target account set.

[0099] The above steps S201 to S205 can classify the original accounts according to the geographical location of each original account to obtain multiple candidate account sets, and screen accounts according to the number of account clusters in the candidate account sets. This can fully utilize the clustering characteristics of abnormal accounts, screen out target account sets that may contain more abnormal accounts, and further identify abnormalities in the target accounts in the target account sets, which can effectively improve the efficiency and accuracy of identifying abnormal accounts.

[0100] See also Figure 3 In some embodiments, step S202 may include but is not limited to steps S301 to S304:

[0101] Step S301, extracting the longitude and latitude data from the account location information;

[0102] Step S302: converting the longitude data into a first coded data according to a preset comparison table, and converting the latitude data into a second coded data according to a preset comparison table;

[0103] Step S303: Merge the first coded data and the second coded data to obtain coded merged data;

[0104] Step S304, performing code conversion on the coded merged data based on a preset algorithm to obtain position coded data;

[0105] In step S301 of some embodiments, the longitude data and latitude data in the account location information are extracted using a preset code program or a web crawler, wherein the longitude data and the latitude data are both two-dimensional data.

[0106] In step S302 of some embodiments, the preset comparison table includes multiple longitude intervals and multiple latitude intervals, and each longitude interval and each latitude interval includes at least one corresponding binary code. Therefore, by formatting the longitude data according to the preset comparison table, first coded data corresponding to the longitude data can be obtained, and by formatting the latitude data according to the preset comparison table, second coded data corresponding to the latitude data can be obtained, wherein the first coded data and the second coded data are binary data. For example, in the preset comparison table, the longitude interval [-180, 180] is divided into two intervals [-180, 0] and (0, 180]. If the longitude data falls in the first interval, it is encoded as 1, and if the longitude data falls in the second interval, it is encoded as 0; the latitude interval [-90, 90] is divided into two intervals [-90, 0] and (0, 90]. If the latitude data falls in the first interval, it is encoded as 1, and if the latitude data falls in the second interval, it is encoded as 0. Furthermore, according to the preset number of splits, the two evenly divided intervals can be divided multiple times to obtain the third interval and the fourth interval under the first interval, the fifth interval and the sixth interval under the second interval, and so on. Multiple coordinate intervals and the corresponding codes for each coordinate interval can be obtained. For example, in the longitude dimension, the first interval includes the third interval [-90, -45] and the fourth interval (-45, 0]. If the longitude data falls in the third interval, it is encoded as 1, and if the longitude data falls in the fourth interval, it is encoded as 0.

[0107] In step S303 of some embodiments, when merging the first coded data and the second coded data, starting from 0, the second coded data is used as odd bits and the first coded data is used as even bits, thereby obtaining coded merged data.

[0108] In step S304 of some embodiments, the preset algorithm may be a Base32 encoding algorithm, which converts the binary encoded merged data into string data based on the preset algorithm to obtain position encoding data, thereby obtaining the position encoding data of each original account. Since the position encoding data is unique in geographical location, the original accounts belonging to the same encoding interval are divided into one category, and the discrete original accounts are divided into multiple candidate account sets, thereby realizing the identification of abnormal accounts by utilizing the group characteristics of the accounts.

[0109] For example, the latitude and longitude data of a certain original account are 40.22077, 116.397128, that is, the latitude data is 40.22077 and the longitude data is 116.397128. When converting the format of longitude and latitude data, the latitude interval [-90, 90] is evenly divided into two intervals [-90, 0] and (0, 90]. If the latitude data is in the first interval, the code is 0, otherwise the code is 1. Since the latitude 40.22077 belongs to (0, 90], the code is 1. Then continue to divide (0, 90) into two intervals (0, 45] and (45, 90]. Since 40.22077 is located in (0, 45], the code is 0. And so on. The latitude interval is split 20 times. Finally, the latitude code of the latitude data 40.22077 is 1011100100110011111, that is, the second code data is 10111001001100 111111. Similarly, the longitude interval [-180, 180] is split and encoded multiple times, resulting in the encoding of the longitude data 116.23128 being 10010010110010010111, i.e., the first encoded data is 10010010110010010111. Furthermore, the encodings of the longitude and latitude data are merged, starting from 0, with the first encoded data as the even bits and the second encoded data as the odd bits, resulting in the encoded merged data being 1110011101001000111100000011100111001101. Finally, the encoded merged data is Base32 encoded to obtain the position encoded data tf35nkxz.

[0110] Through steps S301 to S304, the original account's latitude and longitude data can be conveniently binary-encoded to obtain combined coded data. This combined coded data is then converted from binary form to string form using a preset algorithm to obtain the original account's location coded data. Converting binary data to string data effectively shortens data length and reduces computing resource consumption. Because location coded data is geographically unique, original accounts belonging to the same coding interval can be grouped together based on the location coded data, and discrete original accounts can be divided into multiple candidate account sets. This allows for the identification of abnormal accounts by leveraging the group characteristics of accounts, thereby improving the efficiency and accuracy of identifying abnormal accounts.

[0111] In step S102 of some embodiments, the target access data and basic account information of the target account can be directly obtained from the log information of the target platform backend, or the target access data and basic account information of the target account can be obtained by crawling the preset data source through a web crawler. Among them, the target access data includes the behavioral characteristic data and access scenario data of the target account. The target account is an account registered on the target platform or target client, etc. The basic account information includes the name, contact information, registration device information, etc. of the registrant, and the behavioral characteristic data includes the browsing, clicking, purchasing, collection, etc. of the target account on the target platform or target client, etc. The access scenario data includes the scenario pages of various business fields within the target platform or target client, etc. For example, the access scenario is a product marketing activity or product promotion activity, etc. The access frequency data includes the browsing time, visit time, number of visits, number of interactions, etc. of the target account in different access scenarios.

[0112] In step S103 of some embodiments, the initial graph nodes are determined based on the access scenario data and the basic account information, the initial access behavior sequence is determined based on the behavioral feature data, and the initial heterogeneous graph is constructed based on the initial access behavior sequence and the initial graph nodes. When constructing the initial heterogeneous graph, the access scenario data and the basic account information are used as the initial graph nodes of the initial heterogeneous graph; the behavioral feature data are used as the edges of the initial heterogeneous graph, wherein the initial graph nodes include the initial account node and the initial scenario node, and the initial access behavior sequence includes at least two initial account behavior features, each of which connects two adjacent initial graph nodes. This method can display the target access data and basic account information of the target account in the form of a heterogeneous graph, and can clearly reflect the correlation between the behavioral features of the target account and the access scenario.

[0113] Furthermore, the initial graph node set S = [A, B] of the initial heterogeneous graph is defined, where A represents the initial account node set and B represents the initial scenario node set. Then the current initial graph node set S = [A1, A2, A3, …, Am, B1, B2, B3, …, Bn], where m and n are integers greater than 0.

[0114] For example, the basic account information includes account C1, account C2, scenario P1, and scenario P2. Based on behavioral feature data, it is found that account C1 has purchased in scenario P1, account C2 has browsed in scenario P1, and account C2 has purchased in scenario P2. The initial graph nodes of the initial heterogeneous graph include: initial account node A1, initial account node A2, initial scenario node B1, and initial scenario node B2. The initial access behavior sequence of the initial heterogeneous graph includes: purchase behavior features between account C1 and scenario P1, purchase behavior features between account C2 and scenario P2, and browsing behavior features between account C2 and scenario P1. That is, there is a connection between initial account node A1 and initial scenario node B1, and initial account node A2 is connected to initial scenario node B1 and initial scenario node B2, respectively.

[0115] See also Figure 4 In some embodiments, the initial graph node includes an initial account node and an initial scenario node, and the initial node suspicion level includes a first suspicion level of the initial account node and a second suspicion level of the initial scenario node. Step S104 may include, but is not limited to, steps S401 to S403:

[0116] Step S401, obtaining the feature quantity of the initial account behavior feature;

[0117] Step S402: Calculate the edge suspicion level based on a preset formula and the number of features to obtain the edge suspicion level of each initial account behavior feature;

[0118] Step S403 : Based on the connection relationship between the initial account behavior feature and the initial graph node, the edge suspicions of all initial account behavior features connected to the initial graph node are summed to obtain the initial node suspicion.

[0119] In step S401 of some embodiments, since an edge in the initial heterogeneous graph can only connect to two different types of initial graph nodes, one end connected to the initial account node and the other end connected to the initial scenario node, when calculating the edge suspicion of a certain initial account behavior feature T, the initial account node Ai connected to the initial account behavior feature T is first determined. Then, a statistical function such as a sum function is used to calculate the number of edges connected to the initial account node Ai. The edges connected to the initial account node Ai are queried, and the number of edges is accumulated until all edges connected to the initial account node are queried. The number of edges connected to the initial account node Ai is obtained, and this number is used as the feature number of the initial account feature T, where i is a positive integer less than or equal to m.

[0120] In step S402 of some embodiments, when calculating the edge suspicion based on a preset formula and the number of features to obtain the edge suspicion of each initial account behavior feature, the preset formula can be expressed as shown in formula (1):

[0121]

[0122] Where y is the edge suspicion of the initial account behavior feature, and x is the number of features (i.e., the number of edges). Based on this formula and the above process, the edge suspicion of all initial account behavior features in the initial heterogeneous graph can be calculated more conveniently.

[0123] In step S403 of some embodiments, based on the initial account behavior characteristics and the connection relationship between the initial graph nodes, the edges connected to each initial graph node are determined, and the edge suspicions of these edges connected to the initial graph node are summed to obtain the initial node suspicion of the initial graph node. Summing the edge suspicions of all edges connected to a particular initial account node yields a first suspicion of the initial account node; summing the edge suspicions of all edges connected to a particular initial scenario node yields a second suspicion of the initial scenario node.

[0124] For example, the edges connected to the initial scenario node B2 include the first edge (i.e., the first initial account behavior feature), the second edge (i.e., the second initial account behavior feature), and the third edge (i.e., the third initial account behavior feature). The edge suspicions of the first edge, the second edge, and the third edge are calculated to be 0.05, 0.7, and 0.23, respectively. Then, the second suspicion of the initial scenario node B2 is 0.05+0.7+0.23=0.98.

[0125] Through the above steps S401 to S403, the suspicion level of each initial graph node and each initial account behavior feature can be calculated more conveniently, so that the abnormal situation of each target account can be preliminarily determined based on the size of the suspicion level, which is conducive to improving the accuracy of identifying abnormal accounts.

[0126] See also Figure 5 In some embodiments, step S105 may include but is not limited to steps S501 to S505:

[0127] Step S501: Screening out intermediate graph nodes from the initial graph nodes based on the initial node suspicion, wherein the intermediate graph node is the initial graph node with the smallest initial node suspicion;

[0128] Step S502: removing the intermediate graph nodes from the initial heterogeneous graph to obtain an intermediate heterogeneous graph;

[0129] Step S503, obtaining the number of graph nodes of the intermediate heterogeneous graph;

[0130] Step S504, calculating the node suspicion score of the intermediate heterogeneous graph based on the initial graph nodes of the intermediate heterogeneous graph;

[0131] Step S505 , performing anomaly scoring on the intermediate heterogeneous graph according to a preset formula, the number of graph nodes, and the node suspicion score to obtain an average suspicion degree.

[0132] In step S501 of some embodiments, the size relationship of the initial node suspicions between the initial graph nodes is compared, and the initial graph node with the smallest initial node suspicion is screened out from the initial graph nodes based on this size relationship, and the initial graph node with the smallest initial node suspicion is used as the intermediate graph node.

[0133] In step S502 of some embodiments, the intermediate graph nodes are removed from the initial heterogeneous graph, and the initial account behavior features related to the intermediate graph nodes are removed. The graph is reconstructed based on the remaining initial account nodes, initial scene nodes, and initial account behavior features to obtain the intermediate heterogeneous graph K1 after the first pruning, that is, the remaining initial account nodes and initial scene nodes are used as graph nodes of the reconstructed intermediate heterogeneous graph K1, and the initial account behavior features between the remaining initial account nodes and the initial scene nodes are used as edges of the intermediate heterogeneous graph K1.

[0134] In step S503 of some embodiments, a statistical function such as a sum function may be used to calculate the number of graph nodes in the intermediate heterogeneous graph K1. For example, the sum function is first used to count the total number of nodes |A| of the initial account nodes in the intermediate heterogeneous graph K1, and then the sum function is used to count the total number of nodes |B| of the initial scene nodes in the intermediate heterogeneous graph. Finally, the number of graph nodes in the intermediate heterogeneous graph K1, |S| = |A| + |B|, is obtained.

[0135] In step S504 of some embodiments, the node suspicion of the reconstructed intermediate heterogeneous graph K1 is calculated using the same calculation method as the above steps S401 to S403 to obtain the node suspicion score of the intermediate heterogeneous graph, wherein the node suspicion score F(S) is obtained by adding the sum of the first suspicions F(A) of all initial account nodes in the intermediate heterogeneous graph K1 and the sum of the second suspicions F(B) of all initial scene nodes in the intermediate heterogeneous graph K1.

[0136] In step S505 of some embodiments, the intermediate heterogeneous graph is scored for abnormality according to a preset formula, the number of graph nodes, and the node suspicion score, and the calculation process of obtaining the average suspicion G(S) can be expressed as shown in formula (2):

[0137]

[0138] Where G(S) is the average suspicion of the current intermediate heterogeneous graph, |S| is the total number of graph nodes in the current intermediate heterogeneous graph, |A| is the total number of initial account nodes in the current intermediate heterogeneous graph, |B| is the total number of initial scenario nodes in the current intermediate heterogeneous graph, F(A) is the sum of the first suspicion of all initial account nodes in the current intermediate heterogeneous graph, and F(B) is the sum of the second suspicion of all initial scenario nodes in the current intermediate heterogeneous graph. F(S) is the node suspicion score of the current intermediate heterogeneous graph.

[0139] Similarly, after calculating the average suspicion of the intermediate heterogeneous graph K1, refer to the above-mentioned step S103, recalculate the edge suspicion of the initial account behavior feature in the intermediate heterogeneous graph and the node suspicion of the initial graph node, and then screen new intermediate graph nodes based on the new node suspicion according to the calculated new node suspicion (including the new first suspicion and the new second suspicion), prune the intermediate heterogeneous graph K1 according to the new intermediate graph nodes, and obtain a new intermediate heterogeneous graph K2 and the average suspicion corresponding to the intermediate heterogeneous graph K2. Repeat the above process and continue to prune the intermediate heterogeneous graph K2 to obtain the intermediate heterogeneous graph K3 and the average suspicion corresponding to the intermediate heterogeneous graph K3, ..., and so on, until after the intermediate heterogeneous graph Kj is pruned (that is, after removing the initial graph nodes in the intermediate heterogeneous graph Kj, j is an integer greater than 0), there are no remaining initial graph nodes, and pruning is stopped.

[0140] Through the above steps S501 to S505, the pruning operation of the initial heterogeneous graph can be implemented more conveniently, and multiple intermediate heterogeneous graphs and the average suspicion corresponding to each intermediate heterogeneous graph can be obtained, so that the existence of abnormal accounts in each intermediate heterogeneous graph can be determined according to the size of the average suspicion, which is conducive to identifying abnormal accounts from a group perspective and improving the accuracy of abnormal accounts.

[0141] In step S106 of some embodiments, the average suspicion of the intermediate heterogeneous graph obtained after each pruning is compared. The larger the average suspicion, the more abnormal accounts exist in the intermediate heterogeneous graph. The intermediate heterogeneous graph is then screened according to the average suspicion, and the intermediate heterogeneous graph with the largest average suspicion is selected to obtain the target heterogeneous graph.

[0142] See also Figure 6 In some embodiments, the risk scoring model includes a feature extraction layer and a plurality of preset candidate scoring templates. Step S107 includes but is not limited to steps S601 to S602:

[0143] Step S601: extract node features from the target heterogeneous graph based on the feature extraction layer to obtain target account features;

[0144] Step S602 : Perform risk scoring on the target account characteristics based on the candidate scoring template to obtain risk assessment data for each initial account node.

[0145] In step S601 of some embodiments, the risk scoring model can be constructed based on a commonly used deep learning model. For example, the risk scoring model can be a convolutional neural network model, a recurrent neural network model, etc., but is not limited thereto. The risk scoring model includes a feature extraction layer and multiple preset candidate scoring templates. The feature extraction layer is used to extract node feature information in the target heterogeneous graph. The candidate scoring templates can be constructed based on actual business needs. For example, the candidate scoring templates may set different scoring rules for different account behaviors. When a certain account behavior feature matches the rule, a corresponding score is generated.

[0146] Among them, when extracting node features of the target heterogeneous graph based on the feature extraction layer, a named entity recognition algorithm can be used to extract the entity features corresponding to each initial account node in the target heterogeneous graph to obtain the target account features, which include the registration time, registration type, account access behavior characteristics, etc. of the target account.

[0147] In step S602 of some embodiments, when risk scoring the target account characteristics based on the candidate scoring templates, at least two candidate scoring templates may be extracted as target scoring templates. Risk scores are then performed on the target account characteristics based on the selected target scoring templates, resulting in multiple template scores. Because different template scores have varying degrees of importance for identifying abnormal accounts, these template scores are weighted based on the weights of the different target scoring templates to obtain risk assessment data for each initial account node in the target heterogeneous graph. This risk assessment data can characterize the risk level of each initial account node.

[0148] Through the above steps S601 to S602, it is possible to more conveniently extract features from each initial account node in the target heterogeneous graph, obtain more important account behavior feature information, and directly perform risk scoring based on the preset candidate scoring template, which can greatly improve the efficiency of risk scoring. At the same time, the candidate scoring template is set based on actual business needs and can have good objectivity and rationality, which is conducive to improving the accuracy of risk scoring. Therefore, the risk assessment data can more accurately reflect the degree of risk of each target account, which is conducive to improving the accuracy of identifying abnormal accounts.

[0149] See also Figure 7 In some embodiments, step S108 may include but is not limited to steps S701 to S703:

[0150] Step S701, comparing risk assessment data with a preset risk threshold;

[0151] Step S702: Selecting an initial account node whose risk assessment data is greater than a risk threshold from the target heterogeneous graph as a target account node;

[0152] Step S703: The target account corresponding to the target account node is regarded as an abnormal account.

[0153] In step S701 of some embodiments, the risk threshold can be set based on actual conditions, for example, 0.5. The risk assessment data is compared with the preset risk threshold. If the risk assessment data exceeds the risk threshold, it indicates that there is a high probability that the initial account node is abnormal. If the risk assessment data is less than the risk threshold, it indicates that the initial account node is normal.

[0154] In steps S702 and S703 of some embodiments, by comparing the risk assessment data with a preset risk threshold, if the risk assessment data exceeds the risk threshold, it indicates that there is a high possibility that the initial account node is abnormal. Therefore, the initial account node in the target heterogeneous graph whose risk assessment data is greater than the risk threshold is selected as the target account node, and the target account corresponding to the target account node is selected as the abnormal account.

[0155] Through the above steps S701 to S703, based on the comparison between the risk assessment data and the risk threshold, the initial account nodes with a greater possibility of abnormality can be screened out as target account nodes, and the target accounts corresponding to these target account nodes can be identified, thereby determining the abnormal accounts among all target accounts, thereby improving the accuracy of identifying abnormal accounts.

[0156] The abnormal account identification method of the embodiment of the present application obtains the account location information of the original account and screens the original account based on a preset algorithm and the account location information to obtain the target account. It can fully utilize the clustering characteristics of abnormal accounts to screen out a target account set that may contain more abnormal accounts. Furthermore, the target access data and basic account information of the target account are obtained, and the target access data includes the behavioral feature data and access scenario data of the target account; the initial graph node is determined based on the access scenario data and the basic account information, the initial access behavior sequence is determined based on the behavioral feature data, and an initial heterogeneous graph is constructed based on the initial access behavior sequence and the initial graph node. The target access data of the target account can be displayed in the form of a heterogeneous graph, which can clearly reflect the correlation between the behavioral features of the target account and the access scenario. Furthermore, the node suspicion of the initial graph nodes is calculated to obtain the initial node suspicion, and the edge suspicion is calculated for the initial access behavior sequence to obtain the edge suspicion. Based on the initial node suspicion, the initial heterogeneous graph is pruned to obtain an intermediate heterogeneous graph, and the intermediate heterogeneous graph is scored for anomalies to obtain an average suspicion. The intermediate heterogeneous graph is then screened based on the average suspicion to obtain a target heterogeneous graph. This method facilitates the pruning of the initial heterogeneous graph, resulting in multiple intermediate heterogeneous graphs and the corresponding average suspicion for each intermediate heterogeneous graph. This allows the presence of abnormal accounts in the intermediate heterogeneous graph to be determined based on the average suspicion, facilitating the identification of abnormal accounts from a population perspective. Finally, the target heterogeneous graph is risk-scored based on a preset risk scoring model to obtain risk assessment data, and abnormal accounts are identified from the target heterogeneous graph based on the risk assessment data. This approach can more accurately reflect the degree of risk of each target account through the risk assessment data, significantly improving the accuracy of abnormal account identification.

[0157] See also Figure 8 The present application also provides an abnormal account identification device that can implement the above abnormal account identification method. The device includes:

[0158] The original account screening module 801 is used to obtain the account location information of the original account and screen the original account based on a preset algorithm and the account location information to obtain the target account;

[0159] An account information acquisition module 802 is configured to acquire target access data and basic account information of a target account, wherein the target access data includes behavioral feature data and access scenario data of the target account;

[0160] Heterogeneous graph construction module 803 is configured to determine initial graph nodes based on access scenario data and basic account information, determine initial access behavior sequences based on behavior feature data, and construct an initial heterogeneous graph based on the initial access behavior sequences and initial graph nodes; wherein the initial graph nodes include initial account nodes, the initial access behavior sequences include at least two initial account behavior features, and each initial account behavior feature connects two adjacent initial graph nodes;

[0161] The suspicion calculation module 804 is configured to calculate the node suspicion of the initial graph nodes to obtain the initial node suspicion, and to calculate the edge suspicion of the initial access behavior sequence to obtain the edge suspicion;

[0162] The heterogeneous graph scoring module 805 is used to prune the initial heterogeneous graph based on the initial node suspicion to obtain an intermediate heterogeneous graph, and perform anomaly scoring on the intermediate heterogeneous graph to obtain an average suspicion;

[0163] A heterogeneous graph screening module 806 is used to screen the intermediate heterogeneous graphs according to the average suspiciousness to obtain a target heterogeneous graph;

[0164] The risk scoring module 807 is used to perform risk scoring on the target heterogeneous graph based on a preset risk scoring model to obtain risk assessment data; wherein the risk assessment data is used to characterize the risk level of the initial account node in the target heterogeneous graph;

[0165] The abnormal account identification module 808 is used to identify abnormal accounts from the target heterogeneous graph based on risk assessment data.

[0166] The specific implementation of the abnormal account identification device is basically the same as the specific embodiment of the abnormal account identification method described above, and will not be repeated here.

[0167] The present application also provides an electronic device comprising: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for enabling communication between the processor and the memory. When the program is executed by the processor, the above-described abnormal account identification method is implemented. The electronic device can be any intelligent terminal, including a tablet computer and an in-vehicle computer.

[0168] See also Figure 9 , Figure 9 The hardware structure of an electronic device according to another embodiment is shown. The electronic device includes:

[0169] The processor 901 may be implemented using a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is configured to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0170] The memory 902 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 902 and is called by the processor 901 to execute the abnormal account identification method of the embodiments of this application;

[0171] Input / output interface 903, used to implement information input and output;

[0172] Communication interface 904, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, Wi-Fi, Bluetooth, etc.);

[0173] Bus 905 , which transmits information between various components of the device (e.g., processor 901 , memory 902 , input / output interface 903 , and communication interface 904 );

[0174] The processor 901 , the memory 902 , the input / output interface 903 and the communication interface 904 are connected to each other in communication within the device via a bus 905 .

[0175] An embodiment of the present application also provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the above-mentioned abnormal account identification method.

[0176] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0177] The abnormal account identification method, abnormal account identification device, electronic device, and computer-readable storage medium provided in the embodiments of the present application obtain the account location information of the original account and perform account screening on the original account based on a preset algorithm and the account location information to obtain the target account. This method can fully utilize the clustering characteristics of abnormal accounts to screen out a target account set that may contain more abnormal accounts. Furthermore, the target access data and basic account information of the target account are obtained, and the target access data includes the behavioral feature data and access scenario data of the target account; the initial graph node is determined based on the access scenario data and the basic account information, the initial access behavior sequence is determined based on the behavioral feature data, and an initial heterogeneous graph is constructed based on the initial access behavior sequence and the initial graph node. The target access data of the target account can be displayed in the form of a heterogeneous graph, which can clearly reflect the correlation between the behavioral features of the target account and the access scenario. Furthermore, the node suspicion of the initial graph nodes is calculated to obtain the initial node suspicion, and the edge suspicion is calculated for the initial access behavior sequence to obtain the edge suspicion. Based on the initial node suspicion, the initial heterogeneous graph is pruned to obtain an intermediate heterogeneous graph, and the intermediate heterogeneous graph is scored for anomalies to obtain an average suspicion. The intermediate heterogeneous graph is then screened based on the average suspicion to obtain a target heterogeneous graph. This method facilitates the pruning of the initial heterogeneous graph, resulting in multiple intermediate heterogeneous graphs and the corresponding average suspicion for each intermediate heterogeneous graph. This allows the presence of abnormal accounts in the intermediate heterogeneous graph to be determined based on the average suspicion, facilitating the identification of abnormal accounts from a population perspective. Finally, the target heterogeneous graph is risk-scored based on a preset risk scoring model to obtain risk assessment data, and abnormal accounts are identified from the target heterogeneous graph based on the risk assessment data. This approach can more accurately reflect the degree of risk of each target account through the risk assessment data, significantly improving the accuracy of abnormal account identification.

[0178] The embodiments described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0179] It will be understood by those skilled in the art that Figure 1-7 The technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than those shown in the figures, or a combination of certain steps, or different steps.

[0180] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0181] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0182] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0183] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0184] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the above-mentioned units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0185] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0186] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0187] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store programs.

[0188] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention should be within the scope of the present invention.

Claims

1. A method for identifying abnormal accounts, characterized in that: The method comprises: Obtaining the account location information of the original account, and performing account screening on the original account based on a preset algorithm and the account location information to obtain a target account; Obtaining target access data and basic account information of the target account, wherein the target access data includes behavioral feature data and access scenario data of the target account; Determining an initial graph node based on the access scenario data and the basic account information, determining an initial access behavior sequence based on the behavior feature data, and constructing an initial heterogeneous graph based on the initial access behavior sequence and the initial graph nodes; wherein the initial graph node includes an initial account node, the initial access behavior sequence includes at least two initial account behavior features, and each initial account behavior feature connects two adjacent initial graph nodes; Performing node suspicion calculation on the initial graph nodes to obtain initial node suspicion, and performing edge suspicion calculation on the initial access behavior sequence to obtain edge suspicion; Pruning the initial heterogeneous graph based on the initial node suspicion to obtain an intermediate heterogeneous graph, and performing anomaly scoring on the intermediate heterogeneous graph to obtain an average suspicion; The intermediate heterogeneous graph is screened according to the average suspicion to obtain a target heterogeneous graph; the target heterogeneous graph is risk-scored based on a preset risk scoring model to obtain risk assessment data; wherein the risk assessment data is used to characterize the risk level of the initial account node in the target heterogeneous graph; and abnormal accounts are identified from the target heterogeneous graph based on the risk assessment data; The pruning of the initial heterogeneous graph based on the initial node suspicion to obtain an intermediate heterogeneous graph, and performing anomaly scoring on the intermediate heterogeneous graph to obtain an average suspicion, includes: According to the initial node suspicion, intermediate graph nodes are screened out from the initial graph nodes, wherein the intermediate graph nodes are the initial graph nodes with the smallest initial node suspicion; the intermediate graph nodes are removed from the initial heterogeneous graph to obtain the intermediate heterogeneous graph; the number of graph nodes of the intermediate heterogeneous graph is obtained; based on the initial graph nodes of the intermediate heterogeneous graph, the node suspicion score of the intermediate heterogeneous graph is calculated; and the intermediate heterogeneous graph is scored for abnormality according to a preset formula, the number of graph nodes, and the node suspicion score to obtain the average suspicion.

2. The abnormal account identification method according to claim 1, characterized in that: The obtaining of the account location information of the original account and performing account screening on the original account based on a preset algorithm and the account location information to obtain the target account includes: Obtain the account location information of the original account; encoding the account location information of each original account based on a preset algorithm to obtain location code data of each original account; classifying the original accounts based on the position code data to obtain multiple candidate account sets; Counting the number of original accounts in each candidate account set to obtain the total number of accounts in each candidate account set; The candidate account set is screened based on the total number of accounts to obtain a target account set, and the original account of the target account set is used as the target account.

3. The abnormal account identification method according to claim 2, characterized in that: The encoding process of the account location information of each original account based on a preset algorithm to obtain location code data of each original account includes: Extracting the longitude and latitude data from the account location information; Converting the longitude data into a first coded data according to a preset comparison table, and converting the latitude data into a second coded data according to a preset comparison table; Merging the first coded data and the second coded data to obtain coded merged data; Performing code conversion on the coded merged data based on a preset algorithm to obtain the position coded data; The first encoded data, the second encoded data and the encoded combined data are binary data, and the position encoded data is character string data.

4. The abnormal account identification method according to claim 1, characterized in that: The performing node suspicion calculation on the initial graph nodes to obtain the initial node suspicion, and performing edge suspicion calculation on the initial access behavior sequence to obtain the edge suspicion, includes: Obtaining the number of features of the initial account behavior features; Calculating edge suspicion based on a preset formula and the number of features to obtain an edge suspicion for each of the initial account behavior features; According to the connection relationship between the initial account behavior feature and the initial graph node, the edge suspicion degrees of all initial account behavior features connected to the initial graph node are summed to obtain the initial node suspicion degree.

5. The abnormal account identification method according to claim 1, characterized in that: The risk scoring model includes a feature extraction layer and a plurality of preset candidate scoring templates. The risk scoring of the target heterogeneous graph based on the preset risk scoring model to obtain risk assessment data includes: Extracting node features from the target heterogeneous graph based on the feature extraction layer to obtain target account features; The target account characteristics are risk-scored based on the candidate scoring template to obtain risk assessment data for each of the initial account nodes.

6. The abnormal account identification method according to any one of claims 1 to 5, characterized in that: The identifying abnormal accounts from the target heterogeneous graph according to the risk assessment data includes: Comparing the risk assessment data with a preset risk threshold; Selecting an initial account node whose risk assessment data is greater than the risk threshold from the target heterogeneous graph as a target account node; The target account corresponding to the target account node is used as the abnormal account.

7. An abnormal account identification device, characterized in that: The device comprises: an original account screening module, configured to obtain the account location information of the original account, and screen the original account based on a preset algorithm and the account location information to obtain a target account; An account information acquisition module, configured to acquire target access data and basic account information of the target account, wherein the target access data includes behavioral feature data and access scenario data of the target account; a heterogeneous graph construction module, configured to determine an initial graph node based on the access scenario data and the basic account information, determine an initial access behavior sequence based on the behavior feature data, and construct an initial heterogeneous graph based on the initial access behavior sequence and the initial graph nodes; wherein the initial graph node includes an initial account node, the initial access behavior sequence includes at least two initial account behavior features, and each initial account behavior feature connects two adjacent initial graph nodes; a suspicion degree calculation module, configured to perform node suspicion degree calculation on the initial graph nodes to obtain initial node suspicion degrees, and perform edge suspicion degree calculation on the initial access behavior sequence to obtain edge suspicion degrees; a heterogeneous graph scoring module, configured to prune the initial heterogeneous graph based on the initial node suspicion to obtain an intermediate heterogeneous graph, and perform anomaly scoring on the intermediate heterogeneous graph to obtain an average suspicion; a heterogeneous graph screening module, configured to screen the intermediate heterogeneous graph according to the average suspiciousness to obtain a target heterogeneous graph; A risk scoring module, configured to perform risk scoring on the target heterogeneous graph based on a preset risk scoring model to obtain risk assessment data; wherein the risk assessment data is used to characterize the risk level of the initial account node in the target heterogeneous graph; an abnormal account identification module, configured to identify abnormal accounts from the target heterogeneous graph based on the risk assessment data; The pruning of the initial heterogeneous graph based on the initial node suspicion to obtain an intermediate heterogeneous graph, and performing anomaly scoring on the intermediate heterogeneous graph to obtain an average suspicion, includes: According to the initial node suspicion, intermediate graph nodes are screened out from the initial graph nodes, wherein the intermediate graph nodes are the initial graph nodes with the smallest initial node suspicion; the intermediate graph nodes are removed from the initial heterogeneous graph to obtain the intermediate heterogeneous graph; the number of graph nodes of the intermediate heterogeneous graph is obtained; based on the initial graph nodes of the intermediate heterogeneous graph, the node suspicion score of the intermediate heterogeneous graph is calculated; and the intermediate heterogeneous graph is scored for abnormality according to a preset formula, the number of graph nodes, and the node suspicion score to obtain the average suspicion.

8. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the abnormal account identification method according to any one of claims 1 to 6 when executing the computer program.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the abnormal account identification method according to any one of claims 1 to 6 is implemented.

Images