Account security detection method, medium, device and computing device

Abstract

This disclosure provides an account security detection method, medium, apparatus, and computing device, relating to the field of internet technology. The account security detection method includes: acquiring time-series data of account behavior corresponding to a preset dimension for an account to be detected within a preset time period; performing vector transformation processing on the account behavior time-series data to obtain an embedding vector corresponding to the account behavior time-series data; obtaining the vector distance between the embedding vector and a reference embedding vector, wherein the reference embedding vector is obtained based on the account behavior time-series data assuming the account to be detected is a secure account; determining the degree of behavioral difference corresponding to the preset dimension of the account to be detected based on the vector distance; and determining whether the account to be detected is a secure account based on the degree of behavioral difference. This disclosure can obtain account security detection results more accurately and has higher robustness and greater versatility.

Description

Technical Field

[0001] The embodiments of this disclosure relate to the field of Internet technology, and more specifically, the embodiments of this disclosure relate to an account security detection method, medium, apparatus, and computing device. Background Technology

[0002] This section is intended to provide background or context for embodiments of this disclosure. The description herein is not intended to imply that it is prior art simply because it is included in this section.

[0003] With the development of internet technology, more and more users are registering accounts on the internet and using these accounts to log in and access online services. Due to the ever-increasing number of accounts online, and especially the frequent occurrence of account theft, account security has become a paramount concern.

[0004] Currently, account security testing is typically conducted using the following method: obtaining business data for the target account in at least one dimension and acquiring evaluation coefficients for each dimension; calculating the target account's overall score using pre-defined account evaluation rules based on the business data and evaluation coefficients for each dimension; and determining the target account's security based on its overall score. However, the account security testing results obtained through this method are not accurate enough. Summary of the Invention

[0005] This disclosure provides an account security detection method, medium, apparatus, and computing device to address the problem that account security detection results obtained through current methods are not accurate enough.

[0006] In a first aspect of this disclosure, an account security detection method is provided, comprising:

[0007] Obtain time-series data of account behavior corresponding to preset dimensions for the account to be detected within a preset time period;

[0008] The account behavior time series data is transformed into a vector to obtain the embedded vector corresponding to the account behavior time series data.

[0009] Obtain the vector distance between the embedded vector and the reference embedded vector, which is obtained based on the time series data of account behavior when the account to be detected is a safe account;

[0010] Based on the vector distance, determine the degree of behavioral differences of the account to be detected in the corresponding preset dimension;

[0011] Based on the degree of behavioral differences, determine whether the account to be tested is a safe account.

[0012] In one possible implementation, there are multiple reference embedding vectors, and the degree of behavioral difference of the account to be detected corresponding to a preset dimension is determined based on the vector distance, including: determining the degree of behavioral difference of the account to be detected corresponding to the preset dimension as the average value of the vector distance.

[0013] In one possible implementation, determining whether an account to be detected is a safe account based on the degree of behavioral difference includes: inputting the degree of behavioral difference into a classification model for account security detection processing to obtain the predicted probability corresponding to the account to be detected; if the predicted probability is greater than or equal to a probability threshold, then the account to be detected is determined to be a safe account; if the predicted probability is less than the probability threshold, then the account to be detected is determined to be an unsafe account.

[0014] In one possible implementation, the classification model is trained as follows: Training samples are acquired, including time-series sample data of first account behavior corresponding to preset dimensions within multiple first reference durations for multiple first sample accounts, time-series sample data of second account behavior corresponding to preset dimensions within multiple second reference durations for the first sample accounts, and labels corresponding to the first sample accounts. The labels are used to distinguish whether a first sample account is a secure account. The first reference duration is the duration corresponding to the case where all first sample accounts are secure accounts, and the second reference duration is the duration corresponding to the case where some first sample accounts are insecure accounts. Vector transformation is then performed on the first account behavior time-series sample data. The process involves obtaining the first sample embedding vector corresponding to the time series sample data of the first account behavior, and performing vector transformation on the time series sample data of the second account behavior to obtain the second sample embedding vector corresponding to the time series sample data of the second account behavior. For each second sample embedding vector, the sample vector distance between the second sample embedding vector and each first sample embedding vector under the same preset dimension is obtained. Based on the sample vector distance, the degree of sample behavior difference corresponding to the first sample account in the preset dimension is determined. The degree of sample behavior difference and the label are input into the classification model, and the classification model is iteratively trained until the accuracy of the prediction result output by the classification model is greater than or equal to the accuracy threshold, thus obtaining the trained classification model.

[0015] In one possible implementation, determining the degree of difference in sample behavior of the first sample account corresponding to a preset dimension based on the sample vector distance includes: determining the degree of difference in sample behavior of the first sample account corresponding to the preset dimension as the average value of the sample vector distance.

[0016] In one possible implementation, there are multiple preset dimensions. Based on the degree of behavioral differences, it is determined whether the account to be detected is a safe account. This includes determining whether the account to be detected is a safe account based on the degree of behavioral differences corresponding to different preset dimensions.

[0017] In one possible implementation, the account behavior time series data is subjected to vector transformation processing to obtain the embedding vector corresponding to the account behavior time series data, including: inputting the account behavior time series data into a time series representation learning model for vector transformation processing to obtain the embedding vector corresponding to the account behavior time series data.

[0018] In one possible implementation, the time-series representation learning model is trained by: acquiring time-series sample data of third account behavior corresponding to a preset dimension of the second sample account; iteratively training the time-series representation learning model based on the third account behavior time-series sample data until the time-series representation learning model converges, thus obtaining the trained time-series representation learning model.

[0019] In one possible implementation, acquiring time-series data of account behavior corresponding to a preset dimension for an account to be detected within a preset time period includes: acquiring account behavior data corresponding to a preset dimension for an account to be detected within a preset time period; cleaning the account behavior data to obtain cleaned account behavior data; and sorting the cleaned account behavior data according to the order of timestamps to generate time-series data of account behavior corresponding to a preset dimension for an account to be detected.

[0020] Secondly, embodiments of this disclosure provide an account security detection device, comprising:

[0021] The first acquisition module is used to acquire time series data of account behavior corresponding to a preset dimension of the account to be detected within a preset time period;

[0022] The processing module is used to perform vector transformation processing on the account behavior time series data to obtain the embedded vector corresponding to the account behavior time series data;

[0023] The second acquisition module is used to obtain the vector distance between the embedded vector and the reference embedded vector. The reference embedded vector is obtained based on the time series data of account behavior when the account to be detected is a safe account.

[0024] The first determination module is used to determine the degree of behavioral differences of the account to be detected in a preset dimension based on the vector distance.

[0025] The second determination module is used to determine whether the account to be detected is a safe account based on the degree of difference in behavior.

[0026] In one possible implementation, there are multiple reference embedding vectors, and the first determining module is specifically used to: determine the degree of behavioral difference of the account to be detected corresponding to a preset dimension as the average value of the vector distance.

[0027] In one possible implementation, the second determining module is specifically used to: input the degree of behavioral difference into a classification model for account security detection processing to obtain the predicted probability corresponding to the account to be detected; if the predicted probability is greater than or equal to the probability threshold, the account to be detected is determined to be a safe account; if the predicted probability is less than the probability threshold, the account to be detected is determined to be an unsafe account.

[0028] In one possible implementation, the account security detection device further includes a first training module, used to train a classification model by: acquiring training samples, the training samples including time series sample data of first account behavior corresponding to a preset dimension for multiple first sample accounts within multiple first reference durations, time series sample data of second account behavior corresponding to a preset dimension for multiple second reference durations, and labels corresponding to the first sample accounts, the labels being used to distinguish whether the first sample accounts are secure accounts, the first reference duration being the duration corresponding to the case where all first sample accounts are secure accounts, and the second reference duration being the duration corresponding to the case where some first sample accounts are insecure accounts; processing the first account behavior time series samples... This data undergoes vector transformation to obtain the first sample embedding vector corresponding to the first account behavior time series sample data, and the second account behavior time series sample data undergoes vector transformation to obtain the second sample embedding vector corresponding to the second account behavior time series sample data. For each second sample embedding vector, the sample vector distance between the second sample embedding vector and each first sample embedding vector under the same preset dimension is obtained. Based on the sample vector distance, the degree of sample behavior difference corresponding to the first sample account in the preset dimension is determined. The degree of sample behavior difference and the label are input into the classification model, and the classification model is iteratively trained until the accuracy of the prediction result output by the classification model is greater than or equal to the accuracy threshold, thus obtaining the trained classification model.

[0029] In one possible implementation, when the first training module is used to determine the degree of difference in sample behavior of the first sample account corresponding to a preset dimension based on the sample vector distance, it is specifically used to: determine the degree of difference in sample behavior of the first sample account corresponding to the preset dimension as the average value of the sample vector distance.

[0030] In one possible implementation, there are multiple preset dimensions, and the second determining module is specifically used to: determine whether the account to be detected is a safe account based on the degree of behavioral differences of the account to be detected corresponding to different preset dimensions.

[0031] In one possible implementation, the processing module is specifically used to: input the account behavior time series data into the time series representation learning model for vector transformation processing to obtain the embedding vector corresponding to the account behavior time series data.

[0032] In one possible implementation, the account security detection device further includes a second training module, which is used to train a time-series representation learning model by: acquiring time-series sample data of third account behavior corresponding to a preset dimension of the second sample account; and iteratively training the time-series representation learning model based on the third account behavior time-series sample data until the time-series representation learning model converges, thereby obtaining a trained time-series representation learning model.

[0033] In one possible implementation, the first acquisition module is specifically used to: acquire account behavior data of the account to be detected corresponding to a preset dimension within a preset time period; clean the account behavior data to obtain cleaned account behavior data; and sort the cleaned account behavior data according to the order of timestamps to generate time series data of account behavior of the account to be detected corresponding to the preset dimension.

[0034] Thirdly, embodiments of this disclosure provide a computing device, including: a processor, and a memory communicatively connected to the processor;

[0035] The memory stores instructions that the computer executes;

[0036] The processor executes computer execution instructions stored in memory to implement the account security detection method as described in the first aspect of this disclosure.

[0037] Fourthly, embodiments of this disclosure provide a storage medium storing computer program instructions, which, when executed, implement the account security detection method as described in the first aspect of this disclosure.

[0038] Fifthly, embodiments of this disclosure provide a computer program product, including a computer program that, when executed by a processor, implements the account security detection method as described in the first aspect of this disclosure.

[0039] The account security detection method, medium, apparatus, and computing device provided in this disclosure acquire time-series data of account behavior corresponding to a preset dimension of the account to be detected within a preset time period; perform vector transformation processing on the account behavior time-series data to obtain the embedding vector corresponding to the account behavior time-series data; obtain the vector distance between the embedding vector and the reference embedding vector, the reference embedding vector being obtained based on the account behavior time-series data when the account to be detected is a secure account; determine the degree of behavioral difference corresponding to the preset dimension of the account to be detected based on the vector distance; and determine whether the account to be detected is a secure account based on the degree of behavioral difference. Because this disclosure considers the differences in user behavior habits before and after an account is stolen, by acquiring time-series data of account behavior corresponding to a preset dimension of the account to be detected within a preset time period, obtaining the embedding vector corresponding to the account behavior time-series data, and determining the degree of behavioral difference corresponding to the preset dimension of the account to be detected based on the vector distance between the embedding vector and the reference embedding vector, and then determining whether the account to be detected is a secure account based on the degree of behavioral difference, it can obtain account security detection results more accurately, and has higher robustness and greater versatility. Attached Figure Description

[0040] The above and other objects, features, and advantages of this disclosure will become readily apparent from the following detailed description of exemplary embodiments, taken in conjunction with the accompanying drawings. Several embodiments of this disclosure are illustrated in the drawings by way of example and not limitation, in which:

[0041] Figure 1 This is a schematic diagram of an application scenario provided by an embodiment of the present disclosure;

[0042] Figure 2 A flowchart illustrating an account security detection method provided in an embodiment of this disclosure;

[0043] Figure 3 A flowchart of an account security detection method provided in another embodiment of this disclosure;

[0044] Figure 4 This is a schematic diagram of the structure of an account security detection device provided in an embodiment of the present disclosure;

[0045] Figure 5 A schematic diagram of a storage medium provided in an embodiment of this disclosure;

[0046] Figure 6 This is a schematic diagram of the structure of a computing device provided in an embodiment of the present disclosure.

[0047] In the accompanying drawings, the same or corresponding reference numerals indicate the same or corresponding parts. Detailed Implementation

[0048] The principles and spirit of this disclosure will now be described with reference to several exemplary embodiments. It should be understood that these embodiments are given merely to enable those skilled in the art to better understand and implement this disclosure, and are not intended to limit the scope of this disclosure in any way. Rather, these embodiments are provided to make this disclosure more thorough and complete, and to fully convey the scope of this disclosure to those skilled in the art.

[0049] Those skilled in the art will recognize that the embodiments of this disclosure can be implemented as a system, apparatus, device, method, or computer program product. Therefore, this disclosure can be specifically implemented in the following forms: entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software. The data involved in this disclosure can be data authorized by the user or fully authorized by all parties, and the embodiments / examples of this disclosure can be combined with each other.

[0050] According to embodiments of this disclosure, an account security detection method, medium, apparatus, and computing device are proposed.

[0051] In this article, it is important to understand the following terms:

[0052] Account Action Time Series (AATS) data is a type of time-series data that generates account behavior attributes by sorting account behavior in chronological order.

[0053] The Time2Vec model is a machine learning model that abstracts time series data into embedded vector representations.

[0054] Distance Metric for Eigenvectors (DME) is a method that compares the differences between two feature vectors using a distance variable. It typically includes methods such as Euclidean distance or cosine similarity distance.

[0055] Extreme Gradient Boosting (XGBoost) is a machine learning method based on the boosting framework that can be used as a classification model to solve binary classification problems.

[0056] Furthermore, the number of any elements in the accompanying drawings is for illustrative purposes only and not for limitation, and any naming is for distinction only and has no limiting meaning.

[0057] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0058] The principles and spirit of this disclosure will be explained in detail below with reference to several representative embodiments. Invention Overview

[0060] The inventors have discovered that the theft of internet user accounts is a frequent occurrence, making user account security detection technology a crucial and widely concerned technology within the industry. Related technologies involve acquiring business data of a target account across at least one dimension and obtaining evaluation coefficients for each dimension; calculating a comprehensive score for the target account using pre-defined account evaluation rules based on this data and the corresponding evaluation coefficients; and determining the target account's security based on this comprehensive score. However, these technologies only utilize the business data corresponding to the target account and do not consider the temporal correlation between this data. Furthermore, these technologies rely on pre-defined account evaluation rules, requiring a high level of expertise from the rule designers, and exhibit poor robustness, failing to quickly respond to changes in the stolen account. Therefore, the account security detection results obtained through these methods are inaccurate and lack robustness.

[0061] Another related technique involves acquiring social network data corresponding to an account, integrating features, defining a graph structure model, training the graph structure model using labeled samples, and then using the trained graph structure model to calculate the embedding vectors and predicted probabilities of nodes in the latent feature space over multiple iterations, thereby determining the account's security. However, this technique is only applicable to account security detection with social relationships (i.e., scenarios with account social network data) and cannot be applied to account security detection without social relationships, exhibiting poor versatility.

[0062] Based on the above problems, and considering that each user typically has stable user habits, these habits will result in time-series data of account behavior that aligns with the user's own habits during account usage. However, the user behavior habits of the actual user of a stolen account during the period of the theft differ from those of the legitimate account owner. These differences will inevitably alter the account behavior time-series data. Therefore, comparing the differences in account behavior time-series data can serve as an effective method for account security detection. Thus, this disclosure provides an account security detection method, medium, apparatus, and computing device. By abstracting the account behavior time-series data from different periods into different embedding vectors, the average vector distance between the embedding vectors from different periods is determined. This average value is used to identify the degree of behavioral differences in the account at different periods. Based on this degree of behavioral difference, the existence of an account at risk of theft can be determined, resulting in more accurate account security detection results with higher robustness and versatility.

[0063] Application Scenarios Overview

[0064] First refer to Figure 1 Examples of application scenarios for the solutions provided in this disclosure are given. Figure 1 This is a schematic diagram of an application scenario provided by an embodiment of the present disclosure, such as... Figure 1 As shown, this application scenario includes a server cluster 11 and a terminal 12. The server cluster 11 comprises multiple servers 111 and a storage device 112. The terminal 12 can be a tablet, laptop, desktop computer, or smart home appliance, etc. Users register accounts on the internet through the terminal 12, log in using the registered accounts, and use internet services. The server 111 performs account security checks on the user's registered accounts to determine if the accounts are secure, i.e., whether there is a risk of the accounts being stolen. The server 111 stores the data generated during the account security check process in the storage device 112. Furthermore, during the account security check process, the server 111 and the terminal 12 communicate via a wireless or wired network.

[0065] It should be noted that, Figure 1 This is merely a schematic diagram illustrating one application scenario provided by an embodiment of this disclosure; this embodiment does not necessarily represent an application scenario. Figure 1 The included equipment is not limited, nor is it restricted. Figure 1 The positional relationships between the devices are defined.

[0066] Exemplary methods

[0067] The following is combined Figure 1 Application scenarios, refer to Figure 2This document describes a method for account security detection according to exemplary embodiments of the present disclosure. It should be noted that the above application scenarios are shown only to facilitate understanding of the spirit and principles of the present disclosure, and the embodiments of the present disclosure are not limited in any way. Rather, the embodiments of the present disclosure can be applied to any applicable scenario.

[0068] First, we will introduce the account security detection method through specific examples.

[0069] Figure 2 This is a flowchart illustrating an account security detection method according to an embodiment of this disclosure. The method of this embodiment can be applied to a computing device, which may be a server or a server cluster, etc. Figure 2 As shown, the method in this embodiment includes:

[0070] S201. Obtain the time series data of account behavior corresponding to the preset dimension of the account to be detected within the preset time period.

[0071] In this embodiment of the disclosure, the preset duration is, for example, 24 hours. The preset dimension is, for example, a music listening dimension or a comment dimension, etc., and this embodiment of the disclosure does not limit the preset dimension. The time series data of account behavior corresponding to the preset dimension of the account to be detected within the preset duration can be input by the user to the electronic device executing this method embodiment, or it can be sent by other devices to the electronic device executing this method embodiment.

[0072] Further, optionally, obtaining the account behavior time series data of the account to be detected corresponding to the preset dimension within a preset time period may include: obtaining the account behavior data of the account to be detected corresponding to the preset dimension within a preset time period; cleaning the account behavior data to obtain cleaned account behavior data; and sorting the cleaned account behavior data according to the order of the timestamps to generate the account behavior time series data of the account to be detected corresponding to the preset dimension.

[0073] For example, after obtaining account behavior data for the account to be detected within a preset time period and corresponding to a preset dimension, the account behavior data can be cleaned, such as removing abnormal data, to obtain cleaned account behavior data, thereby ensuring the accuracy of the account security detection results. Sorting the cleaned account behavior data according to the chronological order of timestamps can generate time-series data of account behavior for the account to be detected corresponding to the preset dimension.

[0074] Optionally, if there are multiple preset dimensions and multiple account behavior times corresponding to the preset dimensions of the account to be detected within a preset time period, then the multiple account behavior data can be sorted according to the order of timestamps to generate time series data of account behavior corresponding to each preset dimension of the account to be detected within a preset time period.

[0075] S202. Perform vector transformation processing on the account behavior time series data to obtain the embedded vector corresponding to the account behavior time series data.

[0076] In this step, after obtaining the time-series data of account behavior corresponding to a preset dimension for the account to be detected within a preset time period, the account behavior time-series data can be vectorized to obtain the corresponding embedding vector. For example, inputting the account behavior time-series data into the Time2Vec model for vectorization can yield the corresponding embedding vector. For details on how to obtain the embedding vector corresponding to the account behavior time-series data, please refer to subsequent embodiments; details will not be elaborated here.

[0077] S203. Obtain the vector distance between the embedded vector and the reference embedded vector. The reference embedded vector is obtained based on the time series data of account behavior when the account to be detected is a safe account.

[0078] In this step, the reference embedding vector is obtained based on the time-series data of account behavior when the account to be detected is a safe account, and can be used as the baseline embedding vector for account security detection. For example, assuming the account to be detected is an unsafe account on September 30th, the time-series data of the account behavior corresponding to the music listening dimension on September 30th can be obtained, and then the embedding vector corresponding to this time-series data can be obtained. The reference embedding vector, for example, is obtained based on the time-series data of the account behavior corresponding to the music listening dimension on September 29th, when the account to be detected is a safe account. The cosine similarity distance method can be used to obtain the vector distance between the embedding vector corresponding to September 30th and the reference embedding vector corresponding to September 29th.

[0079] S204. Based on the vector distance, determine the degree of behavioral difference of the account to be detected in the corresponding preset dimension.

[0080] In this step, after obtaining the vector distance between the embedded vector and the reference embedded vector, the degree of behavioral difference corresponding to a preset dimension of the account to be detected can be determined based on the vector distance. It can be understood that each preset dimension corresponds to a degree of behavioral difference. For details on how to determine the degree of behavioral difference corresponding to a preset dimension of the account to be detected, please refer to subsequent embodiments; it will not be elaborated here.

[0081] S205. Determine whether the account to be tested is a safe account based on the degree of behavioral differences.

[0082] In this step, after obtaining the degree of behavioral difference corresponding to the preset dimension of the account to be detected, it can be determined whether the account to be detected is a safe account based on the degree of behavioral difference. For example, the degree of behavioral difference can be input into the XGBoost model for account security detection processing to obtain the predicted probability corresponding to the account to be detected, and then the determination of whether the account to be detected is a safe account can be made based on the predicted probability. For details on how to determine whether the account to be detected is a safe account based on the degree of behavioral difference, please refer to the following embodiments, which will not be repeated here.

[0083] Furthermore, optionally, there are multiple preset dimensions. Based on the degree of behavioral differences, it can be determined whether the account to be tested is a safe account. This can include: determining whether the account to be tested is a safe account based on the degree of behavioral differences of the account to be tested corresponding to different preset dimensions.

[0084] For example, there are 10 preset dimensions. The degree of behavioral difference of the account to be detected for each preset dimension can be input into the XGBoost model for account security detection processing to determine whether the account to be detected is a safe account.

[0085] If the account to be tested is determined to be an insecure account, it can be handled accordingly through subsequent account security procedures.

[0086] The account security detection method provided in this disclosure involves: acquiring time-series data of account behavior corresponding to a preset dimension of the account to be detected within a preset time period; performing vector transformation processing on the account behavior time-series data to obtain an embedding vector corresponding to the account behavior time-series data; obtaining the vector distance between the embedding vector and a reference embedding vector, where the reference embedding vector is obtained based on the account behavior time-series data when the account to be detected is a secure account; determining the degree of behavioral difference corresponding to the preset dimension of the account to be detected based on the vector distance; and determining whether the account to be detected is a secure account based on the degree of behavioral difference. Since this disclosure considers the differences in user behavior habits before and after account theft, by acquiring time-series data of account behavior corresponding to a preset dimension of the account to be detected within a preset time period, obtaining the embedding vector corresponding to the account behavior time-series data, and determining the degree of behavioral difference corresponding to the preset dimension of the account to be detected based on the vector distance between the embedding vector and the reference embedding vector, and then determining whether the account to be detected is a secure account based on the degree of behavioral difference, this method can obtain account security detection results more accurately and has higher robustness and versatility.

[0087] Figure 3 This is a flowchart illustrating an account security detection method according to another embodiment of this disclosure. Based on the above embodiments, this disclosure further describes the account security detection method. Figure 3 As shown, the method in this embodiment of the disclosure may include:

[0088] S301. Obtain the time series data of account behavior corresponding to the preset dimension of the account to be detected within the preset time period.

[0089] For a detailed description of this step, please refer to [link / reference]. Figure 2 The relevant description of S201 in the illustrated embodiment will not be repeated here.

[0090] In this embodiment of the disclosure, Figure 2 Step S202 may further include step S302 as follows:

[0091] S302. Input the account behavior time series data into the time series representation learning model for vector transformation processing to obtain the embedding vector corresponding to the account behavior time series data.

[0092] For example, the time series representation learning model is a Time2Vec model. For details on how to train and obtain the time series representation learning model, please refer to subsequent embodiments; these will not be repeated here. In this step, after obtaining the time series data of account behavior corresponding to a preset dimension for the account to be detected within a preset time period, the account behavior time series data can be input into the Time2Vec model for vector transformation processing to obtain the embedding vector corresponding to the account behavior time series data.

[0093] S303. Obtain the vector distance between the embedded vector and the reference embedded vector. The reference embedded vector is obtained based on the time series data of account behavior when the account to be detected is a safe account.

[0094] For a detailed description of this step, please refer to [link / reference]. Figure 2 The relevant description of S203 in the illustrated embodiment will not be repeated here.

[0095] Considering that there are multiple reference embedding vectors, in this embodiment of the disclosure, Figure 2 Step S204 may further include the following step S304:

[0096] S304. Determine the degree of behavioral difference of the account to be detected in the preset dimension as the average value of the vector distance.

[0097] For example, assuming the account to be tested was an insecure account on September 30th, we can obtain the time-series data of the account's behavior in the music listening dimension on September 30th, and then obtain the embedding vector corresponding to this time-series data. Assume there are three reference embedding vectors: the first reference embedding vector is obtained from the time-series data of the account's behavior in the music listening dimension on September 27th; the second reference embedding vector is obtained from the time-series data of the account's behavior in the music listening dimension on September 28th; and the third reference embedding vector is obtained from the time-series data of the account's behavior in the music listening dimension on September 29th. The account to be tested was a secure account from September 27th to September 29th. We can use the cosine similarity distance method to obtain the first vector distance between the embedding vector on September 30th and the first reference embedding vector, the second vector distance between the embedding vector and the second reference embedding vector, and the third vector distance between the embedding vector and the third reference embedding vector. The average of the first, second, and third vector distances is obtained; this average value represents the degree of behavioral difference of the account in the music listening dimension.

[0098] In this embodiment of the disclosure, Figure 2 Step S205 can further include the following three steps: S305 to S307:

[0099] S305. Input the degree of behavioral difference into the classification model for account security detection processing to obtain the predicted probability of the account to be detected.

[0100] For example, the classification model could be an XGBoost model. How to train and obtain the classification model can be found in subsequent embodiments, and will not be repeated here. In this step, after obtaining the degree of behavioral difference corresponding to the preset dimension of the account to be detected, the degree of behavioral difference can be input into the XGBoost model for account security detection processing to obtain the predicted probability corresponding to the account to be detected.

[0101] S306. If the predicted probability is greater than or equal to the probability threshold, then the account to be detected is determined to be a safe account.

[0102] S307. If the predicted probability is less than the probability threshold, the account to be detected is determined to be an unsafe account.

[0103] It's understandable that after obtaining the predicted probability of the account to be detected from the classification model, the predicted probability can be compared with a probability threshold to determine whether the account is safe. If the account is determined to be unsafe, it can be handled accordingly through subsequent account security procedures.

[0104] The account security detection method provided in this disclosure involves: acquiring time-series data of account behavior corresponding to a preset dimension of the account to be detected within a preset time period; inputting the account behavior time-series data into a time-series representation learning model for vector transformation processing to obtain the embedding vector corresponding to the account behavior time-series data; obtaining the vector distance between the embedding vector and the reference embedding vector, where the reference embedding vector is obtained based on the account behavior time-series data under the condition that the account to be detected is a safe account; determining the degree of behavioral difference corresponding to the preset dimension of the account to be detected as the average value of the vector distance; inputting the degree of behavioral difference into a classification model for account security detection processing to obtain the predicted probability corresponding to the account to be detected; if the predicted probability is greater than or equal to a probability threshold, the account to be detected is determined to be a safe account; if the predicted probability is less than the probability threshold, the account to be detected is determined to be an unsafe account. Since the embodiments of this disclosure take into account the differences in user behavior habits before and after the account is stolen, the time series data of the account behavior corresponding to the preset dimension within the preset time period of the account to be detected is transformed into the corresponding embedding vector through the time series representation learning model. Based on the vector distance between the embedding vector and the reference embedding vector, the degree of behavioral difference of the account to be detected corresponding to the preset dimension is determined. Then, based on the degree of behavioral difference, the classification model is used to determine whether the account to be detected is a safe account. This can obtain the account security detection result more accurately and has higher robustness and higher versatility.

[0105] Based on the above embodiments, in one possible implementation, the time series representation learning model is trained in the following way: acquiring time series sample data of third account behavior corresponding to the second sample account in a preset dimension; iteratively training the time series representation learning model based on the third account behavior time series sample data until the time series representation learning model converges, thereby obtaining the trained time series representation learning model.

[0106] In this embodiment, account behavior data corresponding to different preset dimensions for the second sample account can be obtained. This account behavior data is then cleaned to obtain cleaned account behavior data. The cleaned account behavior data is then sorted according to the chronological order of its timestamps to generate third account behavior time series sample data corresponding to different preset dimensions. For different second sample accounts, third account behavior time series sample data corresponding to different preset dimensions can be obtained separately.

[0107] For example, suppose there are M second sample accounts, and each second sample account has N third account behavior time series sample data in preset dimensions. Arrange the third account behavior time series sample data corresponding to the x-th (1 <= x <= M) second sample account in chronological order into a column, for example, using {x t} represents, where x tThis is used to identify the t-th behavior value corresponding to the j-th preset dimension of the x-th second sample account. Therefore, for the j-th preset dimension, we can obtain a sample Y composed of time series sample data of M third account behaviors. j Thus, N samples Y can be obtained. j For example, using {Y d} represents, where 1 <= d <= N. Each subsample Y d It can be used to train a temporal representation learning model (e.g., using M). d (represented by M) d The time series sample data of the third account behavior of the xth second sample account in the dth preset dimension can be abstracted into an embedding vector V. d，x Each preset dimension corresponds to a time-series representation learning model. Therefore, based on the time-series sample data of third-party account behavior, the time-series representation learning model is iteratively trained until it converges, resulting in a well-trained time-series representation learning model.

[0108] Based on the above embodiments, optionally, the classification model is trained in the following manner: Training samples are obtained, including time-series sample data of first account behavior corresponding to preset dimensions within multiple first reference durations for multiple first sample accounts, time-series sample data of second account behavior corresponding to preset dimensions within multiple second reference durations for multiple first sample accounts, and labels corresponding to the first sample accounts. The labels are used to distinguish whether a first sample account is a safe account. The first reference duration is the duration corresponding to the case where all first sample accounts are safe accounts, and the second reference duration is the duration corresponding to the case where some first sample accounts are unsafe accounts. Vectorization is performed on the first account behavior time-series sample data. The system performs vector transformation on the time series sample data of the first account behavior to obtain the first sample embedding vector, and performs vector transformation on the time series sample data of the second account behavior to obtain the second sample embedding vector. For each second sample embedding vector, the sample vector distance between the second sample embedding vector and each first sample embedding vector under the same preset dimension is obtained. Based on the sample vector distance, the degree of sample behavior difference of the first sample account in the preset dimension is determined. The degree of sample behavior difference and the label are input into the classification model, and the classification model is iteratively trained until the accuracy of the prediction result output by the classification model is greater than or equal to the accuracy threshold, thus obtaining the trained classification model.

[0109] For example, suppose Q training samples are obtained. These Q training samples distinguish whether a first sample account is a safe account by labels. The Q training samples include time series sample data of first account behavior corresponding to different preset dimensions within multiple first reference durations and time series sample data of second account behavior corresponding to different preset dimensions within multiple second reference durations for multiple first sample accounts. The first sample embedding vector corresponding to the first account behavior time series sample data and the second sample embedding vector corresponding to the second account behavior time series sample data can be obtained through the time series representation learning model trained in the above embodiment. For example, for the t-th (1<=t<=Q) first sample account with z different reference durations corresponding to the d-th preset dimension, M can be used to obtain the first sample embedding vector and the second sample embedding vector corresponding to the second account behavior time series sample data. d Obtain z embedding vectors, the set of z embedding vectors is, for example, denoted by {V}. t，d} indicates that, therefore, the set {V} t，d} is composed of z embedding vectors. It should be noted that this disclosure does not limit whether the number of embedding vectors contained in the set is consistent.

[0110] For each second sample embedding vector, the sample vector distance between the second sample embedding vector and each first sample embedding vector in the same preset dimension can be obtained. Then, based on the sample vector distance, the degree of difference in sample behavior corresponding to the preset dimension of the first sample account can be determined. For example, for a set {V} consisting of z embedding vectors... t，d The cosine similarity distance method can be used to obtain the vector distance between the z embedding vectors (e.g., using...). express).

[0111] Further, optionally, determining the degree of difference in sample behavior of the first sample account corresponding to a preset dimension based on the sample vector distance may include: determining the degree of difference in sample behavior of the first sample account corresponding to a preset dimension as the average value of the sample vector distance.

[0112] For example, for each preset dimension, the average distance between different sample vectors under the preset dimension can be obtained as the degree of difference in sample behavior of the first sample account corresponding to the preset dimension.

[0113] Input the degree of difference in sample behavior and labels of each preset dimension into the classification model, and iteratively train the classification model until the accuracy of the prediction results output by the classification model is greater than or equal to the accuracy threshold, and a trained classification model can be obtained.

[0114] Exemplary device

[0115] Having introduced the medium of exemplary embodiments of this disclosure, the following references are made to... Figure 4The account security detection apparatus according to exemplary embodiments of this disclosure will be described. The apparatus of the exemplary embodiments of this disclosure can implement the various processes in the aforementioned account security detection method embodiments and achieve the same functions and effects.

[0116] Figure 4 This is a schematic diagram of the structure of an account security detection device provided in an embodiment of the present disclosure, as shown below. Figure 4 As shown, the account security detection device 400 of this embodiment includes: a first acquisition module 401, a processing module 402, a second acquisition module 403, a first determination module 404, and a second determination module 405.

[0117] in:

[0118] The first acquisition module 401 is used to acquire time series data of account behavior corresponding to a preset dimension of the account to be detected within a preset time period.

[0119] The processing module 402 is used to perform vector transformation processing on the account behavior time series data to obtain the embedded vector corresponding to the account behavior time series data.

[0120] The second acquisition module 403 is used to acquire the vector distance between the embedded vector and the reference embedded vector. The reference embedded vector is obtained based on the account behavior time series data when the account to be detected is a safe account.

[0121] The first determining module 404 is used to determine the degree of behavioral difference of the account to be detected in a preset dimension based on the vector distance.

[0122] The second determination module 405 is used to determine whether the account to be detected is a safe account based on the degree of behavioral difference.

[0123] In one possible implementation, there are multiple reference embedding vectors, and the first determining module 404 can be specifically used to: determine the degree of behavioral difference of the account to be detected corresponding to a preset dimension as the average value of the vector distance.

[0124] In one possible implementation, the second determining module 405 may be specifically used to: input the degree of behavioral difference into a classification model for account security detection processing, and obtain the predicted probability corresponding to the account to be detected; if the predicted probability is greater than or equal to the probability threshold, then the account to be detected is determined to be a safe account; if the predicted probability is less than the probability threshold, then the account to be detected is determined to be an unsafe account.

[0125] In one possible implementation, the account security detection device 400 may further include a first training module 406, used to train a classification model by: acquiring training samples, the training samples including time series sample data of first account behavior corresponding to a preset dimension for multiple first sample accounts within multiple first reference durations, time series sample data of second account behavior corresponding to a preset dimension for multiple second reference durations, and labels corresponding to the first sample accounts, the labels being used to distinguish whether the first sample accounts are secure accounts, the first reference duration being the duration corresponding to the case where all first sample accounts are secure accounts, and the second reference duration being the duration corresponding to the case where some first sample accounts are insecure accounts; and processing the first account behavior time series data. The sequence sample data undergoes vector transformation to obtain the first sample embedding vector corresponding to the first account behavior time series sample data, and the second account behavior time series sample data undergoes vector transformation to obtain the second sample embedding vector corresponding to the second account behavior time series sample data. For each second sample embedding vector, the sample vector distance between the second sample embedding vector and each first sample embedding vector under the same preset dimension is obtained. Based on the sample vector distance, the degree of sample behavior difference corresponding to the first sample account in the preset dimension is determined. The degree of sample behavior difference and the label are input into the classification model, and the classification model is iteratively trained until the accuracy of the prediction result output by the classification model is greater than or equal to the accuracy threshold, thus obtaining the trained classification model.

[0126] In one possible implementation, when the first training module 406 is used to determine the degree of difference in sample behavior of the first sample account corresponding to a preset dimension based on the sample vector distance, it can specifically be used to: determine the degree of difference in sample behavior of the first sample account corresponding to the preset dimension as the average value of the sample vector distance.

[0127] In one possible implementation, there are multiple preset dimensions, and the second determining module 405 can be specifically used to: determine whether the account to be detected is a safe account based on the degree of behavioral differences of the account to be detected corresponding to different preset dimensions.

[0128] In one possible implementation, the processing module 402 can be specifically used to: input the account behavior time series data into the time series representation learning model for vector transformation processing to obtain the embedding vector corresponding to the account behavior time series data.

[0129] In one possible implementation, the account security detection device 400 may further include a second training module 407, which is used to train a time-series representation learning model by: acquiring time-series sample data of third account behavior corresponding to a preset dimension of the second sample account; and iteratively training the time-series representation learning model based on the third account behavior time-series sample data until the time-series representation learning model converges, thereby obtaining a trained time-series representation learning model.

[0130] In one possible implementation, the first acquisition module 401 may be specifically used to: acquire account behavior data of the account to be detected corresponding to a preset dimension within a preset time period; clean the account behavior data to obtain cleaned account behavior data; and sort the cleaned account behavior data according to the order of timestamps to generate time series data of account behavior of the account to be detected corresponding to the preset dimension.

[0131] The apparatus of this disclosure embodiment can be used to execute the account security detection method in any of the above method embodiments. Its implementation principle and technical effect are similar, and will not be described again here.

[0132] Exemplary media

[0133] After introducing the methods of exemplary embodiments of this disclosure, the following references are made. Figure 5 The storage medium of the exemplary embodiments of this disclosure will be described.

[0134] Figure 5 This is a schematic diagram of a storage medium provided according to an embodiment of the present disclosure. (See reference...) Figure 5 As shown, the storage medium 500 stores a program product for implementing the above-described method according to embodiments of the present disclosure. This program product may be a portable compact disc read-only memory (CD-ROM) and includes program code, and can run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto.

[0135] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0136] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. This propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium.

[0137] Program code for performing the operations disclosed herein can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing devices can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN).

[0138] Exemplary computing device

[0139] Having described the methods, media, and apparatus of exemplary embodiments of this disclosure, the following references... Figure 6 A computing device according to an exemplary embodiment of the present disclosure will be described.

[0140] Figure 6 The computing device 600 shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments disclosed herein.

[0141] Figure 6 This is a schematic diagram of the structure of a computing device provided in an embodiment of the present disclosure, as shown below. Figure 6 As shown, the computing device 600 is presented in the form of a general-purpose computing device. The components of the computing device 600 may include, but are not limited to: at least one processing unit 601, at least one storage unit 602, and a bus 603 connecting different system components (including the processing unit 601 and the storage unit 602). For example, the processing unit 601 may specifically be a processor, and the storage unit 602 stores computer execution instructions. The processing unit 601 executes the computer execution instructions stored in the storage unit 602 to implement the aforementioned account security detection method.

[0142] Bus 603 includes a data bus, a control bus, and an address bus.

[0143] Storage unit 602 may include readable media in the form of volatile memory, such as random access memory (RAM) 6021 and / or cache memory 6022, and may further include readable media in the form of non-volatile memory, such as read-only memory (ROM) 6023.

[0144] Storage unit 602 may also include a program / utility 6025 having a set (at least one) of program modules 6024, such program modules 6024 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0145] The computing device 600 can also communicate with one or more external devices 604 (e.g., keyboard, pointing device, etc.). This communication can be performed via input / output (I / O) interface 605. Furthermore, the computing device 600 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 606. Figure 6 As shown, network adapter 606 communicates with other modules of computing device 600 via bus 603. It should be understood that, although not shown in the figures, other hardware and / or software modules may be used in conjunction with computing device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0146] It should be noted that although several units / modules or sub-units / modules of the account security detection device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more units / modules described above can be embodied in one unit / module. Conversely, the features and functions of one unit / module described above can be further divided and embodied by multiple units / modules.

[0147] Furthermore, although the operations of the methods disclosed herein are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all of the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0148] While the spirit and principles of this disclosure have been described with reference to several specific embodiments, it should be understood that this disclosure is not limited to the disclosed specific embodiments, and the division of aspects does not imply that features in these aspects cannot be combined for benefit; such division is merely for convenience of expression. This disclosure is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

Claims

1. A method for detecting security of an account, comprising: obtaining account behavior time series data of a preset dimension corresponding to a to-be-detected account within a preset time period; performing vector conversion processing on the account behavior time series data to obtain an embedding vector corresponding to the account behavior time series data; obtaining a vector distance between the embedding vector and a reference embedding vector, the reference embedding vector being obtained according to account behavior time series data of the to-be-detected account in a case where the to-be-detected account is a secure account; determining a behavior difference degree of the to-be-detected account corresponding to the preset dimension according to the vector distance; determining whether the to-be-detected account is a secure account according to the behavior difference degree based on a classification model; the classification model being obtained by training in the following manner: obtaining training samples, the training samples including first account behavior time series sample data of a plurality of first sample accounts corresponding to the preset dimension within a plurality of first reference time periods, second account behavior time series sample data of the first sample accounts corresponding to the preset dimension within a plurality of second reference time periods, and labels corresponding to the first sample accounts, the labels being used to distinguish whether the first sample accounts are secure accounts, the first reference time period being a time period corresponding to a case where the first sample accounts are all secure accounts, and the second reference time period being a time period corresponding to a case where part of the first sample accounts are insecure accounts; performing vector conversion processing on the first account behavior time series sample data to obtain first sample embedding vectors corresponding to the first account behavior time series sample data, and performing vector conversion processing on the second account behavior time series sample data to obtain second sample embedding vectors corresponding to the second account behavior time series sample data; for each second sample embedding vector, obtaining a sample vector distance between the second sample embedding vector and each first sample embedding vector under the same preset dimension; determining a sample behavior difference degree of the first sample accounts corresponding to the preset dimension according to the sample vector distance; inputting the sample behavior difference degree and the labels into the classification model to iteratively train the classification model until a prediction accuracy of a prediction result output by the classification model is greater than or equal to an accuracy threshold, thereby obtaining a trained classification model.

2. The method of claim 1, wherein the reference embedding vector is a plurality of reference embedding vectors, and the determining of the behavior difference degree of the to-be-detected account corresponding to the preset dimension according to the vector distance comprises: determining the behavior difference degree of the to-be-detected account corresponding to the preset dimension as an average value of the vector distances.

3. The method of claim 1, wherein the determining of whether the to-be-detected account is a secure account according to the behavior difference degree based on the classification model comprises: inputting the behavior difference degree into the classification model to perform account security detection processing, thereby obtaining a prediction probability corresponding to the to-be-detected account; if the prediction probability is greater than or equal to a probability threshold, determining that the to-be-detected account is a secure account. ​ If the predicted probability is less than the probability threshold, it is determined that the account to be detected is an unsafe account.

4. The account security detection method of claim 1, wherein the determining of the sample behavior difference degree of the first sample account corresponding to the preset dimension based on the sample vector distance comprises: determining the sample behavior difference degree of the first sample account corresponding to the preset dimension as an average value of the sample vector distance.

5. The account security detection method of claim 1, wherein the preset dimension is a plurality, and the determining of whether the account to be detected is a safe account based on the behavior difference degree comprises: determining whether the account to be detected is a safe account based on the behavior difference degree of the account to be detected corresponding to different preset dimensions.

6. The account security detection method of any one of claims 1 to 5, wherein the vector conversion processing of the account behavior time sequence data to obtain the embedding vector corresponding to the account behavior time sequence data comprises: inputting the account behavior time sequence data into a time sequence representation learning model for vector conversion processing to obtain the embedding vector corresponding to the account behavior time sequence data.

7. The account security detection method of claim 6, wherein the time sequence representation learning model is obtained by training in the following manner: obtaining third account behavior time sequence sample data corresponding to the preset dimension of a second sample account; iteratively training a time sequence representation learning model based on the third account behavior time sequence sample data until the time sequence representation learning model converges to obtain a trained time sequence representation learning model.

8. The account security detection method of any one of claims 1 to 5, wherein the obtaining of the account behavior time sequence data corresponding to the preset dimension of the account to be detected within a preset time length comprises: obtaining account behavior data corresponding to the preset dimension of the account to be detected within the preset time length; performing cleaning processing on the account behavior data to obtain cleaned account behavior data; sorting the cleaned account behavior data in chronological order of timestamps to generate the account behavior time sequence data corresponding to the preset dimension of the account to be detected.

9. An account security detection device, comprising: a first obtaining module configured to obtain account behavior time sequence data corresponding to a preset dimension of an account to be detected within a preset time length; a processing module configured to perform vector conversion processing on the account behavior time sequence data to obtain an embedding vector corresponding to the account behavior time sequence data; a second obtaining module configured to obtain a vector distance between the embedding vector and a reference embedding vector, the reference embedding vector being obtained based on account behavior time sequence data of the account to be detected being a safe account; a first determining module configured to determine a behavior difference degree of the account to be detected corresponding to the preset dimension based on the vector distance; a second determining module configured to determine whether the account to be detected is a safe account based on a classification model and the behavior difference degree; a first training module configured to obtain the classification model by training in the following manner: obtain training samples, the training samples including first account behavior time sequence sample data corresponding to the preset dimension of a plurality of first sample accounts in a plurality of first reference time lengths, second account behavior time sequence sample data corresponding to the preset dimension of the first sample accounts in a plurality of second reference time lengths, and labels corresponding to the first sample accounts, the labels being used to distinguish whether the first sample accounts are safe accounts, the first reference time length being a time length corresponding to a case where the first sample accounts are all safe accounts, and the second reference time length being a time length corresponding to a case where part of the first sample accounts are unsafe accounts; perform vector conversion processing on the first account behavior time sequence sample data to obtain first sample embedding vectors corresponding to the first account behavior time sequence sample data, and perform vector conversion processing on the second account behavior time sequence sample data to obtain second sample embedding vectors corresponding to the second account behavior time sequence sample data; for each second sample embedding vector, obtain a sample vector distance between the second sample embedding vector and each first sample embedding vector under the same preset dimension; determine a sample behavior difference degree of the first sample accounts corresponding to the preset dimension according to the sample vector distances; input the sample behavior difference degree and the label into a classification model, and iteratively train the classification model until a prediction result output by the classification model has an accuracy greater than or equal to an accuracy threshold, to obtain a trained classification model.

10. The account security detection apparatus according to claim 9, wherein the reference embedding vectors are a plurality of vectors, and the first determination module is specifically configured to: determine the behavior difference degree of the to-be-detected account corresponding to the preset dimension as an average value of the vector distances.

11. The account security detection apparatus according to claim 9, wherein the second determination module is specifically configured to: input the behavior difference degree into a classification model for account security detection processing, to obtain a prediction probability corresponding to the to-be-detected account; if the prediction probability is greater than or equal to a probability threshold, determine that the to-be-detected account is a safe account; and if the prediction probability is less than the probability threshold, determine that the to-be-detected account is an unsafe account.

12. The account security detection apparatus according to claim 9, wherein when the first training module is used to determine the sample behavior difference degree of the first sample accounts corresponding to the preset dimension according to the sample vector distances, the first training module is specifically configured to: determine the sample behavior difference degree of the first sample accounts corresponding to the preset dimension as an average value of the sample vector distances.

13. The account security detection apparatus according to claim 9, wherein the preset dimension is a plurality of dimensions, and the second determination module is specifically configured to: determine whether the to-be-detected account is a safe account according to the behavior difference degrees of the to-be-detected account corresponding to different preset dimensions.

14. The account security detection apparatus according to any one of claims 9 to 13, wherein the processing module is specifically configured to: ​ ​ ​ ​ ​ ​ The account behavior time sequence data is input into a time sequence feature learning model for vector conversion processing, to obtain an embedding vector corresponding to the account behavior time sequence data.

15. The account security detection apparatus of claim 14, further comprising a second training module configured to train the time sequence feature learning model by: obtaining third account behavior time sequence sample data corresponding to the preset dimension for a second sample account; and iteratively training the time sequence feature learning model based on the third account behavior time sequence sample data until the time sequence feature learning model converges, to obtain the trained time sequence feature learning model.

16. The account security detection apparatus of any one of claims 9 to 13, wherein the first obtaining module is specifically configured to: obtain account behavior data corresponding to the preset dimension for the to-be-detected account within the preset time period; perform cleaning processing on the account behavior data to obtain cleaned account behavior data; and sort the cleaned account behavior data according to the chronological order of timestamps, to generate account behavior time sequence data corresponding to the preset dimension for the to-be-detected account. a processor, and a memory in communication with the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the account security detection method of any one of claims 1 to 8.

18. A storage medium having computer program instructions stored therein, the computer program instructions being executed to implement the account security detection method of any one of claims 1 to 8.

19. A computer program product comprising a computer program, the computer program being executed to implement the account security detection method of any one of claims 1 to 8.

17. A computing device comprising: ​ ​ ​ ​ ​

Images