Abnormal user identification method, device and storage medium

Abstract

The present application provides a method, device, and storage medium for identifying abnormal users, relating to the field of communication technology, and for identifying abnormal users and reducing losses to operators. The method comprises: obtaining expected resource usage data and actual resource usage data of users who have opened accounts with third-party operators, the expected resource usage data including an identifier of the expected resource usage, and the actual resource usage data including an identifier of the actual resource usage; identifying a user whose identifier of the expected resource usage is inconsistent with the identifier of the actual resource usage as a first suspected user; determining the inactivity time of the first suspected user, and identifying the first suspected user whose inactivity time is less than a preset threshold as a second suspected user; querying the payment record of the second suspected user, and identifying the second suspected user for which no payment record is found as an abnormal user.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method, device, and storage medium for identifying abnormal users. Background Art

[0002] With the development of gigabit city projects, gigabit broadband services are gradually entering millions of households. Users are increasingly demanding gigabit broadband upgrades. When activating these services, users can choose between official carriers and third-party carriers. Third-party carriers are companies that jointly invest with carriers to build the end-point access network, and the third-party company performs end-point maintenance. These third-party carriers are also known as "three-dimensional" carriers.

[0003] When a user chooses an official operator to activate the corresponding service, the official operator uses its own resources to open an account for the user within the official operator; when a user chooses a third-party operator to activate the corresponding service, the third-party operator uses the third-party resources to open an account for the user within the third-party operator.

[0004] Due to the growing demand for gigabit broadband services, some third-party operators, seeking to maximize profits, are illegally using the official operator's own resources while registering users with third-party operators. These abnormal users, also known as "three-dimensional drift users," occupy the official operator's own resources, causing financial and resource losses to the operator. Therefore, how to accurately identify and locate these abnormal users and reduce losses to the official operator is an urgent problem. Summary of the Invention

[0005] The embodiments of the present application provide a method, device, and storage medium for identifying abnormal users, which are used to identify abnormal users and reduce losses for operators.

[0006] In a first aspect, a method for identifying abnormal users is provided, comprising: obtaining expected resource usage data and actual resource usage data of users who have opened accounts with third-party operators, the expected resource usage data including an identifier of the expected resource usage, and the actual resource usage data including an identifier of the actual resource usage; identifying a user whose identifier of the expected resource usage is inconsistent with the identifier of the actual resource usage as a first suspected user; determining the inactive duration of the first suspected user, and identifying the first suspected user whose inactive duration is less than a preset threshold as a second suspected user; querying the payment record of the second suspected user, and identifying the second suspected user for whom no payment record is queried as an abnormal user.

[0007] The technical solution provided by the embodiment of the present application brings at least the following beneficial effects: when the user's expected resource usage identifier is inconsistent with the actual resource usage identifier, it proves that the resource data expected to be used by the user is inconsistent with the actual resource data used, and the user may be an abnormal user. Therefore, this type of user is identified as a first suspected user. Then, based on the inactive time of the first suspected user, the active user among the first suspected users is determined and identified as a second suspected user. Finally, based on the billing record of the second suspected user, the non-billing user who needs to pay normal fees to the operator among the second suspected users is determined and identified as an abnormal user. Through three identification processes, the abnormal user is finally identified, which improves the accuracy and work efficiency of identifying abnormal users, thereby reducing the loss of the operator.

[0008] As a possible implementation method, determining the inactive time of the first suspected user includes: obtaining the online time record of the first suspected user; determining the inactive time of the first suspected user based on the most recent online time recorded in the online time record, where the inactive time of the first suspected user is the length of time from the most recent online time of the first suspected user.

[0009] As a possible implementation, after determining the inactivity time of the first suspected user, the method further includes: identifying the first suspected user whose inactivity time is greater than or equal to a preset threshold as a silent user; and deleting user data of the silent user.

[0010] As a possible implementation method, the above method also includes: obtaining user information of the abnormal user and information of the third-party operator when the abnormal user opened an account; sending the user information of the abnormal user and information of the third-party operator to the maintenance system, so that the maintenance system can correct the abnormal user and the third-party operator.

[0011] In a second aspect, a device for identifying abnormal users is provided, including: an acquisition module for acquiring expected resource usage data and actual resource usage data of users who have opened accounts with third-party operators, the expected resource usage data including an identifier of the expected resource usage, and the actual resource usage data including an identifier of the actual resource usage; an identification module for identifying a user whose identifier of the expected resource usage is inconsistent with that of the actual resource usage as a first suspected user; a determination module for determining the inactive time period of the first suspected user; the identification module is also used to identify the first suspected user whose inactive time period is less than a preset threshold as a second suspected user; a query module for querying the payment record of the second suspected user; the identification module is also used to identify the second suspected user for whom no payment record is queried as an abnormal user.

[0012] As a possible implementation method, the acquisition module is also used to obtain the online time record of the first suspected user; the determination module is specifically used to: determine the inactive time of the first suspected user based on the most recent online time recorded in the online time record, and the inactive time of the first suspected user is the length of time from the most recent online time of the first suspected user.

[0013] As a possible implementation, the identification module is further configured to identify a first suspected user whose inactivity time is greater than or equal to a preset threshold as a silent user; the apparatus further includes: a deletion module configured to delete user data of the silent user.

[0014] As a possible implementation method, the acquisition module is also used to obtain the user information of the abnormal user and the information of the third-party operator when the abnormal user opens an account; the above-mentioned device also includes: a sending module, used to send the user information of the abnormal user and the information of the third-party operator to the maintenance system, so that the maintenance system can correct the abnormal user and the third-party operator.

[0015] In a third aspect, a device for identifying abnormal users is provided, comprising a processor, wherein when the processor executes a computer program, the method for identifying abnormal users as described in the first aspect is implemented.

[0016] In a fourth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes computer instructions; wherein, when the computer instructions are executed, the abnormal user identification method as described in the first aspect is implemented.

[0017] In this application, the beneficial effects described in the second to fourth aspects can refer to the analysis of the beneficial effects of the first aspect and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings are used to provide a further understanding of the technical solution of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the technical solution of the present application and do not constitute a limitation on the technical solution of the present application.

[0019] Figure 1 A schematic diagram of the structure of an account opening system provided in an embodiment of the present application;

[0020] Figure 2 A flowchart of a method for identifying abnormal users provided in an embodiment of the present application;

[0021] Figure 3 A flowchart of another method for identifying abnormal users provided in an embodiment of the present application;

[0022] Figure 4 A complete flow chart of a method for identifying abnormal users provided in an embodiment of the present application;

[0023] Figure 5 A schematic diagram of the structure of an abnormal user identification device provided in an embodiment of the present application;

[0024] Figure 6 A schematic diagram of the structure of another abnormal user identification device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] The technical solutions of the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0026] In the description of this application, unless otherwise specified, " / " means "or", for example, A / B can mean A or B. "And / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, "at least one" means one or more, and "a plurality" means two or more. Words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit them to be different. It should be noted that in this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations.

[0027] Any embodiment or design described in this application as "exemplary" or "for example" should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete way. In the embodiments of the present application, "indication" may include direct indication and indirect indication. For example, taking the first control information below as an example, the first control information may directly carry information A itself or its index to achieve the purpose of directly indicating information A. Alternatively, the first control information may also carry information B that is associated with information A, thereby achieving the purpose of indirectly indicating information A while indicating information B.

[0028] Figure 1 This is a structural diagram of an account opening system provided in an embodiment of the present application. The account opening system may include a third-party operator 11, a third-party operator coverage area 12, an official operator coverage area 13, a third-party splitter 14, an official splitter 15, and a gigabit service system 16.

[0029] The third-party operator 11 may be a third-party company that jointly invests with the official operator to build a network. The third-party operator coverage area 12 is the area where the third-party operator 11 provides services. The third-party optical splitter 14 is used to provide resource data to users who open accounts with the third-party operator 12.

[0030] The official operator coverage area 15 is an area where services are provided by the official operator. The official optical splitter 15 is used to provide resource data to users who have opened accounts with the official operator.

[0031] The gigabit service system 16 is used to provide resource data to the official operator and the third-party operator 11 so that users who have opened accounts with the official operator and the third-party operator 11 can obtain gigabit network services.

[0032] like Figure 1 As shown, users who normally open accounts with third-party operator 11 use third-party splitter 14. However, some third-party operators, in order to maximize profits, use illegal means to force users who open accounts with third-party operator 12 to use official splitter 15, thereby accessing the official operator's resource data. Under normal circumstances, official splitter 15 only provides resource data to users who open accounts with the official operator. These actions by some third-party operators have occupied the official operator's resources, causing economic and resource losses to the official operator.

[0033] As described in the background, when a user chooses an official carrier to activate a service, the official carrier uses its own resource data to register the user with the official carrier. When a user chooses a third-party carrier to activate a service, the third-party carrier uses its own resource data to register the user with the third-party carrier. To maximize profits, some third-party carriers use the official carrier's own resource data in non-compliant ways, registering users with third-party carriers and pocketing the official carrier's commission.

[0034] Traditional methods for identifying abnormal users rely solely on manual verification, such as manually shutting down optical network signals to identify them, or conducting on-site line inspections to identify them. These traditional identification methods suffer from low efficiency and accuracy, and they fail to account for losses incurred by official operators. Therefore, efficiently and accurately identifying abnormal users and minimizing losses to official operators is an urgent issue.

[0035] In this regard, the present application provides a method for identifying abnormal users, such as Figure 2 As shown, the following steps are included:

[0036] S201: Obtain estimated resource usage data and actual resource usage data of users who have opened accounts with third-party operators.

[0037] In some embodiments, the user database includes the operator information, user information, the user's estimated resource usage data, and the user's actual resource usage data when the user opened an account. When obtaining the estimated resource usage data and actual resource usage data of a user who opened an account with a third-party operator, the estimated resource usage data and actual resource usage data of the user who opened an account with the third-party operator in the user database are obtained based on the name of the third-party operator when the user opened the account.

[0038] Among them, the operator information includes the operator name and the operator's virtual area network information, the user information includes the user name and user number, the user's expected resource usage data includes the user's expected bandwidth resources, expected service quality QOS resources and the identifier of the expected resource usage, and the actual resource usage data includes the user's actual bandwidth resources, actual service quality QOS resources and the identifier of the actual resource usage. The expected resource usage data includes the identifier of the expected resource usage, and the actual resource usage data includes the identifier of the actual resource usage. The above-mentioned identifier of the expected resource usage and the identifier of the actual resource usage will be uploaded to the user database when the user opens an account or registers. The identifier of the expected resource usage data and the actual resource usage data can be a product serial number (SN), which is not limited here.

[0039] For example, when it is necessary to obtain the expected resource usage data and actual resource usage data of users who have opened accounts with third-party operator 1, the expected resource usage data and actual resource usage data of users who have opened accounts with third-party operator 1 can be directly extracted from the user database based on the operator information of third-party operator 1, such as the name of third-party operator 1.

[0040] S202: Identify a user whose identifier of expected resource use is inconsistent with the identifier of actual resource use as a first suspected user.

[0041] It should be noted that when the identifier of the user's expected resource usage is inconsistent with the identifier of the actual resource usage, it proves that the expected resource usage data of this type of user is inconsistent with the actual resource usage data, and therefore this type of user is identified as the first suspected user.

[0042] For example, the resource data of a third-party operator is identified as SN1, and the resource data of the official operator is identified as SN2. For a user who opens an account with a third-party operator, the expected resource usage data is identified as SN1, and the actual resource usage data is identified as SN2. The identification of the expected resource usage data is inconsistent with the identification of the actual resource usage data. From the identification of the resource data, it can be seen that the user's expected resource usage data is the resource data of the third-party operator, but the actual resource usage data is the official resource data. Therefore, this type of user is a first suspected user.

[0043] S203: Determine the inactivity duration of the first suspected user, and identify the first suspected user whose inactivity duration is less than a preset threshold as a second suspected user.

[0044] The inactive time of the first suspected user is the time from the last online time of the first suspected user.

[0045] In some embodiments, the inactive time of the first suspected user is determined by: obtaining the online time record of the first suspected user; and determining the inactive time of the first suspected user according to the most recent online time in the online time record.

[0046] For example, the preset threshold is set to 30 days. Based on the online time record of User 1 among the first suspected users, it can be seen that User 1 was last online 5 days ago, that is, User 1's inactivity time is 5 days, which is less than the preset threshold. This proves that User 1 is still using resource data normally, and User 1 is determined to be the second suspected user.

[0047] In some embodiments, the inactivity time of the first suspected user is determined, and the first suspected user whose inactivity time is greater than or equal to a preset threshold is identified as a silent user, and the user data of the silent user is deleted. Among them, a silent user is a user who has not been online for a long time and does not use the operator's data resources. For example, based on the online time record, it is determined that the last online time of the first suspected user 2 was 60 days ago, that is, the inactivity time of the first suspected user 2 is 60 days, which is greater than the preset threshold of 30 days. The first suspected user 2 is determined to be a silent user, and the user data of the user is deleted.

[0048] The preset threshold may be determined based on the user's historical online records; or based on expert experience.

[0049] It is understood that when the first suspected user's inactivity time is less than the preset threshold, the user is considered an active user and a real online user, and will continue to use the official operator's data resources online. When the first suspected user's inactivity time is greater than or equal to the preset threshold, the user is considered a silent user and a historical user, and will no longer use the official operator's resource data. The user's user data is then directly deleted, reducing storage pressure on the user database.

[0050] S204: Query the payment record of the second suspected user, and identify the second suspected user for which no payment record is found as an abnormal user.

[0051] The billing database is used to store user information and billing records for billing users. Billing users are users who do not pay operator fees. It should be understood that only when a user is a billing user will a corresponding billing record exist in the billing database. Therefore, users with billing records are billing users, while users without billing records are non-billing users.

[0052] In some embodiments, based on the user information of the second suspected user, the payment record of the second suspected user in the payment database is queried.

[0053] For example, if no billing record of User 1 is found in the billing database based on the user information of User 1 among the second suspected users, it is proved that User 1 is a non-billing user and needs to pay fees to the operator normally, so User 1 is an abnormal user.

[0054] In another example, if the billing record of User 2 is found in the billing database based on the user information of User 2, the second suspected user, it is proved that the user is a billing user and does not need to pay fees to the operator, so User 2 is a normal user.

[0055] The embodiments of the present application bring at least the following beneficial effects: when a user's expected resource usage identifier is inconsistent with the actual resource usage identifier, it proves that the resource data expected to be used by the user is inconsistent with the actual resource data used, and the user may be an abnormal user. Therefore, this type of user is identified as a first suspected user. Then, based on the inactive time of the first suspected user, the active user among the first suspected users is determined and identified as a second suspected user. Finally, based on the billing record of the second suspected user, the non-billing user who needs to pay normal fees to the operator among the second suspected users is determined and identified as an abnormal user. Through three identification processes, the abnormal user is finally identified, which improves the accuracy and work efficiency of identifying abnormal users, thereby reducing the loss of the operator.

[0056] In some embodiments, based on Figure 2 The embodiment shown, as Figure 3As shown, the method further includes the following steps after step S204:

[0057] S205: Obtain the user information of the abnormal user and the information of the third-party operator when the abnormal user opened an account.

[0058] Among them, user information includes user name, user account and actual resource usage data information, and third-party operator information includes operator name and access room name.

[0059] S206: Send the user information of the abnormal user and the information of the third-party operator to the maintenance system.

[0060] In some embodiments, after receiving the user information of the abnormal user and the information of the third-party operator, the maintenance system performs correction processing on the abnormal user and the third-party operator.

[0061] For example, the estimated resource usage of abnormal user 1 is identified as SN1, which represents the resource data of a third-party operator, while the actual resource usage is identified as SN2, which represents the resource data of the official operator. After receiving abnormal user 1's user information and the third-party operator information used when abnormal user 1 opened an account, the maintenance system corrects abnormal user 1's actual resource usage to the resource data of the third-party operator and reports abnormal user 1 and the corresponding third-party operator to the relevant market authorities, who then impose financial penalties on abnormal user 1 and the corresponding third-party operator.

[0062] After identifying an abnormal user, this embodiment of the application sends the abnormal user and the third-party operator used to open the account to the maintenance system for correction and punishment. This compensates the official operator for losses, combats non-compliant behavior by abnormal users and third-party operators, and serves as a warning to third-party operators, reducing the probability of such non-compliant behavior.

[0063] like Figure 4 As shown, the embodiment of the present application provides Figure 4 A complete flow chart of a method for identifying abnormal users is shown in FIG. Figure 4 As shown, the method includes the following steps:

[0064] S301: Obtain estimated resource usage data and actual resource usage data of users who have opened accounts with third-party operators.

[0065] S302: Determine whether the identifier of the resource that the user plans to use is consistent with the identifier of the resource that the user actually uses.

[0066] If the identifier of the user's expected resource usage is consistent with the identifier of the actually used resource, then step S303 is executed, and the user is a normal user.

[0067] If the identifier of the resource that the user is expected to use is inconsistent with the identifier of the resource that the user actually uses, it is determined that the user is a first suspected user, and S304 is executed.

[0068] S303: Determine whether the user is a normal user.

[0069] S304: Determine whether the user's inactivity time is less than a preset threshold.

[0070] If the inactivity time of the user is greater than or equal to the preset threshold, step S305 is executed to determine that the user is a silent user.

[0071] If the inactivity time of the user is greater than or equal to the preset threshold, step S306 is executed to determine that the user is a second suspected user.

[0072] S305: Determine that the user is a silent user, and delete the user data of the user.

[0073] S306: Determine whether the user has any payment record.

[0074] If there is a billing record for the user, then step S307 is executed to determine that the user is a normal user who does not need to pay fees to the operator.

[0075] If there is no payment record for the user, then S308 is executed to determine that the user is an abnormal user.

[0076] S307: Determine that the user is a normal user who does not need to pay fees to the operator.

[0077] S308: Determine that this type of user is an abnormal user.

[0078] S309: Obtain the user information of the abnormal user and the information of the third-party operator when the abnormal user opened an account.

[0079] S310: Send the user information of the abnormal user and the information of the third-party operator to the maintenance system.

[0080] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of method. In order to realize the above functions, it includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily appreciate that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in a hardware or computer software driven hardware manner depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0081] In the embodiment of the present application, the communication device can be divided into functional modules according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. Optionally, the division of modules in the embodiment of the present application is schematic and is only a logical functional division. In actual implementation, there may be other division methods.

[0082] Figure 5 A schematic diagram of the structure of an abnormal user identification device provided in an embodiment of the present application is shown as follows: Figure 5 As shown, the abnormal user identification device 40 includes: an acquisition module 401 , an identification module 402 , a determination module 403 and a query module 404 .

[0083] The acquisition module 401 is used to acquire the estimated resource usage data and actual resource usage data of a user who has opened an account with a third-party operator. The estimated resource usage data includes an identifier of the estimated resource usage, and the actual resource usage data includes an identifier of the actual resource usage.

[0084] The identification module 402 is configured to identify a user whose identifier of the resource to be used is expected to be inconsistent with the identifier of the resource to be used actually as a first suspected user.

[0085] The determination module 403 is configured to determine the inactivity duration of the first suspected user.

[0086] The identification module 402 is further configured to identify a first suspected user whose inactivity time is less than a preset threshold as a second suspected user.

[0087] The query module 404 is configured to query the payment record of the second suspected user.

[0088] The identification module 402 is further configured to identify a second suspected user for whom no payment record is found as an abnormal user.

[0089] In some embodiments, the acquisition module 401 is also used to obtain the online time record of the first suspected user; the determination module 403 is specifically used to: determine the inactive time of the first suspected user based on the most recent online time recorded in the online time record, and the inactive time of the first suspected user is the length of time from the most recent online time of the first suspected user.

[0090] In some embodiments, the above-mentioned device further includes: a deletion module 405; the identification module 402 is further used to identify the first suspected user whose inactivity time is greater than or equal to a preset threshold as a silent user; the deletion module 405 is used to delete the user data of the silent user.

[0091] In some embodiments, the above-mentioned device also includes: a sending module 406; the acquisition module 401 is also used to obtain the user information of the abnormal user and the information of the third-party operator when the abnormal user opens an account; the sending module 406 is used to send the user information of the abnormal user and the information of the third-party operator to the maintenance system, so that the maintenance system can correct the abnormal user and the third-party operator.

[0092] In the case of implementing the functions of the above-mentioned integrated modules in the form of hardware, the embodiments of the present application provide the following Figure 6 The identification device of abnormal users shown in FIG. Figure 6 As shown, the abnormal user identification device 50 includes: a processor 502 and a bus 504. Optionally, the abnormal user identification device may further include a memory 501; and optionally, the abnormal user identification device may further include a communication interface 503.

[0093] Processor 502 may implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 502 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field-programmable gate array, or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. It may implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 502 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, or a combination of a DSP and a microprocessor.

[0094] The communication interface 503 is used to connect to other devices via a communication network, such as Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0095] The memory 501 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0096] As a possible implementation, the memory 501 can exist independently of the processor 502. The memory 501 can be connected to the processor 502 via a bus 504 and used to store instructions or program codes. When the processor 502 calls and executes the instructions or program codes stored in the memory 501, an abnormal user identification method provided in an embodiment of the present application can be implemented.

[0097] In another possible implementation, the memory 501 may also be integrated with the processor 502 .

[0098] The bus 504 may be an extended industry standard architecture (EISA) bus, etc. The bus 504 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0099] Some embodiments of the present application provide a computer-readable storage medium (e.g., a non-transitory computer-readable storage medium), which stores computer program instructions. When the computer program instructions are executed on a computer, the computer executes a method as in any of the above embodiments.

[0100] Exemplarily, the computer-readable storage media may include, but are not limited to, magnetic storage devices (e.g., hard disks, floppy disks, or magnetic tapes), optical disks (e.g., compact disks (CDs), digital versatile disks (DVDs), etc.), smart cards, and flash memory devices (e.g., erasable programmable read-only memory (EPROM), cards, sticks, or key drives, etc.). The various computer-readable storage media described in the present disclosure may represent one or more devices and / or other machine-readable storage media for storing information. The term "machine-readable storage medium" may include, but is not limited to, wireless channels and various other media capable of storing, containing, and / or carrying instructions and / or data.

[0101] An embodiment of the present application further provides a computer-readable storage medium, which includes computer-executable instructions. When the computer-executable instructions are executed on a computer, the computer executes the method provided in the above embodiment.

[0102] An embodiment of the present application also provides a computer program product, which can be directly loaded into a memory and contains software code. After being loaded and executed by a computer, the computer program product can implement the method provided in the above embodiment.

[0103] Those skilled in the art will appreciate that, in one or more of the examples above, the functions described herein may be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any medium that facilitates the transmission of a computer program from one place to another. The storage medium may be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0104] The above is only a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or replacements within the technical scope disclosed in the present application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A method for identifying abnormal users, characterized in that: The method comprises: Obtaining estimated resource usage data and actual resource usage data of users who have opened accounts with third-party operators, wherein the estimated resource usage data includes identifiers of estimated resource usage and the actual resource usage data includes identifiers of actual resource usage; Identifying a user whose identifier of the expected resource usage is inconsistent with the identifier of the actually used resource as a first suspected user; Determining an inactivity duration of the first suspected user, and identifying a first suspected user whose inactivity duration is less than a preset threshold as a second suspected user; The payment record of the second suspected user is queried, and the second suspected user for which the payment record is not found is identified as an abnormal user.

2. The method according to claim 1, characterized in that Determining the inactivity duration of the first suspected user includes: Obtaining the online time record of the first suspected user; The inactivity time of the first suspected user is determined according to the most recent online time recorded in the online time record, where the inactivity time of the first suspected user is the time from the most recent online time of the first suspected user.

3. The method according to claim 1, characterized in that After determining the inactivity duration of the first suspected user, the method further includes: Identify the first suspected user whose inactivity time is greater than or equal to the preset threshold as a silent user; Delete the user data of the silent user.

4. The method according to claim 1, wherein The method further comprises: Obtaining user information of the abnormal user and information of the third-party operator when the abnormal user opened an account; The user information of the abnormal user and the information of the third-party operator are sent to a maintenance system, so that the maintenance system performs correction processing on the abnormal user and the third-party operator.

5. A device for identifying abnormal users, characterized in that: The device comprises: An acquisition module, configured to acquire estimated resource usage data and actual resource usage data of users who have opened accounts with third-party operators, wherein the estimated resource usage data includes identifiers of estimated resource usage, and the actual resource usage data includes identifiers of actual resource usage; an identification module, configured to identify a user whose identifier of the expected resource usage is inconsistent with the identifier of the actually used resource as a first suspected user; a determination module, configured to determine an inactive duration of the first suspected user; The identification module is further configured to identify the first suspected user whose inactivity time is less than a preset threshold as a second suspected user; a query module, configured to query the payment records of the second suspected user; The identification module is further configured to identify a second suspected user for whom no payment record is found as an abnormal user.

6. The device according to claim 5, characterized in that The acquisition module is further configured to acquire the online time record of the first suspected user; The determination module is specifically used to: determine the inactivity time of the first suspected user according to the most recent online time recorded in the online time record, where the inactivity time of the first suspected user is the length of time from the most recent online time of the first suspected user.

7. The device according to claim 5, characterized in that The device further comprises: a deletion module; The identification module is further configured to identify a first suspected user whose inactivity time is greater than or equal to the preset threshold as a silent user; The deleting module is used to delete the user data of the silent user.

8. The device according to claim 5, characterized in that The device further includes: a sending module; The acquisition module is further configured to acquire user information of the abnormal user and information of a third-party operator when the abnormal user opens an account; The sending module is configured to send the user information of the abnormal user and the information of the third-party operator to a maintenance system, so that the maintenance system performs correction processing on the abnormal user and the third-party operator.

9. A device for identifying abnormal users, characterized in that: The device includes a processor, and when the processor executes a computer program, the method for identifying abnormal users according to any one of claims 1 to 4 is implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium includes computer instructions; wherein, when the computer instructions are executed, the abnormal user identification method according to any one of claims 1 to 4 is implemented.

Images