An information recognition method, device, equipment, storage medium and program product

Abstract

The application provides an information identification method and device, equipment, storage medium, and program product. The application embodiment can be applied to various scenes such as cloud technology, artificial intelligence, intelligent transportation, and vehicle-mounted devices, and relates to artificial intelligence technology. The method comprises the following steps: determining attribute information of a corresponding account dimension and attribute information of a content dimension for to-be-identified information; the account dimension refers to an information dimension related to an interactive account of the to-be-identified information, and the content dimension refers to an information dimension related to content of the to-be-identified information; a target dimension is selected from the account dimension and the content dimension, and the attribute information of the target dimension is combined to obtain combined attribute information of the to-be-identified information; the combined attribute information is subjected to feature conversion to obtain to-be-identified features corresponding to the to-be-identified information; and based on the classification and identification of the to-be-identified features, an information identification result corresponding to the to-be-identified information is determined. Through the application, the accuracy of information identification can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to artificial intelligence technology, and in particular to an information identification method and device, equipment, a storage medium, and a program product. BACKGROUND

[0002] Among the information circulating on the network, a considerable part is abnormal content. When abnormal content is received by a user, it will have a negative impact on the user. Therefore, it is necessary to identify the information before the user receives it, so as to identify whether the information is abnormal content in advance. In related technologies, when it is determined whether the information is abnormal content, it is usually based on the attribute information of the information. However, whether considering the influence of the attribute or combining attribute vectors of different dimensions, only the different attributes themselves are considered, and the correlation between different attributes is ignored, resulting in low accuracy of information identification. SUMMARY

[0003] The embodiments of the present application provide an information identification method, device, equipment, and computer readable storage medium and program product, which can improve the accuracy of information identification.

[0004] The technical solutions of the embodiments of the present application are as follows:

[0005] The embodiments of the present application provide an information identification method, which comprises the following steps:

[0006] The attribute information of the account dimension and the attribute information of the content dimension corresponding to the to-be-identified information are determined. The account dimension refers to the information dimension related to the interaction account of the to-be-identified information, and the content dimension refers to the information dimension related to the content of the to-be-identified information.

[0007] The target dimension is filtered out from the account dimension and the content dimension, and the attribute information of the target dimension is combined to obtain the combined attribute information of the to-be-identified information.

[0008] The combined attribute information is subjected to feature conversion to obtain the to-be-identified feature corresponding to the to-be-identified information.

[0009] Based on the classification and identification of the to-be-identified feature, the information identification result corresponding to the to-be-identified information is determined. The information identification result represents whether the to-be-identified information is abnormal information.

[0010] The embodiments of the present application provide an information identification device, which comprises the following steps:

[0011] The attribute determining module is configured to determine attribute information of an account dimension and attribute information of a content dimension corresponding to the to-be-identified information; the account dimension refers to an information dimension related to an interaction account of the to-be-identified information, and the content dimension refers to an information dimension related to content of the to-be-identified information.

[0012] The attribute combining module is configured to filter a target dimension from the account dimension and the content dimension, and combine attribute information of the target dimension to obtain combined attribute information of the to-be-identified information.

[0013] The feature converting module is configured to perform feature conversion on the combined attribute information to obtain a to-be-identified feature corresponding to the to-be-identified information.

[0014] The result identifying module is configured to perform classification identification on the to-be-identified feature to determine an information identification result corresponding to the to-be-identified information, where the information identification result represents whether the to-be-identified information is abnormal information.

[0015] In some embodiments of the present application, the information identification apparatus further includes an information determining module, which is configured to, before determining attribute information of an account dimension and attribute information of a content dimension corresponding to the to-be-identified information, acquire newly-included information; the newly-included information is the latest received information; perform clustering processing on the newly-included information to obtain a clustering category to which the newly-included information belongs; and determine an information sample corresponding to a cluster center of the clustering category as the to-be-identified information.

[0016] In some embodiments of the present application, the attribute determining module is further configured to acquire a historical abnormality number and a historical interception number of the to-be-identified information; the historical abnormality number represents a number of times of abnormal behaviors of an interaction account of an information sample included in the clustering category in a historical time period; the historical interception number represents a number of times of interception of the information sample included in the clustering category in the historical time period; perform counting of the number of times of abnormal behaviors on an interaction account of the newly-included information to obtain a newly-included abnormality number, and perform counting of the number of times of interception on the newly-included information to obtain a newly-included interception number; determine a cumulative result of the newly-included abnormality number and the historical abnormality number as the attribute information of the account dimension corresponding to the to-be-identified information; and determine a cumulative result of the newly-included interception number and the historical interception number as the attribute information of the content dimension corresponding to the to-be-identified information.

[0017] In some embodiments of the present application, the attribute determining module is further configured to acquire content description information corresponding to the newly-stored information and basic account information of an interactive account of the newly-stored information, wherein the content description information at least includes a category label of the newly-stored information and a proportion of web links contained in the newly-stored information, and the basic account information at least includes a white list quantity of the interactive account and a login address of the interactive account; and the basic account information is determined as attribute information of the account dimension corresponding to the to-be-identified information, and the content description information is determined as attribute information of the content dimension.

[0018] In some embodiments of the present application, the attribute combination module is further configured to, when the target dimension includes an account dimension, filter at least two target account attributes from the attribute information of the account dimension, and combine the at least two target account attributes to obtain the combined attribute information of the to-be-identified information; when the target dimension includes a content dimension, filter at least two target content attributes from the attribute information of the content dimension, and combine the at least two target content attributes to obtain the combined attribute information of the to-be-identified information; and when the target dimension includes the content dimension and the target dimension, filter a to-be-combined account attribute from the attribute information of the account dimension, filter a matching content attribute from the attribute information of the content dimension with respect to the to-be-combined account attribute, and determine the combined attribute information corresponding to the to-be-identified information by using the to-be-combined account attribute and the matching content attribute.

[0019] In some embodiments of the present application, the combined attribute information includes a plurality of sub-attribute information, and the feature conversion module is further configured to perform feature conversion on each sub-attribute information to obtain a sub-feature corresponding to each sub-attribute information, and splice the sub-feature corresponding to each sub-attribute information to obtain the to-be-identified feature corresponding to the to-be-identified information.

[0020] In some embodiments of the present application, the information identification apparatus further includes an information processing module, which is configured to, after determining an information identification result corresponding to the to-be-identified information based on classified identification of the to-be-identified feature, intercept the to-be-identified information and add the to-be-identified information to an abnormal list when the information identification result indicates that the to-be-identified information is abnormal information, and forward the to-be-identified information and add the to-be-identified information to a normal list when the information identification result indicates that the to-be-identified information is normal information.

[0021] In some embodiments of the present application, the result identification module is further configured to: utilize the feature identification model to perform classification identification on the to-be-identified feature to obtain an abnormal information prediction probability; and determine the information identification result corresponding to the to-be-identified information according to the abnormal information prediction probability and a probability threshold.

[0022] In some embodiments of the present application, the feature identification model comprises a plurality of decision tree models; and the result identification module is further configured to: utilize the plurality of decision tree models to respectively perform classification identification on the to-be-identified feature to obtain a plurality of sub-prediction probabilities corresponding to the plurality of decision tree models; and perform weighted fusion on the plurality of sub-prediction probabilities to obtain the abnormal information prediction probability corresponding to the to-be-identified feature.

[0023] In some embodiments of the present application, the information identification apparatus further comprises a model training module; and the model training module is configured to: before determining the attribute information of the account dimension and the attribute information of the content dimension corresponding to the to-be-identified information, obtain an initial identification model, a plurality of training sample information, and label data of each of the plurality of training sample information; determine sample attributes of the account dimension and sample attributes of the content dimension corresponding to the plurality of training sample information respectively, and filter out the target dimension from the account dimension and the content dimension, and obtain training combined attributes of the plurality of training sample information by utilizing sample attributes of the target dimension; construct training identification features corresponding to the plurality of training sample information respectively according to the training combined attributes; utilize the initial identification model to perform classification identification on the training identification features to obtain training prediction probabilities of each of the plurality of training sample information; and continuously adjust parameters of the initial identification model according to a loss value between the label data and the training prediction probabilities until a training end condition is reached to obtain the feature identification model.

[0024] In some embodiments of the present application, the model training module is further configured to: after obtaining the initial identification model, the plurality of training sample information, and the label data of each of the plurality of training sample information, before continuously adjusting the parameters of the initial identification model according to the loss value between the label data and the training prediction probabilities until the training end condition is reached to obtain the feature identification model, divide the plurality of training sample information according to content types of each of the plurality of training sample information to obtain a plurality of type sets; determine a training weight for each of the plurality of training sample information according to the label data of each of the plurality of training sample information and a type set to which a content type of each of the plurality of training sample information belongs; optimize the loss value between the label data and the training prediction probabilities according to the training weight, and continuously adjust the parameters of the initial identification model according to the optimized loss value until the training end condition is reached to obtain the feature identification model.

[0025] The embodiment of the present application provides an information identification device, comprising:

[0026] a memory for storing executable instructions;

[0027] a processor for executing the executable instructions stored in the memory, so as to realize the information identification method provided by the embodiment of the present application.

[0028] The embodiment of the present application provides a computer readable storage medium, which stores executable instructions, and when the processor executes the executable instructions, realizes the information identification method provided by the embodiment of the present application.

[0029] The embodiment of the present application provides a computer program product, comprising a computer program or instructions, and when the processor executes the computer program or instructions, realizes the information identification method provided by the embodiment of the present application.

[0030] The embodiment of the present application has the following beneficial effects: the information identification device will acquire attribute information respectively for the account dimension and the content dimension, then filter out the target dimension from the account dimension and the content dimension, so as to perform combination processing on the attribute information for the target dimension, thereby reconstructing the combined attribute feature containing the correlation between different attributes through combination processing, so as to accurately describe the abnormal situation to be identified through the combined attribute information, then map the combined attribute information to the feature space, obtain more accurate features to be identified, and finally perform more accurate classification identification based on the more accurate features to be identified, thereby improving the accuracy of information identification. BRIEF DESCRIPTION OF DRAWINGS

[0031] Figure 1 is an architecture schematic diagram of an information identification system provided by the embodiment of the present application;

[0032] Figure 2 is a structure schematic diagram of a server in Figure 1 provided by the embodiment of the present application;

[0033] Figure 3 is a flow schematic diagram of an information identification method provided by the embodiment of the present application;

[0034] Figure 4 is another flow schematic diagram of an information identification method provided by the embodiment of the present application;

[0035] Figure 5 is still another flow schematic diagram of an information identification method provided by the embodiment of the present application;

[0036] Figure 6 is still another flow schematic diagram of an information identification method provided by the embodiment of the present application;

[0037] Figure 7 is a process schematic diagram provided by an embodiment of the application for feature conversion on combined attribute features;

[0038] Figure 8 is a process schematic diagram provided by an embodiment of the application for mail identification;

[0039] Figure 9 is a process schematic diagram provided by an embodiment of the application for training of an XGBoost model;

[0040] Figure 10 is a process schematic diagram provided by an embodiment of the application for mail identification using an XGBoost model. DETAILED DESCRIPTION

[0041] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings, and the described embodiments should not be regarded as limiting the present application, and all other embodiments obtained by those of ordinary skill in the art without making creative efforts fall within the scope of protection of the present application.

[0042] In the following description, “some embodiments” are described, which describe a subset of all possible embodiments, but it can be understood that “some embodiments” can be the same subset or different subsets of all possible embodiments, and can be combined with each other without conflict.

[0043] In the following description, the term “first\second” is only to distinguish similar objects, and does not represent a specific order of the objects, and it can be understood that “first\second” can be interchanged in a specific order or sequence as allowed, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0044] The related data collection processing in the embodiments of the present application should strictly comply with the requirements of relevant laws and regulations, obtain the informed consent or separate consent of the personal information subject, and within the scope of authorization of laws and regulations and the personal information subject, carry out subsequent data use and processing.

[0045] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0046] Before the embodiments of the present application are further described in detail, the terms and phrases involved in the embodiments of the present application are explained, and the terms and phrases involved in the embodiments of the present application are applicable to the following explanations.

[0047] 1) Artificial Intelligence (AI) is the theory, method, technology and application system that use digital computers or digital computer controlled machines to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology of computer science, which tries to understand the essence of intelligence and produce a new intelligent machine that can react in a similar way to human intelligence. Artificial intelligence is the design principle and implementation method of various intelligent machines. The machine has the functions of perception, reasoning and decision-making.

[0048] 2) Machine Learning (ML) is a multi-disciplinary subject involving probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory, etc. It is a special study of how computers simulate or implement human learning behavior to acquire new knowledge or skills, and reorganize existing knowledge structure to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental approach to making computers intelligent. Its applications are widespread in various fields of artificial intelligence. Machine learning and deep learning include artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and rule-based learning.

[0049] 3) Information recognition refers to the classification and recognition processing of received information with the help of artificial intelligence technology to determine whether the information is spam or abnormal content, so as to determine whether to intercept the information for subsequent processing. Information can be email, instant messaging messages, etc.

[0050] 4) Decision Tree is a tree structure, where each internal node identifies a judgment on an attribute, each branch represents an output of a judgment result, and each leaf node represents a classification result. When the decision tree is used for classification, it is called a classification tree; when the decision tree is used for regression, it is called a regression tree.

[0051] 5) eXtreme Gradient Boosting (XGBoost) algorithm, also known as gradient boosting decision tree algorithm, is used to solve supervised learning problems. The decision model of XGBoost algorithm is composed of multiple decision trees.

[0052] Artificial intelligence technology is a comprehensive discipline, involving a wide range of fields, both hardware and software level technology. Artificial intelligence basic technology generally includes, such as sensors, special artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction system, mechatronics and other technologies. Artificial intelligence software technology mainly includes computer vision technology, speech processing technology, natural language processing technology, and machine learning / deep learning, automatic driving, intelligent transportation and several other major directions.

[0053] Among the information circulating on the network, a considerable part is abnormal content. When the abnormal content is received by the user, it will have a negative impact on the user. Based on this, it is necessary to identify the information in advance by means of artificial intelligence technology before the user receives the information, to identify whether the information is abnormal content in advance for the user.

[0054] In related technologies, when determining whether the information is abnormal content, it is usually based on the attribute information of the information. For example, first, from the topic of obtaining information, the user's hobbies and other attributes, reference the influence of these attributes, classify the information to identify whether the information is abnormal content, or convert two or more different dimension attributes into feature vectors respectively, and splice the converted feature vectors, and finally identify whether the information is abnormal content based on the spliced feature vectors (it is worth noting that splicing only indicates that attributes are used in the identification process, and cannot represent that attributes are analyzed and processed in a deeper level).

[0055] As can be seen, in related technologies, whether considering the influence of attributes or combining different dimension attribute vectors, only the conditions of different attributes themselves are considered, and the relevance between different attributes is ignored, resulting in low accuracy of information identification.

[0056] The embodiments of the present application provide an information identification method, device, equipment and computer readable storage medium, program product, which can improve the accuracy of information identification. The following describes an exemplary application of the information identification device provided by the embodiments of the present application. The information identification device provided by the embodiments of the present application can be implemented as a notebook computer, a tablet computer, a desktop computer, a set-top box, a mobile device (for example, a mobile phone, a portable music player, a personal digital assistant, a dedicated message device, a portable game device) and various types of user terminals. It can also be implemented as a server. The following will illustrate an exemplary application when the information identification device is implemented as a server.

[0057] Referring to Figure 1 , Figure 1Fig. 1 is a schematic diagram of an information recognition system according to an embodiment of the present application. To support an information recognition application, in the information recognition system 100, the terminal 400 (exemplarily shown as the terminal 400-1 and the terminal 400-2) connects to the server 200 through the network 300, which can be a wide area network or a local area network, or a combination of the two. In the information recognition system 100, a database 500 is also provided to provide data support to the server 200. The database 500 can be configured in the server 200, or independent of the server 200. Figure 1 Fig. 2 shows an example in which the database 500 is independent of the server 200.

[0058] The terminal 400-1 is configured to generate a response to an operation on the information creation interface displayed on the graphical interface 410-1, create the to-be-recognized information, and send the to-be-recognized information to the server 200 through the network 300.

[0059] The server 200 is configured to determine attribute information of a corresponding account dimension and attribute information of a content dimension for the to-be-recognized information; the account dimension refers to an information dimension related to an interactive account corresponding to the to-be-recognized information, and the content dimension refers to an information dimension related to the content of the to-be-recognized information; a target dimension is filtered from the account dimension and the content dimension, and the attribute information of the target dimension is combined to obtain combined attribute information of the to-be-recognized information; the combined attribute information is subjected to feature conversion to obtain a to-be-recognized feature corresponding to the to-be-recognized information; based on a classification prediction on the to-be-recognized feature, an information recognition result corresponding to the to-be-recognized information is determined, and the information recognition result represents whether the to-be-recognized information is abnormal information. Thus, the server 200 realizes information recognition.

[0060] The server 200 is further configured to forward the to-be-recognized information to the terminal 400-2 when the to-be-recognized information is not abnormal information. The terminal 400-2 is configured to display the to-be-recognized information in the graphical interface 410-2, so that a user of the terminal 400-2 can read or perform other processing.

[0061] In some embodiments, the server 200 can be a standalone physical server, a server cluster or a distributed system composed of multiple physical servers, a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDNs, and basic cloud computing services such as big data and artificial intelligence platforms. The terminal 400 can be a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, a smart home appliance, a vehicle-mounted terminal, etc., but is not limited thereto. The terminal and the server can be connected directly or indirectly through wired or wireless communication, which is not limited in the embodiments of the present application.

[0062] Referring toFigure 2 , Figure 2 This is provided by the embodiments of this application. Figure 1 A schematic diagram of the structure of the server (information identification device) in the diagram. Figure 2 The server 200 shown includes at least one processor 210, memory 250, at least one network interface 220, and a user interface 230. The various components in server 200 are coupled together via a bus system 240. It is understood that the bus system 240 is used to implement communication between these components. In addition to a data bus, the bus system 240 also includes a power bus, a control bus, and a status signal bus. However, for clarity, ... Figure 2 The general labeled all buses as Bus System 240.

[0063] Processor 210 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0064] User interface 230 includes one or more output devices 231 that enable the presentation of media content, including one or more speakers and / or one or more visual displays. User interface 230 also includes one or more input devices 232, including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls.

[0065] The memory 250 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state storage, hard disk drives, optical disk drives, etc. The memory 250 may optionally include one or more storage devices physically located away from the processor 210.

[0066] The memory 250 may include volatile memory or non-volatile memory, or both. The non-volatile memory may be read-only memory (ROM), and the volatile memory may be random access memory (RAM). The memory 250 described in this application embodiment is intended to include any suitable type of memory.

[0067] In some embodiments, memory 250 is capable of storing data to support various operations, examples of which include programs, modules, and data structures or subsets or supersets thereof, as illustrated below.

[0068] The operating system 251 includes system programs for processing various basic system services and performing hardware-related tasks, such as a framework layer, a core library layer, a driver layer, and the like, for implementing various basic services and processing hardware-based tasks;

[0069] The network communication module 252 is configured to reach other computing devices via one or more (wired or wireless) network interfaces 220, exemplary network interfaces 220 including Bluetooth, Wireless Fidelity (Wi-Fi), and Universal Serial Bus (USB), and the like;

[0070] The presentation module 253 is configured to enable presentation of information via one or more output devices 231 (e.g., a display screen, a speaker, and the like) associated with the user interface 230 (e.g., a user interface for operating peripheral devices and displaying content and information);

[0071] The input processing module 254 is configured to detect and interpret one or more user inputs or interactions from one or more input devices 232.

[0072] In some embodiments, the information recognition apparatus provided by the embodiments of the present application can be implemented in a software manner, Figure 2 An information recognition apparatus 255 stored in the memory 250 is shown, which can be in the form of software such as programs and plug-ins, including the following software modules: an attribute determination module 2551, an attribute combination module 2552, a feature conversion module 2553, a result recognition module 2554, an information determination module 2555, an information processing module 2556, and a model training module 2557. These modules are logical, and thus can be combined or further split according to the implemented functions. The functions of the various modules will be described below.

[0073] In some embodiments, a terminal or server can implement the information recognition method provided by the embodiments of the present application by running a computer program. For example, the computer program can be a native program or a software module in the operating system; can be a native application program (APP), i.e., a program that needs to be installed in the operating system to run, such as a mail filtering APP; can also be a small program, i.e., a program that only needs to be downloaded into a browser environment to run; and can also be a small program that can be embedded into any APP. In summary, the above computer program can be any form of application program, module or plug-in.

[0074] The embodiments of the present application can be applied to various scenes such as cloud technology, artificial intelligence, intelligent transportation, vehicle-mounted, etc. In the following, the exemplary application and implementation of the information recognition device provided by the embodiments of the present application will be described.

[0075] Referring to Figure 3 , Figure 3 is a flowchart of the information recognition method provided by the embodiments of the present application, which will be described in combination with the steps shown in Figure 3 .

[0076] S101, determining attribute information of a corresponding account dimension and attribute information of a content dimension for to-be-recognized information.

[0077] The embodiments of the present application are implemented in the scene of recognizing information to determine that the information recognition is abnormal information, for example, recognizing whether an email is an abnormal email, recognizing whether a short message is an advertising short message, etc. After the information recognition starts, the information recognition device acquires attribute information for information waiting for information recognition, that is, to-be-recognized information. In the embodiments of the present application, the information recognition device acquires attribute information from two dimensions of an account dimension and a content dimension, obtains attribute information of the to-be-recognized information in the account dimension, and attribute information in the content dimension.

[0078] It can be understood that the to-be-recognized information can be an email, can be a short message, and can also be a message in an instant messaging application, which is not limited in the embodiments of the present application. The to-be-recognized information can be information of a graphic-text type, or can be information of an audio or video type, which is not limited in the embodiments of the present application.

[0079] It should be noted that the account dimension refers to an information dimension related to an interactive account of the to-be-recognized information. The interactive account can refer to an account receiving information, for example, a receiving account of an email, or can refer to an account generating information, for example, a creating account of an email, or can refer to an account forwarding information, that is, a forwarding account of an email, etc.

[0080] The attribute information of the account dimension can include an account level, a total number of contacts of the account, a number of white lists of the account, a number of black lists, a domain name, and other information weakly related to a use state of a user, or can include a number of reports, a number of abnormal logins, an abnormal login address, a login time, a like history, and other information strongly related to the use state of the user, which is not limited in the embodiments of the present application.

[0081] It should be further noted that the content dimension refers to an information dimension related to content of the to-be-recognized information. The attribute information of the content dimension can include a content category of the to-be-recognized information, a proportion of a web link occupying the to-be-recognized information, and a proportion of the to-be-recognized information being intercepted, etc., which is not limited in the embodiments of the present application.

[0082] In some embodiments, the information to be identified can be newly-included warehouse information, i.e., information newly received by the information identification device. In other embodiments, the information to be identified can also be information obtained after clustering processing or merging processing on the newly-included warehouse information, which is not specifically limited in the embodiments of the present application.

[0083] S102, filtering out a target dimension from the account dimension and the content dimension, and combining attribute information of the target dimension to obtain combined attribute information of the information to be identified.

[0084] After obtaining the attribute information of the account dimension and the attribute information of the content dimension, the information identification device does not directly start feature conversion on the attribute information of the account dimension and the attribute information of the content dimension, but determines a target dimension for attribute combination from the account dimension and the content dimension, and combines attribute information of the target dimension. The attribute obtained after the combination processing is the combined attribute information.

[0085] It should be noted that a single attribute information can not accurately describe the abnormal situation of the information to be identified. Therefore, in the embodiments of the present application, the information identification needs to jointly and process different attributes of the target dimension in a deeper level, to re-create new combined attribute information capable of containing the correlation between different attributes, so as to accurately describe the abnormal situation of the information to be identified through the combined attribute information.

[0086] For example, the white list quantity is attribute information of the account dimension, and the information success sending quantity is attribute information of the content dimension. Assuming that when identifying the information, the white list quantity is used to describe the abnormal situation of the information, two situations will occur. One is that A sender sends mail X to group B, wherein the white list quantity is 8 and the success sending quantity is 10. The other is that C sender sends mail Y to group D, wherein the white list quantity is 20 and the success sending quantity is 1000. At this time, when identifying the information according to the white list quantity, it is judged that mail Y is a normal mail and mail X is an abnormal mail. When judging according to the total information sending quantity (the more the number of times of sending, the more likely it is a normal mail), it is also possible to determine that mail Y is a normal mail and mail X is an abnormal mail. However, if the attribute information of the account dimension and the attribute information of the content dimension, i.e., the white list quantity and the information success sending quantity, are combined according to the embodiments of the present application, it is easy to find that the white list rate (combined attribute information) of mail X is higher and it is more likely to be a normal mail, and the white list rate of mail Y is low and it is more likely to be an abnormal mail. It can be seen that the combined attribute information can more accurately represent the abnormal situation of the information to be identified.

[0087] It can be understood that, in some embodiments, the target dimension can include any one of the account dimension and the content dimension; in other embodiments, the target dimension can include both the account dimension and the content dimension, which is not limited herein.

[0088] S103, performing feature conversion on the combined attribute information to obtain a to-be-identified feature corresponding to the to-be-identified information.

[0089] After obtaining the combined attribute information, the information identification device can perform feature conversion on the combined attribute information by feature encoding or by performing feature conversion on the sub-attributes included in the combined attribute information, to obtain a to-be-identified feature.

[0090] It can be understood that, when the information identification device performs feature conversion on the combined attribute information by feature encoding, the combined attribute information can be input into a feature encoding model for feature encoding, and the encoded feature output by the feature encoding model can be determined as the to-be-identified feature.

[0091] When the information identification device performs feature conversion on the combined attribute information by performing feature conversion on the sub-attributes included in the combined attribute information, the sub-features obtained by performing feature conversion on the sub-attributes can be fused, and the fusion result can be determined as the to-be-identified feature.

[0092] S104, determining an information identification result corresponding to the to-be-identified information based on classified identification of the to-be-identified feature.

[0093] In the embodiments of the present application, the information identification result represents whether the to-be-identified information is abnormal information. The abnormal information can be an abnormal email, a promotional short message of a commodity, a negative impact webpage link, and the like.

[0094] In some embodiments, the information identification device can perform forward reasoning calculation on the to-be-identified feature obtained by feature conversion to obtain a prediction probability value, and then compare the prediction probability value with a probability threshold corresponding to the abnormal information to determine whether the to-be-identified information is abnormal information, thereby obtaining the information identification result.

[0095] In other embodiments, the information identification device can cluster the to-be-identified feature with a feature corresponding to reference information known to be abnormal information or normal information, to determine whether the to-be-identified information and the reference information belong to the same category. When the reference information is abnormal information, the information identification device confirms that the to-be-identified information is abnormal information, and vice versa, when the reference information is normal information, the information identification device confirms that the to-be-identified information is normal information, thereby obtaining the information identification result.

[0096] It can be understood that, compared with the related art, only based on the different attributes of the information identification process itself, in the embodiment of the application, the information identification device will respectively acquire attribute information for the account dimension and the content dimension, and then filter out the target dimension from the account dimension and the content dimension, to perform attribute information combination processing for the target dimension, so as to reconstruct the combined attribute features containing the correlation between different attributes through combination processing, to accurately describe the abnormal situation to be identified through combined attribute information, and then map the combined attribute information to the feature space to obtain more accurate to-be-identified features, and finally perform more accurate classification identification based on the more accurate to-be-identified features, thereby improving the accuracy of information identification.

[0097] Based on Figure 3 , see Figure 4 , Figure 4 is another flowchart of the information identification method provided by the embodiment of the application. In some embodiments of the application, before determining the attribute information of the corresponding account dimension and the attribute information of the content dimension for the to-be-identified information, that is, before S101, the method can further include: S105-S107, as follows:

[0098] S105, acquiring newly-included information.

[0099] It should be noted that the newly-included information is the latest received information, such as a new email, a new short message, and the like.

[0100] S106, performing clustering processing on the newly-included information to obtain a clustering category to which the newly-included information belongs.

[0101] In some embodiments, the number of newly-included information can be multiple, and the information identification device can perform clustering on multiple newly-included information to find the corresponding clustering category for each newly-included information through clustering operation.

[0102] In another embodiment, the number of newly-included information is one, and the information identification device can cluster the newly-included information with the historical included information, so as to determine which historical included information is similar to the newly-included information, that is, to determine the clustering category corresponding to the newly-included information.

[0103] S107, determining the information sample corresponding to the cluster center of the clustering category as the to-be-identified information.

[0104] In the embodiments of the present application, the information identification device does not directly determine the newly-included warehouse information as the to-be-identified information, but acquires information samples corresponding to the class cluster center of the clustering category, and determines the acquired information samples as the to-be-identified information. Since the information samples corresponding to the class cluster center are more representative, the information samples corresponding to the class cluster center can be used as the to-be-identified information, which can facilitate better information identification.

[0105] In the embodiments of the present application, the information identification device determines the clustering category to which the newly-included warehouse information belongs by clustering the newly-included warehouse information, and determines the information samples corresponding to the class cluster center of the clustering category as the to-be-identified information, which can not only improve the representativeness of the to-be-identified information, but also identify the information with the clustering category as the granularity, and accelerate the efficiency of information identification.

[0106] Based on Figure 4 , see Figure 5 , Figure 5 is another flowchart of the information identification method provided by the embodiments of the present application. In some embodiments of the present application, the attribute information of the corresponding account dimension and the attribute information of the content dimension are determined for the to-be-identified information, that is, the specific implementation process of S101 can include S1011-S1014, as follows:

[0107] S1011, acquire the historical abnormal number of times and the historical interception number of times of the to-be-identified information.

[0108] In the embodiments of the present application, the historical abnormal number of times represents the number of times of abnormal behaviors of the interaction account of the information samples included in the clustering category in the historical time; and the historical interception number of times represents the number of times of interception of the information samples included in the clustering category in the historical time period.

[0109] It can be understood that the abnormal behaviors at least include behaviors such as logging in from a different place, using a domain name, being reported, etc. The historical time period can be set according to actual conditions, for example, set to the past 1 month, or set to the past 1 year, etc., which is not limited in the embodiments of the present application.

[0110] S1012, count the number of times of abnormal behaviors of the interaction account of the newly-included warehouse information to obtain a newly-included abnormal number of times, and count the number of times of interception of the newly-included warehouse information to obtain a newly-included interception number of times.

[0111] The information identification device respectively counts the number of times of abnormal behaviors and the number of times of interception of the newly-included warehouse information, determines the number of times of abnormal behaviors as the newly-included abnormal number of times, and determines the number of times of interception as the newly-included interception number of times.

[0112] It should be noted that the abnormal behavior for which the newly added information in the warehouse is counted can be the same as the abnormal behavior corresponding to the historical abnormal number of times, or can be different (at this time, statistics can be performed separately for abnormal behaviors different from the historical abnormal number of times).

[0113] It can be understood that whether the historical abnormal number of times and the historical interception number of times are obtained first or the newly added abnormal number of times and the newly added interception number of times are counted first will not affect the final account dimension attribute information and content dimension attribute information, and therefore, in some embodiments of the present application, the information recognition device can also first perform S1012 and then perform S1011, or simultaneously perform S1011 and S1012, which is not limited in the present application.

[0114] S1013, determining the cumulative result of the newly added abnormal number of times and the historical abnormal number of times as the attribute information of the account dimension corresponding to the to-be-recognized information.

[0115] The information recognition device accumulates the newly added abnormal number of times and the historical abnormal number of times, and the obtained cumulative result is the attribute information of the account dimension of the to-be-recognized information.

[0116] S1014, determining the attribute information of the content dimension corresponding to the to-be-recognized information according to the cumulative result of the newly added interception number of times and the historical interception number of times.

[0117] The information recognition device accumulates the newly added interception number of times and the historical interception number of times, and then directly determines the obtained cumulative result as the attribute information of the content dimension, or determines the ratio of the cumulative result to the total sending number of times of the to-be-recognized information as the attribute information of the content dimension. At this time, the total sending number of times of the to-be-recognized information can be obtained by counting the occurrence number of information samples included in the clustering category corresponding to the to-be-recognized information.

[0118] In the present application, the information recognition device can determine the attribute information of the account dimension through the occurrence of the abnormal behavior, and determine the attribute information of the content dimension through the interception of the information, so as to facilitate the generation of the combined attribute information by using any one of the abnormal behavior and the interception condition.

[0119] In some embodiments of the present application, the specific implementation process of S101 for determining the attribute information of the account dimension and the attribute information of the content dimension corresponding to the to-be-recognized information can also include S1015-S1016, as follows:

[0120] S1015, obtaining the content description information corresponding to the newly added information in the warehouse, and the basic account information of the interactive account of the newly added information in the warehouse.

[0121] It can be understood that the content description information refers to information summarizing the content contained in the newly added information, and the content description information at least includes a category label of the newly added information and a proportion of a web link contained in the newly added information.

[0122] The basic account information refers to information describing the basic situation of the interactive account corresponding to the newly added information, and the basic account information at least includes the number of registration forms of the interactive account and the login address of the interactive account.

[0123] In S1016, the basic account information is determined as attribute information of the account dimension corresponding to the to-be-identified information, and the content description information is determined as attribute information of the content dimension.

[0124] It can be understood that the to-be-identified information can include historical account information (i.e., basic account information determined in a historical time period) and historical description information (i.e., content description information determined in the historical time period), at this time, the information identification device can directly use the basic account information to cover the historical account information to obtain attribute information of the account dimension, and use the content description information to cover the historical description information to obtain attribute information of the content dimension.

[0125] Of course, the to-be-identified information can also determine the basic account information and the historical account information as attribute information of the account dimension, and determine the historical description information and the content description information as attribute information of the content dimension, which is not limited in the embodiment of the application.

[0126] In the embodiment of the application, the information identification device can also determine attribute information of the account dimension based on the basic account information, and determine attribute information of the content dimension based on the content description information, so as to facilitate the generation of combined attribute information by using the basic account information and the content description information subsequently.

[0127] In some embodiments of the application, the attribute information of the target dimension is combined to obtain the combined attribute information of the to-be-identified information, that is, the specific implementation process of S102 can include any one of S1021-S1023, as follows:

[0128] S1021, when the target dimension includes the account dimension, at least two target account attributes are filtered from the attribute information of the account dimension, and the at least two target account attributes are combined to obtain the combined attribute information of the to-be-identified information.

[0129] It can be understood that the combined processing can be difference processing, or ratio processing, or other processing capable of associating two different attributes, which is not limited in the embodiment of the application.

[0130] For example, the information identification device screens out the number of information sending times of the information sending account and the number of reported times of the information sending account from the attribute information of the account dimension, and obtains the combined attribute information, i.e., the reporting rate of sending, by comparing the number of reported times with the number of information sending times.

[0131] S1022, when the target dimension includes the content dimension, screening out at least two target content attributes from the attribute information of the content dimension, and performing combined processing on the at least two target content attributes to obtain the combined attribute information of the to-be-identified information.

[0132] For example, the information identification device screens out the number of webpage links and the number of interception times from the attribute information of the content dimension, and directly compares the number of webpage links with the number of interception times to obtain the combined attribute information, i.e., the webpage link interception ratio.

[0133] S1023, when the target dimension includes the content dimension and the target dimension, screening out a to-be-combined account attribute from the attribute information of the account dimension, screening out a matching content attribute from the attribute information of the content dimension for the to-be-combined account attribute, and determining the combined attribute information corresponding to the to-be-identified information by using the to-be-combined account attribute and the matching content attribute.

[0134] It can be understood that the information identification device can determine the attribute of the content dimension with the same measurement unit as the to-be-combined account attribute as the matching content attribute, or determine the matching content attribute for the to-be-combined account attribute according to the set attribute combination rule, which is not limited in the embodiments of the application.

[0135] In the embodiments of the application, the information identification device can select the target dimension from the content dimension and the account dimension, and can perform combined processing on the attribute information in the selected target dimension, so that the combined attribute information is more diversified.

[0136] Based on Figure 3 , see Figure 6 , Figure 6 is another flowchart of the information identification method provided by the embodiments of the application. In some embodiments of the application, the combined attribute information includes a plurality of sub-attribute information, and at this time, the feature conversion of the combined attribute information to obtain the to-be-identified feature corresponding to the to-be-identified information, i.e., the specific implementation process of S103, can include S1031-S1032, as follows:

[0137] S1031, performing feature conversion on each sub-attribute information to obtain a sub-feature corresponding to each sub-attribute information.

[0138] When the combined attribute information includes multiple sub-attribute information, the information identification device can convert each sub-attribute information into a feature value or a feature vector, and the converted result is a sub-feature corresponding to each sub-attribute information.

[0139] S1032, the sub-feature corresponding to each sub-attribute information is spliced to obtain a to-be-identified feature corresponding to the to-be-identified information.

[0140] Then, the information identification device splices the sub-feature corresponding to each sub-attribute information in a random order or the order of the sub-attribute information, and takes the obtained spliced feature as the to-be-identified feature.

[0141] Exemplarily, Figure 7 is a process diagram for feature conversion of combined attribute features provided by the embodiment of the application. The information identification device converts the sub-attribute information 7-11 to the sub-attribute information 7-14 in the combined attribute information 7-1 into feature values, i.e., 0.4, 2, 1.5, and 0.65, respectively, and then splices the four feature values to obtain (0.4, 2, 1.5, 0.65), which is a to-be-identified feature.

[0142] In the embodiment of the application, the information identification device can splice the sub-features obtained by converting different sub-attribute information to obtain a to-be-identified feature, so as to facilitate subsequent classification prediction based on the to-be-identified feature to obtain an information identification result.

[0143] In some embodiments of the application, after determining the information identification result corresponding to the to-be-identified information based on the classification identification of the to-be-identified feature, i.e., after S104, the method can further include S108 or S109, as follows:

[0144] S108, when the information identification result indicates that the to-be-identified information is abnormal information, the to-be-identified information is intercepted, and the to-be-identified information is added to an abnormal list.

[0145] The information identification device reads the information identification result, and when it is clear from the information identification result that the to-be-identified information is abnormal information, the information identification device intercepts the to-be-identified information, i.e., does not forward the to-be-identified information to an information receiving account, so as to avoid negative effects of abnormal information on a user of the information receiving account. At the same time, the information identification device adds the to-be-identified information to an abnormal list, for example, a blacklist, to further block the spread of abnormal information on the network.

[0146] S109, when the information identification result indicates that the to-be-identified information is normal information, the to-be-identified information is forwarded, and the to-be-identified information is added to a normal list.

[0147] When the information recognition device determines that the to-be-identified information is normal information according to the information recognition result, the information recognition device forwards the to-be-identified information to a corresponding information receiving account, so that a user of the information receiving account can normally obtain the to-be-identified information. Meanwhile, the information recognition device also adds the to-be-identified information to a normal list, for example, a white list, to facilitate subsequent guarantee of normal circulation of the to-be-identified information on the network.

[0148] In the embodiments of the present application, the information recognition device intercepts the to-be-identified information when the to-be-identified information is abnormal information, to block the propagation of the to-be-identified information, and when the to-be-identified information is normal information, the information recognition device normally processes the to-be-identified information, to guarantee that the information receiving account can normally receive the normal information.

[0149] In some embodiments of the present application, based on the classified identification of the to-be-identified feature, the information recognition result corresponding to the to-be-identified information is determined, that is, the specific implementation process of S104 can include: S1041-S1042, as follows:

[0150] S1041, using the feature recognition model, performing classified identification of abnormal information on the to-be-identified feature to obtain an abnormal prediction probability.

[0151] S1042, determining the information recognition result corresponding to the to-be-identified information according to the abnormal prediction probability and a probability threshold.

[0152] The information recognition device obtains the trained feature recognition model, and then inputs the to-be-identified feature into the feature recognition model, to perform classified inference on the to-be-identified feature through the feature recognition model. The probability output by the feature recognition model is the abnormal prediction probability corresponding to the to-be-identified feature. Then, the information recognition device compares the abnormal prediction probability and the probability threshold. When the abnormal prediction probability is greater than or equal to the probability threshold, it is determined that the information recognition result represents that the to-be-identified information is abnormal information. When the abnormal prediction probability is less than the probability threshold, it is determined that the information recognition result represents that the to-be-identified information is normal information. In this way, the determination process of the information recognition result is completed.

[0153] It should be noted that the feature recognition model can be a deep learning model, for example, a convolutional neural network model, a recurrent neural network model, etc. The feature recognition model can also be a shallow machine learning model, for example, a support vector machine, an extreme gradient boosting model, etc.

[0154] It can be understood that the probability threshold can be set by a person according to actual conditions, for example, set to 0.5 or 0.7, etc. The probability threshold can also be obtained by averaging the prediction probabilities corresponding to the abnormal information in a historical time period. The present embodiments do not limit this.

[0155] In the embodiments of the present application, the information recognition device can classify and recognize the to-be-recognized feature by means of the trained feature recognition model, and determine the information recognition result according to the relationship between the abnormal prediction probability output by the feature recognition model and the probability threshold.

[0156] In some embodiments of the present application, the feature recognition model includes a plurality of decision tree models, and when the feature recognition model is used to classify and recognize the to-be-recognized feature, the specific implementation process of S1041 can include S1041a-S1041b as follows:

[0157] S1041a, using the plurality of decision tree models to respectively classify and recognize the to-be-recognized feature, and obtaining a plurality of sub-prediction probabilities corresponding to the plurality of decision tree models.

[0158] When the feature recognition model includes a plurality of decision tree models, the information recognition device will input the to-be-recognized feature into the plurality of decision tree models. Each decision tree model will generate a sub-prediction probability for the to-be-recognized feature, so that the information recognition device will determine a plurality of sub-prediction probabilities for the to-be-recognized feature, and the plurality of decision tree models and the plurality of sub-prediction probabilities correspond one-to-one.

[0159] S1041b, weighting and fusing the plurality of sub-prediction probabilities to obtain the abnormal prediction probability corresponding to the to-be-recognized feature.

[0160] The information recognition device weights and fuses the plurality of sub-prediction probabilities, and the weighting result obtained is the abnormal prediction probability corresponding to the to-be-recognized information. It can be understood that the weighting weights of the plurality of sub-prediction probabilities are the hyperparameters of the decision tree model and have been determined.

[0161] In the embodiments of the present application, the information recognition device can also use the plurality of decision tree models to simultaneously recognize the to-be-recognized feature, and weight the sub-prediction probability output by each decision tree model, so that the abnormal prediction probability can be more accurate.

[0162] In some embodiments of the present application, before determining the attribute information of the account dimension and the attribute information of the content dimension corresponding to the to-be-recognized information, that is, before S101, the method can further include S201-S205 as follows:

[0163] S201, obtaining an initial recognition model, a plurality of training sample information, and a plurality of label data of the plurality of training sample information.

[0164] It can be understood that the initial recognition model can be a model that has not been trained, and in this case, the parameters in the initial recognition model are obtained by random initialization of the parameters. The initial recognition model can also be a pre-trained model, which is not limited by the embodiments of the present application.

[0165] The training sample information can be artificially generated sample information or sample information collected on the network, and the embodiments of the present application are not limited herein. The training sample information is divided into multiple categories, such as positive samples, negative samples, and neutral samples, by label data, and the embodiments of the present application are not limited herein.

[0166] S202, for multiple training sample information, respectively determine the sample attribute of the corresponding account dimension and the sample attribute of the content dimension, and filter out the target dimension from the account dimension and the content dimension, and obtain the training combination attribute of the multiple training sample information by using the sample attribute of the target dimension.

[0167] It can be understood that the processing process of this step is similar to the processing process of S101 and S102 in the foregoing, except that the object of execution is replaced from the to-be-identified information to the training sample information, which will not be repeated here.

[0168] S203, constructing the training recognition features corresponding to the multiple training sample information respectively according to the training combination attribute.

[0169] The information recognition device performs feature conversion on the training combination attribute corresponding to each training sample information to obtain the training recognition features corresponding to each training sample information. It can be understood that the feature conversion process of this step is similar to the feature conversion process in S103, which will not be repeated here.

[0170] S204, using the initial recognition model to perform classification recognition on the training recognition features to obtain the training prediction probability of each training sample information.

[0171] Next, the information recognition device will input the training recognition features corresponding to each training sample information in batches or synchronously into the initial recognition model to calculate the training prediction probability corresponding to each sample information by forward inference of the initial recognition model. That is, the information recognition device will obtain multiple training prediction probabilities corresponding to the multiple training sample information one by one.

[0172] S205, continuously adjusting the parameters of the initial recognition model according to the loss value between the label data and the training prediction probability until the training end condition is reached to obtain the feature recognition model.

[0173] The information recognition device performs loss value calculation on the label data of each training sample information and the training prediction probability of each training sample information, and performs back propagation on the loss value, calculates an update component for each parameter of the initial recognition model, and updates and adjusts the parameters using the update component, to complete an iteration process. This cycle continues until the training end condition is reached, and the information recognition device stops updating the initial recognition model. The initial recognition model obtained after the last update is determined as the feature recognition model.

[0174] It can be understood that the training end condition can be set according to actual conditions, for example, the number of iterations is set to 10,000 times, or the training accuracy is set to 99.9%, and the embodiments of the present application are not limited herein.

[0175] In some embodiments, the information recognition device can also use a part of the plurality of training sample information as a validation set, and after a certain number of iterations of training of the initial recognition model, the validation set is used for validation. When the validation effect is not good, continue to iterate and train, otherwise, stop training in advance and directly obtain the feature recognition model.

[0176] In the embodiments of the present application, the information recognition device can train the initial recognition model through the labeled training sample information to obtain the trained feature recognition model, so as to better classify and recognize the to-be-recognized features by using the trained feature recognition model, and improve the accuracy of the information recognition result.

[0177] In some embodiments of the present application, before S201 and after S205, the method can further include S206-S207:

[0178] S206, divide the content types of the plurality of training sample information respectively to obtain a plurality of type sets.

[0179] The information recognition device divides the content type of each training sample information into positive type, negative type and neutral type. The positive type can be a type that can be used in daily life communication, such as messages with friends and family; the neutral type can be a promotion type, such as an advertisement; and the negative type can be a negative information type, such as a negative web address.

[0180] S207, according to the label data of each training sample information and the type set to which the content type of each training sample information belongs, determine the training weight for each training sample information.

[0181] When the label data of the training sample information is consistent with the type set to which the content type of the training sample information belongs (for example, both are positive samples and positive categories, both are neutral samples and neutral categories, and both are negative samples and negative categories), the information recognition device assigns a first weight to the training sample information; otherwise, the information recognition device assigns a second weight to the training sample information. It should be noted that in the embodiments of the present application, the first weight is greater than the second weight.

[0182] After determining the training weight for each training sample information contained in each type set, the parameters of the initial recognition model are continuously adjusted according to the loss value between the label data and the training prediction probability until the training end condition is reached, and the feature recognition model is obtained, that is, the specific implementation process of S205 can include: S2051, as follows:

[0183] S2051, according to the training weight, optimize the loss value between the label data and the training prediction probability, and continuously adjust the parameters of the initial recognition model using the optimized loss value until the training end condition is reached, and obtain the feature recognition model.

[0184] It should be noted that the label data of the training sample information is not necessarily correct. If the parameters of the initial recognition model are adjusted using the loss value calculated based on the incorrect label data to obtain the feature recognition model, the performance of the feature recognition model will be reduced. To this end, in the embodiments of the present application, the information recognition device matches the label data and the set label, that is, the content type corresponding to the training sample information. When matching, it means that the label data is correct, so as to assign a larger training weight to focus on the loss value obtained based on the label data during training. When not matching, it means that the label data is likely to be incorrect, so as to assign a smaller training weight to minimize the negative impact of the loss value obtained based on the incorrect label data during training, so as to further ensure the performance of the feature recognition model.

[0185] In the embodiments of the present application, the information recognition device determines the possibly problematic label data or content category by judging whether the label data and the content category of the training sample information match, and reduces the influence of the loss value corresponding to the problematic label data during training, thereby ensuring the performance of the feature recognition model.

[0186] In the following, an exemplary application of the embodiments of the present application in an actual application scenario will be described.

[0187] The embodiment of the application is implemented in the scenario that the mailbox server (information identification device) identifies the mail received by the mailbox. Through mail identification, abnormal mails are intercepted and added to the blacklist, thereby reducing the negative impact of abnormal mails and improving the experience of mail users.

[0188] Figure 8 is a process diagram of mail identification provided by the embodiment of the application. Referring to Figure 8 When a new mail (newly added information in the warehouse) enters 8-1, the mailbox server performs sample clustering 8-2 on the new mail to merge the new mail into a similar mail category, and extracts and counts 8-5 the behavior attribute 8-3 (attribute information in the account dimension) and the content attribute 8-4 (attribute information in the content dimension) of the mail sample (to-be-identified information) corresponding to the category cluster center, so as to generate a new combined attribute by using the behavior attribute and the content attribute, input the feature vector (to-be-identified feature) corresponding to the combined attribute into the XGBoost model 8-6 (feature identification model), and determine whether the mail is an abnormal mail. When the mail is an abnormal mail, the mailbox server adds the mail to the blacklist 8-7 (abnormal list), otherwise, the mailbox server adds the mail to the whitelist 8-8 (normal list). In this way, the mailbox server completes the automatic identification of the mail.

[0189] Before the automatic identification of the mail, the mailbox server needs to train the XGBoost model. Figure 9 is a training process diagram of the XGBoost model provided by the embodiment of the application. Referring to Figure 9 The process can include:

[0190] S301, obtaining a training mail sample.

[0191] The mailbox server first selects all the mails of a certain day in the past week from the historical data as a training sample (training sample information).

[0192] S302, data labeling.

[0193] The mailbox server labels the training sample according to the mail content, and divides the training sample into three categories: positive sample 9-1, neutral sample 9-2 and negative sample 9-3. The positive sample refers to the normal mail of the mailbox user or the system mail, the negative sample refers to the abnormal mail with negative properties that the user does not want to receive, and the neutral sample refers to the neutral mail that neither belongs to the daily mail nor to the abnormal mail, such as advertising mail and the like.

[0194] S303, attribute preprocessing and combined attribute calculation.

[0195] The attributes in the present application can be divided into two categories, behavior attributes and content attributes. Among them, the behavior attributes mainly involve the addressee and sender dimensions (such as the number of white-listed recipients, the number of times the sender is reported, etc.), the IP dimension (the number of abnormal IPs and the level of abnormal IPs, etc.), and the domain name dimension (the total number of domain name recipients and the number of unique sender domains, etc.); the content attributes mainly involve the content of the email, the proportion of emails blocked, and the proportion of urls related only to the content of the email.

[0196] It is worth noting that in the reporting and accumulation of behavior attributes, the behavior attributes reported are all absolute values. The mailbox server cannot necessarily distinguish the type of email relying on absolute values, therefore, if the behavior attributes and content attributes that have not been processed are used as meta-attributes, the mailbox server can further calculate combined attributes (combined attribute information) based on the meta-attributes, such as abnormal IP ratio and user whitelist ratio, etc.

[0197] For missing attributes, the mailbox server only needs to set them to a preset value, because XGBoost itself has the ability to handle missing values.

[0198] S304, sample weight calculation.

[0199] The labeling results (label data) of the email are likely to be incorrect due to labeling conditions and other reasons, and the type of the email is directly reflected in the content category. For this reason, the mailbox server couples the labeling results of the email with the email category to set the weight of the training sample (training weight). At this time, the mailbox server also classifies the content category of the email into three types: positive category, neutral category, and negative category, for example, classifying the content category-operation log as a positive category, classifying the content category-negative link as a negative category, and classifying the content category-promotion information as a neutral category. Currently, only when the labeling result of the training sample and the content category are both positive category / neutral category / negative category, the mailbox server will set the training weight of the training sample to 0.9 (first weight), otherwise, it will set the training weight to 0.1 (second weight). In this way, the impact of labeling result errors and content category results on the training of the XGBoost model can be reduced, and the robustness of the XGBoost model can be ensured.

[0200] S305, XGBoost model training.

[0201] The mailbox server trains the XGBoost model based on the labeled samples and the sample weights. When setting the hyperparameters and training hyperparameters of the XGBoost model, the mailbox server sets the maximum depth of the tree to 8, sets the L2 regularization penalty parameter to 2, sets the minimum loss attenuation value to 0.2, sets the feature sampling ratio to 0.7, sets the minimum leaf node to 3, sets the model learning rate to 0.025, and sets other hyperparameters to the default values of the model library.

[0202] The mailbox server divides the training samples into a training set and a validation set in a ratio of 4:1 according to the labeled samples, and determines the optimal number of training iterations of the XGBoost model based on the performance of the XGBoost model on the validation set according to the early stopping training strategy, and tests the XGBoost model by taking all the mail of the next day as a test set.

[0203] When the XGBoost model is trained, the mailbox server can use the XGBoost model in the online real-time identification process of the mail. Figure 9 , see Figure 10 , Figure 10 is a process diagram for mail identification using the XGBoost model provided by the embodiments of the present application. The process can include:

[0204] S401, obtaining a mail sample (to-be-identified information) corresponding to a class cluster center.

[0205] The class cluster center refers to the center of the clustering category to which the new incoming mail belongs.

[0206] S402, extracting behavior attributes and content attributes from the mail sample.

[0207] S403, attribute preprocessing and combined attribute calculation.

[0208] S404, calling the XGBoost model.

[0209] S405, identifying the mail sample.

[0210] In this way, the identification of the mail can be completed.

[0211] It should be noted that after the mailbox server uses the mail identification method provided by the embodiments of the present application, the mail sample identification rate is increased from 74% to 90%, and the mail identification rate is increased from 84% to 94.6%. Moreover, in the XGBoost model, a single mail sample can be identified in only 11 ms.

[0212] It can be understood that, in the embodiments of the present application, related data such as user information, for example, new warehouse information, attribute information of the mail and account dimension, attribute information of the content dimension, etc. When the embodiments of the present application are applied to specific products or technologies, the user's permission or consent is required, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of the country and region.

[0213] The following continues to illustrate an exemplary structure of the information identification apparatus 255 provided by the embodiments of the present application, which is implemented as a software module. In some embodiments, as shown in FIG. 25, the software module stored in the information identification apparatus 255 of the memory 250 can include: Figure 2

[0214] The attribute determination module 2551 is configured to determine attribute information of an account dimension and attribute information of a content dimension corresponding to the to-be-identified information; the account dimension refers to an information dimension related to an interactive account of the to-be-identified information, and the content dimension refers to an information dimension related to content of the to-be-identified information.

[0215] The attribute combination module 2552 is configured to filter out a target dimension from the account dimension and the content dimension, and perform combination processing on attribute information of the target dimension to obtain combined attribute information of the to-be-identified information.

[0216] The feature conversion module 2553 is configured to perform feature conversion on the combined attribute information to obtain a to-be-identified feature corresponding to the to-be-identified information.

[0217] The result identification module 2554 is configured to determine an information identification result corresponding to the to-be-identified information based on classification identification on the to-be-identified feature; the information identification result represents whether the to-be-identified information is abnormal information.

[0218] In some embodiments of the present application, the information identification apparatus 255 further includes an information determination module 2555; the information determination module 2555 is configured to, before determining attribute information of an account dimension and attribute information of a content dimension corresponding to the to-be-identified information, acquire new warehouse information; the new warehouse information is the latest received information; perform clustering processing on the new warehouse information to obtain a clustering category to which the new warehouse information belongs; and determine an information sample corresponding to a cluster center of the clustering category as the to-be-identified information.

[0219] ​In some embodiments of the present application, the attribute determining module 2551 is further configured to obtain a historical number of exceptions and a historical number of interceptions of the to-be-identified information; the historical number of exceptions represents a number of times of abnormal behaviors of an interaction account of an information sample included in the clustering category in a historical time period; the historical number of interceptions represents a number of times of interceptions of the information sample included in the clustering category in the historical time period; a number of times of abnormal behaviors of the interaction account of the newly-stored information is counted to obtain a newly-added number of exceptions, and a number of times of interceptions of the newly-stored information is counted to obtain a newly-added number of interceptions; a cumulative result of the newly-added number of exceptions and the historical number of exceptions is determined as attribute information of the account dimension corresponding to the to-be-identified information; and a cumulative result of the newly-added number of interceptions and the historical number of interceptions is determined as attribute information of the content dimension corresponding to the to-be-identified information.

[0220] In some embodiments of the present application, the attribute determining module 2551 is further configured to obtain content description information corresponding to the newly-stored information and basic account information of an interaction account of the newly-stored information; the content description information at least includes a category label of the newly-stored information and a proportion of web links included in the newly-stored information; and the basic account information at least includes a number of white lists of the interaction account and a login address of the interaction account; the basic account information is determined as attribute information of the account dimension corresponding to the to-be-identified information, and the content description information is determined as attribute information of the content dimension.

[0221] In some embodiments of the present application, the attribute combining module 2552 is further configured to, when the target dimension includes an account dimension, screen at least two target account attributes from the attribute information of the account dimension, and combine the at least two target account attributes to obtain the combined attribute information of the to-be-identified information; when the target dimension includes a content dimension, screen at least two target content attributes from the attribute information of the content dimension, and combine the at least two target content attributes to obtain the combined attribute information of the to-be-identified information; and when the target dimension includes the content dimension and the target dimension, screen a to-be-combined account attribute from the attribute information of the account dimension, screen a matching content attribute from the attribute information of the content dimension according to the to-be-combined account attribute, and determine the combined attribute information corresponding to the to-be-identified information by using the to-be-combined account attribute and the matching content attribute.

[0222] In some embodiments of the present application, the combined attribute information includes a plurality of sub-attribute information; the feature conversion module 2553 is further configured to perform feature conversion on each of the sub-attribute information to obtain a sub-feature corresponding to each of the sub-attribute information; and the sub-feature corresponding to each of the sub-attribute information is spliced to obtain the to-be-recognized feature corresponding to the to-be-recognized information.

[0223] In some embodiments of the present application, the information identification apparatus 255 further includes an information processing module 2556; the information processing module 2556 is configured to, after determining the information identification result corresponding to the to-be-recognized information based on the classified identification of the to-be-recognized feature, intercept the to-be-recognized information when the information identification result indicates that the to-be-recognized information is abnormal information, and add the to-be-recognized information to an abnormal list; and forward the to-be-recognized information when the information identification result indicates that the to-be-recognized information is normal information, and add the to-be-recognized information to a normal list.

[0224] In some embodiments of the present application, the result identification module 2554 is further configured to perform classified identification of abnormal information on the to-be-recognized feature by using a feature identification model to obtain an abnormal prediction probability; and determine the information identification result corresponding to the to-be-recognized information according to the abnormal prediction probability and a probability threshold.

[0225] In some embodiments of the present application, the feature identification model includes a plurality of decision tree models; the result identification module 2554 is further configured to perform classified identification of abnormal information on the to-be-recognized feature by using a plurality of the decision tree models to obtain a plurality of sub-prediction probabilities corresponding to the plurality of decision tree models; and perform weighted fusion on the plurality of sub-prediction probabilities to obtain the abnormal prediction probability corresponding to the to-be-recognized feature.

[0226] In some embodiments of the present application, the information identification apparatus 255 further comprises a model training module 2557; the model training module 2557 is configured to, before determining the attribute information of the corresponding account dimension and the attribute information of the content dimension for the information to be identified, obtain an initial identification model, a plurality of training sample information, and label data of each of the plurality of training sample information; determine, for each of the plurality of training sample information, a sample attribute of the corresponding account dimension and a sample attribute of the content dimension, and filter the target dimension from the account dimension and the content dimension, and obtain training combined attributes of the plurality of training sample information by combining the sample attributes of the target dimension; construct training identification features corresponding to each of the plurality of training sample information according to the training combined attributes; perform classification identification on the training identification features by using the initial identification model to obtain training prediction probabilities of each of the plurality of training sample information; and continuously adjust parameters of the initial identification model according to a loss value between the label data and the training prediction probabilities until a training end condition is reached to obtain the feature identification model.

[0227] In some embodiments of the present application, the model training module 2557 is further configured to, after obtaining the initial identification model, the plurality of training sample information, and the label data of each of the plurality of training sample information, before continuously adjusting the parameters of the initial identification model according to the loss value between the label data and the training prediction probabilities until the training end condition is reached to obtain the feature identification model, divide the plurality of training sample information into a plurality of type sets according to content types of each of the plurality of training sample information; determine a training weight for each of the plurality of training sample information according to the label data of each of the plurality of training sample information and the type set to which the content type of each of the training sample information belongs; optimize the loss value between the label data and the training prediction probabilities according to the training weight, and continuously adjust the parameters of the initial identification model by using the optimized loss value until the training end condition is reached to obtain the feature identification model.

[0228] The embodiment of the present application provides a computer program product or a computer program, which comprises computer instructions stored in a computer readable storage medium. A processor of a computer device (an information identification device) reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer device executes the information identification method provided in the embodiment of the present application.

[0229] The embodiment of the present application provides a computer readable storage medium storing executable instructions, wherein the executable instructions are stored in the computer readable storage medium. When the executable instructions are executed by a processor, the processor will execute the information identification method provided in the embodiment of the present application, for example, as described above.Figure 3 The information recognition method.

[0230] In some embodiments, the computer-readable storage media can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, flash memory, magnetic surface memory, optical disk, or CD-ROM, etc.; or various devices including one or any combination of the above memories.

[0231] In some embodiments, the executable instructions can be in the form of a program, software, software module, script, or code, written in any form of programming language, including compiled or interpreted languages, or declarative or procedural languages, and can be deployed in any form, including being deployed as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0232] As an example, the executable instructions can, but need not, correspond to a file in a file system. The executable instructions can be stored in a portion of a file that holds other programs or data, for example, one or more scripts stored in a markup language document, in a single file dedicated to the program in question, or in multiple coordinated files, for example, files that store one or more modules, sub programs, or portions of code.

[0233] As an example, the executable instructions can be deployed to be executed on one computer (information recognition device), or on multiple computers located at one site, or on multiple computers distributed among multiple sites and connected to one another through a communication network.

[0234] To sum up, by the embodiments of the present application, the information recognition device will respectively acquire attribute information for the account dimension and the content dimension, and then filter out the target dimension from the account dimension and the content dimension to perform combination processing of the attribute information for the target dimension, so as to reconstruct the combined attribute features containing the correlation between attributes through the combination processing, to accurately describe the abnormal situation to be recognized through the combined attribute information, and then map the combined attribute information to the feature space to obtain more accurate to-be-recognized features, and finally perform more accurate classification recognition based on the more accurate to-be-recognized features, thereby improving the accuracy of information recognition; by clustering the newly-included information, the clustering category to which the newly-included information belongs is determined, and the information sample corresponding to the cluster center of the clustering category is determined as the to-be-recognized information, which not only can improve the representativeness of the to-be-recognized information, but also can perform information recognition with the clustering category as the granularity to speed up the efficiency of information recognition; and by judging whether the content category of the label data and the training sample information is consistent, the label data or the content category that may have a problem is determined, and the influence of the loss value corresponding to the problematic label data is reduced during training, thereby ensuring the performance of the feature recognition model.

[0235] The above merely describes the embodiments of the present application, but is not used to limit the protection scope of the present application. Any modification, equivalent replacement, and improvement made within the spirit and scope of the present application shall be included in the protection scope of the present application.

Claims

1. An information recognition method characterized by comprising: The method comprises: determining attribute information of an account dimension and attribute information of a content dimension corresponding to to-be-identified information; the account dimension refers to an information dimension related to an interaction account of the to-be-identified information, and the content dimension refers to an information dimension related to content of the to-be-identified information; filtering out a target dimension from the account dimension and the content dimension, and performing combination processing on attribute information of the target dimension to obtain combined attribute information of the to-be-identified information; performing feature conversion on the combined attribute information to obtain to-be-identified features corresponding to the to-be-identified information; performing classification identification of abnormal information on the to-be-identified features respectively by using a feature identification model comprising a plurality of decision tree models to obtain a plurality of sub-prediction probabilities corresponding to the plurality of decision tree models; performing weighted fusion on the plurality of sub-prediction probabilities to obtain an abnormal prediction probability corresponding to the to-be-identified features; determining an information identification result corresponding to the to-be-identified information according to the abnormal prediction probability and a probability threshold, wherein the information identification result represents whether the to-be-identified information is abnormal information.

2. The method of claim 1, wherein, Before the determining attribute information of an account dimension and attribute information of a content dimension corresponding to to-be-identified information, the method further comprises: obtaining newly added information in a database; the newly added information in the database is the latest received information; performing clustering processing on the newly added information in the database to obtain a clustering category to which the newly added information in the database belongs; determining an information sample corresponding to a class cluster center of the clustering category as the to-be-identified information.

3. The method of claim 2, wherein, The determining attribute information of an account dimension and attribute information of a content dimension corresponding to to-be-identified information comprises: obtaining a historical abnormal number and a historical interception number of the to-be-identified information; wherein the historical abnormal number represents a number of times of abnormal behaviors of an interaction account of an information sample included in the clustering category in a historical time period; and the historical interception number represents a number of times of interception of the information sample included in the clustering category in the historical time period; performing statistics on a number of times of abnormal behaviors of an interaction account of the newly added information in the database to obtain a newly added abnormal number, and performing statistics on a number of times of interception of the newly added information in the database to obtain a newly added interception number; determining a cumulative result of the newly added abnormal number and the historical abnormal number as attribute information of the account dimension corresponding to the to-be-identified information; determining a cumulative result of the newly added interception number and the historical interception number as attribute information of the content dimension corresponding to the to-be-identified information.

4. The method of claim 2, wherein, The determining attribute information of an account dimension and attribute information of a content dimension corresponding to to-be-identified information comprises: obtaining content description information corresponding to the newly added information in the database and basic account information of an interaction account of the newly added information in the database; wherein the content description information at least includes a category label of the newly added information in the database and a proportion of a web link included in the newly added information in the database; and the basic account information at least includes a number of white lists of the interaction account and a login address of the interaction account. The base account information is determined as attribute information of the account dimension corresponding to the to-be-identified information, and the content description information is determined as attribute information of the content dimension.

5. The method according to any one of claims 1 to 4, characterized in that, The attribute information of the target dimension is combined to obtain combined attribute information of the to-be-identified information, including: When the target dimension includes an account dimension, at least two target account attributes are filtered from the attribute information of the account dimension, and the at least two target account attributes are combined to obtain the combined attribute information of the to-be-identified information; When the target dimension includes a content dimension, at least two target content attributes are filtered from the attribute information of the content dimension, and the at least two target content attributes are combined to obtain the combined attribute information of the to-be-identified information; When the target dimension includes the content dimension and the account dimension, a to-be-combined account attribute is filtered from the attribute information of the account dimension, a matching content attribute is filtered from the attribute information of the content dimension according to the to-be-combined account attribute, and the to-be-combined account attribute and the matching content attribute are used to determine the combined attribute information corresponding to the to-be-identified information.

6. The method according to any one of claims 1 to 4, characterized in that, The combined attribute information includes a plurality of sub-attribute information, and the combined attribute information is converted into a to-be-identified feature corresponding to the to-be-identified information, including: Each sub-attribute information is converted into a sub-feature corresponding to each sub-attribute information; Each sub-attribute information is converted into a sub-feature corresponding to each sub-attribute information.

7. The method according to any one of claims 1 to 4, characterized in that, After determining the information identification result corresponding to the to-be-identified information according to the abnormal prediction probability and the probability threshold, the method further includes: When the information identification result indicates that the to-be-identified information is abnormal information, the to-be-identified information is intercepted and added to an abnormal list; When the information identification result indicates that the to-be-identified information is normal information, the to-be-identified information is forwarded and added to a normal list.

8. The method of claim 1, wherein, Before determining the attribute information of the account dimension and the attribute information of the content dimension corresponding to the to-be-identified information, the method further includes: An initial identification model, a plurality of training sample information, and label data of each of the plurality of training sample information are obtained; For a plurality of training sample information, sample attributes of an account dimension and sample attributes of a content dimension corresponding to each of the plurality of training sample information are determined, and the target dimension is filtered from the account dimension and the content dimension. A training combined attribute of the plurality of training sample information is obtained by combining the sample attributes of the target dimension; According to the training combined attribute, a training identification feature corresponding to each of the plurality of training sample information is constructed; The training identification feature is classified and identified by using the initial identification model to obtain a training prediction probability of each of the plurality of training sample information; According to the loss value between the label data and the training prediction probability, the parameters of the initial identification model are continuously adjusted until a training end condition is reached, and the feature identification model is obtained.

9. The method of claim 8, wherein, After obtaining the initial identification model, the plurality of training sample information, and the label data of each of the plurality of training sample information, before the method further comprises: Divide the content types of the plurality of training sample information to obtain a plurality of type sets; According to the label data of each training sample information and the type set to which the content type of each training sample information belongs, determine the training weight for each training sample information; According to the loss value between the label data and the training prediction probability, the parameters of the initial identification model are continuously adjusted until a training end condition is reached, and the feature identification model is obtained. According to the training weight, the loss value between the label data and the training prediction probability is optimized, and the optimized loss value is used to continuously adjust the parameters of the initial identification model until the training end condition is reached, and the feature identification model is obtained.

10. An information recognizing apparatus characterized by comprising: The device comprises: An attribute determination module is configured to determine attribute information of an account dimension and attribute information of a content dimension corresponding to to-be-identified information; the account dimension refers to an information dimension related to an interactive account of the to-be-identified information, and the content dimension refers to an information dimension related to content of the to-be-identified information; An attribute combination module is configured to filter a target dimension from the account dimension and the content dimension, and combine attribute information of the target dimension to obtain combined attribute information of the to-be-identified information; A feature conversion module is configured to perform feature conversion on the combined attribute information to obtain to-be-identified features corresponding to the to-be-identified information; A result identification module is configured to use a feature identification model comprising a plurality of decision tree models to perform classification identification of abnormal information on the to-be-identified features respectively to obtain a plurality of sub-prediction probabilities corresponding to the plurality of decision tree models; perform weighted fusion on the plurality of sub-prediction probabilities to obtain an abnormal prediction probability corresponding to the to-be-identified features; and determine an information identification result corresponding to the to-be-identified information according to the abnormal prediction probability and a probability threshold, wherein the information identification result represents whether the to-be-identified information is abnormal information.

11. The apparatus of claim 10, wherein, The information identification device further comprises: An information determination module is configured to obtain newly-included information before determining attribute information of an account dimension and attribute information of a content dimension corresponding to to-be-identified information; the newly-included information is the latest received information; perform clustering processing on the newly-included information to obtain a clustering category to which the newly-included information belongs; and determine an information sample corresponding to a class cluster center of the clustering category as the to-be-identified information.

12. The apparatus of claim 11, wherein, The attribute determining module is further configured to acquire a historical abnormality number of times and a historical interception number of times of the to-be-identified information, wherein the historical abnormality number of times represents a number of times of abnormal behavior of an interaction account of an information sample included in the clustering category in a historical time period, and the historical interception number of times represents a number of times of interception of the information sample included in the clustering category in the historical time period; a number of times of abnormal behavior of the interaction account of the newly-stored information is counted to obtain a newly-added abnormality number of times, and a number of times of interception of the newly-stored information is counted to obtain a newly-added interception number of times; a cumulative result of the newly-added abnormality number of times and the historical abnormality number of times is determined as attribute information of the account dimension corresponding to the to-be-identified information; and a cumulative result of the newly-added interception number of times and the historical interception number of times is determined as attribute information of the content dimension corresponding to the to-be-identified information.

13. The apparatus of claim 11, wherein, The attribute determining module is further configured to acquire content description information corresponding to the newly-stored information and basic account information of an interaction account of the newly-stored information, wherein the content description information at least includes a category label of the newly-stored information and a proportion of a web link included in the newly-stored information, and the basic account information at least includes a number of white lists of the interaction account and a login address of the interaction account; the basic account information is determined as attribute information of the account dimension corresponding to the to-be-identified information, and the content description information is determined as attribute information of the content dimension.

14. The apparatus of any one of claims 10 to 13, wherein, The attribute combining module is further configured to, when the target dimension includes the account dimension, screen at least two target account attributes from the attribute information of the account dimension, and combine the at least two target account attributes to obtain the combined attribute information of the to-be-identified information; when the target dimension includes the content dimension, screen at least two target content attributes from the attribute information of the content dimension, and combine the at least two target content attributes to obtain the combined attribute information of the to-be-identified information; and when the target dimension includes the content dimension and the account dimension, screen a to-be-combined account attribute from the attribute information of the account dimension, screen a matching content attribute from the attribute information of the content dimension according to the to-be-combined account attribute, and determine the combined attribute information corresponding to the to-be-identified information by using the to-be-combined account attribute and the matching content attribute.

15. The apparatus of any one of claims 10 to 13, wherein, The combined attribute information includes a plurality of sub-attribute information. The feature conversion module is further configured to perform feature conversion on each of the sub-attribute information to obtain a sub-feature corresponding to each of the sub-attribute information, and splice the sub-feature corresponding to each of the sub-attribute information to obtain the to-be-identified feature corresponding to the to-be-identified information.

16. The apparatus of any one of claims 10 to 13, wherein, The information identification apparatus further includes: The information processing module is configured to: after determining, based on the classification and identification of the to-be-identified feature, an information identification result corresponding to the to-be-identified information, intercepting the to-be-identified information when the information identification result indicates that the to-be-identified information is abnormal information, and adding the to-be-identified information to an abnormal list; and forwarding the to-be-identified information and adding the to-be-identified information to a normal list when the information identification result indicates that the to-be-identified information is normal information.

17. The apparatus of claim 10, wherein, The information identification device further includes: The model training module is configured to: before determining, for to-be-identified information, attribute information of a corresponding account dimension and attribute information of a content dimension, obtain an initial identification model, a plurality of training sample information, and label data of each of the plurality of training sample information; determine, for each of the plurality of training sample information, a sample attribute of the account dimension and a sample attribute of the content dimension, and filter the target dimension from the account dimension and the content dimension, obtain training combined attributes of the plurality of training sample information by combining the sample attributes of the target dimension; construct training identification features corresponding to each of the plurality of training sample information according to the training combined attributes; perform classification and identification on the training identification features by using the initial identification model to obtain training prediction probabilities of each of the plurality of training sample information; and continuously adjust parameters of the initial identification model according to a loss value between the label data and the training prediction probabilities until a training end condition is reached to obtain the feature identification model.

18. The apparatus of claim 17, wherein The model training module is further configured to: after obtaining the initial identification model, the plurality of training sample information, and the label data of each of the plurality of training sample information, before continuously adjusting the parameters of the initial identification model according to the loss value between the label data and the training prediction probabilities until the training end condition is reached to obtain the feature identification model, divide each of the plurality of training sample information into a plurality of type sets according to a content type of each of the plurality of training sample information; and determine a training weight for each of the plurality of training sample information according to the label data of each of the plurality of training sample information and the type set to which the content type of each of the plurality of training sample information belongs; The model training module is further configured to: optimize the loss value between the label data and the training prediction probabilities according to the training weight, and continuously adjust the parameters of the initial identification model according to the optimized loss value until the training end condition is reached to obtain the feature identification model.

19. An information recognizing apparatus, characterized by comprising: The information identification device includes: a memory configured to store executable instructions; a processor configured to execute the executable instructions stored in the memory to implement the information identification method of any one of claims 1 to 9.

20. A computer-readable storage medium storing executable instructions, the instructions causing a computer to perform operations comprising: The executable instructions, when executed by the processor, implement the information identification method of any one of claims 1 to 9.

21. A computer program product comprising computer programs or instructions, characterized in that, The computer program or instructions, when executed by the processor, implement the information identification method of any one of claims 1 to 9.

Images