Abnormal subject detection method, apparatus, device, and storage medium

Abstract

The application provides an abnormal subject detection method and device, equipment and a storage medium, relates to the technical field of artificial intelligence, can be applied to various scenes such as cloud technology, artificial intelligence, intelligent transportation and auxiliary driving, and the method comprises the following steps: obtaining subject operation sequences corresponding to a plurality of target traffic objects in a preset period, the subject operation sequence is composed of subject words of an associated traffic subject corresponding to the target traffic object, and the associated traffic subject is a traffic subject that has a preset interaction operation with the target traffic object in the preset period; constructing a subject feature set based on the subject operation sequences corresponding to the plurality of target traffic objects, wherein the subject feature set comprises traffic subject features of the associated traffic subjects corresponding to the plurality of target traffic objects; and performing abnormal detection on the associated traffic subjects according to the traffic subject features to obtain an abnormal subject detection result. The application can significantly improve the accuracy and reliability of abnormal subject detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, and in particular to an abnormal subject detection method, device, equipment and storage medium. BACKGROUND

[0002] With the development of Internet technology, online information promotion has become a mainstream promotion method. The promotion party promotes information through the traffic party responsible for information delivery and release, and the traffic party obtains profit sharing of the promotion party through information flow acquisition, such as taking the click volume of the promoted information as the charging performance. Due to the motive of illegal profit or malicious competition, some traffic parties use cheating behaviors such as brushing to falsely increase exposure, clicks or conversion volume, so effective detection means are needed to identify traffic subjects with the above abnormal conditions to ensure normal information promotion and maintain the rights and interests of the promotion party.

[0003] In the prior art, abnormal subject detection is usually performed through the material information or behavior data of the traffic subject, such as determining that the traffic parties with similar filled or bound material information are the same type of subject, and then performing abnormal detection, or judging whether the traffic parties are the same type through the exposure / click object coincidence degree between the traffic parties. However, the former method depends on the information provided by the traffic party and cannot avoid the interference of false information, and the time cost and calculation complexity of the latter method are extremely high, and the accuracy is poor. SUMMARY

[0004] The present application provides an abnormal subject detection method, device, equipment and storage medium, which can significantly improve the accuracy and reliability of abnormal subject detection.

[0005] In one aspect, the present application provides an abnormal subject detection method, which comprises:

[0006] obtaining a plurality of target traffic object corresponding subject operation sequences in a preset period, the subject operation sequence being composed of subject words of an associated traffic subject corresponding to the target traffic object, the associated traffic subject being a traffic subject that has a preset interaction operation with the target traffic object in the preset period;

[0007] constructing a subject feature set based on the plurality of target traffic object corresponding subject operation sequences, the subject feature set including traffic subject features of the associated traffic subjects corresponding to the plurality of target traffic objects;

[0008] performing abnormal detection on the associated traffic subjects according to the traffic subject features to obtain an abnormal subject detection result.

[0009] Another aspect provides an abnormal subject detection device, which comprises:

[0010] The operation sequence acquisition module is configured to acquire a plurality of target traffic object corresponding main body operation sequences in a preset period, wherein the main body operation sequence is composed of main body words of a target traffic object corresponding associated traffic main body, and the associated traffic main body is a traffic main body that has a preset interaction operation with the target traffic object in the preset period.

[0011] The main body feature set construction module is configured to construct a main body feature set based on the main body operation sequences corresponding to the plurality of target traffic objects, wherein the main body feature set includes traffic main body features of the associated traffic main bodies corresponding to the plurality of target traffic objects.

[0012] The anomaly detection module is configured to perform anomaly detection on the associated traffic main body according to the traffic main body features, and obtain an anomaly main body detection result.

[0013] In another aspect, a computer device is provided, which includes a processor and a memory, and the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the anomaly main body detection method as described above.

[0014] In another aspect, a computer readable storage medium is provided, which stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by a processor to implement the anomaly main body detection method as described above.

[0015] In another aspect, a server is provided, which includes a processor and a memory, and the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the anomaly main body detection method as described above.

[0016] In another aspect, a terminal is provided, which includes a processor and a memory, and the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the anomaly main body detection method as described above.

[0017] In another aspect, a computer program product or computer program is provided, which includes computer instructions executed by a processor to implement the anomaly main body detection method as described above.

[0018] The anomaly main body detection method, device, equipment, storage medium, server, terminal, computer program and computer program product provided by the present application have the following technical effects:

[0019] The technical solution of the present application obtains a subject operation sequence corresponding to a plurality of target traffic objects in a preset time period, the subject operation sequence is composed of subject words of associated traffic subjects corresponding to the target traffic objects, and the associated traffic subjects are traffic subjects that have a preset interaction operation with the target traffic objects in the preset time period; a subject feature set is constructed based on the subject operation sequences corresponding to the plurality of target traffic objects, and the subject feature set includes traffic subject features of the associated traffic subjects corresponding to the plurality of target traffic objects; and then the associated traffic subjects are detected for abnormalities according to the traffic subject features, to obtain an abnormal subject detection result. In this way, the subject operation sequence is obtained based on the operation data of the target traffic objects, and the traffic subject features capable of representing the traffic subjects are further constructed, the abnormal detection is performed without relying on the information provided by the traffic subjects, the reliability and accuracy of the abnormal detection result are improved, and the abnormal detection is performed based on the traffic subject features, the calculation complexity is reduced, the detection efficiency is improved, and the resource occupation is reduced. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present application or the prior art, the drawings needed in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0021] Figure 1 is a schematic diagram of an application environment provided by an embodiment of the present application;

[0022] Figure 2 is a schematic diagram of another application environment provided by an embodiment of the present application;

[0023] Figure 3 is a flowchart of an abnormal subject detection method provided by an embodiment of the present application;

[0024] Figure 4 is a subject interface diagram of a group of traffic subjects provided by an embodiment of the present application;

[0025] Figure 5 is a flowchart of another abnormal subject detection method provided by an embodiment of the present application;

[0026] Figure 6 is a flowchart of another abnormal subject detection method provided by an embodiment of the present application;

[0027] Figure 7 is a flowchart of another abnormal subject detection method provided by an embodiment of the present application;

[0028] Figure 8 is a visual vector distribution diagram provided by an embodiment of the present application;

[0029] Figure 9 is a visual vector distribution diagram of a two-dimensional feature vector of a normal flow principal part provided by an embodiment of the present application;

[0030] Figure 10 is a flow diagram of another abnormal principal part detection method provided by an embodiment of the present application;

[0031] Figure 11 is a model structure diagram of an initial word vector generation model provided by an embodiment of the present application;

[0032] Figure 12 is a framework diagram of an abnormal principal part detection device provided by an embodiment of the present application;

[0033] Figure 13 is a hardware structure block diagram of an electronic device of an abnormal principal part detection method provided by an embodiment of the present application. DETAILED DESCRIPTION

[0034] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application.

[0035] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or server including a series of steps or sub-modules does not necessarily have to be limited to those steps or sub-modules clearly listed, but can include other steps or sub-modules not clearly listed or inherent to these processes, methods, products, or devices.

[0036] Before further detailing the embodiments of the present application, the terms and terms involved in the embodiments of the present application are explained, and the terms and terms involved in the embodiments of the present application are applicable to the following explanations.

[0037] Artificial Intelligence (AI) is the use of digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology of computer science, which attempts to understand the essence of intelligence and produce a new intelligent machine that can react in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines, so that machines have the functions of perception, reasoning and decision-making.

[0038] Artificial intelligence technology is a comprehensive discipline, involving a wide range of fields, both hardware and software technologies. Artificial intelligence basic technologies generally include technologies such as sensors, special artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction system, mechatronics, etc. Artificial intelligence software technology mainly includes computer vision technology, speech processing technology, natural language processing technology, and machine learning / deep learning, etc.

[0039] Nature Language processing (NLP) is an important direction in the field of computer science and artificial intelligence. It studies various theories and methods that can realize effective communication between people and computers using natural language. Natural language processing is a science that integrates linguistics, computer science and mathematics. Therefore, the research in this field will involve natural language, i.e. the language used in daily life, so it is closely related to the study of linguistics. Natural language processing technology usually includes text processing, semantic understanding, machine translation, robot question and answer, knowledge graph, etc.

[0040] In recent years, with the research and progress of artificial intelligence technology, artificial intelligence technology has been widely applied in many fields. The scheme provided by the embodiments of the present application involves machine learning / deep learning and natural language processing of artificial intelligence, which is specifically explained as follows.

[0041] Please refer to Figure 1 , Figure 1 is a schematic diagram of an application environment provided by the embodiments of the present application, as Figure 1 shown, the application environment can at least include terminal 01 and server 02. In actual application, terminal 01 and server 02 can be connected directly or indirectly through wired or wireless communication, which is not limited in the present application.

[0042] The server 02 in the embodiments of the present application can be a stand-alone physical server, can be a server cluster or a distributed system formed by multiple physical servers, and can also be a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and basic cloud computing services such as big data and artificial intelligence platforms.

[0043] Specifically, cloud technology refers to a hosting technology that unifies a series of resources such as hardware, software, and network in a wide area network or a local area network to realize data calculation, storage, processing, and sharing. Cloud technology can be applied to various fields such as medical cloud, cloud Internet of Things, cloud security, cloud education, cloud conference, artificial intelligence cloud service, cloud application, cloud call, and cloud socialization. Cloud technology is based on a cloud computing business model application, which distributes computing tasks on a resource pool formed by a large number of computers, so that various application systems can obtain computing power, storage space, and information services according to needs. The network providing resources is called a “cloud”, and the resources in the “cloud” can be infinitely expanded for users and can be obtained at any time, used on demand, expanded at any time, and paid according to use. As a basic capability provider of cloud computing, a cloud computing resource pool (referred to as a cloud platform, generally referred to as IaaS (Infrastructure as a Service)) platform is established, and a plurality of types of virtual resources are deployed in the resource pool for external customers to select and use. The cloud computing resource pool mainly includes: a computing device (a virtualized machine including an operating system), a storage device, and a network device.

[0044] According to logical function division, the PaaS (Platform as a Service) layer can be deployed on the IaaS layer, and the SaaS (Software as a Service) layer is deployed above the PaaS layer, or the SaaS can be directly deployed on the IaaS. PaaS is a platform for software running, such as a database and a web container. SaaS is various business software, such as a web portal and a short message massager. Generally, SaaS and PaaS are upper layers relative to IaaS.

[0045] Specifically, the server 02 involved above can include an entity device, can specifically include a network communication submodule, a processor, a memory, and the like, and can also include software running in the entity device, and can specifically include an application program and the like.

[0046] Specifically, the terminal 01 can include an entity device of a type of a smart phone, a desktop computer, a tablet computer, a notebook computer, a digital assistant, an augmented reality (AR) / virtual reality (VR) device, a smart voice interaction device, a smart home appliance, a smart wearable device, a vehicle-mounted terminal device, etc., and can also include a software, such as an application program, etc., running in the entity device.

[0047] In the embodiments of the present application, the terminal 01 can be configured to receive a preset interaction operation of a traffic object on a traffic subject, and send object operation data of the preset interaction operation to the server 02, where the object operation data can include operation action information, a traffic subject identifier, a traffic object identifier, and operation time information, etc. The server 02 is configured to store the object operation data, and generate a subject operation sequence corresponding to a target traffic object according to the object operation data, and then perform abnormality detection on the traffic subject based on the subject operation sequence. Specifically, please refer to Figure 2 The server 02 can include an access layer server 021, a data server 022, and an abnormality detection server 023, as shown in Figure 2 The access layer server 021 is configured to receive the object operation data reported by the terminal, and store the object operation data in a promotion database in the data server 022, and the abnormality detection server 023 extracts a subject operation sequence based on the stored object operation data, and then performs abnormality detection. The subject operation sequence can be a click operation sequence of the target traffic object.

[0048] Specifically, the server 02 can also be configured to provide a model training service of an initial word vector generation model to obtain the initial word vector generation model, and can also be configured to store a central word feature matrix, a background word feature matrix, a subject word group, and a subject feature set, etc.

[0049] In addition, it can be understood that Figure 1 and Figure 2 The application environment shown in

[0050] The application environment, or the terminal 01 and the server 02, etc. in the application environment, involved in the embodiments of the present application can be a distributed system formed by a client, a plurality of nodes (any form of computing device in an access network, such as a server, a user terminal) connected through network communication. The distributed system can be a block chain system, which can provide the above-mentioned abnormality subject detection service and data storage service, etc.

[0051] The following introduces an abnormal subject detection method of the application based on the above application environment. The embodiments of the application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, intelligent transportation, and auxiliary driving. Please refer to Figure 3 , Figure 3 is a flowchart of an abnormal subject detection method provided by an embodiment of the application. The present specification provides method operation steps as embodiments or flowcharts, but more or fewer operation steps can be included based on conventional or non-creative labor. The order of steps listed in the embodiments is only one of the many execution orders of the steps, and does not represent the only execution order. In actual system or server product execution, the method order shown in the embodiments or the drawings can be executed in sequence or in parallel (for example, in a parallel processor or multi-threaded processing environment). Specifically, as shown in Figure 3 , the method can include the following steps S201-S205.

[0052] S201: Obtain a subject operation sequence corresponding to a plurality of target traffic objects in a preset period.

[0053] The subject operation sequence is composed of subject words of associated traffic subjects corresponding to the target traffic objects, and the associated traffic subjects are traffic subjects that have a preset interaction operation with the target traffic objects in the preset period. Specifically, the subject operation sequence can represent the operation trajectory of the target traffic object for the associated traffic subjects in the preset period. Each associated traffic subject corresponds to a subject word, and the subject words of different associated traffic subjects are mutually different. The subject word can be a traffic subject identifier of the associated traffic subject, such as a subject registration name or a subject registration ID, etc. It can also be a text word obtained by text processing on the traffic subject identifier.

[0054] The preset period can be a historical time length starting from a preset time, which can be, for example, 1 day, 7 days, 15 days, or 1 month, etc. The preset period can be, for example, the week before 00:00 on Monday, or the month before 00:00 on the 1st of the month.

[0055] Specifically, the traffic subject can refer to a carrier providing the object traffic, for example, media, websites or programs, etc. For example, in the promotion platform, the traffic subject can be a media account with a certain number of fans. In the information promotion scenario, the traffic subject can obtain the information promotion share of the promotion master. For example, under the same exposure, the higher the click rate of the promotion information, the higher the promotion share. The promotion master refers to the subject or service provider who pays for the placement of promotion information. The information promotion operation paid by the promotion master is a valid operation, not an cheating operation. For example, the paid promotion information click operation is a valid click of the real traffic object, not a cheating click. Cheating operation refers to the operation of brushing exposure, brushing clicks and brushing conversion by traffic objects in the exposure, clicks and effect conversion of promotion information, etc. This malicious operation with non-real intention is called cheating operation. Cheating operation not only damages the interests of the promotion master, but also seriously affects the promotion effect, leading to stop or abandon the investment, and even causing public relations risks.

[0056] In actual scenarios, the terminal can display a subject interface of the traffic subject. The subject interface can set a promotion position. The promotion position refers to a media position identifier for placement of promotion information. For example, a media article can set multiple position promotion positions, such as a top promotion position, a middle promotion position and a bottom promotion position. A small program can set a banner promotion position, an incentive promotion position and a plug-in promotion position according to different positions. Figure 4 , Figure 4 The bottom promotion position of the media article, the banner promotion position in the small program and the plug-in promotion position are displayed in the order from left to right in the

[0057] Specifically, the traffic object can be an object that receives exposure of the promotion information of the traffic subject and performs a preset operation on the traffic subject, that is, an object that contributes to traffic. The preset operation can include but is not limited to a click operation on the promotion position or the target promotion page of the traffic subject. Correspondingly, the preset interaction operation can include but is not limited to the traffic object submitting a preset operation to the traffic subject, and the traffic subject pushing target promotion data in response to the preset operation. For example, the preset period is the previous 7 days before the current time, and the associated traffic subject is a traffic subject that receives a click operation of the target traffic object in the previous 7 days and pushes target promotion information to the target traffic object in response to the click operation.

[0058] In actual application, a promotion database can be set. When the flow object performs a preset operation on the flow subject, the terminal sends corresponding object operation data to the promotion database. The object operation data can include but is not limited to operation action information, subject words associated with the flow subject, flow object identifier, and operation time information. The operation action information includes operation action types such as click operation or conversion operation. The subject words associated with the flow subject can be flow subject identifiers associated with the flow subject. Correspondingly, the object operation data of multiple target flow objects in the promotion database in a preset period is obtained, and a subject operation sequence is generated according to the operation data. The multiple target flow objects can be all flow objects in the promotion database that have submitted a preset operation on the flow subject in a preset period.

[0059] In actual application, please refer to Figure 5 S201 can specifically include the following steps S2011-S2012.

[0060] S2011: Obtain object operation data of multiple target flow objects in a preset period, and the object operation data includes flow object identifier, subject words associated with the flow subject, and operation time information of a preset interaction operation.

[0061] S2012: According to the flow object identifier and the operation time information, the subject words are combined and processed to obtain the subject operation sequence corresponding to the multiple target flow objects.

[0062] In specific embodiments, object operation data of object granularity in a preset period is extracted from the promotion database, and a subject operation sequence of object granularity is obtained based on the object operation data. First, based on the flow object identifier and the operation time information, the subject words corresponding to each target flow object in the multiple target flow objects are sorted and combined to obtain an initial sequence corresponding to each target flow object. Specifically, according to the operation time information, the subject words associated with the flow subject that are operated (such as clicked) in the preset period are sorted in time sequence to obtain the initial sequence. For example, the flow subject identifiers of the target flow object x that are clicked in 7 days are appid_1, appid_2, appid_2, appid_3, …, and appid_n. The initial sequence can be (appid_1 / appid_2 / appid_2 / appid_3…… / appid_n), wherein appid_n is a subject word. Then, the continuous same subject words in the initial sequence are processed to obtain the subject operation sequence corresponding to the multiple target flow objects. For example, the sequence obtained after the above sequence is processed is (appid_1 / appid_2 / appid_3…… / appid_n).

[0063] In this way, the subject operation sequence contains timing information and subject information of operations, can reflect the operation track of the traffic object, and is beneficial to improve the information content of the subject feature. Moreover, the operations under the same traffic subject in succession have the same meaning, and removing the same subject words in succession can simplify the data processing amount, facilitate effective extraction of the subject word group, avoid the same subject words in succession being truncated by the window in sliding extraction, and further avoid semantic loss.

[0064] Specifically, after the deduplication processing, the subject operation sequence of each target traffic object is obtained, and sequences with a sequence length less than a preset length are removed. In some cases, the obtained subject operation sequence can also be filtered to remove sequences with a sequence length less than a preset length, so as to exclude the randomness caused by sparse operation objects, and further obtain the subject operation sequence corresponding to the plurality of target traffic objects. The preset length can be 3, for example.

[0065] In the promotion cheating scenario, the same batch of traffic objects are often used for cheating operations, or the same operation mode is used for cheating. The operation mode here refers to the similar operation track of the traffic object on different traffic subjects, such as similar click track. For example, the traffic subjects visited by traffic object x in succession are A->B->C, and the traffic subjects visited by user y in succession are A->D->C (wherein the traffic subject A can be used for cheating task distribution), although the traffic object groups corresponding to the traffic subjects B and D have low coincidence degree, the operation mode of users x and y is similar, that is, both of them visit A first and then visit C, and the traffic subjects B and C are still likely to be the same type of traffic subjects, such as belonging to the same abnormal group. Therefore, the subject operation sequence contains object information and operation mode information, and the vector representation of the traffic subject is constructed based on the subject operation sequence, which can improve the semantic accuracy and information amount of the traffic subject feature, and further improve the reliability of abnormal subject detection.

[0066] S203: Construct a subject feature set based on the subject operation sequence corresponding to the plurality of target traffic objects.

[0067] The subject feature set includes traffic subject features of the associated traffic subjects corresponding to the plurality of target traffic objects, and the traffic subject feature represents the diversion object information and operation mode information of the associated traffic subject. Specifically, the traffic subject feature can be a dense vector with a preset dimension M, which can be 64 dimensions or 200 dimensions, etc. The feature embedding processing is performed on each subject word in the subject operation sequence, and the obtained subject word embedding feature is optimized and updated based on the subject operation sequence and the initial word vector generation model, to obtain the traffic subject feature capable of representing the diversion object information and operation mode information of the associated traffic subject.

[0068] S205: Perform abnormal detection on the associated traffic subject according to the traffic subject feature, to obtain an abnormal subject detection result.

[0069] Specifically, after obtaining the flow subject feature of each associated flow subject, the flow subject feature can be used for anomaly detection. In some embodiments, anomaly detection can be achieved by clustering. For details, please refer to Figure 6 , S205 can specifically include the following steps S2051-S2052.

[0070] S2051: clustering the flow subject features in the subject feature set to obtain a subject feature cluster group.

[0071] S2052: in the case that any associated flow subject corresponding to the subject feature cluster group has an abnormal label, determining the subject feature cluster group as an abnormal subject group.

[0072] Specifically, the abnormal subject group can refer to a group of abnormal subjects that use similar cheating modes or use a batch of flow objects for promotion cheating. The preset clustering analysis algorithm used in the clustering process can include but is not limited to K-means, mean shift clustering, density-based clustering method (DBSCAN), or expectation maximization (EM) clustering, etc. The flow subject features in the subject feature set are divided into multiple subject feature cluster groups through clustering, and the abnormal cluster group is located based on the associated flow subject with an abnormal label, and then the located abnormal cluster group is determined as an abnormal subject group. The abnormal label can be manually marked, or determined based on the attribute data and historical operation data of the associated flow subject, etc. For example, feature extraction and classification recognition are performed on the attribute data and historical operation data to obtain the subject label of the associated flow subject, and the subject label includes a normal label and an abnormal label. In this way, flow subject group identification and anomaly detection are performed through clustering, which accurately locates abnormal subjects, divides abnormal subjects into groups, obtains multi-dimensional positioning information of abnormal subjects, and is beneficial to optimizing the task effect of downstream tasks.

[0073] In other embodiments, anomaly detection can be performed based on feature similarity. For details, please refer to Figure 7 , S205 can specifically include the following steps S2053-S2055.

[0074] S2053: obtaining a seed abnormal subject in the associated flow subjects corresponding to the multiple target flow objects.

[0075] Specifically, the seed abnormal subject can be obtained by manually marking the associated flow subject, or can be pre-stored in the subject blacklist. Accordingly, the associated flow subjects corresponding to the multiple target flow objects are matched with the subject blacklist, and the matched associated flow subjects are determined as seed abnormal subjects. Specifically, the number of seed abnormal subjects can be set based on actual needs, for example, it can be 5.

[0076] S2054: Determine the seed subject feature of the seed abnormal subject in the subject feature set.

[0077] It can be understood that the association relationship between the traffic subject feature and the subject word is constructed in the subject feature set, the subject word matching is performed based on the subject word of the seed abnormal subject in the subject feature set, and then the seed subject feature is obtained.

[0078] S2055: Select the target subject feature matched with the seed subject feature from the subject feature set.

[0079] In specific embodiments, similarity calculation is performed on the seed subject feature and the traffic subject feature in the subject feature set to obtain a feature similarity result. The similarity calculation can use, but is not limited to, similarity algorithms based on distance, angle cosine, or correlation coefficient, such as Euclidean distance algorithm, cosine similarity algorithm, or Pearson correlation coefficient algorithm. Then, the target subject feature is determined from the subject feature set based on the feature similarity result. Specifically, the feature similarity result includes the feature similarity between the seed subject feature and each traffic subject feature in the subject feature set. In some cases, the traffic subject features are sorted based on the feature similarity, and the top K traffic subject features with the highest feature similarity are taken as the target subject features, for example, K can be 5; in other cases, a similarity threshold can be set, and the traffic subject features with a feature similarity higher than the similarity threshold are taken as the target subject features.

[0080] In one embodiment, the angle cosine (Cosine) similarity algorithm is used to calculate the feature similarity between two traffic subject features, and the specific calculation formula is as follows, wherein A and B represent two different traffic subject features, A i and B i are the components of the traffic subject feature A and the traffic subject feature B, respectively.

[0081]

[0082] S2056: Determine the target abnormal subject corresponding to the associated traffic subject of the target subject feature.

[0083] The traffic subject feature can effectively express the traffic object information and operation mode information of the associated traffic subject, the higher the feature similarity, the more similar the traffic object information and operation mode information between the traffic subject features, and the more likely it belongs to the same subject. Through a small amount of seed abnormal subjects, the abnormal subject feature is positioned, and the rapid expansion and mining of abnormal subjects are realized. It can be understood that the more similar the context of the two associated traffic subjects in each subject operation sequence, the more similar the traffic object information and operation mode information between the associated traffic subjects, and the higher the possibility that the two associated traffic subjects belong to the same subject.

[0084] It can be understood that the feature similarity calculation described above can be repeatedly performed based on the determined target subject feature to obtain the feature similarity between the target subject feature and other traffic subject features in the subject feature set, and further determine the traffic subject feature matching the target subject feature, and thus reciprocate, expand and locate the remaining similar target abnormal subject from a single or several seed abnormal subjects, to realize the deep expansion and mining of abnormal subjects, and effectively improve the coverage and detection efficiency of abnormal detection.

[0085] Specifically, the abnormal subject group can be mined based on the feature similarity, such as calculating the feature similarity between the traffic subject feature of the abnormal subject A and other traffic subject features, screening a certain number of traffic subject features with the highest feature similarity, and determining the associated traffic subject corresponding to the screened traffic subject feature and the abnormal subject A as the same abnormal subject group. After obtaining the incremental subject feature of the incremental traffic subject, the feature similarity between the incremental subject feature and the subject feature of the known abnormal subject can be calculated, and the abnormal subject group to which the known abnormal subject with the highest feature similarity belongs is determined as the abnormal subject group to which the incremental traffic subject belongs.

[0086] In some cases, after determining the target abnormal subject, the abnormal detection result can be visualized and displayed, such as displaying the traffic subject identifier (APPID), feature similarity and attribute information of the TOPK abnormal subjects through a table. Please refer to Table 1 below. The attribute information can include but is not limited to subject nickname, subject registration name, settlement subject, subject type and registration time, etc. The serial number 0 in the table is the seed abnormal subject.

[0087] Table 1

[0088]

[0089] In other cases, the abnormal detection result can be generated and verified based on feature dimension reduction. Specifically, each traffic subject feature in the subject feature set can be processed by dimension reduction, such as reducing the 64-dimensional traffic subject feature to a two-dimensional feature vector, and then generating a visual vector distribution map based on the two-dimensional feature vector corresponding to the subject feature set, generating an abnormal detection result based on the vector distribution result in the visual vector distribution map to determine the target abnormal subject. Specifically, the feature dimension reduction method can include but is not limited to t-sne (t-distributed stochastic neighbor embedding, t-distributed stochastic neighbor embedding) and the like.

[0090] Please refer to Figure 8 , Figure 8The visualization vector distribution diagram in an embodiment is shown, and the two-dimensional feature vector of the seed abnormal subject exists in the vector point group on the right side of the diagram, and then the associated traffic subject in the vector point group is determined as the target abnormal subject, and the known normal traffic subject exists in the vector point group on the left side of the diagram, and then the associated traffic subject in the vector point group on the left side is determined as the normal traffic subject. It can be seen that the two-dimensional feature vector of the abnormal subject and the two-dimensional feature vector of the normal traffic subject have obvious distinguishability. In addition, the target abnormal subject determined by the similarity calculation method based on the seed abnormal subject is highly consistent with the associated traffic subject in the vector point group on the right side of the diagram, which verifies the accuracy of the above-mentioned abnormal subject detection method. In this way, based on the above-mentioned method, the abnormal aggregated traffic subject can be quickly located and determined to accurately perceive the abnormality.

[0091] In addition, based on the two-dimensional feature vector and the feature similarity result, the normal traffic subjects can also be grouped. Specifically, a visualization vector distribution diagram is generated based on the two-dimensional feature vector of the normal traffic subject, and the normal traffic subjects are grouped based on the vector distribution and the feature similarity result in the distribution diagram, to obtain a plurality of normal subject groups, and the operation modes of the associated traffic subjects in each normal subject group are similar. Please refer to Figure 9 , which shows a visualization vector distribution diagram of the two-dimensional feature vector of the normal traffic subject provided by an embodiment, Figure 9 The plurality of normal subject groups identified are marked by arrows in the diagram.

[0092] In summary, the technical scheme of the present application constructs the vector representation of the traffic subject based on the subject operation sequence of the traffic object, to express the object information and the operation mode information of the traffic subject; and locates the abnormal subject based on the vector representation, and mines the abnormal subject group and the diffusion of the abnormal subject group, to realize the promotion of anti-cheating. The above-mentioned scheme can break away from the dependence on the information of the traffic subject, identify the traffic subject group with inconsistent data information but high similarity of the traffic object or similar cheating operation mode, realize abnormal group determination and abnormal subject diffusion, and effectively improve the accuracy, coverage and positioning efficiency of abnormal detection.

[0093] Based on part or all of the above-mentioned embodiments, in the embodiment of the present application, please refer to Figure 10 , the subject feature set can be obtained based on the following steps S301-S309.

[0094] S301: Taking each subject word in the subject operation sequence as a center word, the context of the subject operation sequence is extracted to obtain a target subject word group corresponding to a plurality of target traffic objects, and the target subject word group includes a center subject word and a background subject word adjacent to the center subject word.

[0095] Specifically, the subject operation sequence is taken as a sentence, each subject word is taken as a center word, and context background words of the subject operation sequence are extracted based on a preset extraction window. For example, if the preset extraction window is 2, the first two subject words and the last two subject words of each center word in the subject operation sequence are extracted as background words, and each background word is combined with the center word to obtain a plurality of target subject word groups. For example, the subject operation sequence is "A / C / D / E / P / K", A is taken as a center word, and background words C and D are extracted, and then target subject word groups [A, C] / [A, D] are obtained, D is taken as a center word, and background words A and C in the preceding context and background words E and P in the following context are extracted, and then target subject word groups [D, A] / [D, C] / [D, E] / [D, P] are obtained.

[0096] S303: Construct a subject word set according to the subject operation sequences corresponding to the plurality of target traffic objects.

[0097] Specifically, the subject word set includes subject words of associated traffic subjects corresponding to the plurality of target traffic objects. In some embodiments, the subject word set can be stored in the form of a subject word table.

[0098] S305: Construct a first word feature matrix and a second word feature matrix of an initial word vector generation model based on the subject word set.

[0099] Specifically, the initial word vector generation model can include an input layer, a hidden layer, and an output layer, the first word feature matrix is a weight matrix between the input layer and the hidden layer, the second word feature matrix is a weight matrix between the hidden layer and the output layer, the dimension of the first word feature matrix is N*M, and the dimension of the second word feature matrix is M*N, where M is the dimension of the traffic subject feature, and N is the total number of subject words in the subject word set.

[0100] In specific embodiments, S305 can specifically include steps S3051-S3054.

[0101] S3051: Perform first feature encoding processing and second feature encoding processing on the subject words in the subject word set respectively to obtain first encoded features and second encoded features.

[0102] Specifically, the first feature encoding processing and the second feature encoding processing can be random feature assignment to the subject words, and the subject words are encoded into random feature values. The random feature values can be floating-point values, and the random feature values of different subject words are different from each other. After the first feature encoding processing and the second feature encoding processing are performed on the subject words in the subject word set, each subject word obtains two encoded features.

[0103] S3052: Perform feature mapping processing on the first encoding feature and the second encoding feature respectively to obtain an initial center word feature corresponding to the first encoding feature and an initial context word feature corresponding to the second encoding feature, and the initial center word feature and the initial context word feature are dense vectors of a preset dimension.

[0104] Specifically, the feature mapping processing can be mapping the random feature value of the subject word to a dense vector of a preset dimension M.

[0105] S3053: Construct a first word feature matrix based on the initial center word feature.

[0106] S3054: Construct a second word feature matrix based on the initial context word feature.

[0107] The number of rows of the first word feature matrix is the total number of subject words in the subject word set, the number of columns of the second word feature matrix is the preset dimension, the number of rows of the second word feature matrix is the preset dimension, and the number of columns of the second word feature matrix is the total number of multi-subject words.

[0108] Specifically, the first word feature matrix and the second word feature matrix are update targets in the initial word vector generation model training process.

[0109] S307: Perform context prediction training on the initial word vector generation model according to the center subject word and the context subject word to update the first word feature matrix and the second word feature matrix, and obtain a target word vector generation model including a center word feature matrix and a context word feature matrix.

[0110] Specifically, the center word feature matrix includes target center word features of each subject word in the subject word set, and the context word feature matrix includes target context word features of each subject word in the subject word set. The first encoding feature of the center subject word in the subject word group is taken as input, and the second encoding feature of the context word extracted by the preset extraction window is taken as expected output, and the initial word vector generation model is unsupervised trained.

[0111] In actual application, S307 can specifically include the following steps S3071-S3074.

[0112] S3071: Take the first encoding feature of the center subject word as input of the initial word vector generation model, and find the initial center word feature corresponding to the first encoding feature in the first word feature matrix.

[0113] S3072: Perform feature cross processing on the initial center word feature corresponding to the first encoding feature and the second word feature matrix to obtain a cross feature value set.

[0114] S3073: Determine the model loss based on the cross feature value set.

[0115] S3074: training the initial word vector generation model based on the model loss to update the initial center word features in the first word feature matrix and the initial background word features in the second word feature matrix until a training end condition is met, to obtain a target word vector generation model.

[0116] Specifically, the first encoding feature of the center subject word is multiplied by the first word feature matrix through the input layer, and the multiplication result is input into the hidden layer, and then the initial center word feature of the center subject word is output through the hidden layer. Alternatively, the index of the first encoding feature as the initial center word feature in the first word feature matrix and the index of the second encoding feature as the initial background word feature in the second word feature matrix can be found by associating the first encoding feature to input the hidden layer. The initial center word feature output by the hidden layer is processed by feature cross with the second word feature matrix. The feature cross processing here can be an inner product of the initial center word feature and the initial background word features of other subject words in the second word feature matrix. The cross feature value set includes N feature values between the initial center word feature and each initial background word feature; the N feature values are mapped by the softmax layer to obtain the prediction probability of N subject words. The prediction probability represents the probability of the corresponding subject word being a target background subject word in the subject word group to which the input center subject word belongs. The output layer is used to output the predicted background center word based on the prediction probability.

[0117] Further, the model loss is determined according to the prediction probability and a preset loss function, and the first word feature matrix and the second word feature matrix are updated according to the model loss and the gradient descent method. The update processing here is to update each initial center word feature in the first word feature matrix and each initial background word feature in the second word feature matrix. Specifically, the goal of model training and learning is to increase the prediction probability of the target background subject word and reduce the prediction probability of the irrelevant subject word.

[0118] Further, the steps S3071-S3073 are repeatedly executed. If the obtained model loss is lower than the preset loss or the iteration number reaches the preset iteration number, it is determined that the training end condition is met. The initial word vector generation model obtained in the current iteration is determined as the target word vector generation model, the updated first word feature matrix obtained in the current iteration is determined as the center word feature matrix, and the updated second feature matrix is determined as the background word feature matrix. If the model loss is higher than the preset loss or the iteration number does not reach the preset iteration number, steps S3071-S3073 are repeated until the training end condition is met.

[0119] In one embodiment, the above-mentioned initial word vector generation model can be a skip-gram. Please refer to Figure 11 , which shows a model structure diagram of the initial word vector generation model. In the diagram, W is the center word feature matrix, W' is the background word feature matrix, c is the center word, and w is the background word.ki a second encoding feature of a background subject word predicted by the model to be in the same group as the center subject word i.

[0120] S309: Construct a subject feature set according to the center word feature matrix of the target word vector generation model.

[0121] Specifically, after obtaining the target word vector generation model, the target center word feature of each subject word in the center word feature matrix of the target word vector generation model is determined as the traffic subject feature of the associated traffic subject corresponding to the subject word, and then the subject feature set is obtained. It can be understood that the initial center word feature and the initial background word feature obtained by the feature mapping processing do not contain effective semantic information. The initial word vector generation model is iteratively trained based on the object granularity subject operation sequence containing operation mode information, the word vector of the subject word is optimized, so that the word vector of the subject word contains semantic information of the operation mode and the object information, so as to realize the diffusion and group mining of abnormal subjects.

[0122] In some embodiments, the training target word vector generation model can be updated with a certain time length as the update granularity to obtain an updated subject feature set. The certain time length can be 1 day, for example, the top 7 subject operation sequences are obtained every day, and then the subject feature set corresponding to the current 7 days is constructed based on the above method.

[0123] In other embodiments, the target word vector generation model can be updated and trained based on incremental update. Correspondingly, S203 can further include the following steps.

[0124] S401: Obtain an incremental subject operation sequence and an incremental subject word group corresponding to the incremental subject operation sequence.

[0125] S403: Determine a new subject word in the incremental subject operation sequence, the new subject word being a subject word not belonging to the subject word set.

[0126] S405: Select a reference traffic subject from the associated traffic subjects corresponding to the plurality of target traffic objects, the reference traffic subject being a traffic subject similar in attribute to the incremental traffic subject corresponding to the new subject word.

[0127] Specifically, the incremental subject operation sequence can be obtained periodically, for example, the subject feature sequence is obtained once a week, and the corresponding subject word group is obtained. Each incremental subject word in the incremental subject operation sequence is matched with the subject words in the subject word set. If it is determined that the incremental subject word already exists in the subject word set, the target center word feature of the incremental subject word in the current center word feature matrix is still used. If the incremental subject word does not exist in the subject word set, it is determined as a new subject word, and the attribute data of the associated traffic subject corresponding to the new subject word is obtained, such as subject category and subject operation data, and a certain number of reference traffic subjects are selected based on the attribute data.

[0128] S407: generating initial incremental principal features of the incremental principal according to the principal features of the reference principal.

[0129] Specifically, the principal features of a certain number of reference principals can be summed and averaged to obtain the initial incremental principal features. The summing and averaging can be simple summing and averaging or weighted summing and averaging.

[0130] S409: updating the center word feature matrix and the background word feature matrix of the target word vector generation model according to the initial incremental principal features.

[0131] In some cases, the initial incremental principal features of the new principal are added to the center word feature matrix and the background word feature matrix. In other cases, initial background word features of the incremental principal are also generated according to the background word features of the reference principal, and then the initial incremental principal features of the new principal are added to the center word feature matrix and the initial background word features of the new principal are added to the background word feature matrix.

[0132] S411: iteratively training the context prediction of the target word vector generation model based on the incremental principal word group and the target principal word group to obtain an updated word vector generation model.

[0133] S413: constructing an updated principal feature set based on the center word feature matrix of the updated target model.

[0134] It can be understood that S411 and S413 are similar to the implementation modes of the aforementioned S307 and S309, and will not be described here. The target center word features of the incremental principal are included in the center word feature matrix of the updated word vector generation model, that is, the updated principal feature set includes the principal features of the associated incremental principal corresponding to the incremental principal. In this way, the model and the principal feature set are periodically updated, the confidence of the principal features and the abnormal detection result is improved, the initial word vector is generated based on the existing principal features of the incremental principal, and then the initial word vector is trained, so that the initial word vector has certain effective semantic information, the model convergence speed is accelerated, and the early confidence of the principal features of the incremental principal is improved.

[0135] In summary, the subject operation sequence is first constructed based on the subject operation sequence, the vector representation of the principal is trained using the preset word vector generation model, the feature similarity between the principals is described, and finally the abnormal group and the diffusion abnormal principal are mined based on the vector representation of the principal and the feature similarity, so as to improve the coverage of the cheating principal, perceive the abnormal principal in the group dimension, reduce the potential cheating risk, and maintain and promote the interests of the principal and the promotion ecology.

[0136] The embodiment of the present application also provides an abnormal subject detection device 600, as shown in Figure 12 Figure 12 The embodiment of the present application shows a structural schematic diagram of an abnormal subject detection device, and the device can include the following modules.

[0137] The operation sequence acquisition module 10 is configured to acquire subject operation sequences corresponding to a plurality of target traffic objects in a preset period, wherein the subject operation sequence is composed of subject words of an associated traffic subject corresponding to the target traffic object, and the associated traffic subject is a traffic subject that has a preset interaction operation with the target traffic object in the preset period;

[0138] The subject feature set construction module 20 is configured to construct a subject feature set based on the subject operation sequences corresponding to the plurality of target traffic objects, wherein the subject feature set includes traffic subject features of the associated traffic subjects corresponding to the plurality of target traffic objects;

[0139] The anomaly detection module 30 is configured to perform anomaly detection on the associated traffic subjects according to the traffic subject features, to obtain an abnormal subject detection result.

[0140] In some embodiments, the subject feature set construction module 20 can include:

[0141] The context extraction sub-module is configured to take each subject word in the subject operation sequence as a center word, to perform context extraction on the subject operation sequence, to obtain target subject word groups corresponding to the plurality of target traffic objects, and the target subject word group includes the center subject word and background subject words adjacent to the center subject word;

[0142] The subject word set construction sub-module is configured to construct a subject word set according to the subject operation sequences corresponding to the plurality of target traffic objects;

[0143] The feature matrix construction sub-module is configured to construct a first word feature matrix and a second word feature matrix of an initial word vector generation model based on the subject word set;

[0144] The prediction training sub-module is configured to perform context prediction training on the initial word vector generation model according to the center subject word and the background subject words, to update the first word feature matrix and the second word feature matrix, to obtain a target word vector generation model including a center word feature matrix and a background word feature matrix;

[0145] The subject feature set generation sub-module is configured to construct the subject feature set according to the center word feature matrix of the target word vector generation model.

[0146] In some embodiments, the feature matrix construction sub-module can include:

[0147] ​The feature encoding unit is configured to perform first feature encoding processing and second feature encoding processing on the subject words in the subject word set respectively to obtain first encoded features and second encoded features.

[0148] The feature mapping unit is configured to perform feature mapping processing on the first encoded features and the second encoded features respectively to obtain initial center word features corresponding to the first encoded features and initial background word features corresponding to the second encoded features, the initial center word features and the initial background word features being dense vectors of a preset dimension.

[0149] The first word feature matrix construction unit is configured to construct a first word feature matrix based on the initial center word features.

[0150] The second word feature matrix construction unit is configured to construct a second word feature matrix based on the initial background word features.

[0151] The first word feature matrix has a number of rows equal to a total number of the subject words in the subject word set, the second word feature matrix has a number of columns equal to the preset dimension, the second word feature matrix has a number of rows equal to the preset dimension, and the second word feature matrix has a number of columns equal to a total number of the multi-subject words.

[0152] In some embodiments, the prediction training submodule can include:

[0153] The center word feature lookup unit is configured to take the first encoded features of the center subject words as inputs of the initial word vector generation model, and look up the initial center word features corresponding to the first encoded features in the first word feature matrix.

[0154] The feature crossing unit is configured to perform feature crossing processing on the initial center word features corresponding to the first encoded features and the second word feature matrix to obtain a set of crossing feature values.

[0155] The model loss determination unit is configured to determine a model loss based on the set of crossing feature values.

[0156] The model training unit is configured to train the initial word vector generation model based on the model loss to update the initial center word features in the first word feature matrix and the initial background word features in the second word feature matrix until a training end condition is met, and obtain a target word vector generation model.

[0157] In some embodiments, the subject feature set construction module 20 can further include:

[0158] The incremental sequence acquisition submodule is configured to acquire an incremental subject operation sequence and an incremental subject word group corresponding to the incremental subject operation sequence.

[0159] The new subject word determination submodule is configured to determine new subject words in the incremental subject operation sequence, the new subject words being subject words not belonging to the subject word set.

[0160] The reference traffic subject screening submodule is configured to screen a reference traffic subject from the associated traffic subjects corresponding to the plurality of target traffic objects, the reference traffic subject being a traffic subject similar to the incremental traffic subject corresponding to the new subject word in an incremental subject attribute;

[0161] The incremental word feature generation submodule is configured to generate initial incremental subject features of the incremental traffic subject according to the traffic subject features of the reference traffic subject;

[0162] The feature matrix updating submodule is configured to update the center word feature matrix and the background word feature matrix of the target word vector generation model according to the initial incremental subject features;

[0163] The update training submodule is configured to perform iterative training of the context prediction of the target word vector generation model based on the incremental subject word group and the target subject word group, to obtain an updated word vector generation model;

[0164] The subject feature set updating submodule is configured to construct an updated subject feature set based on the center word feature matrix of the updated target model.

[0165] In some embodiments, the operation sequence acquisition module 10 can include:

[0166] The operation data acquisition submodule is configured to acquire object operation data of the plurality of target traffic objects respectively in a preset time period, the object operation data including traffic object identifiers, subject words of associated traffic subjects, and operation time information of preset interaction operations;

[0167] The subject word combination submodule is configured to combine and process the subject words according to the traffic object identifiers and the operation time information, to obtain subject operation sequences corresponding to the plurality of target traffic objects.

[0168] In some embodiments, the subject word combination submodule can include:

[0169] The sorting combination unit is configured to sort and combine the subject words corresponding to each of the plurality of target traffic objects based on the traffic object identifiers and the operation time information, to obtain initial sequences corresponding to the plurality of target traffic objects respectively;

[0170] The deduplication processing unit is configured to perform deduplication processing on the continuous same subject words in the initial sequences, to obtain the subject operation sequences corresponding to the plurality of target traffic objects.

[0171] In some embodiments, the anomaly detection module 30 can include:

[0172] The clustering processing submodule is configured to perform clustering processing on the traffic subject features in the subject feature set, to obtain subject feature clusters;

[0173] The first subject determining submodule is configured to determine the subject feature cluster as an abnormal subject group when any associated traffic subject corresponding to the subject feature cluster group has an abnormal label.

[0174] In some embodiments, the anomaly detection module 30 can include:

[0175] The seed subject obtaining submodule is configured to obtain a seed abnormal subject in the associated traffic subjects corresponding to the target traffic objects.

[0176] The seed feature determining submodule is configured to determine a seed subject feature of the seed abnormal subject in the subject feature set.

[0177] The target feature screening submodule is configured to screen a target subject feature matching the seed subject feature from the subject feature set.

[0178] The second subject determining submodule is configured to determine the associated traffic subject corresponding to the target subject feature as a target abnormal subject.

[0179] In some embodiments, the target feature screening submodule can include:

[0180] The similarity calculation unit is configured to perform similarity calculation on the seed subject feature and the traffic subject features in the subject feature set to obtain a feature similarity result.

[0181] The target feature determining unit is configured to determine the target subject feature from the subject feature set based on the feature similarity result.

[0182] It should be noted that the above device embodiments and method embodiments are based on the same implementation.

[0183] Embodiments of the present application provide an anomaly subject detection device, which can be a terminal or a server, including a processor and a memory, the memory storing at least one instruction or at least one program, the at least one instruction or the at least one program being loaded and executed by the processor to implement the anomaly subject detection method provided by the above method embodiments.

[0184] The memory can be used to store software programs and modules, and the processor can execute various functions and anomaly subject detection by running the software programs and modules stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, application programs required by functions, etc.; the data storage area can store data created according to the use of the device, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other volatile solid-state memory device. Accordingly, the memory can also include a memory controller to provide access for the processor to the memory.

[0185] The methods and embodiments provided in this application can be executed in electronic devices such as mobile terminals, computer terminals, servers, or similar computing devices. Figure 13 This is a hardware structure block diagram of an electronic device for an abnormal subject detection method provided in an embodiment of this application. For example... Figure 13 As shown, the electronic device 900 can vary significantly due to different configurations or performance. It may include one or more Central Processing Units (CPUs) 910 (CPUs 910 may include, but are not limited to, microprocessors such as MCUs or programmable logic devices such as FPGAs), a memory 930 for storing data, and one or more storage media 920 (e.g., one or more mass storage devices) for storing application programs 923 or data 922. The memory 930 and storage media 920 may be temporary or persistent storage. The program stored in the storage media 920 may include one or more modules, each module including a series of instruction operations on the electronic device. Furthermore, the CPU 910 may be configured to communicate with the storage media 920 and execute a series of instruction operations in the storage media 920 on the electronic device 900. The electronic device 900 may also include one or more power supplies 960, one or more wired or wireless network interfaces 950, one or more input / output interfaces 940, and / or one or more operating systems 921, such as Windows Server. TM Mac OS X TM Unix TM Linux™, FreeBSD™, etc.

[0186] The input / output interface 940 can be used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the electronic device 900. In one example, the input / output interface 940 includes a network interface controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the input / output interface 940 may be a radio frequency (RF) module for wireless communication with the Internet.

[0187] Those skilled in the art will understand that Figure 13 The structure shown is for illustrative purposes only and does not limit the structure of the electronic device described above. For example, the electronic device 900 may also include... Figure 13 The more or fewer components shown, or having the same Figure 13different configurations are shown.

[0188] The embodiment of the present application further provides a computer readable storage medium, which can be arranged in an electronic device to store at least one instruction or at least one program for implementing an abnormal subject detection method in the method embodiment, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the abnormal subject detection method provided by the method embodiment.

[0189] Optionally, in the embodiment, the storage medium can be located in at least one network server of a plurality of network servers of a computer network. Optionally, in the embodiment, the storage medium can include but is not limited to a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk and various storage program codes.

[0190] According to an aspect of the present application, a computer program product or a computer program is provided, which includes computer instructions stored in a computer readable storage medium. A processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to enable the computer device to perform the method provided in the various optional implementation manners.

[0191] As can be seen from the embodiments of the abnormal subject detection method, device, equipment, server, terminal, storage medium and program product provided by the present application, the technical solution of the present application obtains a subject operation sequence corresponding to a plurality of target traffic objects in a preset period, the subject operation sequence is composed of subject words of an associated traffic subject corresponding to the target traffic object, the associated traffic subject is a traffic subject that has a preset interaction operation with the target traffic object in the preset period; a subject feature set is constructed based on the subject operation sequences corresponding to the plurality of target traffic objects, the subject feature set includes traffic subject features of the associated traffic subjects corresponding to the plurality of target traffic objects; and then the associated traffic subjects are detected based on the traffic subject features to obtain an abnormal subject detection result. In this way, the subject operation sequence is obtained based on the operation data of the target traffic object, and the traffic subject features capable of representing the traffic subjects are further constructed, the abnormal detection is performed without relying on the information provided by the traffic subjects, the reliability and accuracy of the abnormal detection result are improved, and based on the traffic subject features, the computational complexity is reduced, the detection efficiency is improved, and the resource occupation is reduced.

[0192] It should be noted that the above-mentioned order of the embodiments of the present application is only for description, and does not represent the advantages and disadvantages of the embodiments. And the above-mentioned specific embodiments of the present application are described. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from the order in the embodiments and still achieve the desired result. In addition, the processes depicted in the figures do not necessarily require the particular order or sequential order shown or described to achieve the desired results. In certain implementations, multitasking and parallel processing can be advantageous or possible.

[0193] Each of the embodiments in the present application is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other. Each embodiment focuses on the difference from other embodiments. Especially, for the device, equipment and storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiments.

[0194] A person of ordinary skill in the art can understand that all or part of the steps of the above-mentioned embodiments can be completed by hardware, or by a program instructing the relevant hardware to complete, and the program can be stored in a computer readable storage medium. The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk.

[0195] The above is only the preferred embodiment of the present application, and does not limit the present application. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. An abnormal subject detection method, characterized in that, The method includes: Obtain the main operation sequence corresponding to multiple target traffic objects within a preset time period. The main operation sequence is composed of the main words of the associated traffic subjects corresponding to the target traffic objects. The associated traffic subjects are traffic subjects that have preset interactive operations with the target traffic objects within the preset time period. A subject feature set is constructed based on the subject operation sequence corresponding to the multiple target traffic objects. The subject feature set includes the traffic subject features of the associated traffic subjects corresponding to the multiple target traffic objects. Anomaly detection is performed on the associated traffic subject based on the characteristics of the traffic subject, and anomaly detection results are obtained.

2. The method according to claim 1, characterized in that, The construction of the main feature set based on the main operation sequence corresponding to the multiple target traffic objects includes: Using each subject word in the main operation sequence as the center word, the context of the main operation sequence is extracted to obtain the target subject word group corresponding to the multiple target traffic objects. The target subject word group includes the center subject word and the background subject word adjacent to the center subject word. Construct a subject word set based on the subject operation sequence corresponding to the multiple target traffic objects; Based on the main word set, construct the first word feature matrix and the second word feature matrix of the initial word vector generation model; The initial word vector generation model is trained for context prediction based on the central subject word and the background subject word to update the first word feature matrix and the second word feature matrix, thereby obtaining a target word vector generation model including the central word feature matrix and the background word feature matrix; The main feature set is constructed based on the central word feature matrix of the target word vector generation model.

3. The method according to claim 2, characterized in that, The first word feature matrix and the second word feature matrix of the initial word vector generation model constructed based on the main word set include: The main words in the main word set are subjected to first feature encoding processing and second feature encoding processing respectively to obtain first encoding features and second encoding features; The first encoded feature and the second encoded feature are respectively subjected to feature mapping processing to obtain the initial center word feature corresponding to the first encoded feature and the initial background word feature corresponding to the second encoded feature. The initial center word feature and the initial background word feature are dense vectors of a preset dimension. Construct the first word feature matrix based on the initial center word features; Construct the second word feature matrix based on the initial background word features; Wherein, the number of rows in the first word feature matrix is ​​the total number of main words in the main word set, the number of columns in the second word feature matrix is ​​the preset dimension, the number of rows in the second word feature matrix is ​​the preset dimension, and the number of columns in the second word feature matrix is ​​the total number of main words.

4. The method according to claim 3, characterized in that, The step of training the initial word vector generation model based on the central subject word and the background subject word to update the first word feature matrix and the second word feature matrix, thereby obtaining a target word vector generation model including the central word feature matrix and the background word feature matrix, includes: The first encoding feature of the central word is used as the input of the initial word vector generation model, and the initial central word feature corresponding to the first encoding feature is found in the first word feature matrix; The initial center word feature corresponding to the first encoded feature and the second word feature matrix are subjected to feature cross processing to obtain a cross feature value set; The model loss is determined based on the aforementioned cross feature set; The initial word vector generation model is trained based on the model loss to update the initial center word features in the first word feature matrix and the initial background word features in the second word feature matrix until the training termination condition is met, thus obtaining the target word vector generation model.

5. The method according to claim 2, characterized in that, The method further includes: Obtain the incremental subject operation sequence and the incremental subject phrase corresponding to the incremental subject operation sequence; Determine the newly added subject words in the incremental subject operation sequence, wherein the newly added subject words are subject words that do not belong to the subject word set; Reference traffic subjects are selected from the associated traffic subjects corresponding to the multiple target traffic objects. The reference traffic subjects are traffic subjects with similar attributes to the incremental traffic subjects corresponding to the newly added subject words. The initial incremental subject characteristics of the incremental traffic subject are generated based on the traffic subject characteristics of the reference traffic subject; The center word feature matrix and background word feature matrix of the target word vector generation model are updated based on the initial incremental subject features; Based on the incremental subject phrase and the target subject phrase, the target word vector generation model is iteratively trained using context prediction to obtain an updated word vector generation model; An updated subject feature set is constructed based on the updated target model's central word feature matrix.

6. The method according to any one of claims 1-5, characterized in that, The main operation sequence for obtaining multiple target traffic objects within a preset time period includes: Obtain object operation data for each of the multiple target traffic objects within the preset time period. The object operation data includes traffic object identifier, subject words associated with the traffic subject, and operation time information of the preset interactive operation. The subject words are combined based on the traffic object identifier and the operation time information to obtain the subject operation sequence corresponding to the multiple target traffic objects.

7. The method according to claim 6, characterized in that, The step of combining the main words based on the operation time information to obtain the main operation sequence corresponding to the multiple target traffic objects includes: Based on the traffic object identifier and the operation time information, the main words corresponding to each of the multiple target traffic objects are sorted and combined to obtain the initial sequence corresponding to each of the multiple target traffic objects. The initial sequence is deduplicated by removing consecutive identical subject words to obtain the subject operation sequence corresponding to the multiple target traffic objects.

8. The method according to any one of claims 1-5, characterized in that, The step of performing anomaly detection on the associated traffic subject based on the traffic subject characteristics to obtain the anomaly subject detection result includes: Clustering is performed on the traffic main features in the main feature set to obtain main feature clusters; If any associated traffic subject corresponding to the main feature cluster has an abnormal label, the main feature cluster is identified as an abnormal subject group.

9. The method according to any one of claims 1-5, characterized in that, The step of performing anomaly detection on the associated traffic subject based on the traffic subject characteristics to obtain the anomaly subject detection result includes: Obtain the seed abnormal subject from the associated traffic subjects corresponding to the multiple target traffic objects; The seed subject features of the seed abnormal subject are determined from the subject feature set; Target subject features that match the seed subject features are selected from the subject feature set; The associated traffic subject corresponding to the target subject characteristics is identified as the target abnormal subject.

10. The method according to claim 9, characterized in that, The step of selecting target subject features that match the seed subject features from the subject feature set includes: The similarity between the seed main features and the traffic main features in the main feature set is calculated to obtain the feature similarity result; The target subject features are determined from the subject feature set based on the feature similarity results.

11. An abnormal subject detection device, characterized in that, The device includes: Operation sequence acquisition module: used to acquire the main operation sequence corresponding to multiple target traffic objects within a preset time period. The main operation sequence is composed of the main words of the associated traffic subject corresponding to the target traffic object. The associated traffic subject is a traffic subject that has a preset interactive operation with the target traffic object within the preset time period. Subject Feature Set Construction Module: Used to construct a subject feature set based on the subject operation sequence corresponding to the multiple target traffic objects, wherein the subject feature set includes traffic subject features of the associated traffic subjects corresponding to the multiple target traffic objects; Anomaly detection module: used to perform anomaly detection on the associated traffic subject based on the characteristics of the traffic subject, and obtain the anomaly subject detection result.

12. A computer-readable storage medium, characterized in that, The storage medium stores at least one instruction or at least one program segment, which is loaded and executed by a processor to implement the abnormal subject detection method as described in any one of claims 1-10.

13. A computer device, characterized in that, The device includes a processor and a memory, the memory storing at least one instruction or at least one program, the at least one instruction or the at least one program being loaded and executed by the processor to implement the abnormal subject detection method as described in any one of claims 1-10.

14. A computer program product or computer program, characterized in that, The computer program product or computer program includes computer instructions that, when executed by a processor, implement the abnormal subject detection method as described in any one of claims 1-10.

Images