Method, apparatus and electronic device for identifying a network fraud behavior

Abstract

The present application provides a method, apparatus and electronic device for identifying online fraud behaviors. The method includes: obtaining first interaction behavior characteristics between a first social account and a second social account; obtaining a first fraud behavior risk level of the second social account according to the first interaction behavior characteristics; when the first fraud behavior risk level is greater than or equal to a preset risk level, confirming whether the social relationship of the second social account is in an abnormal social state; when the social relationship of the second social account is in an abnormal social state, obtaining the abnormal behavior frequency of the second social account; when the abnormal behavior frequency is greater than a preset frequency, sending a fraud behavior warning message to the first social account. Through the above method, the problem that due to the complexity of online social relationships, the monitoring of online fraud behaviors sometimes results in misjudgment and false alarms, which not only brings unnecessary troubles to users, but also affects the reputation of the business side, is solved.

Description

Technical Field

[0001] This application relates to the technical field of data analysis, and particularly to a method, apparatus, and electronic device for identifying network fraud behavior. Background Art

[0002] Currently, with the extensive development of the Internet and the rapid development of online modes such as e-commerce, instant messaging, and third-party payment, interacting through the social functions in the above-mentioned related applications has become a part of people's daily lives. However, behind this convenience, there are also some risks, such as network fraud. To protect the interests of users and business parties, developers need to strengthen the monitoring of online transactions and timely identify and prevent network fraud behavior. Due to the complexity of network social relationships, misjudgment and false alarms sometimes occur, which not only cause unnecessary troubles to users but also affect the reputation of business parties.

[0003] Based on the actual needs in the above scenario, a method, apparatus, and electronic device for identifying network fraud behavior are proposed to solve the problems existing in the related technologies. Summary of the Invention

[0004] This application provides a method, apparatus, and electronic device for identifying network fraud behavior to solve the problem that due to the complexity of network social relationships, misjudgment and false alarms sometimes occur in the monitoring of network fraud behavior, which not only cause unnecessary troubles to users but also affect the reputation of business parties.

[0005] In the first aspect of this application, a method for identifying network fraud behavior is provided. The method includes: obtaining the first interaction behavior feature between the first social account and the second social account; obtaining the first fraud behavior risk degree of the second social account according to the first interaction behavior feature; when the first fraud behavior risk degree is greater than or equal to the preset risk degree, confirming whether the social relationship of the second social account is in a social abnormal state; when the social relationship of the second social account is in a social abnormal state, obtaining the abnormal behavior frequency of the second social account; when the abnormal behavior frequency is greater than the preset frequency, sending a fraud behavior warning message to the first social account.

[0006] By adopting the above method, based on the first interaction behavior characteristics between the first social account and the second social account, it is determined whether there is a risk of fraud behavior for the second social account; at the same time, when the risk of the second social account is too high, the social relationships of the second social account are detected to determine whether the second social account is an abnormal account, and finally, based on the abnormal behavior frequency of the abnormal account, it is determined whether to send a fraud behavior warning message to the first social account. Through the interaction behavior characteristics, account social relationships, and abnormal behavior frequencies, the network fraud behavior of the second social account is identified and confirmed from multiple dimensions, improving the accuracy of the network fraud behavior monitoring results, taking into account the complexity of network social relationships, and reducing the occurrence of misjudgment and false alarm situations in the monitoring results.

[0007] Optionally, confirming whether the social relationship of the second social account is in a socially abnormal state specifically includes: obtaining the social states between each social account having a social relationship with the second social account; obtaining the social correlation degree between each social account based on the social states between each social account; when the social correlation degree is less than the preset social correlation degree, confirming that the social relationship of the second social account is in a socially abnormal state; when the social correlation degree is greater than or equal to the preset social correlation degree, confirming that the social relationship of the second social account is in a socially normal state.

[0008] By adopting the above method, a comprehensive analysis of the social relationships of the second social account can be carried out, which can more accurately judge the association degree between social accounts and improve the accuracy of social relationship analysis.

[0009] Optionally, the method further includes: when the social relationship of the second social account is in a socially normal state, obtaining the common social accounts of the first social account and the second social account; obtaining the second interaction behavior characteristics between the second social account and the common social accounts to obtain the second fraud behavior risk degree of the second social account; when the second fraud behavior risk degree is greater than or equal to the preset risk degree, sending an account abnormal warning message to the first social account.

[0010] By adopting the above method, it is possible to further identify the possibility that the first interaction behavior between the first social account and the second social account is abnormal when the social relationship of the second social account is in a socially normal state. Remind the first social account that the current second social account is in an abnormal state, and avoid being lax about the abnormal interaction behavior of the second social account due to the second social account being in a socially normal state.

[0011] Optionally, according to the first interaction behavior feature, obtain the first fraud behavior risk degree of the second social account, specifically including: vectorize the first interaction behavior feature according to the interaction behavior content, interaction behavior frequency, and interaction behavior time of the first interaction behavior feature to obtain a first interaction behavior vector; input the first interaction behavior vector into a preset vector machine model, where the preset vector machine model is trained according to the interaction behavior features of historical social fraud accounts; obtain the first fraud behavior risk degree output by the preset vector machine model.

[0012] By adopting the above method, vectorizing the first interaction behavior feature and inputting the first interaction behavior vector into the preset vector machine model, a more accurate first fraud behavior risk degree of the second social account can be obtained, improving the accuracy of fraud behavior recognition.

[0013] Optionally, the method further includes: obtaining the account login address of the second social account; comparing the account login address with the historical account login addresses to determine whether the account login address is the common address of the second social account.

[0014] By adopting the above method, obtaining the account login address of the second social account and comparing the account login address with the historical account login addresses can more timely discover whether the account login address is the common address of the second social account, enhancing the monitoring ability of network fraud behavior.

[0015] Optionally, obtain the second interaction behavior feature between the second social account and the common social account to obtain the second fraud behavior risk degree of the second social account, specifically including: query the occurrence time point of the first interaction behavior feature; according to the occurrence time point, pull the interaction behavior feature between the second social account and the common social account to obtain the second interaction behavior feature; according to the second interaction behavior feature, obtain multiple fraud behavior risk degrees of the second social account and any one common social account, sort the multiple fraud behavior risk degrees, and determine the fraud behavior risk degree ranked first as the second fraud behavior risk degree.

[0016] By adopting the above method, pulling the interaction behavior feature between the second social account and the common social account according to the occurrence time point, obtaining multiple fraud behavior risk degrees of the second social account and any one common social account according to these features, and sorting the multiple fraud behavior risk degrees, a more accurate second fraud behavior risk degree can be obtained, providing more reliable support for preventing network fraud behavior.

[0017] Optionally, the social association degree between each social account is determined according to the following formula:

[0018] W = S n / 0.5n(n - 1)

[0019] Among them, W is the social correlation degree, n is the number of each social account, and S n is the number of social relationships existing in each social account.

[0020] The second aspect of this application provides an identification device for network fraud behavior, and the device includes: a feature acquisition unit, a first risk judgment unit, a status confirmation unit, a frequency acquisition unit, and a first information prompt unit.

[0021] The feature acquisition unit is used to acquire the first interaction behavior feature between the first social account and the second social account.

[0022] The first risk judgment unit is used to obtain the first fraud behavior risk degree of the second social account according to the first interaction behavior feature.

[0023] The status confirmation unit is used to confirm whether the social relationship of the second social account is in a social abnormal state when the first fraud behavior risk degree is greater than or equal to the preset risk degree.

[0024] The frequency acquisition unit is used to obtain the abnormal behavior frequency of the second social account when the social relationship of the second social account is in a social abnormal state.

[0025] The first information prompt unit is used to send a fraud behavior warning message to the first social account when the abnormal behavior frequency is greater than the preset frequency.

[0026] Optionally, the status confirmation unit specifically includes a status acquisition module, a correlation degree acquisition module, and a status judgment module.

[0027] The status acquisition module is used to acquire the social status between each social account having a social relationship with the second social account.

[0028] The correlation degree acquisition module is used to obtain the social correlation degree between each social account according to the social status between each social account.

[0029] The status judgment module is used to confirm that the social relationship of the second social account is in a social abnormal state when the social correlation degree is less than the preset social correlation degree; and confirm that the social relationship of the second social account is in a social normal state when the social correlation degree is greater than or equal to the preset social correlation degree.

[0030] Optionally, the device further includes an account acquisition unit, a second risk judgment unit, and a second information prompt unit.

[0031] The account acquisition unit is used to acquire the common social accounts of the first social account and the second social account when the social relationship of the second social account is in a social normal state.

[0032] The second risk judgment unit is configured to obtain the second interaction behavior feature between the second social account and the common social account, and obtain the second fraud behavior risk degree of the second social account.

[0033] The second information prompt unit is configured to send an account anomaly warning message to the first social account when the second fraud behavior risk degree is greater than or equal to the preset risk degree.

[0034] Optionally, the first risk judgment unit specifically includes a feature processing module, a model application module, and a risk acquisition module.

[0035] The feature processing module is configured to perform vectorization processing on the first interaction behavior feature according to the interaction behavior content, interaction behavior frequency, and interaction behavior time of the first interaction behavior feature, and obtain the first interaction behavior vector.

[0036] The model application module is configured to input the first interaction behavior vector into a preset vector machine model, and the preset vector machine model is trained according to the interaction behavior features of historical social fraud accounts.

[0037] The risk acquisition module is configured to obtain the first fraud behavior risk degree output by the preset vector machine model.

[0038] Optionally, the device further includes an address detection unit, and the address detection unit is configured to obtain the account login address of the second social account; compare the account login address with the historical account login address to determine whether the account login address is the common address of the second social account.

[0039] Optionally, the second risk judgment unit is specifically configured to query the occurrence time point of the first interaction behavior feature; pull the interaction behavior feature between the second social account and the common social account according to the occurrence time point to obtain the second interaction behavior feature; according to the second interaction behavior feature, obtain multiple fraud behavior risk degrees of the second social account and any one common social account, sort the multiple fraud behavior risk degrees, and determine the fraud behavior risk degree ranked first as the second fraud behavior risk degree.

[0040] A third aspect of the present application provides an electronic device, which includes a processor, a memory, a user interface, and a network interface. The memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device executes the method of any one of the above.

[0041] A fourth aspect of the present application provides a computer-readable storage medium, which stores instructions, and when the instructions are executed, the method of any one of the above is executed.

[0042] Compared with the related art, the beneficial effects of the present application are:

[0043] 1. By adopting the above method, the network fraud behavior of the second social account is identified and confirmed from multiple dimensions through interactive behavior characteristics, account social relationships, and abnormal behavior frequencies, improving the accuracy of the monitoring results of network fraud behavior. Considering the complexity of network social relationships, the occurrence of misjudgment and false alarm in the monitoring results is reduced.

[0044] 2. By adopting the above method, a comprehensive analysis of the social relationships of the second social account can be carried out, enabling a more accurate judgment of the degree of association between social accounts and improving the accuracy of social relationship analysis.

[0045] 3. It is possible to further identify the possibility that the first interactive behavior between the first social account and the second social account is abnormal when the social relationship of the second social account is in a normal social state. Remind the first social account that the current second social account is in an abnormal state, and avoid being lax about the abnormal interactive behavior of the second social account due to the normal social state of the second social account.

[0046] 4. By adopting the above method, the account login address of the second social account is obtained and compared with the historical account login address, enabling a more timely discovery of whether the account login address is the usual address of the second social account and enhancing the monitoring ability of network fraud behavior.

[0047] 5. Pull the interactive behavior characteristics between the second social account and the common social accounts according to the occurrence time point, and obtain the multiple fraud behavior risk degrees of the second social account and any one of the common social accounts based on these characteristics. Sorting the multiple fraud behavior risk degrees can obtain a more accurate second fraud behavior risk degree, providing more reliable support for preventing network fraud behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 is the first process schematic diagram of a method for identifying network fraud behavior provided by an embodiment of the present application;

[0049] Figure 2 is the first scenario schematic diagram of a method for identifying network fraud behavior provided by an embodiment of the present application;

[0050] Figure 3 is the second scenario schematic diagram of a method for identifying network fraud behavior provided by an embodiment of the present application;

[0051] Figure 4 is the second process schematic diagram of a method for identifying network fraud behavior provided by an embodiment of the present application;

[0052] Figure 5It is a schematic diagram of a third scenario of a method for identifying online fraud behavior provided by an embodiment of the present application;

[0053] Figure 6 It is a schematic structural diagram of an apparatus for identifying online fraud behavior provided by an embodiment of the present application;

[0054] Figure 7 It is a schematic structural diagram of an electronic device provided by an embodiment of the present application.

[0055] Reference numerals: 61, feature acquisition unit; 62, first risk judgment unit; 63, status confirmation unit; 64, frequency acquisition unit; 65, first information prompt unit; 700, electronic device; 701, processor; 702, communication bus; 703, user interface; 704, network interface; 705, memory. Detailed implementation manners

[0056] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of this specification. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments.

[0057] In the description of the embodiments of the present application, words such as "exemplary", "for example" or "for illustration" are used to represent examples, illustrations or explanations. Any embodiment or design solution described as "exemplary", "for example" or "for illustration" in the embodiments of the present application should not be construed as being more preferred or having more advantages than other embodiments or design solutions. Exactly speaking, the use of words such as "exemplary", "for example" or "for illustration" is intended to present related concepts in a specific manner.

[0058] In the description of the embodiments of the present application, unless otherwise specified, the meaning of the term "a plurality" refers to two or more. For example, a plurality of systems refers to two or more systems, and a plurality of screen terminals refers to two or more screen terminals. In addition, the terms "first" and "second" are only used for descriptive purposes and cannot be construed as indicating or implying relative importance or implicitly indicating the technical features indicated. Thus, the features defined with "first" and "second" may explicitly or implicitly include one or more of such features. The terms "include", "comprise", "have" and their variants all mean "including but not limited to", unless otherwise particularly emphasized in other ways.

[0059] The method in the embodiments of the present application is used to solve the problem that due to the complexity of online social relationships, the monitoring of online fraud behavior sometimes results in misjudgment and false alarm, which not only brings unnecessary troubles to users, but also affects the reputation of the business party.

[0060] Specifically, it can be applied to Internet application scenarios with social relationships, used to identify whether the user behaviors in the social network are normal, timely detect and handle fraud behaviors, and protect the privacy and property of users. For example, in a social network, some people may conduct fraud behaviors by forging friend accounts, spreading false information, etc. Using this method can timely detect and handle these accounts and information, protecting the interests of users. Specifically, service providing platforms including online game platforms, e-commerce platforms, and instant messaging software can protect the rights and interests of users through this method.

[0061] Exemplarily, in an online game platform, the above method can be used to identify whether behaviors such as transactions and competitions in the game are normal, preventing fraud behaviors from destroying the fairness of the game and damaging the interests of users. Using this method can timely detect and handle these behaviors, protecting the interests of other users.

[0062] For an e-commerce platform, it is a high-incidence area of online fraud behaviors. The above method can be used to identify whether the transaction behaviors between buyers and sellers are normal, timely detect fraud behaviors, and protect the interests of buyers and sellers. For example, when the transaction behaviors between a buyer and a seller are abnormal, the platform can timely detect and take corresponding measures through using this method to avoid the situation of being defrauded of property.

[0063] An online payment system is also a place where online fraud behaviors occur frequently. The above method can be used to identify whether payment behaviors are normal, preventing fraud behaviors from threatening the security of the payment system. For example, during the payment process, if it is found that the payment behavior is abnormal, this method can be used to timely identify and intercept fraud behaviors, protecting the security of the payment system and the property of users.

[0064] The embodiment of the present application provides a method for identifying online fraud behaviors, as Figure 1 shown, the method includes steps S101 - S105.

[0065] S101, obtain the first interaction behavior feature between the first social account and the second social account.

[0066] Specifically, the first interaction behavior feature includes: the content of the interaction behavior, the frequency of the interaction behavior, and the time of the interaction behavior.

[0067] Among them, the content of the interaction behavior: The message content sent between the first social account and the second social account may be an important clue to fraud. For example, if the message content contains a large number of repeated, random or abnormal characters, or involves sensitive information (such as personal information, bank account numbers, etc.), then there may be a risk of fraud for the second social account. Interaction behavior frequency: The frequency of sending messages between the first social account and the second social account is also a factor in judging fraud behavior. If the frequency of sending messages is too high or too low, it may imply a risk of fraud for the second social account. Interaction behavior time:; For example, the time of sending messages: The time of sending messages between the first social account and the second social account can also be used as a factor in judging fraud behavior. For example, if the time of sending messages is in abnormal time periods such as late at night or early in the morning, then there may be a risk of fraud for the second social account.

[0068] S102. Obtain the first fraud risk degree of the second social account according to the first interaction behavior feature.

[0069] In a possible implementation manner, obtaining the first fraud risk degree of the second social account according to the first interaction behavior feature specifically includes S1021 - S1023.

[0070] S1021. Vectorize the first interaction behavior feature according to the interaction behavior content, interaction behavior frequency, and interaction behavior time of the first interaction behavior feature to obtain a first interaction behavior vector.

[0071] S1022. Input the first interaction behavior vector into a preset vector machine model, and the preset vector machine model is trained according to the interaction behavior features of historical social fraud accounts.

[0072] S1023. Obtain the first fraud risk degree output by the preset vector machine model.

[0073] Specifically, machine learning algorithms can be used to train and learn the interaction behavior features of historical social fraud accounts, so as to obtain a model including the interaction behavior vectors of social fraud accounts, and this model can predict whether there is a risk of fraud for the second social account. Specific machine learning algorithms can include Support Vector Machine (SVM), Random Forest, Neural Network, etc.

[0074] The historical social fraud accounts in the embodiments of the present application are social accounts that have been manually or automatically identified by the server and confirmed to have fraud behavior in the past. The embodiments of the present application can also iterate the preset vector machine model according to the recognition results of the second social account to obtain the interaction behavior vectors of new social fraud accounts.

[0075] In an embodiment of the present application, the interaction behavior characteristics of historical social fraud accounts are vectorized to obtain an interaction behavior characteristic model of social fraud accounts, that is, a preset vector machine model. The first interaction behavior vector obtained in step 1021 is input into the preset vector machine model, and the interaction behavior vector of the social fraud account and the first interaction behavior vector are compared for similarity to obtain the first fraud behavior risk degree.

[0076] S103. When the first fraud behavior risk degree is greater than or equal to the preset risk degree, confirm whether the social relationship of the second social account is in a socially abnormal state.

[0077] In a possible implementation manner, in step S103, confirming whether the social relationship of the second social account is in a socially abnormal state specifically includes steps S1031 - S1033

[0078] S1031. Obtain the social states among the social accounts that have social relationships with the second social account.

[0079] In an embodiment of the present application, as Figure 2 shown, B2 is the second social account, A1 is the first social account; A1 - A6 are the social accounts that have social relationships with the second social account. The social state among the social accounts in the embodiment of the present application refers to the social state among A1 - A6 except B2. Referring to the solid line connection relationship in the figure, if there is a solid line connection, it means there is a social relationship between two social accounts. For example, there is a social relationship between A1 and A2, and there is no social relationship between A1 and A6.

[0080] S1032. Obtain the social correlation degrees among the social accounts according to the social states among the social accounts.

[0081] In a possible implementation manner, the social correlation degrees among the social accounts are determined according to the following formula:

[0082] W = S n / 0.5n(n - 1)

[0083] where W is the social correlation degree, n is the number of social accounts, and S n is the number of social relationships among the social accounts.

[0084] Specifically, referring to Figure 2 the scenario schematic diagram in, the number of social accounts is 6, S n = 3, 0.5n(n - 1)=15, W = 20%.

[0085] S1033. When the social association degree is less than the preset social association degree, confirm that the social relationship of the second social account is in an abnormal social state; when the social association degree is greater than or equal to the preset social association degree, confirm that the social relationship of the second social account is in a normal social state.

[0086] In the embodiments of the present application, the preset social association degree can be specifically set as needed. Exemplarily, the preset social association degree in the embodiments of the present application is set to 15%.

[0087] As Figure 2 shown, the social association degree is greater than the preset social association degree. Therefore, in Figure 2 the social relationship of the second social account B2 is in a normal social state. As Figure 3 shown, the social association degree is 0%, and the social relationship of the second social account B2 is in an abnormal social state.

[0088] See Figure 3 , in Figure 3 , there is no social relationship between the social accounts that have a social relationship with the second social account B2. Therefore, there is a relatively high possibility that the second social account B2 has a risk of fraud behavior. For the user of the second social account B2, it is a characteristic means of a fraudulent account to facilitate the implementation of fraud behavior by widely obtaining the social relationships of multiple accounts. Therefore, when the social association degree is too low, the risk of fraud behavior of the second social account B2 will increase significantly.

[0089] S104. When the social relationship of the second social account is in an abnormal social state, obtain the abnormal behavior frequency of the second social account.

[0090] S105. When the abnormal behavior frequency is greater than the preset frequency, send a fraud behavior warning message to the first social account.

[0091] In the embodiments of the present application, a social account with fraud behavior usually conducts online fraud behavior on multiple social accounts at the same time. Therefore, when the abnormal behavior frequency is greater than the preset frequency and the social relationship of the second social account is in an abnormal social state, the fraud behavior of the second social account can be determined with a high probability. Therefore, it is necessary to send a fraud behavior warning message to the first social account.

[0092] As Figure 4 shown, in a possible implementation manner, after step S103, the method further includes steps S401 - S403.

[0093] S401. When the social relationship of the second social account is in a normal social state, obtain the common social accounts of the first social account and the second social account.

[0094] As Figure 5As shown, the social connection degree of the second social account B2 is 20%, which is greater than the preset social connection degree. Therefore, the social relationship of the second social account B2 is in a normal social state. Obtain the common social accounts of the first social account A1 and the second social account B2, including A2 and A6.

[0095] S402. Obtain the second interaction behavior characteristics between the second social account and the common social accounts to obtain the second fraud behavior risk degree of the second social account.

[0096] In the embodiment of the present application, obtain the interaction behavior characteristics of the second social account B2 with A2 and A6 respectively to obtain the second interaction behavior characteristics.

[0097] In a possible implementation manner, obtaining the second interaction behavior characteristics between the second social account and the common social accounts to obtain the second fraud behavior risk degree of the second social account specifically includes steps S4021 - S4024.

[0098] S4021. Query the occurrence time point of the first interaction behavior characteristics.

[0099] S4022. According to the occurrence time point, pull the interaction behavior characteristics between the second social account and the common social accounts to obtain the second interaction behavior characteristics.

[0100] In the embodiment of the present application, since the social relationship of the second social account B2 is in a normal social state, when calculating the second fraud behavior risk degree, if all the mutual behavior characteristics between the second social account B2 and the common social accounts A2 and A6 in history are pulled, it will lead to a decrease in the correlation degree between the second fraud behavior risk degree and the first social account A1. Therefore, according to the occurrence time point, pull the interaction behavior characteristics between the second social account and the common social accounts to obtain the second interaction behavior characteristics.

[0101] S4023. According to the second interaction behavior characteristics, obtain multiple fraud behavior risk degrees of the second social account and any one of the common social accounts.

[0102] For the process of obtaining multiple fraud behavior risk degrees of the second social account and any one of the common social accounts in the embodiment of the present application, refer to the content of the above embodiment.

[0103] S4024. Sort the multiple fraud behavior risk degrees, and determine the fraud behavior risk degree ranked first as the second fraud behavior risk degree.

[0104] S403. When the second fraud behavior risk degree is greater than or equal to the preset risk degree, send an account anomaly warning message to the first social account.

[0105] In a possible implementation, the method further includes: obtaining the account login address of the second social account; comparing the account login address with the historical account login address to determine whether the account login address is the usual address of the second social account.

[0106] In the embodiment of the present application, when the social relationship of the second social account B2 is in a normal social state, the first interaction behavior feature between the second social account B2 and the first social account A1 may not be operated by the actual user of the second social account B2, but there may be a situation where other users log in. Therefore, obtain the account login address of the second social account; compare the account login address with the historical account login address to determine whether the account login address is the usual address of the second social account.

[0107] Exemplarily, when the account login address is not the usual address of the second social account, a relevant reminder is sent to the first social account A1. In the embodiment of the present application, the relevant reminder sent is only used to inform that there is a risk in the social behavior of the first social account A1, and does not include prompting the user of the first social account A1 that the account login address of the second social account B2 is an unusual address, so as to avoid disclosing account privacy.

[0108] By adopting the above embodiments, the beneficial effects that the present application can achieve include one or more of the following:

[0109] 1. By adopting the above method, through the interaction behavior feature, account social relationship, and abnormal behavior frequency, the network fraud behavior of the second social account is identified and confirmed from multiple dimensions, improving the accuracy of the network fraud behavior monitoring result, considering the complexity of the network social relationship, and reducing the occurrence of misjudgment and false alarm in the monitoring result.

[0110] 2. By adopting the above method, a comprehensive analysis of the social relationship of the second social account is carried out, which can more accurately judge the degree of association between social accounts, and improve the accuracy of social relationship analysis.

[0111] 3. It is possible to further identify the possibility that the first interaction behavior between the first social account and the second social account is abnormal when the social relationship of the second social account is in a normal social state. Remind the first social account that the account of the current second social account is in an abnormal state, and avoid being lax about the abnormal interaction behavior of the second social account due to the normal social state of the second social account.

[0112] 4. By adopting the above method, obtaining the account login address of the second social account and comparing the account login address with the historical account login address can more timely discover whether the account login address is the usual address of the second social account, enhancing the monitoring ability of network fraud behavior.

[0113] 5. Pull the interaction behavior characteristics between the second social account and the common social account according to the occurrence time point, and obtain the multiple fraud behavior risk degrees of the second social account and any one of the common social accounts based on these characteristics. Sorting the multiple fraud behavior risk degrees can obtain a more accurate second fraud behavior risk degree, providing more reliable support for preventing online fraud behavior.

[0114] The embodiment of the present application provides an identification device for online fraud behavior, such as Figure 6 shown. The device includes: a feature acquisition unit 61, a first risk judgment unit 62, a status confirmation unit 63, a frequency acquisition unit 64, and a first information prompt unit 65.

[0115] The feature acquisition unit 61 is used to acquire the first interaction behavior characteristics between the first social account and the second social account.

[0116] The first risk judgment unit 62 is used to obtain the first fraud behavior risk degree of the second social account according to the first interaction behavior characteristics.

[0117] The status confirmation unit 63 is used to confirm whether the social relationship of the second social account is in an abnormal social state when the first fraud behavior risk degree is greater than or equal to the preset risk degree.

[0118] The frequency acquisition unit 64 is used to acquire the abnormal behavior frequency of the second social account when the social relationship of the second social account is in an abnormal social state.

[0119] The first information prompt unit 65 is used to send a fraud behavior warning message to the first social account when the abnormal behavior frequency is greater than the preset frequency.

[0120] In a possible implementation manner, the status confirmation unit 63 specifically includes a status acquisition module, a correlation degree acquisition module, and a status judgment module.

[0121] The status acquisition module is used to acquire the social status between each social account having a social relationship with the second social account.

[0122] The correlation degree acquisition module is used to obtain the social correlation degree between each social account according to the social status between each social account.

[0123] The status judgment module is used to confirm that the social relationship of the second social account is in an abnormal social state when the social correlation degree is less than the preset social correlation degree; and confirm that the social relationship of the second social account is in a normal social state when the social correlation degree is greater than or equal to the preset social correlation degree.

[0124] In a possible implementation, the device further includes an account acquisition unit, a second risk judgment unit, and a second information prompt unit.

[0125] The account acquisition unit is configured to acquire the common social accounts of the first social account and the second social account when the social relationship of the second social account is in a normal social state.

[0126] The second risk judgment unit is configured to obtain the second interaction behavior characteristics between the second social account and the common social accounts, and obtain the second fraud behavior risk degree of the second social account.

[0127] The second information prompt unit is configured to send an account anomaly warning message to the first social account when the second fraud behavior risk degree is greater than or equal to a preset risk degree.

[0128] In a possible implementation, the first risk judgment unit 62 specifically includes a feature processing module, a model application module, and a risk acquisition module.

[0129] The feature processing module is configured to perform vectorization processing on the first interaction behavior characteristics according to the interaction behavior content, interaction behavior frequency, and interaction behavior time of the first interaction behavior characteristics, and obtain the first interaction behavior vector.

[0130] The model application module is configured to input the first interaction behavior vector into a preset vector machine model, and the preset vector machine model is trained according to the interaction behavior characteristics of historical social fraud accounts.

[0131] The risk acquisition module is configured to obtain the first fraud behavior risk degree output by the preset vector machine model.

[0132] In a possible implementation, the device further includes an address detection unit, and the address detection unit is configured to obtain the account login address of the second social account; compare the account login address with the historical account login address to determine whether the account login address is the common address of the second social account.

[0133] In a possible implementation, the second risk judgment unit is specifically configured to query the occurrence time point of the first interaction behavior characteristics; according to the occurrence time point, pull the interaction behavior characteristics between the second social account and the common social accounts to obtain the second interaction behavior characteristics; according to the second interaction behavior characteristics, obtain multiple fraud behavior risk degrees of the second social account and any one of the common social accounts, sort the multiple fraud behavior risk degrees, and determine the first sorted fraud behavior risk degree as the second fraud behavior risk degree.

[0134] It should be noted that when the device provided in the above embodiments realizes its functions, only the division of the above functional modules is used for illustration. In actual applications, the above functions can be allocated to different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiments belong to the same concept. For the specific implementation process, please refer to the method embodiments and will not be elaborated here.

[0135] Please refer to Figure 7 , which is a schematic structural diagram of an electronic device provided by an embodiment of the present application. As Figure 7 shown, the electronic device 700 may include: at least one processor 701, at least one network interface 704, a user interface 703, a memory 705, and at least one communication bus 702.

[0136] Among them, the communication bus 702 is used to realize the connection and communication between these components.

[0137] Among them, the user interface 703 may include a display screen (Display) and a camera (Camera). Optionally, the user interface 703 may further include a standard wired interface and a wireless interface.

[0138] Among them, the network interface 704 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface).

[0139] Among them, the processor 701 may include one or more processing cores. The processor 701 connects various parts within the entire server through various interfaces and lines, and executes various functions of the server and processes data by running or executing instructions, programs, code sets, or instruction sets stored in the memory 705, and by invoking the data stored in the memory 705. Optionally, the processor 701 may be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), or programmable logic array (PLA). The processor 701 may integrate one or a combination of several of a central processing unit (CPU), a graphics processing unit (GPU), and a modem, etc. Among them, the CPU mainly processes the operating system, user interface, application programs, etc.; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 701 and may be implemented separately by a single chip.

[0140] Among them, the memory 705 may include random access memory (RAM) and may also include read-only memory. Optionally, the memory 705 includes a non-transitory computer-readable storage medium. The memory 705 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 705 may include a program storage area and a data storage area. Among them, the program storage area may store instructions for implementing the operating system, instructions for at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the above-mentioned method embodiments, etc.; the data storage area may store the data involved in the above-mentioned method embodiments. Optionally, the memory 705 may also be at least one storage device located far from the aforementioned processor 701. As Figure 7 shown, the memory 705, as a computer storage medium, may include an operating system, a network communication module, a user interface module, and an application program for identifying network fraud behavior.

[0141] In Figure 7In the electronic device 700 shown, the user interface 703 is mainly used to provide an interface for the user to input and obtain the data input by the user; and the processor 701 can be used to call the application program stored in the memory 705 for identifying network fraud behaviors. When executed by one or more processors, the electronic device 700 is caused to execute one or more of the methods as described in the foregoing embodiments.

[0142] It should be noted that, for the foregoing method embodiments, for the sake of simple description, they are all expressed as a series of action combinations. However, those skilled in the art should know that this application is not limited by the described action sequence, because according to this application, certain steps can be adopted in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0143] In the above embodiments, the descriptions of the various embodiments have their own emphases. For the parts not detailed in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0144] In several embodiments provided by this application, it should be understood that the disclosed device can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there can be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed coupling or direct coupling or communication connection to each other can be through some service interfaces. The indirect coupling or communication connection of the device or unit can be in an electrical or other form.

[0145] The units described as separate components may or may not be physically separated. The components displayed as units may or may not be physical units, that is, they can be located in one place, or can be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0146] In addition, in each embodiment of this application, the functional units can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit. The above integrated units can be implemented in the form of hardware or in the form of software functional units.

[0147] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of this application. The aforementioned memory includes: various media such as USB flash drives, mobile hard disks, magnetic disks, or optical discs that can store program codes.

[0148] The above are only exemplary embodiments of the present disclosure, and the scope of the present disclosure cannot be limited thereby. That is, any equivalent changes and modifications made in accordance with the teachings of the present disclosure still fall within the scope covered by the present disclosure. After considering the specification and the disclosure of the practical truth, those skilled in the art will easily think of other implementation schemes of the present disclosure. This application aims to cover any variations, uses, or adaptive changes of the present disclosure, and these variations, uses, or adaptive changes follow the general principles of the present disclosure and include the common general knowledge or conventional technical means in the technical field not recorded in the present disclosure.

Claims

1. A method for identifying network fraud, characterized in that: The method comprises: Acquire a first interaction behavior feature between the first social account and the second social account; Obtaining a first fraudulent behavior risk level of the second social account according to the first interactive behavior feature; When the risk level of the first fraudulent behavior is greater than or equal to a preset risk level, confirming whether the social relationship of the second social account is in an abnormal social state; When the social relationship of the second social account is in the abnormal social state, obtaining the abnormal behavior frequency of the second social account; When the frequency of the abnormal behavior is greater than a preset frequency, a fraud warning message is sent to the first social account; The method further comprises: When the social relationship of the second social account is in a normal social state, obtaining a common social account of the first social account and the second social account; Acquire a second interaction behavior feature between the second social account and the common social account to obtain a second fraud behavior risk of the second social account; When the second fraudulent behavior risk level is greater than or equal to a preset risk level, sending an account abnormality warning message to the first social account; The acquiring of a second interactive behavior feature between the second social account and the common social account to obtain a second fraudulent behavior risk of the second social account specifically includes: Querying the occurrence time of the first interactive behavior feature; According to the occurrence time point, extracting the interaction behavior feature between the second social account and the common social account to obtain the second interaction behavior feature; According to the second interactive behavior feature, multiple fraud risk scores of the second social account and any one of the common social accounts are obtained, The multiple fraud risk levels are ranked, and the first-ranked fraud risk level is determined as the second fraud risk level.

2. The method according to claim 1, characterized in that: The determining whether the social relationship of the second social account is in an abnormal social state specifically includes: Acquire the social status between each social account that has a social relationship with the second social account; According to the social statuses of the social accounts, obtaining the social association degree between the social accounts; When the social association degree is less than a preset social association degree, confirming that the social relationship of the second social account is in the social abnormal state; When the social association degree is greater than or equal to a preset social association degree, it is confirmed that the social relationship of the second social account is in a normal social state.

3. The method according to claim 1, characterized in that The obtaining, according to the first interactive behavior feature, a first fraudulent behavior risk level of the second social account specifically includes: According to the interactive behavior content, the interactive behavior frequency, and the interactive behavior time of the first interactive behavior feature, the first interactive behavior feature is vectorized to obtain a first interactive behavior vector; Inputting the first interaction behavior vector into a preset vector machine model, wherein the preset vector machine model is trained based on interaction behavior features of historical social fraud accounts; The first fraud risk level output by the preset vector machine model is obtained.

4. The method according to claim 1, characterized in that: The method further comprises: Obtaining the account login address of the second social account; The account login address is compared with the historical account login address to determine whether the account login address is a common address of the second social account.

5. The method according to claim 2, characterized in that: The social association degree between the social accounts is determined according to the following formula: W=S n / 0.5n(n-1) Wherein, W is the social association degree, n is the number of each social account, S n is the number of social relationships existing in each of the social accounts.

6. A device for identifying network fraud, characterized in that: The device includes a feature acquisition unit, a first risk judgment unit, a state confirmation unit, a frequency acquisition unit, and a first information prompting unit; The feature acquisition unit is used to acquire a first interaction behavior feature between the first social account and the second social account; The first risk judgment unit is used to obtain a first fraudulent behavior risk of the second social account according to the first interactive behavior feature; The status confirmation unit is configured to confirm whether the social relationship of the second social account is in an abnormal social relationship state when the risk level of the first fraudulent behavior is greater than or equal to a preset risk level; The frequency acquisition unit is configured to acquire the abnormal behavior frequency of the second social account when the social relationship of the second social account is in the abnormal social state; The first information prompting unit is configured to send a fraud warning message to the first social account when the frequency of the abnormal behavior is greater than a preset frequency; The device also includes an account acquisition unit, a second risk judgment unit, and a second information prompting unit; The account acquisition unit is configured to acquire a common social account of the first social account and the second social account when the social relationship of the second social account is in a normal social state; The second risk judgment unit is used to obtain a second interaction behavior feature between the second social account and the common social account to obtain a second fraud behavior risk level of the second social account; The second information prompting unit is configured to send an account abnormality warning message to the first social account when the second fraudulent behavior risk level is greater than or equal to a preset risk level; Among them, the second risk judgment unit is used to query the occurrence time point of the first interactive behavior feature; according to the occurrence time point, pull the interactive behavior feature between the second social account and the common social account to obtain the second interactive behavior feature; according to the second interactive behavior feature, obtain multiple fraud behavior risk degrees of the second social account and any one of the common social accounts, sort the multiple fraud behavior risk degrees, and determine the fraud behavior risk degree that is ranked first as the second fraud behavior risk degree.

7. An electronic device, characterized in that: It includes a processor user interface, a network interface and a memory, wherein the memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device executes the method as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed, the method according to any one of claims 1 to 5 is performed.

Images